Project

General

Profile

Download (19.4 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
	vpn_pptp.php
4
	part of m0n0wall (http://m0n0.ch/wall)
5
	
6
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
7
	All rights reserved.
8
	
9
	Redistribution and use in source and binary forms, with or without
10
	modification, are permitted provided that the following conditions are met:
11
	
12
	1. Redistributions of source code must retain the above copyright notice,
13
	   this list of conditions and the following disclaimer.
14
	
15
	2. Redistributions in binary form must reproduce the above copyright
16
	   notice, this list of conditions and the following disclaimer in the
17
	   documentation and/or other materials provided with the distribution.
18
	
19
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
20
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
21
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
23
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28
	POSSIBILITY OF SUCH DAMAGE.
29
*/
30

    
31
require("guiconfig.inc");
32

    
33
if (!is_array($config['pptpd']['radius'])) {
34
	$config['pptpd']['radius'] = array();
35
}
36
$pptpcfg = &$config['pptpd'];
37

    
38
$pconfig['remoteip'] = $pptpcfg['remoteip'];
39
$pconfig['localip'] = $pptpcfg['localip'];
40
$pconfig['redir'] = $pptpcfg['redir'];
41
$pconfig['mode'] = $pptpcfg['mode'];
42
$pconfig['wins'] = $pptpcfg['wins'];
43
$pconfig['req128'] = isset($pptpcfg['req128']);
44
$pconfig['radiusenable'] = isset($pptpcfg['radius']['enable']);
45
$pconfig['radiusissueips'] = isset($pptpdcfg['radius']['radiusissueips']);
46
$pconfig['radiussecenable'] = isset($pptpcfg['radius']['secenable']);
47
$pconfig['radacct_enable'] = isset($pptpcfg['radius']['accounting']);
48
$pconfig['radiusserver'] = $pptpcfg['radius']['server'];
49
$pconfig['radiussecret'] = $pptpcfg['radius']['secret'];
50
$pconfig['radiusserver2'] = $pptpcfg['radius']['server2'];
51
$pconfig['radiussecret2'] = $pptpcfg['radius']['secret2'];
52
$pconfig['n_pptp_units'] = $pptpcfg['n_pptp_units'];
53
$pconfig['pptp_subnet'] = $pptpcfg['pptp_subnet'];
54
$pconfig['radius_acct_update'] = $pptpcfg['radius_acct_update'];
55
$pconfig['radius_nasip'] = $pptpcfg['radius_nasip'];
56

    
57
if ($_POST) {
58

    
59
	unset($input_errors);
60
	$pconfig = $_POST;
61

    
62
	/* input validation */
63
	if ($_POST['mode'] == "server") {
64
		$reqdfields = explode(" ", "localip remoteip");
65
		$reqdfieldsn = explode(",", "Server address,Remote start address");
66
		
67
		if ($_POST['radiusenable']) {
68
			$reqdfields = array_merge($reqdfields, explode(" ", "radiusserver radiussecret"));
69
			$reqdfieldsn = array_merge($reqdfieldsn, 
70
				explode(",", "RADIUS server address,RADIUS shared secret"));
71
		}
72
		
73
		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
74
		
75
		if (($_POST['localip'] && !is_ipaddr($_POST['localip']))) {
76
			$input_errors[] = "A valid server address must be specified.";
77
		}
78
		if (($_POST['subnet'] && !is_ipaddr($_POST['remoteip']))) {
79
			$input_errors[] = "A valid remote start address must be specified.";
80
		}
81
		if (($_POST['radiusserver'] && !is_ipaddr($_POST['radiusserver']))) {
82
			$input_errors[] = "A valid RADIUS server address must be specified.";
83
		}
84
		
85
		if (!$input_errors) {	
86
			$_POST['remoteip'] = $pconfig['remoteip'] = gen_subnet($_POST['remoteip'], $g['pptp_subnet']);
87
			$subnet_start = ip2long($_POST['remoteip']);
88
			$subnet_end = ip2long($_POST['remoteip']) + $g['n_pptp_units'] - 1;
89
						
90
			if ((ip2long($_POST['localip']) >= $subnet_start) && 
91
			    (ip2long($_POST['localip']) <= $subnet_end)) {
92
				$input_errors[] = "The specified server address lies in the remote subnet.";	
93
			}
94
			if ($_POST['localip'] == $config['interfaces']['lan']['ipaddr']) {
95
				$input_errors[] = "The specified server address is equal to the LAN interface address.";	
96
			}
97
		}
98
	} else if ($_POST['mode'] == "redir") {
99
		$reqdfields = explode(" ", "redir");
100
		$reqdfieldsn = explode(",", "PPTP redirection target address");
101
		
102
		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
103
		
104
		if (($_POST['redir'] && !is_ipaddr($_POST['redir']))) {
105
			$input_errors[] = "A valid target address must be specified.";
106
		}
107
	} else {
108
		/* turning pptp off, lets dump any custom rules */
109
		$rules = &$config['filter']['rule'];
110
		for($x=0; $x<count($rules); $x++) {
111
			if($rules[$x]['interface'] == "pptp") { 
112
				unset($rules[$x]);
113
			}
114
		}
115
		unset($config['pptpd']['mode']);
116

    
117
		write_config();
118
	}
119

    
120
	if (!$input_errors) {
121
		$pptpcfg['remoteip'] = $_POST['remoteip'];
122
		$pptpcfg['redir'] = $_POST['redir'];
123
		$pptp['localip'] = $_POST['localip'];
124
		$pptpcfg['mode'] = $_POST['mode'];
125
		$pptpcfg['wins'] = $_POST['wins'];
126
		$pptpcfg['n_pptp_units'] = $_POST['n_pptp_units'];	
127
		$pptpcfg['pptp_subnet'] = $_POST['pptp_subnet'];
128
		$pptpcfg['radius']['server'] = $_POST['radiusserver'];
129
		$pptpcfg['radius']['secret'] = $_POST['radiussecret'];
130
		$pptpcfg['radius']['server2'] = $_POST['radiusserver2'];
131
		$pptpcfg['radius']['secret2'] = $_POST['radiussecret2'];
132
		$pptpcfg['radius_nasip'] = $_POST['radius_nasip'];
133
		$pptpcfg['radius_acct_update'] = $_POST['radius_acct_update'];
134

    
135
		if($_POST['req128'] == "yes") 
136
			$pptpcfg['req128'] = true;
137
		else
138
			unset($pptpcfg['req128']);
139

    
140
		if($_POST['radiusenable'] == "yes") 
141
			$pptpcfg['radius']['enable'] = true;
142
		else 
143
			unset($pptpcfg['radius']['enable']);
144
			
145
		if($_POST['radiussecenable'] == "yes") 
146
			$pptpcfg['radius']['secenable'] = true;
147
		else 
148
			unset($pptpcfg['radius']['secenable']);
149
			
150
		if($_POST['radacct_enable'] == "yes") 
151
			$pptpcfg['radius']['accounting'] = true;
152
		else 
153
			unset($pptpcfg['radius']['accounting']);
154
		
155
		if($_POST['radiusissueips'] == "yes") {
156
			$pptpcfg['radius']['radiusissueips'] = true;
157
		} else
158
			unset($pptpcfg['radius']['radiusissueips']);
159
		
160
		write_config();
161
		
162
		$retval = 0;
163
		
164
		config_lock();
165
		$retval = vpn_setup();
166
		config_unlock();
167
		
168
		$savemsg = get_std_save_message($retval);
169
		
170
		filter_configure();
171
	}
172
}
173

    
174
$pgtitle = "VPN PPTP";
175
include("head.inc");
176

    
177
?>
178

    
179
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
180
<?php include("fbegin.inc"); ?>
181
<p class="pgtitle"><?=$pgtitle?></p>
182
<script language="JavaScript">
183
<!--
184
function get_radio_value(obj)
185
{
186
	for (i = 0; i < obj.length; i++) {
187
		if (obj[i].checked)
188
			return obj[i].value;
189
	}
190
	return null;
191
}
192

    
193
function enable_change(enable_over) {
194
	if ((get_radio_value(document.iform.mode) == "server") || enable_over) {
195
		document.iform.remoteip.disabled = 0;
196
		document.iform.localip.disabled = 0;
197
		document.iform.req128.disabled = 0;
198
		document.iform.radiusenable.disabled = 0;
199
		document.iform.wins.disabled = 0;
200
		document.iform.n_pptp_units.disabled = 0;
201
		document.iform.pptp_subnet.disabled = 0;	
202
		
203
		if (document.iform.radiusenable.checked || enable_over) {
204
			document.iform.radiussecenable.disabled = 0;
205
			document.iform.radacct_enable.disabled = 0;
206
			document.iform.radiusserver.disabled = 0;
207
			document.iform.radiussecret.disabled = 0;
208
			document.iform.radius_nasip.disabled = 0;	
209
			document.iform.radius_acct_update.disabled = 0;	
210
			document.iform.radiusissueips.disabled = 0;		
211
		} else {
212
			document.iform.radacct_enable.disabled = 1;
213
			document.iform.radiusserver.disabled = 1;
214
			document.iform.radiussecret.disabled = 1;
215
			document.iform.radius_nasip.disabled = 1;	
216
			document.iform.radius_acct_update.disabled = 1;	
217
			document.iform.radiusissueips.disabled = 1;
218
		}
219

    
220
		if (document.iform.radiussecenable.checked || enable_over) {
221
			document.iform.radiusserver2.disabled = 0;
222
			document.iform.radiussecret2.disabled = 0;
223
		} else {
224

    
225
			document.iform.radiusserver2.disabled = 1;
226
			document.iform.radiussecret2.disabled = 1;
227
		}
228
	} else {
229
		document.iform.remoteip.disabled = 1;
230
		document.iform.localip.disabled = 1;
231
		document.iform.req128.disabled = 1;
232
		document.iform.n_pptp_units.disabled = 1;
233
		document.iform.pptp_subnet.disabled = 1;	
234
		document.iform.radiusenable.disabled = 1;
235
		document.iform.radacct_enable.disabled = 1;
236
		document.iform.radiusserver.disabled = 1;
237
		document.iform.radiussecret.disabled = 1;
238
		document.iform.radius_nasip.disabled = 1;	
239
		document.iform.radius_acct_update.disabled = 1;
240
		document.iform.radiussecenable.disabled = 1;
241
		document.iform.radiusserver2.disabled = 1;
242
		document.iform.radiussecret2.disabled = 1;	
243
		document.iform.wins.disabled = 1;
244
		document.iform.radiusissueips.disabled = 1;
245
	}
246
	if ((get_radio_value(document.iform.mode) == "redir") || enable_over) {
247
		document.iform.redir.disabled = 0;
248
	} else {
249
		document.iform.redir.disabled = 1;
250
	}
251
}
252
//-->
253
</script>
254
<form action="vpn_pptp.php" method="post" name="iform" id="iform">
255
<?php if ($input_errors) print_input_errors($input_errors); ?>
256
<?php if ($savemsg) print_info_box($savemsg); ?>
257
<table width="100%" border="0" cellpadding="0" cellspacing="0">
258
  <tr><td class="tabnavtbl">
259
<?php
260
	$tab_array = array();
261
	$tab_array[0] = array("Configuration", true, "vpn_pptp.php");
262
	$tab_array[1] = array("Users", false, "vpn_pptp_users.php");
263
	display_top_tabs($tab_array);
264
?>  
265
  </td></tr>
266
  <tr> 
267
    <td>
268
<div id="mainarea">
269
              <table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
270
                <tr> 
271
                  <td width="22%" valign="top" class="vtable">&nbsp;</td>
272
                  <td width="78%" class="vtable"> 
273
                    <input name="mode" type="radio" onclick="enable_change(false)" value="off"
274
				  	<?php if (($pconfig['mode'] != "server") && ($pconfig['mode'] != "redir")) echo "checked";?>>
275
                    Off</td>
276
                <tr> 
277
                  <td width="22%" valign="top" class="vtable">&nbsp;</td>
278
                  <td width="78%" class="vtable">
279
<input type="radio" name="mode" value="redir" onclick="enable_change(false)" <?php if ($pconfig['mode'] == "redir") echo "checked"; ?>>
280
                    Redirect incoming PPTP connections to:</td>
281
                <tr> 
282
                  <td width="22%" valign="top" class="vncellreq">PPTP redirection</td>
283
                  <td width="78%" class="vtable"> 
284
                    <?=$mandfldhtml;?><input name="redir" type="text" class="formfld" id="redir" size="20" value="<?=htmlspecialchars($pconfig['redir']);?>"> 
285
                    <br>
286
                    Enter the IP address of a host which will accept incoming 
287
                    PPTP connections.</td>
288
                <tr> 
289
                  <td width="22%" valign="top" class="vtable">&nbsp;</td>
290
                  <td width="78%" class="vtable">
291
<input type="radio" name="mode" value="server" onclick="enable_change(false)" <?php if ($pconfig['mode'] == "server") echo "checked"; ?>>
292
                    Enable PPTP server</td>
293
                <tr> 
294
                  <td width="22%" valign="top" class="vncellreq">Max. concurrent 
295
                    connections</td>
296
                  <td width="78%" class="vtable"> 
297
                    <?=$g['n_pptp_units'];?>
298
                  </td>
299
                <tr> 
300
                  <td width="22%" valign="top" class="vncellreq">Server address</td>
301
                  <td width="78%" class="vtable"> 
302
                    <?=$mandfldhtml;?><input name="localip" type="text" class="formfld" id="localip" size="20" value="<?=htmlspecialchars($pconfig['localip']);?>"> 
303
                    <br>
304
                    Enter the IP address the PPTP server should use on its side 
305
                    for all clients.</td>
306
                </tr>
307
                <tr> 
308
                  <td width="22%" valign="top" class="vncellreq">Remote address 
309
                    range</td>
310
                  <td width="78%" class="vtable"> 
311
                    <?=$mandfldhtml;?><input name="remoteip" type="text" class="formfld" id="remoteip" size="20" value="<?=htmlspecialchars($pconfig['remoteip']);?>">
312
                    <br>
313
                    Specify the starting address for the client IP address subnet.<br>
314
                </tr>
315
                <tr> 
316
                  <td width="22%" valign="top" class="vncellreq">Subnet netmask</td>
317
                  <td width="78%" class="vtable">
318
		    <select id="pptp_subnet" name="pptp_subnet">
319
		    <?php
320
		     for($x=0; $x<33; $x++) {
321
			if($x == $pconfig['pptp_subnet'])
322
				$SELECTED = " SELECTED";
323
			else
324
				$SELECTED = "";
325
			echo "<option value=\"{$x}\"{$SELECTED}>{$x}</option>\n";			
326
		     }
327
		    ?>
328
		    </select>
329
		    <br>Hint: 24 is 255.255.255.0
330
                  </td>
331
		</tr>
332
                <tr> 
333
                  <td width="22%" valign="top" class="vncellreq">No. PPTP users</td>
334
                  <td width="78%" class="vtable">
335
		    <select id="n_pptp_units" name="n_pptp_units">
336
		    <?php
337
		     for($x=0; $x<255; $x++) {
338
			if($x == $pconfig['n_pptp_units'])
339
				$SELECTED = " SELECTED";
340
			else
341
				$SELECTED = "";
342
			echo "<option value=\"{$x}\"{$SELECTED}>{$x}</option>\n";			
343
		     }
344
		    ?>
345
		    </select>
346
		    <br>Hint: 10 is TEN pptp clients
347
                  </td>
348
                </tr>
349
                <tr> 
350
                  <td width="22%" valign="top" class="vncell">RADIUS</td>
351
                  <td width="78%" class="vtable"> 
352
                      <input name="radiusenable" type="checkbox" id="radiusenable" onclick="enable_change(false)" value="yes" <?php if ($pconfig['radiusenable']) echo "checked"; ?>>
353
                      <strong>Use a RADIUS server for authentication<br>
354
                      </strong>When set, all users will be authenticated using 
355
                      the RADIUS server specified below. The local user database 
356
                      will not be used.<br>
357
                      <br>
358
                      <input name="radacct_enable" type="checkbox" id="radacct_enable" onclick="enable_change(false)" value="yes" <?php if ($pconfig['radacct_enable']) echo "checked"; ?>>
359
                      <strong>Enable RADIUS accounting <br>
360
                      </strong>Sends accounting packets to the RADIUS server.</td>
361
                </tr>
362
                <tr> 
363
                  <td width="22%" valign="top" class="vncell">RADIUS server </td>
364
                  <td width="78%" class="vtable">
365
                      <input name="radiusserver" type="text" class="formfld" id="radiusserver" size="20" value="<?=htmlspecialchars($pconfig['radiusserver']);?>">
366
                      <br>
367
                      Enter the IP address of the RADIUS server.</td>
368
                </tr>
369
                <tr> 
370
                  <td width="22%" valign="top" class="vncell">RADIUS shared secret</td>
371
                  <td width="78%" valign="top" class="vtable">
372
                      <input name="radiussecret" type="password" class="formfld" id="radiussecret" size="20" value="<?=htmlspecialchars($pconfig['radiussecret']);?>">
373
                      <br>
374
                      Enter the shared secret that will be used to authenticate 
375
                      to the RADIUS server.</td>
376
                </tr>
377
                  <td width="78%" class="vtable"> 
378
                      <input name="radiussecenable" type="checkbox" id="radiussecenable" onclick="enable_change(false)" value="yes" <?php if ($pconfig['radiussecenable']) echo "checked"; ?>>
379
                      <strong>Use a backup RADIUS server for failover authentication<br>
380
                      </strong>When set, all users will be authenticated using 
381
                      the RADIUS server specified below. The local user database 
382
                      will not be used</td>
383
                </tr>
384
                <tr> 
385
                  <td width="22%" valign="top" class="vncell">BACKUP RADIUS server </td>
386
                  <td width="78%" class="vtable">
387
                      <input name="radiusserver2" type="text" class="formfld" id="radiusserver2" size="20" value="<?=htmlspecialchars($pconfig['radiusserver2']);?>">
388
                      <br>
389
                      Enter the IP address of the RADIUS server.</td>
390
                </tr>
391
                <tr> 
392
                  <td width="22%" valign="top" class="vncell">BACKUP RADIUS shared secret</td>
393
                  <td width="78%" valign="top" class="vtable">
394
                      <input name="radiussecret2" type="password" class="formfld" id="radiussecret2" size="20" value="<?=htmlspecialchars($pconfig['radiussecret2']);?>">
395
                      <br>
396
                      Enter the shared secret that will be used to authenticate 
397
                      to the RADIUS server.</td>
398
                </tr>
399
                <tr> 
400
                  <td width="22%" valign="top" class="vncell">Radius NAS IP</td>
401
                  <td width="78%" valign="top" class="vtable">
402
                      <input name="radius_nasip" class="formfld" id="radius_nasip" size="20" value="<?=htmlspecialchars($pconfig['radius_nasip']);?>">
403
                  </td>
404
		  </tr>
405
                <tr> 
406
                  <td width="22%" valign="top" class="vncell">Radius Accounting Update</td>
407
                  <td width="78%" valign="top" class="vtable">
408
                      <input name="radius_acct_update" class="formfld" id="radius_acct_update" size="20" value="<?=htmlspecialchars($pconfig['radius_acct_update']);?>">
409
                  </td>
410
		  </tr>
411
                <tr> 
412
                  <td width="22%" valign="top" class="vncell">RADIUS issued IP's</td>
413
                  <td width="78%" valign="top" class="vtable">
414
                      <input name="radiusissueips" value="yes" type="checkbox" class="formfld" id="radiusissueips"<?php if($pconfig['radiusissueips']) echo " CHECKED"; ?>>
415
                      <br>Issue IP Addresses via RADIUS server.
416

    
417
                  </td>
418
                </tr>
419
                <tr> 
420
                  <td width="22%" valign="top" class="vncell">WINS Server</td>
421
                  <td width="78%" valign="top" class="vtable">
422
                      <input name="wins" class="formfld" id="wins" size="20" value="<?=htmlspecialchars($pconfig['wins']);?>">
423
                  </td>
424
                </tr>
425
                <tr> 
426
                  <td height="16" colspan="2" valign="top"></td>
427
                </tr>
428
                <tr> 
429
                  <td width="22%" valign="middle">&nbsp;</td>
430
                  <td width="78%" class="vtable"> 
431
                    <input name="req128" type="checkbox" id="req128" value="yes" <?php if ($pconfig['req128']) echo "checked"; ?>> 
432
                    <strong>Require 128-bit encryption</strong><br>
433
                    When set, 128-bit encryption will be accepted. Otherwise, 
434
                    40-bit and 56-bit encryption will be accepted, too. Note that 
435
                    encryption will always be forced on PPTP connections (i.e. 
436
                    unencrypted connections will not be accepted).</td>
437
                </tr>
438
                <tr> 
439
                  <td width="22%" valign="top">&nbsp;</td>
440
                  <td width="78%"> 
441
                    <input name="Submit" type="submit" class="formbtn" value="Save" onclick="enable_change(true)"> 
442
                  </td>
443
                </tr>
444
                <tr> 
445
                  <td width="22%" valign="top">&nbsp;</td>
446
                  <td width="78%"><span class="vexpl"><span class="red"><strong>Note:<br>
447
                    </strong></span>don't forget to <a href="firewall_rules.php?if=pptp">add a firewall rule</a> to permit 
448
                    traffic from PPTP clients!</span></td>
449
                </tr>
450
              </table>
451
</div>
452
			</td>
453
	</tr>
454
</table>
455
</form>
456
<script language="JavaScript">
457
<!--
458
enable_change(false);
459
//-->
460
</script>
461
<?php include("fend.inc"); ?>
462
</body>
463
</html>
464

    
(171-171/175)