Project

General

Profile

Download (14.9 KB) Statistics
| Branch: | Tag: | Revision:
1 5b237745 Scott Ullrich
#!/usr/local/bin/php
2 e2411886 Scott Ullrich
<?php 
3 5b237745 Scott Ullrich
/*
4
	vpn_openvpn.php
5
6
	Copyright (C) 2004 Peter Curran (peter@closeconsultants.com).
7
	All rights reserved.
8 e2411886 Scott Ullrich
	
9 5b237745 Scott Ullrich
	Redistribution and use in source and binary forms, with or without
10
	modification, are permitted provided that the following conditions are met:
11 e2411886 Scott Ullrich
	
12 5b237745 Scott Ullrich
	1. Redistributions of source code must retain the above copyright notice,
13
	   this list of conditions and the following disclaimer.
14 e2411886 Scott Ullrich
	
15 5b237745 Scott Ullrich
	2. Redistributions in binary form must reproduce the above copyright
16
	   notice, this list of conditions and the following disclaimer in the
17
	   documentation and/or other materials provided with the distribution.
18 e2411886 Scott Ullrich
	
19 5b237745 Scott Ullrich
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
20
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
21
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
23
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28
	POSSIBILITY OF SUCH DAMAGE.
29
*/
30
31 d797cd0c Scott Ullrich
$pgtitle = "VPN: OpenVPN";
32 5b237745 Scott Ullrich
require("guiconfig.inc");
33
require_once("openvpn.inc");
34
35
if (!is_array($config['ovpn']))
36
	$config['ovpn'] = array();
37
if (!is_array($config['ovpn']['server'])){
38
	$config['ovpn']['server'] =  array();
39
	$config['ovpn']['server']['tun_iface'] = "tun0";
40
	$config['ovpn']['server']['psh_options'] = array();
41
	/* Initialise with some sensible defaults */
42
	$config['ovpn']['server']['port'] = 5000;
43
	$config['ovpn']['server']['proto'] = 'UDP';
44
	$config['ovpn']['server']['maxcli'] = 25;
45
	$config['ovpn']['server']['crypto'] = 'BF-CBC';
46
	$config['ovpn']['server']['dupcn'] = true;
47
	$config['ovpn']['server']['verb'] = 1;
48
}
49
50
if ($_POST) {
51
52
	unset($input_errors);
53
54
	/* input validation */
55
	if ($_POST['enable']) {
56
		$reqdfields = explode(" ", "tun_iface bind_iface ipblock");
57
		$reqdfieldsn = explode(",", "Tunnel type,Interface binding,IP address block start");
58
59
		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
60
61
	}
62 e2411886 Scott Ullrich
	
63 5b237745 Scott Ullrich
	/* need a test here to make sure prefix and max_clients are coherent */
64 e2411886 Scott Ullrich
	
65 5b237745 Scott Ullrich
	/* Sort out the cert+key files */
66
	if (is_null($_POST['ca_cert']))
67
		$input_errors[] = "You must provide a CA certificate file";
68
	elseif (!strstr($_POST['ca_cert'], "BEGIN CERTIFICATE") || !strstr($_POST['ca_cert'], "END CERTIFICATE"))
69
		$input_errors[] = "The CA certificate does not appear to be valid.";
70 e2411886 Scott Ullrich
		
71 5b237745 Scott Ullrich
	if (is_null($_POST['srv_cert']))
72
		$input_errors[] = "You must provide a server certificate file";
73
	elseif (!strstr($_POST['srv_cert'], "BEGIN CERTIFICATE") || !strstr($_POST['srv_cert'], "END CERTIFICATE"))
74
		$input_errors[] = "The server certificate does not appear to be valid.";
75 e2411886 Scott Ullrich
		
76 5b237745 Scott Ullrich
	if (is_null($_POST['srv_key']))
77
		$input_errors[] = "You must provide a server key file";
78
	elseif (!strstr($_POST['srv_key'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['srv_key'], "END RSA PRIVATE KEY"))
79
		$input_errors[] = "The server key does not appear to be valid.";
80 e2411886 Scott Ullrich
		
81 5b237745 Scott Ullrich
	if (is_null($_POST['dh_param']))
82
		$input_errors[] = "You must provide a DH parameters file";
83
	elseif (!strstr($_POST['dh_param'], "BEGIN DH PARAMETERS") || !strstr($_POST['dh_param'], "END DH PARAMETERS"))
84
		$input_errors[] = "The DH parameters do not appear to be valid.";
85 e2411886 Scott Ullrich
				
86 5b237745 Scott Ullrich
	if (!$input_errors) {
87
		$server =& $config['ovpn']['server'];
88
		$server['enable'] = $_POST['enable'] ? true : false;
89 e2411886 Scott Ullrich
		
90 5b237745 Scott Ullrich
		/* Make sure that the tunnel interface type has not changed */
91 e2411886 Scott Ullrich
		if ($server['tun_iface'] != $_POST['tun_iface']){ 
92 5b237745 Scott Ullrich
			$server['tun_iface'] = $_POST['tun_iface'];
93
			touch($d_sysrebootreqd_path);
94
		}
95 e2411886 Scott Ullrich
		
96 5b237745 Scott Ullrich
		$server['bind_iface'] = $_POST['bind_iface'];
97
		$server['port'] = $_POST['port'];
98
		$server['proto'] = $_POST['proto'];
99 e2411886 Scott Ullrich
		
100 5b237745 Scott Ullrich
		/* Make sure the IP address and/or prefix have not changed */
101
		if ($server['ipblock'] != $_POST['ipblock']){
102
			$server['ipblock'] = $_POST['ipblock'];
103
			touch($d_sysrebootreqd_path);
104
		}
105
		if ($server['prefix'] != $_POST['prefix']){
106
			$server['prefix'] = $_POST['prefix'];
107
			touch($d_sysrebootreqd_path);
108
		}
109 e2411886 Scott Ullrich
		
110 5b237745 Scott Ullrich
		$server['maxcli'] = $_POST['maxcli'];
111
		$server['crypto'] = $_POST['crypto'];
112
		$server['cli2cli'] = $_POST['cli2cli'] ? true : false;
113
		$server['dupcn'] = $_POST['dupcn'] ? true : false;
114
		$server['psh_options']['redir'] = $_POST['psh_redir'] ? true : false;
115
		$server['psh_options']['redir_loc'] = $_POST['psh_redir_loc'] ? true : false;
116
		if ($_POST['psh_rtedelay'])
117
			$server['psh_options']['rtedelay'] = $_POST['psh_rtedelay_int'];
118
		if ($_POST['psh_ping'])
119
			$server['psh_options']['ping'] = $_POST['psh_ping_int'];
120
		if ($_POST['psh_pingexit'])
121
			$server['psh_options']['pingexit'] = $_POST['psh_pingexit_int'];
122
		if ($_POST['psh_pingrst'])
123
			$server['psh_options']['pingrst'] = $_POST['psh_pingrst_int'];
124
		if ($_POST['inact'])
125
			$server['psh_options']['inact'] = $_POST['psh_inact_int'];
126
		$server['ca_cert'] = base64_encode($_POST['ca_cert']);
127
		$server['srv_cert'] = base64_encode($_POST['srv_cert']);
128
		$server['srv_key'] = base64_encode($_POST['srv_key']);
129 e2411886 Scott Ullrich
		$server['dh_param'] = base64_encode($_POST['dh_param']);	
130
			
131 5b237745 Scott Ullrich
		write_config();
132
133
		$retval = 0;
134
		if (file_exists($d_sysrebootreqd_path)) {
135
			/* Rewrite interface definitions */
136
			$retval = ovpn_server_iface();
137
		}
138
		else{
139
			ovpn_lock();
140
			$retval = ovpn_config_server();
141
			ovpn_unlock();
142
		}
143
		$savemsg = get_std_save_message($retval);
144
	}
145
}
146
147
/* Simply take a copy of the array */
148
$pconfig = $config['ovpn']['server'];
149
150 4df96eff Scott Ullrich
$pgtitle = "Firewall: NAT: Inbound";
151
include("head.inc");
152
153 5b237745 Scott Ullrich
?>
154 422f27c0 Scott Ullrich
155
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
156 5b237745 Scott Ullrich
<?php include("fbegin.inc"); ?>
157 4b8fffef Scott Ullrich
<p class="pgtitle"><?php echo $pgtitle; ?></p>
158 5b237745 Scott Ullrich
<?php if ($input_errors) print_input_errors($input_errors); ?>
159
<?php if (file_exists($d_sysrebootreqd_path)) print_info_box(get_std_save_message(0)); ?>
160
161
<form action="vpn_openvpn.php" method="post" enctype="multipart/form-data" name="iform" id="iform">
162
<table width="100%" border="0" cellpadding="0" cellspacing="0">
163
  <tr><td>
164 e2411886 Scott Ullrich
  <ul id="tabnav">	        
165 5b237745 Scott Ullrich
	<li class="tabact">Server</li>
166
	<li class="tabinact"><a href="vpn_openvpn_cli.php">Client</a></li>
167
  </ul>
168
  </td></tr>
169
  <tr>
170
  <td class="tabcont">
171
    <strong><span class="red">WARNING: This feature is experimental and modifies your optional interface configuration.
172
  Backup your configuration before using OpenVPN, and restore it before upgrading.<br>
173
&nbsp;  <br>
174
    </span></strong><table width="100%" border="0" cellpadding="6" cellspacing="0">
175
  <tr>
176
    <td width="22%" valign="top" class="vtable">&nbsp;</td>
177
    <td width="78%" class="vtable">
178
      <input name="enable" type="checkbox" value="yes" <?php if (isset($pconfig['enable'])) echo "checked"; ?>>
179
      <strong>Enable OpenVPN server </strong></td>
180
   </tr>
181 e2411886 Scott Ullrich
   
182 5b237745 Scott Ullrich
   <tr>
183
     <td width="22%" valign="top" class="vncellreq">Tunnel type</td>
184
     <td width="78%" class="vtable">
185
       <input type="radio" name="tun_iface" class="formfld" value="tun0" <?php if ($pconfig['tun_iface'] == 'tun0') echo "checked"; ?>>
186
          TUN&nbsp;
187
       <input type="radio" name="tun_iface" class="formfld" value="tap0" <?php if ($pconfig['tun_iface'] == 'tap0') echo "checked"; ?>>
188
          TAP
189
      </td>
190
    </tr>
191 e2411886 Scott Ullrich
    
192 5b237745 Scott Ullrich
    <tr>
193
      <td width="22%" valign="top" class="vncell">OpenVPN protocol/port</td>
194
      <td width="78%" class="vtable">
195
	<input type="radio" name="proto" class="formfld" value="UDP" <?php if ($pconfig['proto'] == 'UDP') echo "checked"; ?>>
196
           UDP&nbsp;
197
        <input type="radio" name="proto" class="formfld" value="TCP" <?php if ($pconfig['proto'] == 'TCP') echo "checked"; ?>>
198
           TCP<br><br>
199 e2411886 Scott Ullrich
        Port: 
200 5b237745 Scott Ullrich
        <input name="port" type="text" class="formfld" size="5" maxlength="5" value="<?= $pconfig['port']; ?>"><br>
201
        Enter the port number to use for the server (default is 5000).</td>
202
    </tr>
203 e2411886 Scott Ullrich
    
204 5b237745 Scott Ullrich
    <tr>
205
      <td width="22%" valign="top" class="vncellreq">Interface binding</td>
206
      <td width="78%" class="vtable">
207
	<select name="bind_iface" class="formfld">
208 e2411886 Scott Ullrich
        <?php 
209 5b237745 Scott Ullrich
	$interfaces = ovpn_real_interface_list();
210
	foreach ($interfaces as $key => $iface):
211
        ?>
212
	<option value="<?=$key;?>" <?php if ($key == $pconfig['bind_iface']) echo "selected"; ?>> <?= $iface;?>
213
        </option>
214
        <?php endforeach;?>
215
        </select>
216
        <span class="vexpl"><br>
217
        Choose an interface for the OpenVPN server to listen on.</span></td>
218
    </tr>
219 e2411886 Scott Ullrich
		
220
    <tr> 
221 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">IP address block</td>
222 e2411886 Scott Ullrich
      <td width="78%" class="vtable"> 
223 5b237745 Scott Ullrich
        <input name="ipblock" type="text" class="formfld" size="20" value="<?=htmlspecialchars($pconfig['ipblock']);?>">
224 e2411886 Scott Ullrich
        / 
225 5b237745 Scott Ullrich
        <select name="prefix" class="formfld">
226
          <?php for ($i = 29; $i > 19; $i--): ?>
227
          <option value="<?=$i;?>" <?php if ($i == $pconfig['prefix']) echo "selected"; ?>>
228
            <?=$i;?>
229
          </option>
230
          <?php endfor; ?>
231
        </select>
232
        <br>
233
        Enter the IP address block for the OpenVPN server and clients to use.<br>
234
        <br>
235 e2411886 Scott Ullrich
	Maximum number of simultaneous clients: 
236 5b237745 Scott Ullrich
	<input name="maxcli" type="text" class="formfld" size="3" maxlength="3" value="<?=htmlspecialchars($pconfig['maxcli']);?>">
237
	</td>
238
    </tr>
239 e2411886 Scott Ullrich
    
240
    <tr> 
241 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">CA certificate</td>
242 e2411886 Scott Ullrich
      <td width="78%" class="vtable"> 
243 5b237745 Scott Ullrich
      <textarea name="ca_cert" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['ca_cert']));?></textarea>
244
      <br>
245 e2411886 Scott Ullrich
      Paste a CA certificate in X.509 PEM format here.</td>
246 5b237745 Scott Ullrich
    </tr>
247 e2411886 Scott Ullrich
		
248
    <tr> 
249 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">Server certificate</td>
250
      <td width="78%" class="vtable">
251
        <textarea name="srv_cert" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['srv_cert']));?></textarea>
252
        <br>
253
        Paste a server certificate in X.509 PEM format here.</td>
254
     </tr>
255 e2411886 Scott Ullrich
     
256
     <tr> 
257 5b237745 Scott Ullrich
       <td width="22%" valign="top" class="vncellreq">Server key</td>
258 e2411886 Scott Ullrich
       <td width="78%" class="vtable"> 
259 5b237745 Scott Ullrich
         <textarea name="srv_key" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['srv_key']));?></textarea>
260
         <br>Paste the server RSA private key here.</td>
261
      </tr>
262 e2411886 Scott Ullrich
      
263
      <tr> 
264 5b237745 Scott Ullrich
        <td width="22%" valign="top" class="vncellreq">DH parameters</td>
265 e2411886 Scott Ullrich
        <td width="78%" class="vtable"> 
266 5b237745 Scott Ullrich
	  <textarea name="dh_param" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['dh_param']));?></textarea>
267 e2411886 Scott Ullrich
          <br>          
268 5b237745 Scott Ullrich
          Paste the Diffie-Hellman parameters in PEM format here.</td>
269
      </tr>
270 e2411886 Scott Ullrich
      
271 5b237745 Scott Ullrich
      <tr>
272
        <td width="22%" valign="top" class="vncell">Crypto</td>
273
        <td width="78%" class="vtable">
274
          <select name="crypto" class="formfld">
275
	    <?php $cipher_list = ovpn_get_cipher_list();
276
	    foreach($cipher_list as $key => $value){
277
	    ?>
278
	      <option value="<?= $key ?>" <?php if ($pconfig['crypto'] == $key) echo "selected"; ?>>
279
	        <?= $value ?>
280
	      </option>
281
	    <?php
282
	    }
283
	    ?>
284
	  </select>
285
	  <br>
286
	  Select a data channel encryption cipher.</td>
287
      </tr>
288 e2411886 Scott Ullrich
      
289 5b237745 Scott Ullrich
      <tr>
290
        <td width="22%" valign="top" class="vncell">Internal routing mode</td>
291
        <td width="78%" class="vtable">
292
	  <input name="cli2cli" type="checkbox" value="yes" <?php if (isset($pconfig['cli2cli'])) echo "checked"; ?>>
293
          <strong>Enable client-to-client routing</strong><br>
294
          If this option is on,  clients are allowed to talk to each other.</td>
295
      </tr>
296 e2411886 Scott Ullrich
      
297 5b237745 Scott Ullrich
      <tr>
298
        <td width="22%" valign="top" class="vncell">Client authentication</td>
299
        <td width="78%" class="vtable">
300
	  <input name="dupcn" type="checkbox" value="yes" <?php if (isset($pconfig['dupcn'])) echo "checked"; ?>>
301
          <strong>Permit duplicate client certificates</strong><br>
302
	  If this option is on, clients with duplicate certificates will not be disconnected.</td>
303
      </tr>
304 e2411886 Scott Ullrich
	 
305 5b237745 Scott Ullrich
      <tr>
306
        <td width="22%" valign="top" class="vncell">Client-push options</td>
307
        <td width="78%" class="vtable">
308
	      <table border="0" cellspacing="0" cellpadding="0">
309
	        <tr>
310
              <td><input type="checkbox" name="psh_redir" value="yes" <?php if (isset($pconfig['psh_options']['redir'])) echo "checked"; ?>>
311
              Redirect-gateway</td>
312
              <td>&nbsp;</td>
313
              <td><input type="checkbox" name="psh_redir_loc" value="yes" <?php if (isset($pconfig['psh_options']['redir_loc'])) echo "checked"; ?>>
314
                Local</td>
315
	          </tr>
316
            <tr>
317
              <td><input type="checkbox" name="psh_rtedelay" value="yes" <?php if (isset($pconfig['psh_options']['rtedelay'])) echo "checked"; ?>> Route-delay</td>
318
              <td width="16">&nbsp;</td>
319
              <td><input type="text" name="psh_rtedelay_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['rtedelay']?>"> seconds</td>
320
            </tr>
321
            <tr>
322
              <td><input type="checkbox" name="psh_inact" value="yes" <?php if (isset($pconfig['psh_options']['inact'])) echo "checked"; ?>>
323
    Inactive</td>
324
              <td>&nbsp;</td>
325
              <td><input type="text" name="psh_inact_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['inact']?>">
326
    seconds</td>
327
            </tr>
328
            <tr>
329
              <td><input type="checkbox" name="psh_ping" value="yes" <?php if (isset($pconfig['psh_options']['ping'])) echo "checked"; ?>> Ping</td>
330
              <td>&nbsp;</td>
331
              <td>Interval: <input type="text" name="psh_ping_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['ping']?>"> seconds</td>
332
            </tr>
333
            <tr>
334
              <td><input type="checkbox" name="psh_pingexit" value="yes" <?php if (isset($pconfig['psh_options']['pingexit'])) echo "checked"; ?>> Ping-exit</td>
335
              <td>&nbsp;</td>
336
              <td>Interval: <input type="text" name="psh_pingexit_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['pingexit']?>"> seconds</td>
337
            </tr>
338
            <tr>
339
              <td><input type="checkbox" name="psh_pingrst" value="yes" <?php if (isset($pconfig['psh_options']['pingrst'])) echo "checked"; ?>> Ping-restart</td>
340
              <td>&nbsp;</td>
341
              <td>Interval: <input type="text" name="psh_pingrst_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['pingrst']?>"> seconds</td>
342
            </tr>
343
          </table></td>
344
      </tr>
345
      <tr>
346
        <td width="22%" valign="top">&nbsp;</td>
347
        <td width="78%">
348
          <input name="Submit" type="submit" class="formbtn" value="Save">
349
        </td>
350
      </tr>
351
      <tr>
352
        <td width="22%" valign="top">&nbsp;</td>
353
        <td width="78%"><span class="vexpl"><span class="red"><strong>Note:<br>
354
          </strong></span>Changing any settings on this page will disconnect all clients!</span>
355
	</td>
356
      </tr>
357
    </table>  </td>
358
</tr>
359
</table>
360
</form>
361
<?php include("fend.inc"); ?>