/src/etc/inc/openvpn.auth-user.php - Annotate - pfSense - pfSense bugtracker

| Branch: | Tag: | Revision:

root/src/etc/inc/openvpn.auth-user.php @ b27ae464

1	3c11bd3c	Matthew Grooms	<?php
2			/*
3	ac24dc24	Renato Botelho	* openvpn.auth-user.php
4			*
5			* part of pfSense (https://www.pfsense.org)
6	c5d81585	Renato Botelho	* Copyright (c) 2008 Shrew Soft Inc
7	b8f91b7c	Luiz Souza	* Copyright (c) 2008-2018 Rubicon Communications, LLC (Netgate)
8	ac24dc24	Renato Botelho	* All rights reserved.
9			*
10	b12ea3fb	Renato Botelho	* Licensed under the Apache License, Version 2.0 (the "License");
11			* you may not use this file except in compliance with the License.
12			* You may obtain a copy of the License at
13	ac24dc24	Renato Botelho	*
14	b12ea3fb	Renato Botelho	* http://www.apache.org/licenses/LICENSE-2.0
15	ac24dc24	Renato Botelho	*
16	b12ea3fb	Renato Botelho	* Unless required by applicable law or agreed to in writing, software
17			* distributed under the License is distributed on an "AS IS" BASIS,
18			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19			* See the License for the specific language governing permissions and
20			* limitations under the License.
21	ac24dc24	Renato Botelho	*/
22	09221bc3	Renato Botelho
23	3c11bd3c	Matthew Grooms	/*
24			* OpenVPN calls this script to authenticate a user
25			* based on a username and password. We lookup these
26			* in our config.xml file and check the credentials.
27			*/
28
29	befad728	Ermal	require_once("globals.inc");
30	3c11bd3c	Matthew Grooms	require_once("config.inc");
31	cc686d98	Ermal Lu?i	require_once("radius.inc");
32	a13ce628	Ermal Lu?i	require_once("auth.inc");
33	cc686d98	Ermal Lu?i	require_once("interfaces.inc");
34	3c11bd3c	Matthew Grooms
35	cc686d98	Ermal Lu?i	/**
36			* Get the NAS-Identifier
37			*
38	a409a857	Kacper	* We will return "openVPN" so that connections can be distinguished by the Radius
39	cc686d98	Ermal Lu?i	*/
40			if (!function_exists("getNasID")) {
41	086cf944	Phil Davis	function getNasID() {
42	a409a857	Kacper	return "openVPN";
43	cc686d98	Ermal Lu?i	}
44			}
45
46			/**
47			* Get the NAS-IP-Address based on the current wan address
48			*
49			* Use functions in interfaces.inc to find this out
50			*
51			*/
52			if (!function_exists("getNasIP")) {
53	086cf944	Phil Davis	function getNasIP() {
54	b37a2e8c	Phil Davis	$nasIp = get_interface_ip();
55			if (!$nasIp) {
56			$nasIp = "0.0.0.0";
57			}
58			return $nasIp;
59	cc686d98	Ermal Lu?i	}
60			}
61	a409a857	Kacper
62			/**
63			* Set the NAS-Port-Type
64			*
65			* Should be "Virtual" since that denotes VPN connections
66			*/
67			if (!function_exists("getNasPortType")) {
68			function getNasPortType() {
69			return RADIUS_VIRTUAL;
70			}
71			}
72
73			/**
74			* Set the NAS-Port
75			*
76			* We will return the port the client connected to
77			*/
78			if (!function_exists("getNasPort")) {
79			function getNasPort() {
80			return $_GET['nas_port'];
81			}
82			}
83
84			/**
85			* Set the Called-Station-ID
86			*
87			* We will return the IP and port the client connected to
88			*/
89			if (!function_exists("getCalledStationId")) {
90			function getCalledStationId() {
91			return get_interface_ip() . ":" . getNasPort();
92			}
93			}
94
95	3c11bd3c	Matthew Grooms	/* setup syslog logging */
96			openlog("openvpn", LOG_ODELAY, LOG_AUTH);
97
98	8fa0a534	Ermal LUÇI	if (isset($_GET['username'])) {
99	c165a17e	jim-p	$authmodes = explode(",", base64_decode($_GET['authcfg']));
100	a3d88018	Edin Sarajlic	/* Any string retrieved through $_GET is automatically urlDecoded */
101			$username = base64_decode($_GET['username']);
102			$password = base64_decode($_GET['password']);
103	5e28dad4	Ermal	$common_name = $_GET['cn'];
104			$modeid = $_GET['modeid'];
105			$strictusercn = $_GET['strictcn'] == "false" ? false : true;
106			} else {
107			/* read data from environment */
108			$username = getenv("username");
109			$password = getenv("password");
110			$common_name = getenv("common_name");
111			}
112	3c11bd3c	Matthew Grooms
113			if (!$username \|\| !$password) {
114	1f5309a3	Matthew Grooms	syslog(LOG_ERR, "invalid user authentication environment");
115	8fa0a534	Ermal LUÇI	if (isset($_GET['username'])) {
116	5e28dad4	Ermal	echo "FAILED";
117	b2af12ad	Ermal	closelog();
118	5e28dad4	Ermal	return;
119	b2af12ad	Ermal	} else {
120			closelog();
121	52550ca5	Ermal LUÇI	return (-1);
122	b2af12ad	Ermal	}
123	3c11bd3c	Matthew Grooms	}
124
125	b37a2e8c	Phil Davis	/* Replaced by a sed with proper variables used below(ldap parameters). */
126	c61e4626	Ermal Lu?i	//<template>
127
128	1492e02c	Ermal	if (file_exists("{$g['varetc_path']}/openvpn/{$modeid}.ca")) {
129			putenv("LDAPTLS_CACERT={$g['varetc_path']}/openvpn/{$modeid}.ca");
130			putenv("LDAPTLS_REQCERT=never");
131			}
132
133	c61e4626	Ermal Lu?i	$authenticated = false;
134	8901958c	jim-p
135	5319cf40	Talle	if (($strictusercn === true) && (mb_strtolower($common_name) !== mb_strtolower($username))) {
136	8901958c	jim-p	syslog(LOG_WARNING, "Username does not match certificate common name ({$username} != {$common_name}), access denied.\n");
137	8fa0a534	Ermal LUÇI	if (isset($_GET['username'])) {
138	5e28dad4	Ermal	echo "FAILED";
139	b2af12ad	Ermal	closelog();
140	5e28dad4	Ermal	return;
141	b2af12ad	Ermal	} else {
142			closelog();
143	52550ca5	Ermal LUÇI	return (1);
144	b2af12ad	Ermal	}
145	5e28dad4	Ermal	}
146
147			if (!is_array($authmodes)) {
148			syslog(LOG_WARNING, "No authentication server has been selected to authenticate against. Denying authentication for user {$username}");
149	8fa0a534	Ermal LUÇI	if (isset($_GET['username'])) {
150	5e28dad4	Ermal	echo "FAILED";
151	b2af12ad	Ermal	closelog();
152	5e28dad4	Ermal	return;
153	b2af12ad	Ermal	} else {
154			closelog();
155	52550ca5	Ermal LUÇI	return (1);
156	b2af12ad	Ermal	}
157	8901958c	jim-p	}
158
159	1492e02c	Ermal	$attributes = array();
160	c61e4626	Ermal Lu?i	foreach ($authmodes as $authmode) {
161			$authcfg = auth_get_authserver($authmode);
162	821a4351	Renato Botelho	if (!$authcfg && $authmode != "Local Database") {
163	c61e4626	Ermal Lu?i	continue;
164	b37a2e8c	Phil Davis	}
165	c61e4626	Ermal Lu?i
166	1492e02c	Ermal	$authenticated = authenticate_user($username, $password, $authcfg, $attributes);
167	b37a2e8c	Phil Davis	if ($authenticated == true) {
168	006a162f	Ermal Lu?i	break;
169	b37a2e8c	Phil Davis	}
170	c61e4626	Ermal Lu?i	}
171
172			if ($authenticated == false) {
173	3260b82f	Ermal	syslog(LOG_WARNING, "user '{$username}' could not authenticate.\n");
174	8fa0a534	Ermal LUÇI	if (isset($_GET['username'])) {
175	5e28dad4	Ermal	echo "FAILED";
176	b2af12ad	Ermal	closelog();
177	5e28dad4	Ermal	return;
178	b2af12ad	Ermal	} else {
179			closelog();
180	52550ca5	Ermal LUÇI	return (-1);
181	b2af12ad	Ermal	}
182	3c11bd3c	Matthew Grooms	}
183
184	b37a2e8c	Phil Davis	if (file_exists("/etc/inc/openvpn.attributes.php")) {
185			include_once("/etc/inc/openvpn.attributes.php");
186			}
187
188	1492e02c	Ermal	$content = "";
189			if (is_array($attributes['dns-servers'])) {
190	b37a2e8c	Phil Davis	foreach ($attributes['dns-servers'] as $dnssrv) {
191			if (is_ipaddr($dnssrv)) {
192			$content .= "push \"dhcp-option DNS {$dnssrv}\"\n";
193			}
194			}
195	1492e02c	Ermal	}
196			if (is_array($attributes['routes'])) {
197	b37a2e8c	Phil Davis	foreach ($attributes['routes'] as $route) {
198	5e28dad4	Ermal	$content .= "push \"route {$route} vpn_gateway\"\n";
199	b37a2e8c	Phil Davis	}
200	1492e02c	Ermal	}
201
202			if (isset($attributes['framed_ip'])) {
203	ee8f9940	doktornotor	if (isset($attributes['framed_mask'])) {
204	b37a2e8c	Phil Davis	$content .= "topology subnet\n";
205			$content .= "ifconfig-push {$attributes['framed_ip']} {$attributes['framed_mask']}";
206			} else {
207	ee8f9940	doktornotor	$content .= "topology net30\n";
208	356ec787	doktornotor	$content .= "ifconfig-push {$attributes['framed_ip']} ". long2ip((ip2long($attributes['framed_ip']) - 1));
209	ee8f9940	doktornotor	}
210	b37a2e8c	Phil Davis	}
211
212			if (!empty($content)) {
213			@file_put_contents("{$g['tmp_path']}/{$username}", $content);
214	1492e02c	Ermal	}
215
216	3260b82f	Ermal	syslog(LOG_NOTICE, "user '{$username}' authenticated\n");
217	b2af12ad	Ermal	closelog();
218	a13ce628	Ermal Lu?i
219	b37a2e8c	Phil Davis	if (isset($_GET['username'])) {
220	5e28dad4	Ermal	echo "OK";
221	b37a2e8c	Phil Davis	} else {
222	52550ca5	Ermal LUÇI	return (0);
223	b37a2e8c	Phil Davis	}
224	3c11bd3c	Matthew Grooms
225	fe2031ab	Ermal	?>

Project

General

Profile

pfSense