- {% blocktrans trimmed %} - Your OpenVPN installation is currently using RSA. Switching to the - modern Elliptic Curve Cryptography improves speed of establishing a - connection and security. This operation is irreversible. It should only take - a few minutes on most single board computers. - {% endblocktrans %} -
- -- {% blocktrans trimmed %} - All new installations of OpenVPN on {{ box_name }} will - use ECC by default. We recommend migrating as soon as possible. - {% endblocktrans %} -
- -- {% blocktrans trimmed %} - Warning: Existing client profiles will be invalidated by this operation. All - OpenVPN users on {{ box_name }} must download their new profiles. OpenVPN - clients compatible with ECC should be used to connect to this server. - {% endblocktrans %} -
- - diff --git a/plinth/modules/openvpn/templates/openvpn.html b/plinth/modules/openvpn/templates/openvpn.html index 62a42c3e8..6c2d8a4cb 100644 --- a/plinth/modules/openvpn/templates/openvpn.html +++ b/plinth/modules/openvpn/templates/openvpn.html @@ -7,49 +7,31 @@ {% load i18n %} {% load static %} -{% block status %} - - {% if status.is_setup %} - {{ block.super }} - {% endif %} - -{% endblock %} - {% block configuration %} - {% if status.is_setup %} ++ {% blocktrans trimmed %} + To connect to {{ box_name }}'s VPN, you need to download a profile and + feed it to an OpenVPN client on your mobile or desktop machine. OpenVPN + Clients are available for most platforms. Click "Learn more..." above for + recommended clients and instructions on how to configure them. + {% endblocktrans %} +
-- {% blocktrans trimmed %} - To connect to {{ box_name }}'s VPN, you need to download a - profile and feed it to an OpenVPN client on your mobile or - desktop machine. OpenVPN Clients are available for most - platforms. Click "Learn more..." above for recommended clients - and instructions on how to configure them. - {% endblocktrans %} -
++ {% blocktrans trimmed %} + Profile is specific to each user of {{ box_name }}. Keep it a secret. + {% endblocktrans %} +
-- {% blocktrans trimmed %} - Profile is specific to each user of {{ box_name }}. Keep it a - secret. - {% endblocktrans %} -
+ - - {% if not using_ecc %} - {% include "migrate_to_ecc.html" %} - {% endif %} - - {% endif %} + + {% endblock %} diff --git a/plinth/modules/openvpn/tests/test_configuration.py b/plinth/modules/openvpn/tests/test_configuration.py deleted file mode 100644 index 11f8e8cee..000000000 --- a/plinth/modules/openvpn/tests/test_configuration.py +++ /dev/null @@ -1,67 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -""" -Test module for OpenVPN configuration. -""" - -import os -from unittest.mock import patch - -import pytest - -from plinth.modules import openvpn -from plinth.modules.openvpn import privileged - -pytestmark = pytest.mark.usefixtures('mock_privileged') -privileged_modules_to_mock = ['plinth.modules.openvpn.privileged'] - - -@pytest.fixture(name='keys_directory') -def fixture_keys_directory(tmp_path): - return tmp_path - - -@pytest.fixture(autouse=True) -def fixture_set_keys_directory(keys_directory): - """Set the keys directory in the actions module.""" - privileged.DH_PARAMS = f'{keys_directory}/pki/dh.pem' - privileged.EC_PARAMS_DIR = f'{keys_directory}/pki/ecparams' - - -@pytest.fixture(name='conf_file') -def fixture_conf_file(tmp_path): - """Fixture that returns an empty configuration file.""" - return str(tmp_path / 'freedombox.conf') - - -def test_identify_rsa_configuration(conf_file): - """Identify RSA configuration based on configuration file.""" - with patch('plinth.modules.openvpn.SERVER_CONFIGURATION_FILE', conf_file): - with open(conf_file, 'w', encoding='utf-8') as file_handle: - file_handle.write('dh /etc/openvpn/freedombox-keys/pki/dh.pem') - assert not openvpn.is_using_ecc() - - -def test_identify_ecc_configuration(conf_file): - """Identify ECC configuration based on configuration file.""" - with patch('plinth.modules.openvpn.SERVER_CONFIGURATION_FILE', conf_file): - with open(conf_file, 'w', encoding='utf-8') as file_handle: - file_handle.write('dh none') - assert openvpn.is_using_ecc() - - -def test_is_setup_with_rsa(keys_directory): - """is_setup should work with RSA configuration.""" - (keys_directory / 'pki').mkdir() - dh_params_file = keys_directory / 'pki' / 'dh.pem' - dh_params_file.write_text('some content') - assert privileged.is_setup() - os.remove(dh_params_file) - - -def test_is_setup_with_ecc(keys_directory): - """is_setup should work with RSA configuration.""" - (keys_directory / 'pki' / 'ecparams').mkdir(parents=True) - ec_params_file = keys_directory / 'pki' / 'ecparams' / 'somecurve.pem' - ec_params_file.write_text('some content') - assert privileged.is_setup() - os.remove(ec_params_file) diff --git a/plinth/modules/openvpn/urls.py b/plinth/modules/openvpn/urls.py index 77b24d3e1..e9382644b 100644 --- a/plinth/modules/openvpn/urls.py +++ b/plinth/modules/openvpn/urls.py @@ -1,7 +1,5 @@ # SPDX-License-Identifier: AGPL-3.0-or-later -""" -URLs for the OpenVPN module. -""" +"""URLs for the OpenVPN module.""" from django.urls import re_path @@ -11,8 +9,6 @@ from . import views urlpatterns = [ re_path(r'^apps/openvpn/$', views.OpenVPNAppView.as_view(), name='index'), - re_path(r'^apps/openvpn/setup/$', views.setup, name='setup'), - re_path(r'^apps/openvpn/ecc/$', views.ecc, name='ecc'), re_path(r'^apps/openvpn/profile/$', user_group_view(views.profile, 'vpn'), name='profile'), ] diff --git a/plinth/modules/openvpn/views.py b/plinth/modules/openvpn/views.py index f64ff29c1..3dad16fc2 100644 --- a/plinth/modules/openvpn/views.py +++ b/plinth/modules/openvpn/views.py @@ -4,11 +4,8 @@ import logging from django.http import HttpResponse -from django.shortcuts import redirect -from django.views.decorators.http import require_POST -from plinth import app as app_module -from plinth.modules import config, openvpn +from plinth.modules import config from plinth.views import AppView from . import privileged @@ -22,26 +19,6 @@ class OpenVPNAppView(AppView): app_id = 'openvpn' template_name = 'openvpn.html' - def get_context_data(self, *args, **kwargs): - """Add additional context data for template.""" - context = super().get_context_data(*args, **kwargs) - context['status'] = { - 'is_setup': privileged.is_setup(), - } - context['using_ecc'] = openvpn.is_using_ecc() - return context - - -@require_POST -def setup(_): - """Start the setup process.""" - if not privileged.is_setup(): - privileged.setup() - - app_module.App.get('openvpn').enable() - - return redirect('openvpn:index') - def profile(request): """Provide the user's profile for download.""" @@ -58,12 +35,3 @@ def profile(request): 'attachment; filename={username}.ovpn'.format(username=username) return response - - -@require_POST -def ecc(_): - """Migrate from RSA to ECC.""" - if privileged.is_setup(): - privileged.setup() - - return redirect('openvpn:index')