9f6450502c
- Obtain CN for port forwarding https verification - Obtain for each server if they support port forwarding - Obtain for each server their IP address for openvpn UDP and openvpn TCP (one for each) - Updater program updated to use API - Hardcoded values updated for PIA v3 and v4 servers - Clearer separation between pia v3 and v4 - Fixes #250
85 lines
2.1 KiB
Go
85 lines
2.1 KiB
Go
package provider
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/qdm12/gluetun/internal/constants"
|
|
"github.com/qdm12/gluetun/internal/models"
|
|
)
|
|
|
|
func buildPIAConf(connections []models.OpenVPNConnection, verbosity int, root bool, cipher, auth string, extras models.ExtraConfigOptions) (lines []string) {
|
|
var X509CRL, certificate string
|
|
if extras.EncryptionPreset == constants.PIAEncryptionPresetNormal {
|
|
if len(cipher) == 0 {
|
|
cipher = "aes-128-cbc"
|
|
}
|
|
if len(auth) == 0 {
|
|
auth = "sha1"
|
|
}
|
|
X509CRL = constants.PiaX509CRLNormal
|
|
certificate = constants.PIACertificateNormal
|
|
} else { // strong encryption
|
|
if len(cipher) == 0 {
|
|
cipher = aes256cbc
|
|
}
|
|
if len(auth) == 0 {
|
|
auth = "sha256"
|
|
}
|
|
X509CRL = constants.PiaX509CRLStrong
|
|
certificate = constants.PIACertificateStrong
|
|
}
|
|
lines = []string{
|
|
"client",
|
|
"dev tun",
|
|
"nobind",
|
|
"persist-key",
|
|
"remote-cert-tls server",
|
|
|
|
// PIA specific
|
|
"ping 300", // Ping every 5 minutes to prevent a timeout error
|
|
"reneg-sec 0",
|
|
"compress", // allow PIA server to choose the compression to use
|
|
|
|
// Added constant values
|
|
"auth-nocache",
|
|
"mute-replay-warnings",
|
|
"pull-filter ignore \"auth-token\"", // prevent auth failed loops
|
|
"auth-retry nointeract",
|
|
"remote-random",
|
|
"suppress-timestamps",
|
|
|
|
// Modified variables
|
|
fmt.Sprintf("verb %d", verbosity),
|
|
fmt.Sprintf("auth-user-pass %s", constants.OpenVPNAuthConf),
|
|
fmt.Sprintf("proto %s", connections[0].Protocol),
|
|
fmt.Sprintf("cipher %s", cipher),
|
|
fmt.Sprintf("auth %s", auth),
|
|
}
|
|
if strings.HasSuffix(cipher, "-gcm") {
|
|
lines = append(lines, "ncp-disable")
|
|
}
|
|
if !root {
|
|
lines = append(lines, "user nonrootuser")
|
|
}
|
|
for _, connection := range connections {
|
|
lines = append(lines, fmt.Sprintf("remote %s %d", connection.IP, connection.Port))
|
|
}
|
|
lines = append(lines, []string{
|
|
"<crl-verify>",
|
|
"-----BEGIN X509 CRL-----",
|
|
X509CRL,
|
|
"-----END X509 CRL-----",
|
|
"</crl-verify>",
|
|
}...)
|
|
lines = append(lines, []string{
|
|
"<ca>",
|
|
"-----BEGIN CERTIFICATE-----",
|
|
certificate,
|
|
"-----END CERTIFICATE-----",
|
|
"</ca>",
|
|
"",
|
|
}...)
|
|
return lines
|
|
}
|