Revision 9b915686
Added by Ermal LUÇI almost 11 years ago
etc/inc/globals.inc | ||
---|---|---|
73 | 73 |
"disablecrashreporter" => false, |
74 | 74 |
"crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php", |
75 | 75 |
"debug" => false, |
76 |
"latest_config" => "10.9",
|
|
76 |
"latest_config" => "11.0",
|
|
77 | 77 |
"nopkg_platforms" => array("cdrom"), |
78 | 78 |
"minimum_ram_warning" => "101", |
79 | 79 |
"minimum_ram_warning_text" => "128 MB", |
etc/inc/upgrade_config.inc | ||
---|---|---|
3360 | 3360 |
} |
3361 | 3361 |
} |
3362 | 3362 |
|
3363 |
function upgrade_109_to_110() { |
|
3364 |
global $config; |
|
3365 |
|
|
3366 |
if (!is_array($config['ipsec']) || !is_array($config['ipsec']['phase2'])) |
|
3367 |
return; |
|
3368 |
|
|
3369 |
foreach ($config['ipsec']['phase2'] as &$rule) { |
|
3370 |
if (!empty($rule['uniqid'])) |
|
3371 |
continue; |
|
3372 |
|
|
3373 |
$rule['uniqid'] = uniqid(); |
|
3374 |
} |
|
3375 |
} |
|
3376 |
|
|
3363 | 3377 |
?> |
etc/inc/vpn.inc | ||
---|---|---|
504 | 504 |
$ipsecconf .= "config setup\n\tuniqueids = yes\n"; |
505 | 505 |
$ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n"; |
506 | 506 |
|
507 |
foreach ($a_phase2 as $ph2_index => $ph2ent) {
|
|
507 |
foreach ($a_phase2 as $ph2ent) { |
|
508 | 508 |
$ikeid = $ph2ent['ikeid']; |
509 | 509 |
|
510 | 510 |
$ph1ent = false; |
... | ... | |
727 | 727 |
|
728 | 728 |
$ipsecconf .=<<<EOD |
729 | 729 |
|
730 |
conn con{$ph2_index}-{$ph1ent['ikeid']}
|
|
730 |
conn con{$ph1ent['ikeid']}-{$ph2ent['uniqid']}
|
|
731 | 731 |
aggressive = {$aggressive} |
732 | 732 |
fragmentation = yes |
733 | 733 |
keyexchange = {$keyexchange} |
usr/local/www/vpn_ipsec.php | ||
---|---|---|
93 | 93 |
|
94 | 94 |
/* remove the phase1 entry */ |
95 | 95 |
unset($a_phase1[$_GET['p1index']]); |
96 |
vpn_ipsec_configure(); |
|
97 | 96 |
write_config(); |
98 |
filter_configure();
|
|
97 |
mark_subsystem_dirty('ipsec');
|
|
99 | 98 |
header("Location: vpn_ipsec.php"); |
100 | 99 |
exit; |
101 | 100 |
} |
... | ... | |
105 | 104 |
{ |
106 | 105 |
if ($a_phase1[$_GET['p1index']] && $a_phase2[$_GET['p2index']]) { |
107 | 106 |
/* remove the phase2 entry */ |
108 |
unset($a_phase2[$_GET['p2index']]); |
|
109 |
vpn_ipsec_configure(); |
|
110 |
filter_configure(); |
|
111 |
write_config(); |
|
107 |
foreach ($a_phase2 as $ph2idx => $ph2) { |
|
108 |
if ($ph2['uniqid'] == $_GET['p2index']) { |
|
109 |
unset($a_phase2[$ph2idx]); |
|
110 |
write_config(); |
|
111 |
mark_subsystem_dirty('ipsec'); |
|
112 |
break; |
|
113 |
} |
|
114 |
} |
|
112 | 115 |
header("Location: vpn_ipsec.php"); |
113 | 116 |
exit; |
114 | 117 |
} |
... | ... | |
289 | 292 |
foreach ($a_phase2 as $ph2ent) { |
290 | 293 |
if ($ph2ent['ikeid'] != $ph1ent['ikeid']) |
291 | 294 |
continue; |
292 |
if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) |
|
293 |
continue; |
|
294 | 295 |
$phase2count++; |
295 | 296 |
} |
296 | 297 |
?> |
... | ... | |
312 | 313 |
</a> |
313 | 314 |
</td> |
314 | 315 |
</tr> |
315 |
<?php |
|
316 |
$j = 0; |
|
317 |
foreach ($a_phase2 as $ph2ent) { |
|
318 |
if ($ph2ent['ikeid'] != $ph1ent['ikeid']) { |
|
319 |
$j++; |
|
316 |
<?php |
|
317 |
foreach ($a_phase2 as $ph2ent): |
|
318 |
if ($ph2ent['ikeid'] != $ph1ent['ikeid']) |
|
320 | 319 |
continue; |
321 |
} |
|
322 | 320 |
|
323 | 321 |
if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) { |
324 | 322 |
$spans = "<span class=\"gray\">"; |
... | ... | |
326 | 324 |
} |
327 | 325 |
else |
328 | 326 |
$spans = $spane = ""; |
329 |
?>
|
|
330 |
<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$j;?>'">
|
|
327 |
?> |
|
328 |
<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid'];?>'">
|
|
331 | 329 |
|
332 | 330 |
<td class="listlr nowrap"> |
333 | 331 |
<?=$spans;?> |
... | ... | |
359 | 357 |
<td class="listr"> |
360 | 358 |
<?=$spans;?> |
361 | 359 |
<?php |
362 |
$k = 0; |
|
363 |
foreach ($ph2ent['encryption-algorithm-option'] as $ph2ea) { |
|
364 |
if ($k++) |
|
360 |
foreach ($ph2ent['encryption-algorithm-option'] as $k => $ph2ea) { |
|
361 |
if ($k) |
|
365 | 362 |
echo ", "; |
366 | 363 |
echo $p2_ealgos[$ph2ea['name']]['name']; |
367 | 364 |
if ($ph2ea['keylen']) { |
... | ... | |
377 | 374 |
<td class="listr nowrap"> |
378 | 375 |
<?=$spans;?> |
379 | 376 |
<?php |
380 |
$k = 0; |
|
381 |
foreach ($ph2ent['hash-algorithm-option'] as $ph2ha) { |
|
382 |
if ($k++) |
|
377 |
foreach ($ph2ent['hash-algorithm-option'] as $k => $ph2ha) { |
|
378 |
if ($k) |
|
383 | 379 |
echo ", "; |
384 | 380 |
echo $p2_halgos[$ph2ha]; |
385 | 381 |
} |
... | ... | |
387 | 383 |
<?=$spane;?> |
388 | 384 |
</td> |
389 | 385 |
<td class="list nowrap"> |
390 |
<a href="vpn_ipsec_phase2.php?p2index=<?=$j;?>">
|
|
386 |
<a href="vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid'];?>">
|
|
391 | 387 |
<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase2 entry"); ?>" width="17" height="17" border="0" alt="edit" /> |
392 | 388 |
</a> |
393 |
<a href="vpn_ipsec.php?act=delph2&p1index=<?=$i;?>&p2index=<?=$j;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
|
|
389 |
<a href="vpn_ipsec.php?act=delph2&p1index=<?=$i;?>&p2index=<?=$ph2ent['uniqid'];?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
|
|
394 | 390 |
<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase2 entry"); ?>" width="17" height="17" border="0" alt="delete" /> |
395 | 391 |
</a> |
396 |
<a href="vpn_ipsec_phase2.php?dup=<?=$j;?>">
|
|
392 |
<a href="vpn_ipsec_phase2.php?dup=<?=$ph2ent['uniqid'];?>">
|
|
397 | 393 |
<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new Phase 2 based on this one"); ?>" width="17" height="17" border="0" alt="add" /> |
398 | 394 |
</a> |
399 | 395 |
</td> |
400 | 396 |
</tr> |
401 | 397 |
|
402 |
<?php |
|
403 |
$j++; |
|
404 |
} |
|
405 |
?> |
|
398 |
<?php endforeach; ?> |
|
399 |
|
|
406 | 400 |
</table> |
407 | 401 |
</td> |
408 | 402 |
</tr> |
usr/local/www/vpn_ipsec_phase2.php | ||
---|---|---|
51 | 51 |
|
52 | 52 |
$a_phase2 = &$config['ipsec']['phase2']; |
53 | 53 |
|
54 |
if (is_numericint($_GET['p2index'])) |
|
55 |
$p2index = $_GET['p2index']; |
|
56 |
if (isset($_POST['p2index']) && is_numericint($_POST['p2index'])) |
|
57 |
$p2index = $_POST['p2index']; |
|
58 |
|
|
59 |
if (isset($_GET['dup']) && is_numericint($_GET['dup'])) |
|
60 |
$p2index = $_GET['dup']; |
|
54 |
if (!empty($_GET['p2index'])) |
|
55 |
$uindex = $_GET['p2index']; |
|
56 |
if (!empty($_POST['uniqid'])) |
|
57 |
$uindex = $_POST['uniqid']; |
|
58 |
|
|
59 |
if (!empty($_GET['dup'])) |
|
60 |
$uindex = $_GET['dup']; |
|
61 |
|
|
62 |
$ph2found = false; |
|
63 |
if (isset($uindex)) { |
|
64 |
foreach ($a_phase2 as $p2index => $ph2) { |
|
65 |
if ($ph2['uniqid'] == $uindex) { |
|
66 |
$ph2found = true; |
|
67 |
break; |
|
68 |
} |
|
69 |
} |
|
70 |
} |
|
61 | 71 |
|
62 |
if (isset($p2index) && $a_phase2[$p2index])
|
|
72 |
if ($ph2found === true)
|
|
63 | 73 |
{ |
64 |
$pconfig['ikeid'] = $a_phase2[$p2index]['ikeid'];
|
|
65 |
$pconfig['disabled'] = isset($a_phase2[$p2index]['disabled']);
|
|
66 |
$pconfig['mode'] = $a_phase2[$p2index]['mode'];
|
|
67 |
$pconfig['descr'] = $a_phase2[$p2index]['descr'];
|
|
68 |
$old_ph2ent = $a_phase2[$p2index];
|
|
69 |
|
|
70 |
if (!empty($a_phase2[$p2index]['natlocalid']))
|
|
71 |
idinfo_to_pconfig("natlocal",$a_phase2[$p2index]['natlocalid'],$pconfig);
|
|
72 |
idinfo_to_pconfig("local",$a_phase2[$p2index]['localid'],$pconfig);
|
|
73 |
idinfo_to_pconfig("remote",$a_phase2[$p2index]['remoteid'],$pconfig);
|
|
74 |
|
|
75 |
$pconfig['proto'] = $a_phase2[$p2index]['protocol'];
|
|
76 |
ealgos_to_pconfig($a_phase2[$p2index]['encryption-algorithm-option'],$pconfig);
|
|
77 |
$pconfig['halgos'] = $a_phase2[$p2index]['hash-algorithm-option'];
|
|
78 |
$pconfig['pfsgroup'] = $a_phase2[$p2index]['pfsgroup'];
|
|
79 |
$pconfig['lifetime'] = $a_phase2[$p2index]['lifetime'];
|
|
80 |
$pconfig['pinghost'] = $a_phase2[$p2index]['pinghost'];
|
|
81 |
|
|
82 |
if (isset($a_phase2[$p2index]['mobile']))
|
|
74 |
$pconfig['ikeid'] = $ph2['ikeid'];
|
|
75 |
$pconfig['disabled'] = isset($ph2['disabled']);
|
|
76 |
$pconfig['mode'] = $ph2['mode'];
|
|
77 |
$pconfig['descr'] = $ph2['descr'];
|
|
78 |
$pconfig['uniqid'] = $ph2['uniqid'];
|
|
79 |
|
|
80 |
if (!empty($ph2['natlocalid']))
|
|
81 |
idinfo_to_pconfig("natlocal",$ph2['natlocalid'],$pconfig);
|
|
82 |
idinfo_to_pconfig("local",$ph2['localid'],$pconfig);
|
|
83 |
idinfo_to_pconfig("remote",$ph2['remoteid'],$pconfig);
|
|
84 |
|
|
85 |
$pconfig['proto'] = $ph2['protocol'];
|
|
86 |
ealgos_to_pconfig($ph2['encryption-algorithm-option'],$pconfig);
|
|
87 |
$pconfig['halgos'] = $ph2['hash-algorithm-option'];
|
|
88 |
$pconfig['pfsgroup'] = $ph2['pfsgroup'];
|
|
89 |
$pconfig['lifetime'] = $ph2['lifetime'];
|
|
90 |
$pconfig['pinghost'] = $ph2['pinghost'];
|
|
91 |
|
|
92 |
if (isset($ph2['mobile']))
|
|
83 | 93 |
$pconfig['mobile'] = true; |
84 | 94 |
} |
85 | 95 |
else |
... | ... | |
94 | 104 |
$pconfig['halgos'] = explode(",", "hmac_sha1,hmac_md5"); |
95 | 105 |
$pconfig['pfsgroup'] = "0"; |
96 | 106 |
$pconfig['lifetime'] = "3600"; |
107 |
$pconfig['uniqid'] = uniqid(); |
|
97 | 108 |
|
98 |
/* mobile client */
|
|
99 |
if($_GET['mobile'])
|
|
100 |
$pconfig['mobile']=true;
|
|
109 |
/* mobile client */
|
|
110 |
if($_GET['mobile'])
|
|
111 |
$pconfig['mobile']=true;
|
|
101 | 112 |
} |
102 | 113 |
|
103 |
if (isset($_GET['dup']) && is_numericint($_GET['dup'])) |
|
114 |
unset($ph2); |
|
115 |
if (!empty($_GET['dup'])) { |
|
116 |
unset($uindex); |
|
104 | 117 |
unset($p2index); |
118 |
$pconfig['uniqid'] = uniqid(); |
|
119 |
} |
|
105 | 120 |
|
106 | 121 |
if ($_POST) { |
107 | 122 |
|
... | ... | |
112 | 127 |
$input_errors[] = gettext("A valid ikeid must be specified."); |
113 | 128 |
|
114 | 129 |
/* input validation */ |
115 |
$reqdfields = explode(" ", "localid_type halgos"); |
|
116 |
$reqdfieldsn = array(gettext("Local network type"),gettext("P2 Hash Algorithms")); |
|
130 |
$reqdfields = explode(" ", "localid_type halgos uniqid");
|
|
131 |
$reqdfieldsn = array(gettext("Local network type"),gettext("P2 Hash Algorithms"), gettext("Unique Identifier"));
|
|
117 | 132 |
if (!isset($pconfig['mobile'])){ |
118 | 133 |
$reqdfields[] = "remoteid_type"; |
119 | 134 |
$reqdfieldsn[] = gettext("Remote network type"); |
... | ... | |
191 | 206 |
if (isset($pconfig['mobile'])){ |
192 | 207 |
/* User is adding phase 2 for mobile phase1 */ |
193 | 208 |
foreach($a_phase2 as $key => $name){ |
194 |
if (isset($name['mobile'])){
|
|
209 |
if (isset($name['mobile']) && $name['uniqid'] != $pconfig['uniqid']) {
|
|
195 | 210 |
/* check duplicate localids only for mobile clents */ |
196 | 211 |
$localid_data = ipsec_idinfo_to_cidr($name['localid'], false, $name['mode']); |
197 | 212 |
$entered = array(); |
... | ... | |
200 | 215 |
if (isset($pconfig['localid_netbits'])) $entered['netbits'] = $pconfig['localid_netbits']; |
201 | 216 |
$entered_localid_data = ipsec_idinfo_to_cidr($entered, false, $pconfig['mode']); |
202 | 217 |
if ($localid_data == $entered_localid_data){ |
203 |
if (!isset($pconfig['p2index'])){ |
|
204 |
/* adding new p2 entry */ |
|
205 |
$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients."); |
|
206 |
break; |
|
207 |
}else if ($pconfig['p2index'] != $key){ |
|
208 |
/* editing p2 and entered p2 networks match with different p2 for given p1 */ |
|
209 |
$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients."); |
|
210 |
break; |
|
211 |
} |
|
218 |
/* adding new p2 entry */ |
|
219 |
$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients."); |
|
220 |
break; |
|
212 | 221 |
} |
213 | 222 |
} |
214 | 223 |
} |
... | ... | |
216 | 225 |
/* User is adding phase 2 for site-to-site phase1 */ |
217 | 226 |
$input_error = 0; |
218 | 227 |
foreach($a_phase2 as $key => $name){ |
219 |
if (!isset($name['mobile']) && $pconfig['ikeid'] == $name['ikeid']){
|
|
228 |
if (!isset($name['mobile']) && $pconfig['ikeid'] == $name['ikeid'] && $pconfig['uniqid'] != $name['uniqid']) {
|
|
220 | 229 |
/* check duplicate subnets only for given phase1 */ |
221 | 230 |
$localid_data = ipsec_idinfo_to_cidr($name['localid'], false, $name['mode']); |
222 | 231 |
$remoteid_data = ipsec_idinfo_to_cidr($name['remoteid'], false, $name['mode']); |
... | ... | |
231 | 240 |
if (isset($pconfig['remoteid_netbits'])) $entered_remote['netbits'] = $pconfig['remoteid_netbits']; |
232 | 241 |
$entered_remoteid_data = ipsec_idinfo_to_cidr($entered_remote, false, $pconfig['mode']); |
233 | 242 |
if ($localid_data == $entered_localid_data && $remoteid_data == $entered_remoteid_data) { |
234 |
if (!isset($pconfig['p2index'])){ |
|
235 |
/* adding new p2 entry */ |
|
236 |
$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1."); |
|
237 |
break; |
|
238 |
}else if ($pconfig['p2index'] != $key){ |
|
239 |
/* editing p2 and entered p2 networks match with different p2 for given p1 */ |
|
240 |
$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1."); |
|
241 |
break; |
|
242 |
} |
|
243 |
/* adding new p2 entry */ |
|
244 |
$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1."); |
|
245 |
break; |
|
243 | 246 |
} |
244 | 247 |
} |
245 | 248 |
} |
... | ... | |
259 | 262 |
|
260 | 263 |
if (!$input_errors) { |
261 | 264 |
|
265 |
$ph2ent = array(); |
|
262 | 266 |
$ph2ent['ikeid'] = $pconfig['ikeid']; |
267 |
$ph2ent['uniqid'] = $pconfig['uniqid']; |
|
263 | 268 |
$ph2ent['mode'] = $pconfig['mode']; |
264 | 269 |
$ph2ent['disabled'] = $pconfig['disabled'] ? true : false; |
265 | 270 |
|
... | ... | |
281 | 286 |
if (isset($pconfig['mobile'])) |
282 | 287 |
$ph2ent['mobile'] = true; |
283 | 288 |
|
284 |
ipsec_lookup_phase1($ph2ent, $ph1ent); |
|
285 |
if (($ph1ent['protocol'] == "inet") && ($ph2ent['mode'] == "tunnel6")) |
|
286 |
$input_errors[] = gettext("Phase 1 is using IPv4. You cannot use Tunnel IPv6 on Phase 2."); |
|
287 |
if (($ph1ent['protocol'] == "inet6") && ($ph2ent['mode'] == "tunnel")) |
|
288 |
$input_errors[] = gettext("Phase 1 is using IPv6. You cannot use Tunnel IPv4 on Phase 2."); |
|
289 |
} |
|
290 |
|
|
291 |
if (!$input_errors) { |
|
292 |
if (isset($p2index) && $a_phase2[$p2index]) |
|
289 |
if ($ph2found === true && $a_phase2[$p2index]) |
|
293 | 290 |
$a_phase2[$p2index] = $ph2ent; |
294 | 291 |
else |
295 | 292 |
$a_phase2[] = $ph2ent; |
296 | 293 |
|
297 | 294 |
|
298 |
/* now we need to find all phase2 entries for this host */ |
|
299 |
if(is_array($ph2ent)) { |
|
300 |
ipsec_lookup_phase1($ph2ent, $ph1ent); |
|
301 |
$old_ph1ent = $ph1ent; |
|
302 |
$old_ph1ent['remote-gateway'] = resolve_retry($old_ph1ent['remote-gateway']); |
|
303 |
} |
|
304 |
|
|
305 | 295 |
write_config(); |
306 | 296 |
mark_subsystem_dirty('ipsec'); |
307 | 297 |
|
... | ... | |
780 | 770 |
<tr> |
781 | 771 |
<td width="22%" valign="top"> </td> |
782 | 772 |
<td width="78%"> |
783 |
<?php if (isset($p2index) && $a_phase2[$p2index]): ?> |
|
784 |
<input name="p2index" type="hidden" value="<?=htmlspecialchars($p2index);?>" /> |
|
785 |
<?php endif; ?> |
|
786 | 773 |
<?php if ($pconfig['mobile']): ?> |
787 | 774 |
<input name="mobile" type="hidden" value="true" /> |
788 | 775 |
<input name="remoteid_type" type="hidden" value="mobile" /> |
789 | 776 |
<?php endif; ?> |
790 | 777 |
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" /> |
791 | 778 |
<input name="ikeid" type="hidden" value="<?=htmlspecialchars($pconfig['ikeid']);?>" /> |
779 |
<input name="uniqid" type="hidden" value="<?=htmlspecialchars($pconfig['uniqid']);?>" /> |
|
792 | 780 |
</td> |
793 | 781 |
</tr> |
794 | 782 |
</table> |
... | ... | |
817 | 805 |
/* local utility functions */ |
818 | 806 |
|
819 | 807 |
function pconfig_to_ealgos(& $pconfig) { |
820 |
|
|
821 | 808 |
global $p2_ealgos; |
822 | 809 |
|
823 | 810 |
$ealgos = array(); |
Also available in: Unified diff
Use a uniqid() to track phase2 entries to avoid confustion and various mistakes when modifying and editing them.