1#@!#!123s

: / opt / osquery / share / osquery / lenses /
Filename : openvpn.aug
back
(* OpenVPN module for Augeas
 Author: Raphael Pinson <raphink@gmail.com>
 Author: Justin Akers <dafugg@gmail.com>

 Reference: http://openvpn.net/index.php/documentation/howto.html
 Reference: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

 TODO: Inline file support
*)


module OpenVPN =
  autoload xfm

(************************************************************************
 *                           USEFUL PRIMITIVES
 *************************************************************************)

let eol    = Util.eol
let indent = Util.indent

(* Define separators *)
let sep    = Util.del_ws_spc

(* Define value regexps.
   Custom simplified ipv6 used instead of Rx.ipv6 as the augeas Travis instances
   are limited to 2GB of memory. Using 'ipv6_re = Rx.ipv6' consumes an extra
   2GB of memory and thus the test is OOM-killed.
*)
let ipv6_re = /[0-9A-Fa-f:]+/
let ipv4_re = Rx.ipv4
let ip_re  = ipv4_re|ipv6_re
let num_re = Rx.integer
let fn_re  = /[^#; \t\n][^#;\n]*[^#; \t\n]|[^#; \t\n]/
let fn_safe_re = /[^#; \t\r\n]+/
let an_re  = /[a-z][a-z0-9_-]*/
let hn_re  = Rx.hostname
let port_re = /[0-9]+/
let host_re = ip_re|hn_re
let proto_re = /(tcp|udp)/
let proto_ext_re = /(udp|tcp-client|tcp-server)/
let alg_re = /(none|[A-Za-z][A-Za-z0-9-]+)/
let ipv6_bits_re = ipv6_re . /\/[0-9]+/

(* Define store aliases *)
let ip     = store ip_re
let num    = store num_re
let filename = store fn_re
let filename_safe = store fn_safe_re
let hostname = store hn_re
let sto_to_dquote = store /[^"\n]+/   (* " Emacs, relax *)
let port = store port_re
let host = store host_re
let proto = store proto_re
let proto_ext = store proto_ext_re

(* define comments and empty lines *)
let comment = Util.comment_generic /[ \t]*[;#][ \t]*/ "# "
let comment_or_eol = eol | Util.comment_generic /[ \t]*[;#][ \t]*/ " # "

let empty   = Util.empty


(************************************************************************
 *                               SINGLE VALUES
 *
 *   - local => IP|hostname
 *   - port  => num
 *   - proto => udp|tcp-client|tcp-server
 *   - proto-force => udp|tcp
 *   - mode  => p2p|server
 *   - dev   => (tun|tap)\d*
 *   - dev-node => filename
 *   - ca    => filename
 *   - config => filename
 *   - cert  => filename
 *   - key   => filename
 *   - dh    => filename
 *   - ifconfig-pool-persist => filename
 *   - learn-address => filename
 *   - cipher => [A-Z0-9-]+
 *   - max-clients => num
 *   - user  => alphanum
 *   - group => alphanum
 *   - status => filename
 *   - log   => filename
 *   - log-append => filename
 *   - client-config-dir => filename
 *   - verb => num
 *   - mute => num
 *   - fragment => num
 *   - mssfix   => num
 *   - connect-retry num
 *   - connect-retry-max num
 *   - connect-timeout num
 *   - http-proxy-timeout num
 *   - max-routes num
 *   - ns-cert-type => "server"
 *   - resolv-retry => "infinite"
 *   - script-security => [0-3] (execve|system)?
 *   - ipchange => command
 *   - topology => type
 *************************************************************************)

let single_host = "local" | "tls-remote"
let single_ip   = "lladdr"
let single_ipv6_bits = "iroute-ipv6"
                     | "server-ipv6"
                     | "ifconfig-ipv6-pool"
let single_num = "port"
               | "max-clients"
               | "verb"
               | "mute"
               | "fragment"
               | "mssfix"
               | "connect-retry"
               | "connect-retry-max"
               | "connect-timeout"
               | "http-proxy-timeout"
               | "resolv-retry"
               | "lport"
               | "rport"
               | "max-routes"
               | "max-routes-per-client"
               | "route-metric"
               | "tun-mtu"
               | "tun-mtu-extra"
               | "shaper"
               | "ping"
               | "ping-exit"
               | "ping-restart"
               | "sndbuf"
               | "rcvbuf"
               | "txqueuelen"
               | "link-mtu"
               | "nice"
               | "management-log-cache"
               | "bcast-buffers"
               | "tcp-queue-limit"
               | "server-poll-timeout"
               | "keysize"
               | "pkcs11-pin-cache"
               | "tls-timeout"
               | "reneg-bytes"
               | "reneg-pkts"
               | "reneg-sec"
               | "hand-window"
               | "tran-window"
let single_fn   = "ca"
                | "cert"
                | "extra-certs"
                | "config"
                | "key"
                | "dh"
                | "log"
                | "log-append"
                | "client-config-dir"
                | "dev-node"
                | "cd"
                | "chroot"
                | "writepid"
                | "client-config-dir"
                | "tmp-dir"
                | "replay-persist"
                | "ca"
                | "capath"
                | "pkcs12"
                | "pkcs11-id"
                | "askpass"
                | "tls-export-cert"
                | "x509-track"
let single_an  = "user"
               | "group"
               | "management-client-user"
               | "management-client-group"
let single_cmd = "ipchange"
                | "iproute"
                | "route-up"
                | "route-pre-down"
                | "mark"
                | "up"
                | "down"
                | "setcon"
                | "echo"
                | "client-connect"
                | "client-disconnect"
                | "learn-address"
                | "tls-verify"

let single_entry (kw:regexp) (re:regexp)
               = [ key kw . sep . store re . comment_or_eol ]

let single_opt_entry (kw:regexp) (re:regexp)
                = [ key kw . (sep . store re)? .comment_or_eol ]

let single     = single_entry single_num num_re
      	       | single_entry single_fn  fn_re
	       | single_entry single_an  an_re
	       | single_entry single_host host_re
	       | single_entry single_ip ip_re
           | single_entry single_ipv6_bits ipv6_bits_re
           | single_entry single_cmd fn_re
	       | single_entry "proto"    proto_ext_re
	       | single_entry "proto-force"    proto_re
	       | single_entry "mode"    /(p2p|server)/
               | single_entry "dev"      /(tun|tap)[0-9]*|null/
	       | single_entry "dev-type"      /(tun|tap)/
	       | single_entry "topology"      /(net30|p2p|subnet)/
	       | single_entry "cipher" alg_re
	       | single_entry "auth" alg_re
	       | single_entry "resolv-retry" "infinite"
	       | single_entry "script-security" /[0-3]( execve| system)?/
	       | single_entry "route-gateway" (host_re|/dhcp/)
	       | single_entry "mtu-disc" /(no|maybe|yes)/
	       | single_entry "remap-usr1" /SIG(HUP|TERM)/
	       | single_entry "socket-flags" /(TCP_NODELAY)/
           | single_entry "auth-retry" /(none|nointeract|interact)/
           | single_entry "tls-version-max" Rx.decimal
           | single_entry "verify-hash" /([A-Za-z0-9]{2}:)+[A-Za-z0-9]{2}/
           | single_entry "pkcs11-cert-private" /[01]/
           | single_entry "pkcs11-protected-authentication" /[01]/
           | single_entry "pkcs11-private-mode" /[A-Za-z0-9]+/
           | single_entry "key-method" /[12]/
           | single_entry "ns-cert-type" /(client|server)/
           | single_entry "remote-cert-tls" /(client|server)/

let single_opt  = single_opt_entry "comp-lzo" /(yes|no|adaptive)/
                | single_opt_entry "syslog" fn_re
                | single_opt_entry "daemon" fn_re
                | single_opt_entry "auth-user-pass" fn_re
                | single_opt_entry "explicit-exit-notify" num_re
                | single_opt_entry "engine" fn_re

(************************************************************************
 *                               DOUBLE VALUES
 *************************************************************************)

let double_entry (kw:regexp) (a:string) (aval:regexp) (b:string) (bval:regexp)
    = [ key kw
      . sep . [ label a . store aval ]
      . sep . [ label b . store bval ]
      . comment_or_eol
      ]

let double_secopt_entry (kw:regexp) (a:string) (aval:regexp) (b:string) (bval:regexp)
    = [ key kw
      . sep . [ label a . store aval ]
      . (sep . [ label b . store bval ])?
      . comment_or_eol
      ]


let double  = double_entry "keepalive" "ping" num_re "timeout" num_re
            | double_entry "hash-size" "real" num_re "virtual" num_re
            | double_entry "ifconfig" "local" ip_re "remote" ip_re
            | double_entry "connect-freq" "num" num_re "sec" num_re
            | double_entry "verify-x509-name" "name" hn_re "type"
                /(subject|name|name-prefix)/
            | double_entry "ifconfig-ipv6" "address" ipv6_bits_re "remote" ipv6_re
            | double_entry "ifconfig-ipv6-push" "address" ipv6_bits_re "remote" ipv6_re
            | double_secopt_entry "iroute" "local" ip_re "netmask" ip_re
            | double_secopt_entry "stale-routes-check" "age" num_re "interval" num_re
            | double_secopt_entry "ifconfig-pool-persist"
                "file" fn_safe_re "seconds" num_re
            | double_secopt_entry "secret" "file" fn_safe_re "direction" /[01]/
            | double_secopt_entry "prng" "algorithm" alg_re "nsl" num_re
            | double_secopt_entry "replay-window" "window-size" num_re "seconds" num_re


(************************************************************************
 *                               FLAGS
 *************************************************************************)

let flag_words = "client-to-client"
               | "duplicate-cn"
	       | "persist-key"
	       | "persist-tun"
	       | "client"
	       | "remote-random"
	       | "nobind"
	       | "mute-replay-warnings"
	       | "http-proxy-retry"
	       | "socks-proxy-retry"
           | "remote-random-hostname"
           | "show-proxy-settings"
           | "float"
           | "bind"
           | "nobind"
           | "tun-ipv6"
           | "ifconfig-noexec"
           | "ifconfig-nowarn"
           | "route-noexec"
           | "route-nopull"
           | "allow-pull-fqdn"
           | "mtu-test"
           | "ping-timer-rem"
           | "persist-tun"
           | "persist-local-ip"
           | "persist-remote-ip"
           | "mlock"
           | "up-delay"
           | "down-pre"
           | "up-restart"
           | "disable-occ"
           | "errors-to-stderr"
           | "passtos"
           | "suppress-timestamps"
           | "fast-io"
           | "multihome"
           | "comp-noadapt"
           | "management-client"
           | "management-query-passwords"
           | "management-query-proxy"
           | "management-query-remote"
           | "management-forget-disconnect"
           | "management-hold"
           | "management-signal"
           | "management-up-down"
           | "management-client-auth"
           | "management-client-pf"
           | "push-reset"
           | "push-peer-info"
           | "disable"
           | "ifconfig-pool-linear"
           | "client-to-client"
           | "duplicate-cn"
           | "ccd-exclusive"
           | "tcp-nodelay"
           | "opt-verify"
           | "auth-user-pass-optional"
           | "client-cert-not-required"
           | "username-as-common-name"
           | "pull"
           | "key-direction"
           | "no-replay"
           | "mute-replay-warnings"
           | "no-iv"
           | "use-prediction-resistance"
           | "test-crypto"
           | "tls-server"
           | "tls-client"
           | "pkcs11-id-management"
           | "single-session"
           | "tls-exit"
           | "auth-nocache"
           | "show-ciphers"
           | "show-digests"
           | "show-tls"
           | "show-engines"
           | "genkey"
           | "mktun"
           | "rmtun"


let flag_entry (kw:regexp)
               = [ key kw . comment_or_eol ]

let flag       = flag_entry flag_words


(************************************************************************
 *                               OTHER FIELDS
 *
 *   - server        => IP IP [nopool]
 *   - server-bridge => IP IP IP IP
 *   - route	     => host host [host [num]]
 *   - push          => "string"
 *   - tls-auth      => filename [01]
 *   - remote        => hostname/IP [num] [(tcp|udp)]
 *   - management    => IP num filename
 *   - http-proxy    => host port [filename|keyword] [method]
 *   - http-proxy-option => (VERSION decimal|AGENT string)
 *   ...
 *   and many others
 *
 *************************************************************************)

let server          = [ key "server"
                      . sep . [ label "address" . ip ]
                      . sep . [ label "netmask" . ip ]
                      . (sep . [ key "nopool" ]) ?
                      . comment_or_eol
                      ]

let server_bridge =
    let ip_params = [ label "address" . ip ] . sep
        . [ label "netmask" . ip ] . sep
        . [ label "start"   . ip ] . sep
        . [ label "end"     . ip ] in
            [ key "server-bridge"
            . sep . (ip_params|store /(nogw)/)
            . comment_or_eol
            ]

let route =
    let route_net_kw   = store (/(vpn_gateway|net_gateway|remote_host)/|host_re) in
        [ key "route" . sep
        . [ label "address" . route_net_kw ]
        . (sep . [ label "netmask" . store (ip_re|/default/) ]
            . (sep . [ label "gateway" . route_net_kw ]
                . (sep . [ label "metric" . store (/default/|num_re)] )?
            )?
        )?
        . comment_or_eol
        ]

let route_ipv6 =
    let route_net_re = /(vpn_gateway|net_gateway|remote_host)/ in
        [ key "route-ipv6" . sep
        . [ label "network" . store (route_net_re|ipv6_bits_re) ]
        . (sep . [ label "gateway" . store (route_net_re|ipv6_re) ]
            . (sep . [ label "metric" . store (/default/|num_re)] )?
        )?
        . comment_or_eol
        ]

let push          = [ key "push" . sep
                    . Quote.do_dquote sto_to_dquote
		    . comment_or_eol
                    ]

let tls_auth      = [ key "tls-auth" . sep
                    . [ label "key"       . filename     ] . sep
		    . [ label "is_client" . store /[01]/ ] . comment_or_eol
                    ]

let remote        = [ key "remote" . sep
                    . [ label "server" . host ]
		            . (sep . [label "port" . port]
                        . (sep . [label "proto" . proto]) ? ) ?
                    . comment_or_eol
		    ]

let http_proxy =
    let auth_method_re = /(none|basic|ntlm)/ in
        let auth_method = store auth_method_re in
            [ key "http-proxy"
            . sep . [ label "server" . host ]
            . sep . [ label "port"   . port ]
            . (sep . [ label "auth" .  filename_safe ]
                . (sep . [ label "auth-method" . auth_method ]) ? )?
            . comment_or_eol
            ]

let http_proxy_option = [ key "http-proxy-option"
                        . sep . [ label "option" . store /(VERSION|AGENT)/ ]
                        . sep . [ label "value" . filename ]
                        . comment_or_eol
                        ]

let socks_proxy     = [ key "socks-proxy"
                      . sep . [ label "server" . host ]
                      . (sep . [ label "port"   . port ]
                        . (sep . [ label "auth" .  filename_safe ])? )?
                      . comment_or_eol
                      ]

let port_share      = [ key "port-share"
                      . sep . [ label "host" . host ]
                      . sep . [ label "port" . port ]
                      . (sep . [ label "dir" . filename ])?
                      . comment_or_eol
                      ]

let route_delay     = [ key "route-delay"
                    . (sep . [ label "seconds" . num ]
                        . (sep . [ label "win-seconds" . num ] ) ?
                    )?
                    . comment_or_eol
                    ]

let inetd           = [ key "inetd"
                    . (sep . [label "mode" . store /(wait|nowait)/ ]
                        . (sep . [ label "progname" . filename ] ) ?
                    )?
                    . comment_or_eol
                    ]

let inactive        = [ key "inactive"
                    . sep . [ label "seconds" . num ]
                    . (sep . [ label "bytes" . num ] ) ?
                    . comment_or_eol
                    ]

let client_nat      = [ key "client-nat"
                    . sep . [ label "type" . store /(snat|dnat)/ ]
                    . sep . [ label "network" . ip ]
                    . sep . [ label "netmask" . ip ]
                    . sep . [ label "alias" . ip ]
                    . comment_or_eol
                    ]

let status          = [ key "status"
                    . sep . [ label "file" . filename_safe ]
                    . (sep . [ label "repeat-seconds" . num ]) ?
                    . comment_or_eol
                    ]

let plugin          = [ key "plugin"
                    . sep . [ label "file" . filename_safe ]
                    . (sep . [ label "init-string" . filename ]) ?
                    . comment_or_eol
                    ]

let management    = [ key "management" . sep
                    . [ label "server" . ip ]
                    . sep . [ label "port" . port ]
                    . (sep . [ label "pwfile" . filename ] ) ?
                    . comment_or_eol
                    ]

let auth_user_pass_verify   = [ key "auth-user-pass-verify"
                              . sep . [ Quote.quote_spaces (label "command") ]
                              . sep . [ label "method" . store /via-(env|file)/ ]
                              . comment_or_eol
                              ]

let static_challenge    = [ key "static-challenge"
                          . sep . [ Quote.quote_spaces (label "text") ]
                          . sep . [ label "echo" . store /[01]/ ]
                          . comment_or_eol
                          ]

let cryptoapicert        = [ key "cryptoapicert" . sep . Quote.dquote
                          . [ key /[A-Z]+/ . Sep.colon . store /[A-Za-z _-]+/ ]
                          . Quote.dquote . comment_or_eol
                          ]

let setenv =
    let envvar = /[^#;\/ \t\n][A-Za-z0-9_-]+/ in
        [ key ("setenv"|"setenv-safe")
        . sep . [ key envvar . sep . store fn_re ]
        . comment_or_eol
        ]

let redirect =
    let redirect_flag   = /(local|autolocal|def1|bypass-dhcp|bypass-dns|block-local)/ in
        let redirect_key    = "redirect-gateway" | "redirect-private" in
            [ key redirect_key
            . (sep . [ label "flag" . store redirect_flag ] ) +
            . comment_or_eol
            ]

let tls_cipher =
    let ciphername = /[A-Za-z0-9!_-]+/ in
        [ key "tls-cipher" . sep
        . [label "cipher" . store ciphername]
        . (Sep.colon . [label "cipher" . store ciphername])*
        . comment_or_eol
        ]

let remote_cert_ku =
    let usage = [label "usage" . store /[A-Za-z0-9]{1,2}/] in
        [ key "remote-cert-ku" . sep . usage . (sep . usage)* . comment_or_eol ]

(* FIXME: Surely there's a nicer way to do this *)
let remote_cert_eku =
    let oid = [label "oid" . store /[0-9]+\.([0-9]+\.)*[0-9]+/] in
        let symbolic = [Quote.do_quote_opt
            (label "symbol" . store /[A-Za-z0-9][A-Za-z0-9 _-]*[A-Za-z0-9]/)] in
            [ key "remote-cert-eku" . sep . (oid|symbolic) . comment_or_eol ]

let status_version          = [ key "status-version"
                              . (sep . num) ?
                              . comment_or_eol
                              ]

let ifconfig_pool           = [ key "ifconfig-pool"
                              . sep . [ label "start" . ip ]
                              . sep . [ label "end" . ip ]
                              . (sep . [ label "netmask" . ip ])?
                              . comment_or_eol
                              ]

let ifconfig_push           = [ key "ifconfig-push"
                              . sep . [ label "local" . ip ]
                              . sep . [ label "remote-netmask" . ip ]
                              . (sep . [ label "alias" . store /[A-Za-z0-9_-]+/ ] )?
                              . comment_or_eol
                              ]

let ignore_unknown_option   = [ key "ignore-unknown-option"
                              . (sep . [ label "opt" . store /[A-Za-z0-9_-]+/ ] ) +
                              . comment_or_eol
                              ]

let tls_version_min         = [ key "tls-version-min"
                              . sep . store Rx.decimal
                              . (sep . [ key "or-highest" ]) ?
                              . comment_or_eol
                              ]

let crl_verify              = [ key "crl-verify"
                              . sep . filename_safe
                              . (sep . [ key "dir" ]) ?
                              . comment_or_eol
                              ]

let x509_username_field =
    let fieldname = /[A-Za-z0-9_-]+/ in
        let extfield = ([key /ext/ . Sep.colon . store fieldname]) in
            let subjfield = ([label "subj" . store fieldname]) in
                [ key "x509-username-field"
                . sep . (extfield|subjfield)
                . comment_or_eol
                ]

let other   = server
            | server_bridge
            | route
            | push
            | tls_auth
            | remote
            | http_proxy
            | http_proxy_option
            | socks_proxy
            | management
            | route_delay
            | client_nat
            | redirect
            | inactive
            | setenv
            | inetd
            | status
            | status_version
            | plugin
            | ifconfig_pool
            | ifconfig_push
            | ignore_unknown_option
            | auth_user_pass_verify
            | port_share
            | static_challenge
            | tls_version_min
            | tls_cipher
            | cryptoapicert
            | x509_username_field
            | remote_cert_ku
            | remote_cert_eku
            | crl_verify
            | route_ipv6


(************************************************************************
 *                              LENS & FILTER
 *************************************************************************)

let lns    = ( comment | empty | single | single_opt | double | flag | other )*

let filter = (incl "/etc/openvpn/client.conf")
           . (incl "/etc/openvpn/server.conf")

let xfm = transform lns filter