Project

General

Profile

Download (17.6 KB) Statistics
| Branch: | Tag: | Revision:
1
#!/usr/local/bin/php
2
<?php
3
/*
4
	vpn_ipsec_mobile.php
5
	part of m0n0wall (http://m0n0.ch/wall)
6
	
7
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
8
	All rights reserved.
9
	
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12
	
13
	1. Redistributions of source code must retain the above copyright notice,
14
	   this list of conditions and the following disclaimer.
15
	
16
	2. Redistributions in binary form must reproduce the above copyright
17
	   notice, this list of conditions and the following disclaimer in the
18
	   documentation and/or other materials provided with the distribution.
19
	
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
*/
31

    
32
require("guiconfig.inc");
33

    
34
if (!is_array($config['ipsec']['mobileclients'])) {
35
	$config['ipsec']['mobileclients'] = array();
36
}
37
$a_ipsec = &$config['ipsec']['mobileclients'];
38

    
39
if (count($a_ipsec) == 0) {
40
	/* defaults */
41
	$pconfig['p1mode'] = "aggressive";
42
	$pconfig['p1myidentt'] = "myaddress";
43
	$pconfig['p1ealgo'] = "3des";
44
	$pconfig['p1halgo'] = "sha1";
45
	$pconfig['p1dhgroup'] = "2";
46
	$pconfig['p1authentication_method'] = "pre_shared_key";
47
	$pconfig['p2proto'] = "esp";
48
	$pconfig['p2ealgos'] = explode(",", "3des,blowfish,cast128,rijndael");
49
	$pconfig['p2halgos'] = explode(",", "hmac_sha1,hmac_md5");
50
	$pconfig['p2pfsgroup'] = "0";
51
} else {
52
	$pconfig['enable'] = isset($a_ipsec['enable']);
53
	$pconfig['p1mode'] = $a_ipsec['p1']['mode'];
54
		
55
	if (isset($a_ipsec['p1']['myident']['myaddress']))
56
		$pconfig['p1myidentt'] = 'myaddress';
57
	else if (isset($a_ipsec['p1']['myident']['address'])) {
58
		$pconfig['p1myidentt'] = 'address';
59
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['address'];
60
	} else if (isset($a_ipsec['p1']['myident']['fqdn'])) {
61
		$pconfig['p1myidentt'] = 'fqdn';
62
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['fqdn'];
63
	} else if (isset($a_ipsec['p1']['myident']['ufqdn'])) {
64
		$pconfig['p1myidentt'] = 'user_fqdn';
65
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['ufqdn'];
66
 	}
67
	
68
	$pconfig['p1ealgo'] = $a_ipsec['p1']['encryption-algorithm'];
69
	$pconfig['p1halgo'] = $a_ipsec['p1']['hash-algorithm'];
70
	$pconfig['p1dhgroup'] = $a_ipsec['p1']['dhgroup'];
71
	$pconfig['p1lifetime'] = $a_ipsec['p1']['lifetime'];
72
	$pconfig['p1authentication_method'] = $a_ipsec['p1']['authentication_method'];
73
	$pconfig['p1cert'] = base64_decode($a_ipsec['p1']['cert']);
74
	$pconfig['p1privatekey'] = base64_decode($a_ipsec['p1']['private-key']);
75
	$pconfig['p2proto'] = $a_ipsec['p2']['protocol'];
76
	$pconfig['p2ealgos'] = $a_ipsec['p2']['encryption-algorithm-option'];
77
	$pconfig['p2halgos'] = $a_ipsec['p2']['hash-algorithm-option'];
78
	$pconfig['p2pfsgroup'] = $a_ipsec['p2']['pfsgroup'];
79
	$pconfig['p2lifetime'] = $a_ipsec['p2']['lifetime'];
80
}
81

    
82
if ($_POST) {
83
	unset($input_errors);
84
	$pconfig = $_POST;
85

    
86
	/* input validation */
87
	$reqdfields = explode(" ", "p2ealgos p2halgos");
88
	$reqdfieldsn = explode(",", "P2 Encryption Algorithms,P2 Hash Algorithms");
89
	
90
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
91
	
92
	if ($_POST['p1authentication_method']== "rsasig") {
93
		if (!strstr($_POST['p1cert'], "BEGIN CERTIFICATE") || !strstr($_POST['p1cert'], "END CERTIFICATE"))
94
			$input_errors[] = "This certificate does not appear to be valid.";
95
		if (!strstr($_POST['p1privatekey'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['p1privatekey'], "END RSA PRIVATE KEY"))
96
			$input_errors[] = "This key does not appear to be valid.";	
97
	}
98
	
99
	if (($_POST['p1lifetime'] && !is_numeric($_POST['p1lifetime']))) {
100
		$input_errors[] = "The P1 lifetime must be an integer.";
101
	}
102
	if (($_POST['p2lifetime'] && !is_numeric($_POST['p2lifetime']))) {
103
		$input_errors[] = "The P2 lifetime must be an integer.";
104
	}
105
	if ((($_POST['p1myidentt'] == "address") && !is_ipaddr($_POST['p1myident']))) {
106
		$input_errors[] = "A valid IP address for 'My identifier' must be specified.";
107
	}
108
	if ((($_POST['p1myidentt'] == "fqdn") && !is_domain($_POST['p1myident']))) {
109
		$input_errors[] = "A valid domain name for 'My identifier' must be specified.";
110
	}
111
	if ($_POST['p1myidentt'] == "user_fqdn") {
112
		$ufqdn = explode("@",$_POST['p1myident']);
113
		if (!is_domain($ufqdn[1])) 
114
			$input_errors[] = "A valid User FQDN in the form of user@my.domain.com for 'My identifier' must be specified.";
115
	}
116
	
117
	if ($_POST['p1myidentt'] == "myaddress")
118
		$_POST['p1myident'] = "";
119

    
120
	if (!$input_errors) {
121
		$ipsecent = array();
122
		$ipsecent['enable'] = $_POST['enable'] ? true : false;
123
		$ipsecent['p1']['mode'] = $_POST['p1mode'];
124
		
125
		$ipsecent['p1']['myident'] = array();
126
		switch ($_POST['p1myidentt']) {
127
			case 'myaddress':
128
				$ipsecent['p1']['myident']['myaddress'] = true;
129
				break;
130
			case 'address':
131
				$ipsecent['p1']['myident']['address'] = $_POST['p1myident'];
132
				break;
133
			case 'fqdn':
134
				$ipsecent['p1']['myident']['fqdn'] = $_POST['p1myident'];
135
				break;
136
			case 'user_fqdn':
137
				$ipsecent['p1']['myident']['ufqdn'] = $_POST['p1myident'];
138
				break;
139
		}
140
		
141
		$ipsecent['p1']['encryption-algorithm'] = $_POST['p1ealgo'];
142
		$ipsecent['p1']['hash-algorithm'] = $_POST['p1halgo'];
143
		$ipsecent['p1']['dhgroup'] = $_POST['p1dhgroup'];
144
		$ipsecent['p1']['lifetime'] = $_POST['p1lifetime'];
145
		$ipsecent['p1']['private-key'] = base64_encode($_POST['p1privatekey']);
146
		$ipsecent['p1']['cert'] = base64_encode($_POST['p1cert']);
147
		$ipsecent['p1']['authentication_method'] = $_POST['p1authentication_method'];
148
		$ipsecent['p2']['protocol'] = $_POST['p2proto'];
149
		$ipsecent['p2']['encryption-algorithm-option'] = $_POST['p2ealgos'];
150
		$ipsecent['p2']['hash-algorithm-option'] = $_POST['p2halgos'];
151
		$ipsecent['p2']['pfsgroup'] = $_POST['p2pfsgroup'];
152
		$ipsecent['p2']['lifetime'] = $_POST['p2lifetime'];
153
		
154
		$a_ipsec = $ipsecent;
155
		
156
		write_config();
157
		touch($d_ipsecconfdirty_path);
158
		
159
		header("Location: vpn_ipsec_mobile.php");
160
		exit;
161
	}
162
}
163

    
164
$pgtitle = "VPN: IPsec: Mobile";
165
include("head.inc");
166

    
167
?>
168
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
169
<?php include("fbegin.inc"); ?>
170
<p class="pgtitle"><?=$pgtitle?></p>
171
<script language="JavaScript">
172
<!--
173
function methodsel_change() {
174
	switch (document.iform.p1authentication_method.selectedIndex) {
175
		case 1:	/* rsa */
176
			document.iform.p1privatekey.disabled = 0;
177
			document.iform.p1cert.disabled = 0;
178
			break;
179
		default: /* pre-shared */
180
			document.iform.p1privatekey.disabled = 1;
181
			document.iform.p1cert.disabled = 1;
182
			break;
183
	}
184
}
185
//-->
186
</script>
187
<form action="vpn_ipsec.php" method="post">
188
<?php if ($input_errors) print_input_errors($input_errors); ?>
189
<?php if (file_exists($d_ipsecconfdirty_path)): ?><p>
190
<?php print_info_box_np("The IPsec tunnel configuration has been changed.<br>You must apply the changes in order for them to take effect.");?><br>
191
<?php endif; ?>
192
</form>
193
<form action="vpn_ipsec_mobile.php" method="post" name="iform" id="iform">
194
<table width="100%" border="0" cellpadding="0" cellspacing="0">
195
  <tr><td class="tabnavtbl">
196
<?php
197
	$tab_array = array();
198
	$tab_array[0] = array("Tunnels", false, "vpn_ipsec.php");
199
	$tab_array[1] = array("Mobile clients", true, "vpn_ipsec_mobile.php");
200
	$tab_array[2] = array("Pre-shared keys", false, "vpn_ipsec_keys.php");
201
	$tab_array[3] = array("CAs", false, "vpn_ipsec_ca.php");
202
	$tab_array[4] = array("Failover IPSEC", false, "/pkg_edit.php?xml=sasyncd.xml&id=0");
203
	display_top_tabs($tab_array);
204
?>
205
  </td></tr>
206
  <tr> 
207
    <td>
208
	 <div id="mainarea">
209
              <table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
210
			  <tr> 
211
                        <td width="22%" valign="top">&nbsp;</td>
212
                        <td width="78%"> 
213
                    <input name="enable" type="checkbox" id="enable" value="yes" <?php if ($pconfig['enable']) echo "checked"; ?>>
214
                    <strong>Allow mobile clients</strong></td>
215
                </tr>
216
                <tr> 
217
                  <td colspan="2" valign="top" class="listtopic">Phase 1 proposal 
218
                    (Authentication)</td>
219
                </tr>
220
                <tr> 
221
                  <td width="22%" valign="top" class="vncellreq">Negotiation mode</td>
222
                        <td width="78%" class="vtable">
223
					<select name="p1mode" class="formfld">
224
                      <?php $modes = explode(" ", "main aggressive"); foreach ($modes as $mode): ?>
225
                      <option value="<?=$mode;?>" <?php if ($mode == $pconfig['p1mode']) echo "selected"; ?>> 
226
                      <?=htmlspecialchars($mode);?>
227
                      </option>
228
                      <?php endforeach; ?>
229
                    </select> <br> <span class="vexpl">Aggressive is faster, but 
230
                    less secure.</span></td>
231
                </tr>
232
                <tr> 
233
                  <td width="22%" valign="top" class="vncellreq">My identifier</td>
234
                        <td width="78%" class="vtable">
235
					<select name="p1myidentt" class="formfld">
236
                      <?php foreach ($my_identifier_list as $mode => $modename): ?>
237
                      <option value="<?=$mode;?>" <?php if ($mode == $pconfig['p1myidentt']) echo "selected"; ?>> 
238
                      <?=htmlspecialchars($modename);?>
239
                      </option>
240
                      <?php endforeach; ?>
241
                    </select> <input name="p1myident" type="text" class="formfld" id="p1myident" size="30" value="<?=$pconfig['p1myident'];?>"> 
242
                  </td>
243
                </tr>
244
                <tr> 
245
                  <td width="22%" valign="top" class="vncellreq">Encryption algorithm</td>
246
                        <td width="78%" class="vtable">
247
					<select name="p1ealgo" class="formfld">
248
                      <?php foreach ($p1_ealgos as $algo => $algoname): ?>
249
                      <option value="<?=$algo;?>" <?php if ($algo == $pconfig['p1ealgo']) echo "selected"; ?>> 
250
                      <?=htmlspecialchars($algoname);?>
251
                      </option>
252
                      <?php endforeach; ?>
253
                    </select> <br> <span class="vexpl">Must match the setting 
254
                    chosen on the remote side. </span></td>
255
                </tr>
256
                <tr> 
257
                  <td width="22%" valign="top" class="vncellreq">Hash algorithm</td>
258
                        <td width="78%" class="vtable">
259
					<select name="p1halgo" class="formfld">
260
                      <?php foreach ($p1_halgos as $algo => $algoname): ?>
261
                      <option value="<?=$algo;?>" <?php if ($algo == $pconfig['p1halgo']) echo "selected"; ?>> 
262
                      <?=htmlspecialchars($algoname);?>
263
                      </option>
264
                      <?php endforeach; ?>
265
                    </select> <br> <span class="vexpl">Must match the setting 
266
                    chosen on the remote side. </span></td>
267
                </tr>
268
                <tr> 
269
                  <td width="22%" valign="top" class="vncellreq">DH key group</td>
270
                        <td width="78%" class="vtable">
271
					<select name="p1dhgroup" class="formfld">
272
                      <?php $keygroups = explode(" ", "1 2 5"); foreach ($keygroups as $keygroup): ?>
273
                      <option value="<?=$keygroup;?>" <?php if ($keygroup == $pconfig['p1dhgroup']) echo "selected"; ?>> 
274
                      <?=htmlspecialchars($keygroup);?>
275
                      </option>
276
                      <?php endforeach; ?>
277
                    </select> <br> <span class="vexpl"><em>1 = 768 bit, 2 = 1024 
278
                    bit, 5 = 1536 bit</em><br>
279
                    Must match the setting chosen on the remote side. </span></td>
280
                </tr>
281
                <tr> 
282
                  <td width="22%" valign="top" class="vncell">Lifetime</td>
283
                        <td width="78%" class="vtable"> 
284
                    <input name="p1lifetime" type="text" class="formfld" id="p1lifetime" size="20" value="<?=$pconfig['p1lifetime'];?>">
285
                    seconds</td>
286
                </tr>
287
                <tr> 
288
                  <td width="22%" valign="top" class="vncellreq">Authentication method</td>
289
                  <td width="78%" class="vtable">
290
					<select name="p1authentication_method" class="formfld" onChange="methodsel_change()">
291
                      <?php foreach ($p1_authentication_methods as $method => $methodname): ?>
292
                      <option value="<?=$method;?>" <?php if ($method == $pconfig['p1authentication_method']) echo "selected"; ?>> 
293
                      <?=htmlspecialchars($methodname);?>
294
                      </option>
295
                      <?php endforeach; ?>
296
                    </select> <br> <span class="vexpl">Must match the setting 
297
                    chosen on the remote side. </span></td>
298
                </tr>
299
                <tr> 
300
                  <td width="22%" valign="top" class="vncellreq">Certificate</td>
301
                  <td width="78%" class="vtable"> 
302
                    <textarea name="p1cert" cols="65" rows="7" id="p1cert" class="formpre"><?=htmlspecialchars($pconfig['p1cert']);?></textarea>
303
                    <br> 
304
                    Paste a certificate in X.509 PEM format here.</td>
305
                </tr>
306
                <tr> 
307
                  <td width="22%" valign="top" class="vncellreq">Key</td>
308
                  <td width="78%" class="vtable"> 
309
                    <textarea name="p1privatekey" cols="65" rows="7" id="p1privatekey" class="formpre"><?=htmlspecialchars($pconfig['p1privatekey']);?></textarea>
310
                    <br> 
311
                    Paste an RSA private key in PEM format here.</td>
312
                </tr>
313
                <tr> 
314
                  <td colspan="2" class="list" height="12"></td>
315
                </tr>
316
                <tr> 
317
                  <td colspan="2" valign="top" class="listtopic">Phase 2 proposal 
318
                    (SA/Key Exchange)</td>
319
                </tr>
320
                <tr> 
321
                  <td width="22%" valign="top" class="vncellreq">Protocol</td>
322
                        <td width="78%" class="vtable">
323
					<select name="p2proto" class="formfld">
324
                      <?php foreach ($p2_protos as $proto => $protoname): ?>
325
                      <option value="<?=$proto;?>" <?php if ($proto == $pconfig['p2proto']) echo "selected"; ?>> 
326
                      <?=htmlspecialchars($protoname);?>
327
                      </option>
328
                      <?php endforeach; ?>
329
                    </select> <br> <span class="vexpl">ESP is encryption, AH is 
330
                    authentication only </span></td>
331
                </tr>
332
                <tr> 
333
                  <td width="22%" valign="top" class="vncellreq">Encryption algorithms</td>
334
                        <td width="78%" class="vtable"> 
335
                          <?php foreach ($p2_ealgos as $algo => $algoname): ?>
336
                    <input type="checkbox" name="p2ealgos[]" value="<?=$algo;?>" <?php if (in_array($algo, $pconfig['p2ealgos'])) echo "checked"; ?>> 
337
                    <?=htmlspecialchars($algoname);?>
338
                    <br> 
339
                    <?php endforeach; ?>
340
                    <br>
341
                    Hint: use 3DES for best compatibility or if you have a hardware 
342
                    crypto accelerator card. Blowfish is usually the fastest in 
343
                    software encryption. </td>
344
                </tr>
345
                <tr> 
346
                  <td width="22%" valign="top" class="vncellreq">Hash algorithms</td>
347
                        <td width="78%" class="vtable"> 
348
                          <?php foreach ($p2_halgos as $algo => $algoname): ?>
349
                    <input type="checkbox" name="p2halgos[]" value="<?=$algo;?>" <?php if (in_array($algo, $pconfig['p2halgos'])) echo "checked"; ?>> 
350
                    <?=htmlspecialchars($algoname);?>
351
                    <br> 
352
                    <?php endforeach; ?>
353
                  </td>
354
                </tr>
355
                <tr> 
356
                  <td width="22%" valign="top" class="vncellreq">PFS key group</td>
357
                        <td width="78%" class="vtable">
358
					<select name="p2pfsgroup" class="formfld">
359
                      <?php foreach ($p2_pfskeygroups as $keygroup => $keygroupname): ?>
360
                      <option value="<?=$keygroup;?>" <?php if ($keygroup == $pconfig['p2pfsgroup']) echo "selected"; ?>> 
361
                      <?=htmlspecialchars($keygroupname);?>
362
                      </option>
363
                      <?php endforeach; ?>
364
                    </select> <br> <span class="vexpl"><em>1 = 768 bit, 2 = 1024 
365
                    bit, 5 = 1536 bit</em></span></td>
366
                </tr>
367
                <tr> 
368
                  <td width="22%" valign="top" class="vncell">Lifetime</td>
369
                        <td width="78%" class="vtable"> 
370
                    <input name="p2lifetime" type="text" class="formfld" id="p2lifetime" size="20" value="<?=$pconfig['p2lifetime'];?>">
371
                    seconds</td>
372
                </tr>
373
                <tr> 
374
                  <td width="22%" valign="top">&nbsp;</td>
375
                  <td width="78%"> 
376
                    <input name="Submit" type="submit" class="formbtn" value="Save">
377
                  </td>
378
                </tr>
379
              </table>
380
	  </div>
381
	 </td>
382
	</tr>
383
</table>
384
</form>
385
<script language="JavaScript">
386
<!--
387
methodsel_change();
388
//-->
389
</script>
390
<?php include("fend.inc"); ?>
391
</body>
392
</html>
(124-124/133)