ccvpn/lambdainst/openvpn.py

import json
import uuid
from django.utils.translation import ugettext as _
from django.conf import settings


CA_CERT = settings.OPENVPN_CA

CONFIG_OS = (
    ('windows', _("Windows")),
    ('android', _("Android")),
    ('ubuntu', _("Ubuntu")),
    ('osx', _("OS X")),
    ('ios', _("iOS")),
    ('chromeos', _("Chrome OS")),
    ('freebox', _("Freebox")),
    ('other', _("Other / GNU/Linux")),
)

PROTOCOLS = (
    ('udp', _("UDP (default)")),
    ('tcp', _("TCP")),
    ('udpl', _("UDP (low MTU)")),
)


def _make_onc(username, name, hostname, port, protocol, http_proxy=None, ipv6=True):
    cert_id = '{%s}' % uuid.uuid4()
    vpn_id = '{%s}' % uuid.uuid4()

    openvpn_config = {
        'ServerCARef': cert_id,
        'ClientCertType': 'None',
        'CompLZO': 'true',
        'Port': port,
        'Proto': protocol,
        'ServerPollTimeout': 10,
        'NsCertType': 'server',
        'Username': username,
    }
    cert = {
        'GUID': cert_id,
        'Type': 'Authority',
        'X509': CA_CERT.strip(),
    }
    vpn = {
        'GUID': vpn_id,
        'Name': name,
        'Type': 'VPN',
        'VPN': {
            'Type': 'OpenVPN',
            'Host': hostname,
            'OpenVPN': openvpn_config,
        },
    }

    return json.dumps({
        'type': 'UnencryptedConfiguration',
        'Certificates': [cert],
        'NetworkConfigurations': [vpn],
    }, indent=2)


def make_config(username, gw_name, os, protocol, http_proxy=None, ipv6=True):

    use_frag = protocol == 'udpl' and os != 'ios'
    ipv6 = ipv6 and (os != 'freebox')
    http_proxy = http_proxy if protocol == 'tcp' else None
    resolvconf = os in ('ubuntu', 'other')

    openvpn_proto = {'udp': 'udp', 'udpl': 'udp', 'tcp': 'tcp'}
    openvpn_ports = {'udp': 1196,  'udpl': 1194,  'tcp': 443}

    hostname = 'gw.%s.204vpn.net' % gw_name
    port = openvpn_ports[protocol]
    proto = openvpn_proto[protocol]

    if os == 'chromeos':
        name = "CCrypto VPN"
        if gw_name != 'random':
            name += " " + gw_name.upper()
        return _make_onc(username, name, hostname, port, proto, http_proxy, ipv6)

    remote = str(hostname)
    remote += ' ' + str(port)
    remote += ' ' + proto

    config = """\
# +----------------------------+
# | Cognitive Cryptography VPN |
# |  https://vpn.ccrypto.org/  |
# +----------------------------+

verb 4
client
tls-client
script-security 2
remote-cert-tls server
dev tun
nobind
persist-key
persist-tun
comp-lzo yes

remote {remote}

auth-user-pass

""".format(remote=remote)

    if os == 'ios':
        # i'd like to note here how much i hate OpenVPN
        config += "redirect-gateway ipv6\n"
        config += 'push "route 0.0.0.0 128.0.0.0"\n'
        config += 'push "route 128.0.0.0 128.0.0.0"\n'
    else:
        config += "redirect-gateway def1\n"
        if ipv6:
            config += "tun-ipv6\n"
            config += "route-ipv6 2000::/3\n"
            config += "\n"

    if use_frag:
        config += "fragment 1300\n"
        config += "mssfix 1300\n"
        config += "\n"

    if http_proxy:
        config += "http-proxy %s\n\n" % http_proxy

    if resolvconf:
        config += "up /etc/openvpn/update-resolv-conf\n"
        config += "down /etc/openvpn/update-resolv-conf\n"
        config += "\n"

    if os == 'windows':
        config += "register-dns\n"
        config += "\n"

    config += "<ca>\n%s\n</ca>" % CA_CERT

    if os == 'windows':
        config = config.replace('\n', '\r\n')

    return config