Project

General

Profile

Download (14.9 KB) Statistics
| Branch: | Tag: | Revision:
1 5b237745 Scott Ullrich
#!/usr/local/bin/php
2 e2411886 Scott Ullrich
<?php 
3 5b237745 Scott Ullrich
/*
4
	vpn_openvpn.php
5
6
	Copyright (C) 2004 Peter Curran (peter@closeconsultants.com).
7
	All rights reserved.
8 e2411886 Scott Ullrich
	
9 5b237745 Scott Ullrich
	Redistribution and use in source and binary forms, with or without
10
	modification, are permitted provided that the following conditions are met:
11 e2411886 Scott Ullrich
	
12 5b237745 Scott Ullrich
	1. Redistributions of source code must retain the above copyright notice,
13
	   this list of conditions and the following disclaimer.
14 e2411886 Scott Ullrich
	
15 5b237745 Scott Ullrich
	2. Redistributions in binary form must reproduce the above copyright
16
	   notice, this list of conditions and the following disclaimer in the
17
	   documentation and/or other materials provided with the distribution.
18 e2411886 Scott Ullrich
	
19 5b237745 Scott Ullrich
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
20
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
21
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
23
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28
	POSSIBILITY OF SUCH DAMAGE.
29
*/
30
31
require("guiconfig.inc");
32
require_once("openvpn.inc");
33
34
if (!is_array($config['ovpn']))
35
	$config['ovpn'] = array();
36
if (!is_array($config['ovpn']['server'])){
37
	$config['ovpn']['server'] =  array();
38
	$config['ovpn']['server']['tun_iface'] = "tun0";
39
	$config['ovpn']['server']['psh_options'] = array();
40
	/* Initialise with some sensible defaults */
41
	$config['ovpn']['server']['port'] = 5000;
42
	$config['ovpn']['server']['proto'] = 'UDP';
43
	$config['ovpn']['server']['maxcli'] = 25;
44
	$config['ovpn']['server']['crypto'] = 'BF-CBC';
45
	$config['ovpn']['server']['dupcn'] = true;
46
	$config['ovpn']['server']['verb'] = 1;
47
}
48
49
if ($_POST) {
50
51
	unset($input_errors);
52
53
	/* input validation */
54
	if ($_POST['enable']) {
55
		$reqdfields = explode(" ", "tun_iface bind_iface ipblock");
56
		$reqdfieldsn = explode(",", "Tunnel type,Interface binding,IP address block start");
57
58
		do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
59
60
	}
61 e2411886 Scott Ullrich
	
62 5b237745 Scott Ullrich
	/* need a test here to make sure prefix and max_clients are coherent */
63 e2411886 Scott Ullrich
	
64 5b237745 Scott Ullrich
	/* Sort out the cert+key files */
65
	if (is_null($_POST['ca_cert']))
66
		$input_errors[] = "You must provide a CA certificate file";
67
	elseif (!strstr($_POST['ca_cert'], "BEGIN CERTIFICATE") || !strstr($_POST['ca_cert'], "END CERTIFICATE"))
68
		$input_errors[] = "The CA certificate does not appear to be valid.";
69 e2411886 Scott Ullrich
		
70 5b237745 Scott Ullrich
	if (is_null($_POST['srv_cert']))
71
		$input_errors[] = "You must provide a server certificate file";
72
	elseif (!strstr($_POST['srv_cert'], "BEGIN CERTIFICATE") || !strstr($_POST['srv_cert'], "END CERTIFICATE"))
73
		$input_errors[] = "The server certificate does not appear to be valid.";
74 e2411886 Scott Ullrich
		
75 5b237745 Scott Ullrich
	if (is_null($_POST['srv_key']))
76
		$input_errors[] = "You must provide a server key file";
77
	elseif (!strstr($_POST['srv_key'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['srv_key'], "END RSA PRIVATE KEY"))
78
		$input_errors[] = "The server key does not appear to be valid.";
79 e2411886 Scott Ullrich
		
80 5b237745 Scott Ullrich
	if (is_null($_POST['dh_param']))
81
		$input_errors[] = "You must provide a DH parameters file";
82
	elseif (!strstr($_POST['dh_param'], "BEGIN DH PARAMETERS") || !strstr($_POST['dh_param'], "END DH PARAMETERS"))
83
		$input_errors[] = "The DH parameters do not appear to be valid.";
84 e2411886 Scott Ullrich
				
85 5b237745 Scott Ullrich
	if (!$input_errors) {
86
		$server =& $config['ovpn']['server'];
87
		$server['enable'] = $_POST['enable'] ? true : false;
88 e2411886 Scott Ullrich
		
89 5b237745 Scott Ullrich
		/* Make sure that the tunnel interface type has not changed */
90 e2411886 Scott Ullrich
		if ($server['tun_iface'] != $_POST['tun_iface']){ 
91 5b237745 Scott Ullrich
			$server['tun_iface'] = $_POST['tun_iface'];
92
			touch($d_sysrebootreqd_path);
93
		}
94 e2411886 Scott Ullrich
		
95 5b237745 Scott Ullrich
		$server['bind_iface'] = $_POST['bind_iface'];
96
		$server['port'] = $_POST['port'];
97
		$server['proto'] = $_POST['proto'];
98 e2411886 Scott Ullrich
		
99 5b237745 Scott Ullrich
		/* Make sure the IP address and/or prefix have not changed */
100
		if ($server['ipblock'] != $_POST['ipblock']){
101
			$server['ipblock'] = $_POST['ipblock'];
102
			touch($d_sysrebootreqd_path);
103
		}
104
		if ($server['prefix'] != $_POST['prefix']){
105
			$server['prefix'] = $_POST['prefix'];
106
			touch($d_sysrebootreqd_path);
107
		}
108 e2411886 Scott Ullrich
		
109 5b237745 Scott Ullrich
		$server['maxcli'] = $_POST['maxcli'];
110
		$server['crypto'] = $_POST['crypto'];
111
		$server['cli2cli'] = $_POST['cli2cli'] ? true : false;
112
		$server['dupcn'] = $_POST['dupcn'] ? true : false;
113
		$server['psh_options']['redir'] = $_POST['psh_redir'] ? true : false;
114
		$server['psh_options']['redir_loc'] = $_POST['psh_redir_loc'] ? true : false;
115
		if ($_POST['psh_rtedelay'])
116
			$server['psh_options']['rtedelay'] = $_POST['psh_rtedelay_int'];
117
		if ($_POST['psh_ping'])
118
			$server['psh_options']['ping'] = $_POST['psh_ping_int'];
119
		if ($_POST['psh_pingexit'])
120
			$server['psh_options']['pingexit'] = $_POST['psh_pingexit_int'];
121
		if ($_POST['psh_pingrst'])
122
			$server['psh_options']['pingrst'] = $_POST['psh_pingrst_int'];
123
		if ($_POST['inact'])
124
			$server['psh_options']['inact'] = $_POST['psh_inact_int'];
125
		$server['ca_cert'] = base64_encode($_POST['ca_cert']);
126
		$server['srv_cert'] = base64_encode($_POST['srv_cert']);
127
		$server['srv_key'] = base64_encode($_POST['srv_key']);
128 e2411886 Scott Ullrich
		$server['dh_param'] = base64_encode($_POST['dh_param']);	
129
			
130 5b237745 Scott Ullrich
		write_config();
131
132
		$retval = 0;
133
		if (file_exists($d_sysrebootreqd_path)) {
134
			/* Rewrite interface definitions */
135
			$retval = ovpn_server_iface();
136
		}
137
		else{
138
			ovpn_lock();
139
			$retval = ovpn_config_server();
140
			ovpn_unlock();
141
		}
142
		$savemsg = get_std_save_message($retval);
143
	}
144
}
145
146
/* Simply take a copy of the array */
147
$pconfig = $config['ovpn']['server'];
148
149 b128368a Bill Marquette
$pgtitle = "VPN: OpenVPN";
150 4df96eff Scott Ullrich
include("head.inc");
151
152 5b237745 Scott Ullrich
?>
153 422f27c0 Scott Ullrich
154
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
155 5b237745 Scott Ullrich
<?php include("fbegin.inc"); ?>
156 b128368a Bill Marquette
<p class="pgtitle"><?=$pgtitle?></p>
157 5b237745 Scott Ullrich
<?php if ($input_errors) print_input_errors($input_errors); ?>
158
<?php if (file_exists($d_sysrebootreqd_path)) print_info_box(get_std_save_message(0)); ?>
159
160
<form action="vpn_openvpn.php" method="post" enctype="multipart/form-data" name="iform" id="iform">
161
<table width="100%" border="0" cellpadding="0" cellspacing="0">
162
  <tr><td>
163 e2411886 Scott Ullrich
  <ul id="tabnav">	        
164 5b237745 Scott Ullrich
	<li class="tabact">Server</li>
165
	<li class="tabinact"><a href="vpn_openvpn_cli.php">Client</a></li>
166
  </ul>
167
  </td></tr>
168
  <tr>
169
  <td class="tabcont">
170
    <strong><span class="red">WARNING: This feature is experimental and modifies your optional interface configuration.
171
  Backup your configuration before using OpenVPN, and restore it before upgrading.<br>
172
&nbsp;  <br>
173
    </span></strong><table width="100%" border="0" cellpadding="6" cellspacing="0">
174
  <tr>
175
    <td width="22%" valign="top" class="vtable">&nbsp;</td>
176
    <td width="78%" class="vtable">
177
      <input name="enable" type="checkbox" value="yes" <?php if (isset($pconfig['enable'])) echo "checked"; ?>>
178
      <strong>Enable OpenVPN server </strong></td>
179
   </tr>
180 e2411886 Scott Ullrich
   
181 5b237745 Scott Ullrich
   <tr>
182
     <td width="22%" valign="top" class="vncellreq">Tunnel type</td>
183
     <td width="78%" class="vtable">
184
       <input type="radio" name="tun_iface" class="formfld" value="tun0" <?php if ($pconfig['tun_iface'] == 'tun0') echo "checked"; ?>>
185
          TUN&nbsp;
186
       <input type="radio" name="tun_iface" class="formfld" value="tap0" <?php if ($pconfig['tun_iface'] == 'tap0') echo "checked"; ?>>
187
          TAP
188
      </td>
189
    </tr>
190 e2411886 Scott Ullrich
    
191 5b237745 Scott Ullrich
    <tr>
192
      <td width="22%" valign="top" class="vncell">OpenVPN protocol/port</td>
193
      <td width="78%" class="vtable">
194
	<input type="radio" name="proto" class="formfld" value="UDP" <?php if ($pconfig['proto'] == 'UDP') echo "checked"; ?>>
195
           UDP&nbsp;
196
        <input type="radio" name="proto" class="formfld" value="TCP" <?php if ($pconfig['proto'] == 'TCP') echo "checked"; ?>>
197
           TCP<br><br>
198 e2411886 Scott Ullrich
        Port: 
199 5b237745 Scott Ullrich
        <input name="port" type="text" class="formfld" size="5" maxlength="5" value="<?= $pconfig['port']; ?>"><br>
200
        Enter the port number to use for the server (default is 5000).</td>
201
    </tr>
202 e2411886 Scott Ullrich
    
203 5b237745 Scott Ullrich
    <tr>
204
      <td width="22%" valign="top" class="vncellreq">Interface binding</td>
205
      <td width="78%" class="vtable">
206
	<select name="bind_iface" class="formfld">
207 e2411886 Scott Ullrich
        <?php 
208 5b237745 Scott Ullrich
	$interfaces = ovpn_real_interface_list();
209
	foreach ($interfaces as $key => $iface):
210
        ?>
211
	<option value="<?=$key;?>" <?php if ($key == $pconfig['bind_iface']) echo "selected"; ?>> <?= $iface;?>
212
        </option>
213
        <?php endforeach;?>
214
        </select>
215
        <span class="vexpl"><br>
216
        Choose an interface for the OpenVPN server to listen on.</span></td>
217
    </tr>
218 e2411886 Scott Ullrich
		
219
    <tr> 
220 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">IP address block</td>
221 e2411886 Scott Ullrich
      <td width="78%" class="vtable"> 
222 5b237745 Scott Ullrich
        <input name="ipblock" type="text" class="formfld" size="20" value="<?=htmlspecialchars($pconfig['ipblock']);?>">
223 e2411886 Scott Ullrich
        / 
224 5b237745 Scott Ullrich
        <select name="prefix" class="formfld">
225
          <?php for ($i = 29; $i > 19; $i--): ?>
226
          <option value="<?=$i;?>" <?php if ($i == $pconfig['prefix']) echo "selected"; ?>>
227
            <?=$i;?>
228
          </option>
229
          <?php endfor; ?>
230
        </select>
231
        <br>
232
        Enter the IP address block for the OpenVPN server and clients to use.<br>
233
        <br>
234 e2411886 Scott Ullrich
	Maximum number of simultaneous clients: 
235 5b237745 Scott Ullrich
	<input name="maxcli" type="text" class="formfld" size="3" maxlength="3" value="<?=htmlspecialchars($pconfig['maxcli']);?>">
236
	</td>
237
    </tr>
238 e2411886 Scott Ullrich
    
239
    <tr> 
240 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">CA certificate</td>
241 e2411886 Scott Ullrich
      <td width="78%" class="vtable"> 
242 5b237745 Scott Ullrich
      <textarea name="ca_cert" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['ca_cert']));?></textarea>
243
      <br>
244 e2411886 Scott Ullrich
      Paste a CA certificate in X.509 PEM format here.</td>
245 5b237745 Scott Ullrich
    </tr>
246 e2411886 Scott Ullrich
		
247
    <tr> 
248 5b237745 Scott Ullrich
      <td width="22%" valign="top" class="vncellreq">Server certificate</td>
249
      <td width="78%" class="vtable">
250
        <textarea name="srv_cert" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['srv_cert']));?></textarea>
251
        <br>
252
        Paste a server certificate in X.509 PEM format here.</td>
253
     </tr>
254 e2411886 Scott Ullrich
     
255
     <tr> 
256 5b237745 Scott Ullrich
       <td width="22%" valign="top" class="vncellreq">Server key</td>
257 e2411886 Scott Ullrich
       <td width="78%" class="vtable"> 
258 5b237745 Scott Ullrich
         <textarea name="srv_key" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['srv_key']));?></textarea>
259
         <br>Paste the server RSA private key here.</td>
260
      </tr>
261 e2411886 Scott Ullrich
      
262
      <tr> 
263 5b237745 Scott Ullrich
        <td width="22%" valign="top" class="vncellreq">DH parameters</td>
264 e2411886 Scott Ullrich
        <td width="78%" class="vtable"> 
265 5b237745 Scott Ullrich
	  <textarea name="dh_param" cols="65" rows="4" class="formpre"><?=htmlspecialchars(base64_decode($pconfig['dh_param']));?></textarea>
266 e2411886 Scott Ullrich
          <br>          
267 5b237745 Scott Ullrich
          Paste the Diffie-Hellman parameters in PEM format here.</td>
268
      </tr>
269 e2411886 Scott Ullrich
      
270 5b237745 Scott Ullrich
      <tr>
271
        <td width="22%" valign="top" class="vncell">Crypto</td>
272
        <td width="78%" class="vtable">
273
          <select name="crypto" class="formfld">
274
	    <?php $cipher_list = ovpn_get_cipher_list();
275
	    foreach($cipher_list as $key => $value){
276
	    ?>
277
	      <option value="<?= $key ?>" <?php if ($pconfig['crypto'] == $key) echo "selected"; ?>>
278
	        <?= $value ?>
279
	      </option>
280
	    <?php
281
	    }
282
	    ?>
283
	  </select>
284
	  <br>
285
	  Select a data channel encryption cipher.</td>
286
      </tr>
287 e2411886 Scott Ullrich
      
288 5b237745 Scott Ullrich
      <tr>
289
        <td width="22%" valign="top" class="vncell">Internal routing mode</td>
290
        <td width="78%" class="vtable">
291
	  <input name="cli2cli" type="checkbox" value="yes" <?php if (isset($pconfig['cli2cli'])) echo "checked"; ?>>
292
          <strong>Enable client-to-client routing</strong><br>
293
          If this option is on,  clients are allowed to talk to each other.</td>
294
      </tr>
295 e2411886 Scott Ullrich
      
296 5b237745 Scott Ullrich
      <tr>
297
        <td width="22%" valign="top" class="vncell">Client authentication</td>
298
        <td width="78%" class="vtable">
299
	  <input name="dupcn" type="checkbox" value="yes" <?php if (isset($pconfig['dupcn'])) echo "checked"; ?>>
300
          <strong>Permit duplicate client certificates</strong><br>
301
	  If this option is on, clients with duplicate certificates will not be disconnected.</td>
302
      </tr>
303 e2411886 Scott Ullrich
	 
304 5b237745 Scott Ullrich
      <tr>
305
        <td width="22%" valign="top" class="vncell">Client-push options</td>
306
        <td width="78%" class="vtable">
307
	      <table border="0" cellspacing="0" cellpadding="0">
308
	        <tr>
309
              <td><input type="checkbox" name="psh_redir" value="yes" <?php if (isset($pconfig['psh_options']['redir'])) echo "checked"; ?>>
310
              Redirect-gateway</td>
311
              <td>&nbsp;</td>
312
              <td><input type="checkbox" name="psh_redir_loc" value="yes" <?php if (isset($pconfig['psh_options']['redir_loc'])) echo "checked"; ?>>
313
                Local</td>
314
	          </tr>
315
            <tr>
316
              <td><input type="checkbox" name="psh_rtedelay" value="yes" <?php if (isset($pconfig['psh_options']['rtedelay'])) echo "checked"; ?>> Route-delay</td>
317
              <td width="16">&nbsp;</td>
318
              <td><input type="text" name="psh_rtedelay_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['rtedelay']?>"> seconds</td>
319
            </tr>
320
            <tr>
321
              <td><input type="checkbox" name="psh_inact" value="yes" <?php if (isset($pconfig['psh_options']['inact'])) echo "checked"; ?>>
322
    Inactive</td>
323
              <td>&nbsp;</td>
324
              <td><input type="text" name="psh_inact_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['inact']?>">
325
    seconds</td>
326
            </tr>
327
            <tr>
328
              <td><input type="checkbox" name="psh_ping" value="yes" <?php if (isset($pconfig['psh_options']['ping'])) echo "checked"; ?>> Ping</td>
329
              <td>&nbsp;</td>
330
              <td>Interval: <input type="text" name="psh_ping_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['ping']?>"> seconds</td>
331
            </tr>
332
            <tr>
333
              <td><input type="checkbox" name="psh_pingexit" value="yes" <?php if (isset($pconfig['psh_options']['pingexit'])) echo "checked"; ?>> Ping-exit</td>
334
              <td>&nbsp;</td>
335
              <td>Interval: <input type="text" name="psh_pingexit_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['pingexit']?>"> seconds</td>
336
            </tr>
337
            <tr>
338
              <td><input type="checkbox" name="psh_pingrst" value="yes" <?php if (isset($pconfig['psh_options']['pingrst'])) echo "checked"; ?>> Ping-restart</td>
339
              <td>&nbsp;</td>
340
              <td>Interval: <input type="text" name="psh_pingrst_int" class="formfld" size="4" value="<?= $pconfig['psh_options']['pingrst']?>"> seconds</td>
341
            </tr>
342
          </table></td>
343
      </tr>
344
      <tr>
345
        <td width="22%" valign="top">&nbsp;</td>
346
        <td width="78%">
347
          <input name="Submit" type="submit" class="formbtn" value="Save">
348
        </td>
349
      </tr>
350
      <tr>
351
        <td width="22%" valign="top">&nbsp;</td>
352
        <td width="78%"><span class="vexpl"><span class="red"><strong>Note:<br>
353
          </strong></span>Changing any settings on this page will disconnect all clients!</span>
354
	</td>
355
      </tr>
356
    </table>  </td>
357
</tr>
358
</table>
359
</form>
360
<?php include("fend.inc"); ?>