nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-09-19 04:59:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

openvpn: client configuration for RSA and ECC

Browse Source 
Provide the correct client configuration based on whether the server is
using RSA or ECC.

Signed-off-by: Joseph Nuthalapati <njoseph@riseup.net>
Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
This commit is contained in:
Joseph Nuthalapati 2020-11-09 01:32:43 +05:30 committed by James Valleroy
parent 030e6ce98d
commit a3df0342b7
No known key found for this signature in database
GPG Key ID: 77C0C75E7B650808
1 changed files with 51 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
actions/openvpn
View File

@ -49,12 +49,11 @@ verb 3
tls-server tls-server
tls-version-min 1.2 tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384 cipher AES-256-CBC
cipher AES-256-GCM
script-security 2 script-security 2
''' '''
CLIENT_CONFIGURATION = ''' CLIENT_CONFIGURATION_RSA = '''
client client
remote {remote} 1194 remote {remote} 1194
proto udp proto udp
@ -62,7 +61,26 @@ proto udp6
dev tun dev tun
nobind nobind
remote-cert-tls server remote-cert-tls server
cipher AES-256-GCM cipher AES-256-CBC
comp-lzo
redirect-gateway
verb 3
<ca>
{ca}</ca>
<cert>
{cert}</cert>
<key>
{key}</key>'''
CLIENT_CONFIGURATION_ECC = '''
client
remote {remote} 1194
proto udp
proto udp6
dev tun
nobind
remote-cert-tls server
cipher AES-256-CBC
redirect-gateway redirect-gateway
verb 3 verb 3
<ca> <ca>
@ -74,7 +92,6 @@ verb 3
CERTIFICATE_CONFIGURATION = { CERTIFICATE_CONFIGURATION = {
'EASYRSA_BATCH': '1', 'EASYRSA_BATCH': '1',
'EASYRSA_ALGO': 'ec',
'EASYRSA_DIGEST': 'sha512', 'EASYRSA_DIGEST': 'sha512',
'KEY_CONFIG': '/usr/share/easy-rsa/openssl-easyrsa.cnf', 'KEY_CONFIG': '/usr/share/easy-rsa/openssl-easyrsa.cnf',
'KEY_DIR': KEYS_DIRECTORY, 'KEY_DIR': KEYS_DIRECTORY,
@ -90,7 +107,17 @@ CERTIFICATE_CONFIGURATION = {
'EASYRSA_REQ_NAME': 'FreedomBox' 'EASYRSA_REQ_NAME': 'FreedomBox'
} }
COMMON_ARGS = {'env': CERTIFICATE_CONFIGURATION, 'cwd': KEYS_DIRECTORY} CERTIFICATE_CONFIGURATION_RSA = {
'EASYRSA_KEY_SIZE': '4096',
**CERTIFICATE_CONFIGURATION
}
CERTIFICATE_CONFIGURATION_ECC = {
'EASYRSA_ALGO': 'ec',
**CERTIFICATE_CONFIGURATION
}
COMMON_ARGS = {'env': CERTIFICATE_CONFIGURATION_ECC, 'cwd': KEYS_DIRECTORY}
def parse_arguments(): def parse_arguments():
@ -111,9 +138,19 @@ def parse_arguments():
return parser.parse_args() return parser.parse_args()
def _is_using_ecc():
"""Return whether the service is using ECC."""
if os.path.exists(SERVER_CONFIGURATION_PATH):
with open(SERVER_CONFIGURATION_PATH, 'r') as file_handle:
for line in file_handle:
if line.strip() == 'dh none':
return True
return False
def _is_setup(): def _is_setup():
"""Return whether setup is complete.""" """Return whether setup is complete."""
return any(os.path.exists(fil) for fil in [DH_PARAMS, EC_PARAMS_DIR]) return _is_non_empty_file(DH_PARAMS) or os.path.exists(EC_PARAMS_DIR)
def subcommand_is_setup(_): def subcommand_is_setup(_):
@ -215,13 +252,18 @@ def subcommand_get_profile(arguments):
subprocess.check_call([ subprocess.check_call([
'/usr/share/easy-rsa/easyrsa', 'build-client-full', username, '/usr/share/easy-rsa/easyrsa', 'build-client-full', username,
'nopass' 'nopass'
], **COMMON_ARGS) ], env=CERTIFICATE_CONFIGURATION_ECC if _is_using_ecc() else
CERTIFICATE_CONFIGURATION_RSA,
cwd=KEYS_DIRECTORY)
user_certificate_string = _read_file(user_certificate) user_certificate_string = _read_file(user_certificate)
user_key_string = _read_file(user_key) user_key_string = _read_file(user_key)
ca_string = _read_file(CA_CERTIFICATE_PATH) ca_string = _read_file(CA_CERTIFICATE_PATH)
profile = CLIENT_CONFIGURATION.format(ca=ca_string, client_configuration = CLIENT_CONFIGURATION_ECC if _is_using_ecc(
) else CLIENT_CONFIGURATION_RSA
profile = client_configuration.format(ca=ca_string,
cert=user_certificate_string, cert=user_certificate_string,
key=user_key_string, key=user_key_string,
remote=remote_server) remote=remote_server)