Project

General

Profile

« Previous | Next » 

Revision 9b915686

Added by Ermal LUÇI almost 11 years ago

Use a uniqid() to track phase2 entries to avoid confustion and various mistakes when modifying and editing them.

View differences:

etc/inc/globals.inc
73 73
	"disablecrashreporter" => false,
74 74
	"crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php",
75 75
	"debug" => false,
76
	"latest_config" => "10.9",
76
	"latest_config" => "11.0",
77 77
	"nopkg_platforms" => array("cdrom"),
78 78
	"minimum_ram_warning" => "101",
79 79
	"minimum_ram_warning_text" => "128 MB",
etc/inc/upgrade_config.inc
3360 3360
	}
3361 3361
}
3362 3362

  
3363
function upgrade_109_to_110() {
3364
	global $config;
3365

  
3366
	if (!is_array($config['ipsec']) || !is_array($config['ipsec']['phase2']))
3367
		return;
3368

  
3369
	foreach ($config['ipsec']['phase2'] as &$rule) {
3370
		if (!empty($rule['uniqid']))
3371
			continue;
3372

  
3373
		$rule['uniqid'] = uniqid();
3374
	}
3375
}
3376

  
3363 3377
?>
etc/inc/vpn.inc
504 504
				$ipsecconf .= "config setup\n\tuniqueids = yes\n";
505 505
				$ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n";
506 506

  
507
				foreach ($a_phase2 as $ph2_index => $ph2ent) {
507
				foreach ($a_phase2 as $ph2ent) {
508 508
					$ikeid = $ph2ent['ikeid'];
509 509

  
510 510
					$ph1ent = false;
......
727 727

  
728 728
					$ipsecconf .=<<<EOD
729 729

  
730
conn con{$ph2_index}-{$ph1ent['ikeid']}
730
conn con{$ph1ent['ikeid']}-{$ph2ent['uniqid']}
731 731
	aggressive = {$aggressive}
732 732
	fragmentation = yes
733 733
	keyexchange = {$keyexchange}
usr/local/www/vpn_ipsec.php
93 93

  
94 94
		/* remove the phase1 entry */
95 95
		unset($a_phase1[$_GET['p1index']]);
96
		vpn_ipsec_configure();
97 96
		write_config();
98
		filter_configure();
97
		mark_subsystem_dirty('ipsec');
99 98
		header("Location: vpn_ipsec.php");
100 99
		exit;
101 100
	}
......
105 104
{
106 105
	if ($a_phase1[$_GET['p1index']] && $a_phase2[$_GET['p2index']]) {
107 106
		/* remove the phase2 entry */
108
		unset($a_phase2[$_GET['p2index']]);
109
		vpn_ipsec_configure();
110
		filter_configure();
111
		write_config();
107
		foreach ($a_phase2 as $ph2idx => $ph2) {
108
			if ($ph2['uniqid'] == $_GET['p2index']) {
109
				unset($a_phase2[$ph2idx]);
110
				write_config();
111
				mark_subsystem_dirty('ipsec');
112
				break;
113
			}
114
		}
112 115
		header("Location: vpn_ipsec.php");
113 116
		exit;
114 117
	}
......
289 292
									foreach ($a_phase2 as $ph2ent) {
290 293
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) 
291 294
											continue;
292
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) 
293
											continue;
294 295
										$phase2count++;
295 296
									}
296 297
								?>								
......
312 313
										</a>
313 314
									</td>
314 315
								</tr>
315
								<?php
316
									$j = 0;
317
									foreach ($a_phase2 as $ph2ent) {
318
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) {
319
											$j++;
316
							<?php
317
									foreach ($a_phase2 as $ph2ent):
318
										if ($ph2ent['ikeid'] != $ph1ent['ikeid'])
320 319
											continue;
321
										}
322 320

  
323 321
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) {
324 322
											$spans = "<span class=\"gray\">";
......
326 324
										}
327 325
										else
328 326
											$spans = $spane = "";
329
								?>
330
								<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$j;?>'">
327
							?>
328
								<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid'];?>'">
331 329

  
332 330
									<td class="listlr nowrap">
333 331
										<?=$spans;?>
......
359 357
									<td class="listr">
360 358
										<?=$spans;?>
361 359
										<?php
362
											$k = 0;
363
											foreach ($ph2ent['encryption-algorithm-option'] as $ph2ea) {
364
												if ($k++)
360
											foreach ($ph2ent['encryption-algorithm-option'] as $k => $ph2ea) {
361
												if ($k)
365 362
													echo ", ";
366 363
												echo $p2_ealgos[$ph2ea['name']]['name'];
367 364
												if ($ph2ea['keylen']) {
......
377 374
									<td class="listr nowrap">
378 375
										<?=$spans;?>
379 376
										<?php
380
											$k = 0;
381
											foreach ($ph2ent['hash-algorithm-option'] as $ph2ha) {
382
												if ($k++)
377
											foreach ($ph2ent['hash-algorithm-option'] as $k => $ph2ha) {
378
												if ($k)
383 379
													echo ", ";
384 380
												echo $p2_halgos[$ph2ha];
385 381
											}
......
387 383
										<?=$spane;?>
388 384
									</td>
389 385
									<td class="list nowrap">
390
										<a href="vpn_ipsec_phase2.php?p2index=<?=$j;?>">
386
										<a href="vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid'];?>">
391 387
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase2 entry"); ?>" width="17" height="17" border="0" alt="edit" />
392 388
										</a>
393
										<a href="vpn_ipsec.php?act=delph2&amp;p1index=<?=$i;?>&amp;p2index=<?=$j;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
389
										<a href="vpn_ipsec.php?act=delph2&amp;p1index=<?=$i;?>&amp;p2index=<?=$ph2ent['uniqid'];?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
394 390
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase2 entry"); ?>" width="17" height="17" border="0" alt="delete" />
395 391
										</a>
396
										<a href="vpn_ipsec_phase2.php?dup=<?=$j;?>">
392
										<a href="vpn_ipsec_phase2.php?dup=<?=$ph2ent['uniqid'];?>">
397 393
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new Phase 2 based on this one"); ?>" width="17" height="17" border="0" alt="add" />
398 394
										</a>
399 395
									</td>
400 396
								</tr>
401 397

  
402
								<?php
403
										$j++;
404
									}
405
								?>
398
								<?php endforeach; ?>
399

  
406 400
							</table>
407 401
						</td>
408 402
					</tr>
usr/local/www/vpn_ipsec_phase2.php
51 51

  
52 52
$a_phase2 = &$config['ipsec']['phase2'];
53 53

  
54
if (is_numericint($_GET['p2index']))
55
	$p2index = $_GET['p2index'];
56
if (isset($_POST['p2index']) && is_numericint($_POST['p2index']))
57
	$p2index = $_POST['p2index'];
58

  
59
if (isset($_GET['dup']) && is_numericint($_GET['dup']))
60
	$p2index = $_GET['dup'];
54
if (!empty($_GET['p2index']))
55
	$uindex = $_GET['p2index'];
56
if (!empty($_POST['uniqid']))
57
	$uindex = $_POST['uniqid'];
58

  
59
if (!empty($_GET['dup']))
60
	$uindex = $_GET['dup'];
61

  
62
$ph2found = false;
63
if (isset($uindex)) {
64
	foreach ($a_phase2 as $p2index => $ph2) {
65
		if ($ph2['uniqid'] == $uindex) {
66
			$ph2found = true;
67
			break;
68
		}
69
	}
70
}
61 71

  
62
if (isset($p2index) && $a_phase2[$p2index])
72
if ($ph2found === true)
63 73
{
64
	$pconfig['ikeid'] = $a_phase2[$p2index]['ikeid'];
65
	$pconfig['disabled'] = isset($a_phase2[$p2index]['disabled']);
66
	$pconfig['mode'] = $a_phase2[$p2index]['mode'];
67
	$pconfig['descr'] = $a_phase2[$p2index]['descr'];
68
	$old_ph2ent = $a_phase2[$p2index];
69

  
70
	if (!empty($a_phase2[$p2index]['natlocalid']))
71
		idinfo_to_pconfig("natlocal",$a_phase2[$p2index]['natlocalid'],$pconfig);
72
	idinfo_to_pconfig("local",$a_phase2[$p2index]['localid'],$pconfig);
73
	idinfo_to_pconfig("remote",$a_phase2[$p2index]['remoteid'],$pconfig);
74

  
75
	$pconfig['proto'] = $a_phase2[$p2index]['protocol'];
76
	ealgos_to_pconfig($a_phase2[$p2index]['encryption-algorithm-option'],$pconfig);
77
	$pconfig['halgos'] = $a_phase2[$p2index]['hash-algorithm-option'];
78
	$pconfig['pfsgroup'] = $a_phase2[$p2index]['pfsgroup'];
79
	$pconfig['lifetime'] = $a_phase2[$p2index]['lifetime'];
80
	$pconfig['pinghost'] = $a_phase2[$p2index]['pinghost'];
81

  
82
	if (isset($a_phase2[$p2index]['mobile']))
74
	$pconfig['ikeid'] = $ph2['ikeid'];
75
	$pconfig['disabled'] = isset($ph2['disabled']);
76
	$pconfig['mode'] = $ph2['mode'];
77
	$pconfig['descr'] = $ph2['descr'];
78
	$pconfig['uniqid'] = $ph2['uniqid'];
79

  
80
	if (!empty($ph2['natlocalid']))
81
		idinfo_to_pconfig("natlocal",$ph2['natlocalid'],$pconfig);
82
	idinfo_to_pconfig("local",$ph2['localid'],$pconfig);
83
	idinfo_to_pconfig("remote",$ph2['remoteid'],$pconfig);
84

  
85
	$pconfig['proto'] = $ph2['protocol'];
86
	ealgos_to_pconfig($ph2['encryption-algorithm-option'],$pconfig);
87
	$pconfig['halgos'] = $ph2['hash-algorithm-option'];
88
	$pconfig['pfsgroup'] = $ph2['pfsgroup'];
89
	$pconfig['lifetime'] = $ph2['lifetime'];
90
	$pconfig['pinghost'] = $ph2['pinghost'];
91

  
92
	if (isset($ph2['mobile']))
83 93
		$pconfig['mobile'] = true;
84 94
}
85 95
else
......
94 104
	$pconfig['halgos'] = explode(",", "hmac_sha1,hmac_md5");
95 105
	$pconfig['pfsgroup'] = "0";
96 106
	$pconfig['lifetime'] = "3600";
107
	$pconfig['uniqid'] = uniqid();
97 108

  
98
    /* mobile client */
99
    if($_GET['mobile'])
100
        $pconfig['mobile']=true;
109
	/* mobile client */
110
	if($_GET['mobile'])
111
		$pconfig['mobile']=true;
101 112
}
102 113

  
103
if (isset($_GET['dup']) && is_numericint($_GET['dup']))
114
unset($ph2);
115
if (!empty($_GET['dup'])) {
116
	unset($uindex);
104 117
	unset($p2index);
118
	$pconfig['uniqid'] = uniqid();
119
}
105 120

  
106 121
if ($_POST) {
107 122

  
......
112 127
		$input_errors[] = gettext("A valid ikeid must be specified.");
113 128

  
114 129
	/* input validation */
115
	$reqdfields = explode(" ", "localid_type halgos");
116
	$reqdfieldsn = array(gettext("Local network type"),gettext("P2 Hash Algorithms"));
130
	$reqdfields = explode(" ", "localid_type halgos uniqid");
131
	$reqdfieldsn = array(gettext("Local network type"),gettext("P2 Hash Algorithms"), gettext("Unique Identifier"));
117 132
	if (!isset($pconfig['mobile'])){
118 133
		$reqdfields[] = "remoteid_type";
119 134
		$reqdfieldsn[] = gettext("Remote network type");
......
191 206
	if (isset($pconfig['mobile'])){
192 207
		/* User is adding phase 2 for mobile phase1 */
193 208
		foreach($a_phase2 as $key => $name){
194
			if (isset($name['mobile'])){
209
			if (isset($name['mobile']) && $name['uniqid'] != $pconfig['uniqid']) {
195 210
				/* check duplicate localids only for mobile clents */
196 211
				$localid_data = ipsec_idinfo_to_cidr($name['localid'], false, $name['mode']);
197 212
				$entered = array();
......
200 215
				if (isset($pconfig['localid_netbits'])) $entered['netbits'] = $pconfig['localid_netbits'];
201 216
				$entered_localid_data = ipsec_idinfo_to_cidr($entered, false, $pconfig['mode']);
202 217
				if ($localid_data == $entered_localid_data){
203
					if (!isset($pconfig['p2index'])){
204
						/* adding new p2 entry */
205
						$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
206
						break;
207
					}else if ($pconfig['p2index'] != $key){
208
						/* editing p2 and entered p2 networks match with different p2 for given p1 */
209
						$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
210
						break;
211
					}
218
					/* adding new p2 entry */
219
					$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
220
					break;
212 221
				}
213 222
			}
214 223
		}
......
216 225
		/* User is adding phase 2 for site-to-site phase1 */
217 226
		$input_error = 0;
218 227
		foreach($a_phase2 as $key => $name){
219
			if (!isset($name['mobile']) && $pconfig['ikeid'] == $name['ikeid']){
228
			if (!isset($name['mobile']) && $pconfig['ikeid'] == $name['ikeid'] && $pconfig['uniqid'] != $name['uniqid']) {
220 229
				/* check duplicate subnets only for given phase1 */
221 230
				$localid_data = ipsec_idinfo_to_cidr($name['localid'], false, $name['mode']);
222 231
				$remoteid_data = ipsec_idinfo_to_cidr($name['remoteid'], false, $name['mode']);
......
231 240
				if (isset($pconfig['remoteid_netbits'])) $entered_remote['netbits'] = $pconfig['remoteid_netbits'];
232 241
				$entered_remoteid_data = ipsec_idinfo_to_cidr($entered_remote, false, $pconfig['mode']);
233 242
				if ($localid_data == $entered_localid_data && $remoteid_data == $entered_remoteid_data) { 
234
					if (!isset($pconfig['p2index'])){
235
						/* adding new p2 entry */
236
						$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1.");
237
						break;
238
					}else if ($pconfig['p2index'] != $key){
239
						/* editing p2 and entered p2 networks match with different p2 for given p1 */
240
						$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1.");
241
						break;
242
					}
243
					/* adding new p2 entry */
244
					$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1.");
245
					break;
243 246
				}
244 247
			}
245 248
		}
......
259 262

  
260 263
	if (!$input_errors) {
261 264

  
265
		$ph2ent = array();
262 266
		$ph2ent['ikeid'] = $pconfig['ikeid'];
267
		$ph2ent['uniqid'] = $pconfig['uniqid'];
263 268
		$ph2ent['mode'] = $pconfig['mode'];
264 269
		$ph2ent['disabled'] = $pconfig['disabled'] ? true : false;
265 270

  
......
281 286
		if (isset($pconfig['mobile']))
282 287
			$ph2ent['mobile'] = true;
283 288

  
284
		ipsec_lookup_phase1($ph2ent, $ph1ent);
285
		if (($ph1ent['protocol'] == "inet") && ($ph2ent['mode'] == "tunnel6"))
286
			$input_errors[] = gettext("Phase 1 is using IPv4. You cannot use Tunnel IPv6 on Phase 2.");
287
		if (($ph1ent['protocol'] == "inet6") && ($ph2ent['mode'] == "tunnel"))
288
			$input_errors[] = gettext("Phase 1 is using IPv6. You cannot use Tunnel IPv4 on Phase 2.");
289
	}
290

  
291
	if (!$input_errors) {
292
		if (isset($p2index) && $a_phase2[$p2index])
289
		if ($ph2found === true && $a_phase2[$p2index])
293 290
			$a_phase2[$p2index] = $ph2ent;
294 291
		else
295 292
			$a_phase2[] = $ph2ent;
296 293

  
297 294

  
298
		/* now we need to find all phase2 entries for this host */
299
		if(is_array($ph2ent)) {
300
			ipsec_lookup_phase1($ph2ent, $ph1ent);
301
			$old_ph1ent = $ph1ent;
302
			$old_ph1ent['remote-gateway'] = resolve_retry($old_ph1ent['remote-gateway']);
303
		}
304

  
305 295
		write_config();
306 296
		mark_subsystem_dirty('ipsec');
307 297

  
......
780 770
					<tr>
781 771
						<td width="22%" valign="top">&nbsp;</td>
782 772
						<td width="78%">
783
						<?php if (isset($p2index) && $a_phase2[$p2index]): ?>
784
							<input name="p2index" type="hidden" value="<?=htmlspecialchars($p2index);?>" />
785
						<?php endif; ?>
786 773
						<?php if ($pconfig['mobile']): ?>
787 774
							<input name="mobile" type="hidden" value="true" />
788 775
							<input name="remoteid_type" type="hidden" value="mobile" />
789 776
						<?php endif; ?>
790 777
							<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />
791 778
							<input name="ikeid" type="hidden" value="<?=htmlspecialchars($pconfig['ikeid']);?>" />
779
							<input name="uniqid" type="hidden" value="<?=htmlspecialchars($pconfig['uniqid']);?>" />
792 780
						</td>
793 781
					</tr>
794 782
				</table>
......
817 805
/* local utility functions */
818 806

  
819 807
function pconfig_to_ealgos(& $pconfig) {
820

  
821 808
	global $p2_ealgos;
822 809

  
823 810
	$ealgos = array();

Also available in: Unified diff