Regression #12549 » patch-12549.diff
| src/etc/inc/ipsec.inc | ||
|---|---|---|
|
* NAME
|
||
|
* ipsec_setup_userpools - Generate per-user custom pool settings for swanctl
|
||
|
* INPUTS
|
||
|
* None
|
||
|
* $ph1ent = Mobile IPsec Phase 1 entry
|
||
|
* RESULT
|
||
|
* Adds configured per-user pool settings to $scconf using the primary mobile
|
||
|
* pool as a base configuration.
|
||
| ... | ... | |
|
* Given this new flexible format, it is now possible to override any valid
|
||
|
* pool setting, so future expansion of per-user settings is possible.
|
||
|
******/
|
||
|
function ipsec_setup_userpools() {
|
||
|
function ipsec_setup_userpools($ph1ent) {
|
||
|
global $config, $scconf;
|
||
|
$a_mobilekey = $config['ipsec']['mobilekey'];
|
||
| ... | ... | |
|
if (!is_array($a_mobilekey) ||
|
||
|
empty($a_mobilekey) ||
|
||
|
!is_array($scconf['connections']) ||
|
||
|
!is_array($scconf['con-mobile-defaults']) ||
|
||
|
!is_array($scconf['pools']) ||
|
||
|
!is_array($scconf['mobile-pool'])) {
|
||
|
return;
|
||
| ... | ... | |
|
/* Craft a cloned connection with the ID information to match */
|
||
|
$scconf['connections'][$upconn]['remote'] = array();
|
||
|
$scconf['connections'][$upconn]['remote']['id'] = $clientid;
|
||
|
if ($ph1ent['authentication_method'] != "eap-mschapv2") {
|
||
|
$scconf['connections'][$upconn]['remote']['id'] = $clientid;
|
||
|
}
|
||
|
$scconf['connections'][$upconn]['remote']['eap_id'] = $clienteapid;
|
||
|
$scconf['connections'][$upconn]['pools'] = $upbase;
|
||
| ... | ... | |
|
case 'eap-mschapv2':
|
||
|
if (isset($ph1ent['mobile'])) {
|
||
|
$local['auth'] = "pubkey";
|
||
|
unset($remote['id']);
|
||
|
$remote['eap_id'] = "%any";
|
||
|
$remote['auth'] = "eap-mschapv2";
|
||
|
}
|
||
| ... | ... | |
|
* their children, authentication, etc.
|
||
|
******/
|
||
|
function ipsec_setup_tunnels($gateways_status = false) {
|
||
|
global $aggressive_mode_psk, $a_client, $config,
|
||
|
global $aggressive_mode_psk, $a_phase2, $a_client, $config,
|
||
|
$filterdns_list, $g, $ifacesuse, $ipsec_idhandling, $ipsec_log_cats,
|
||
|
$ipsec_log_sevs, $ipsec_swanctl_basedir, $ipsec_swanctl_dirs,
|
||
|
$ipseccfg, $mobile_ipsec_auth, $natfilterrules, $p1_ealgos,
|
||
| ... | ... | |
|
$scconf["{$cname}-defaults"] = $conn_defaults;
|
||
|
/* Array reference to make things easier */
|
||
|
$conn =& $scconf["{$cname}-defaults"];
|
||
|
$scconf['connections']["{$cname} : {$cname}-defaults"] = array("# Stub to load con-mobile-defaults");
|
||
|
} else {
|
||
|
$cname = ipsec_conid($ph1ent);
|
||
|
/* Start with common default values */
|
||
| ... | ... | |
|
}
|
||
|
if (isset($p1['mobile']) && !isset($p1['disabled'])) {
|
||
|
$mobile_configured = true;
|
||
|
$mobilep1 = $p1;
|
||
|
}
|
||
|
$tunnels[$p1['ikeid']] = $p1;
|
||
|
$tunnels[$p1['ikeid']]['p2'] = array();
|
||
| ... | ... | |
|
/* Setup mobile address pools */
|
||
|
ipsec_setup_pools();
|
||
|
/* Setup per-user pools */
|
||
|
ipsec_setup_userpools();
|
||
|
ipsec_setup_userpools($mobilep1);
|
||
|
$scconf['connections']["con-mobile : con-mobile-defaults"] = array("# Stub to load con-mobile-defaults");
|
||
|
}
|
||
|
/* Setup secret data */
|
||
|
$scconf['secrets'] = array();
|
||
.png){kind=link}