c4354871f7
- From now only a single OpenVPN connection is written to the OpenVPN configuration file - If multiple connections are matched given the user parameters (i.e. city, region), it is picked at pseudo random using the current time as the pseudo random seed. - Not relying on Openvpn picking a random remote address, may refer to #229 - Program is aware of which connection is to be used, in order to use its matching CN for port forwarding TLS verification with PIA v4 servers, see #236 - Simplified firewall mechanisms
83 lines
2.0 KiB
Go
83 lines
2.0 KiB
Go
package provider
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/qdm12/gluetun/internal/constants"
|
|
"github.com/qdm12/gluetun/internal/models"
|
|
)
|
|
|
|
func buildPIAConf(connection models.OpenVPNConnection, verbosity int, root bool, cipher, auth string, extras models.ExtraConfigOptions) (lines []string) {
|
|
var X509CRL, certificate string
|
|
if extras.EncryptionPreset == constants.PIAEncryptionPresetNormal {
|
|
if len(cipher) == 0 {
|
|
cipher = "aes-128-cbc"
|
|
}
|
|
if len(auth) == 0 {
|
|
auth = "sha1"
|
|
}
|
|
X509CRL = constants.PiaX509CRLNormal
|
|
certificate = constants.PIACertificateNormal
|
|
} else { // strong encryption
|
|
if len(cipher) == 0 {
|
|
cipher = aes256cbc
|
|
}
|
|
if len(auth) == 0 {
|
|
auth = "sha256"
|
|
}
|
|
X509CRL = constants.PiaX509CRLStrong
|
|
certificate = constants.PIACertificateStrong
|
|
}
|
|
lines = []string{
|
|
"client",
|
|
"dev tun",
|
|
"nobind",
|
|
"persist-key",
|
|
"remote-cert-tls server",
|
|
|
|
// PIA specific
|
|
"ping 300", // Ping every 5 minutes to prevent a timeout error
|
|
"reneg-sec 0",
|
|
"compress", // allow PIA server to choose the compression to use
|
|
|
|
// Added constant values
|
|
"auth-nocache",
|
|
"mute-replay-warnings",
|
|
"pull-filter ignore \"auth-token\"", // prevent auth failed loops
|
|
"auth-retry nointeract",
|
|
"remote-random",
|
|
"suppress-timestamps",
|
|
|
|
// Modified variables
|
|
fmt.Sprintf("verb %d", verbosity),
|
|
fmt.Sprintf("auth-user-pass %s", constants.OpenVPNAuthConf),
|
|
fmt.Sprintf("proto %s", connection.Protocol),
|
|
fmt.Sprintf("remote %s %d", connection.IP, connection.Port),
|
|
fmt.Sprintf("cipher %s", cipher),
|
|
fmt.Sprintf("auth %s", auth),
|
|
}
|
|
if strings.HasSuffix(cipher, "-gcm") {
|
|
lines = append(lines, "ncp-disable")
|
|
}
|
|
if !root {
|
|
lines = append(lines, "user nonrootuser")
|
|
}
|
|
lines = append(lines, []string{
|
|
"<crl-verify>",
|
|
"-----BEGIN X509 CRL-----",
|
|
X509CRL,
|
|
"-----END X509 CRL-----",
|
|
"</crl-verify>",
|
|
}...)
|
|
lines = append(lines, []string{
|
|
"<ca>",
|
|
"-----BEGIN CERTIFICATE-----",
|
|
certificate,
|
|
"-----END CERTIFICATE-----",
|
|
"</ca>",
|
|
"",
|
|
}...)
|
|
return lines
|
|
}
|