Project

General

Profile

Download (17.7 KB) Statistics
| Branch: | Tag: | Revision:
1
#!/usr/local/bin/php
2
<?php
3
/*
4
	vpn_ipsec_mobile.php
5
	part of m0n0wall (http://m0n0.ch/wall)
6
	
7
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
8
	All rights reserved.
9
	
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12
	
13
	1. Redistributions of source code must retain the above copyright notice,
14
	   this list of conditions and the following disclaimer.
15
	
16
	2. Redistributions in binary form must reproduce the above copyright
17
	   notice, this list of conditions and the following disclaimer in the
18
	   documentation and/or other materials provided with the distribution.
19
	
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
*/
31

    
32
$pgtitle = "VPN: IPsec";
33
require("guiconfig.inc");
34

    
35
if (!is_array($config['ipsec']['mobileclients'])) {
36
	$config['ipsec']['mobileclients'] = array();
37
}
38
$a_ipsec = &$config['ipsec']['mobileclients'];
39

    
40
if (count($a_ipsec) == 0) {
41
	/* defaults */
42
	$pconfig['p1mode'] = "aggressive";
43
	$pconfig['p1myidentt'] = "myaddress";
44
	$pconfig['p1ealgo'] = "3des";
45
	$pconfig['p1halgo'] = "sha1";
46
	$pconfig['p1dhgroup'] = "2";
47
	$pconfig['p1authentication_method'] = "pre_shared_key";
48
	$pconfig['p2proto'] = "esp";
49
	$pconfig['p2ealgos'] = explode(",", "3des,blowfish,cast128,rijndael");
50
	$pconfig['p2halgos'] = explode(",", "hmac_sha1,hmac_md5");
51
	$pconfig['p2pfsgroup'] = "0";
52
} else {
53
	$pconfig['enable'] = isset($a_ipsec['enable']);
54
	$pconfig['p1mode'] = $a_ipsec['p1']['mode'];
55
		
56
	if (isset($a_ipsec['p1']['myident']['myaddress']))
57
		$pconfig['p1myidentt'] = 'myaddress';
58
	else if (isset($a_ipsec['p1']['myident']['address'])) {
59
		$pconfig['p1myidentt'] = 'address';
60
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['address'];
61
	} else if (isset($a_ipsec['p1']['myident']['fqdn'])) {
62
		$pconfig['p1myidentt'] = 'fqdn';
63
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['fqdn'];
64
	} else if (isset($a_ipsec['p1']['myident']['ufqdn'])) {
65
		$pconfig['p1myidentt'] = 'user_fqdn';
66
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['ufqdn'];
67
 	}
68
	
69
	$pconfig['p1ealgo'] = $a_ipsec['p1']['encryption-algorithm'];
70
	$pconfig['p1halgo'] = $a_ipsec['p1']['hash-algorithm'];
71
	$pconfig['p1dhgroup'] = $a_ipsec['p1']['dhgroup'];
72
	$pconfig['p1lifetime'] = $a_ipsec['p1']['lifetime'];
73
	$pconfig['p1authentication_method'] = $a_ipsec['p1']['authentication_method'];
74
	$pconfig['p1cert'] = base64_decode($a_ipsec['p1']['cert']);
75
	$pconfig['p1privatekey'] = base64_decode($a_ipsec['p1']['private-key']);
76
	$pconfig['p2proto'] = $a_ipsec['p2']['protocol'];
77
	$pconfig['p2ealgos'] = $a_ipsec['p2']['encryption-algorithm-option'];
78
	$pconfig['p2halgos'] = $a_ipsec['p2']['hash-algorithm-option'];
79
	$pconfig['p2pfsgroup'] = $a_ipsec['p2']['pfsgroup'];
80
	$pconfig['p2lifetime'] = $a_ipsec['p2']['lifetime'];
81
}
82

    
83
if ($_POST) {
84
	unset($input_errors);
85
	$pconfig = $_POST;
86

    
87
	/* input validation */
88
	$reqdfields = explode(" ", "p2ealgos p2halgos");
89
	$reqdfieldsn = explode(",", "P2 Encryption Algorithms,P2 Hash Algorithms");
90
	
91
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
92
	
93
	if ($_POST['p1authentication_method']== "rsasig") {
94
		if (!strstr($_POST['p1cert'], "BEGIN CERTIFICATE") || !strstr($_POST['p1cert'], "END CERTIFICATE"))
95
			$input_errors[] = "This certificate does not appear to be valid.";
96
		if (!strstr($_POST['p1privatekey'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['p1privatekey'], "END RSA PRIVATE KEY"))
97
			$input_errors[] = "This key does not appear to be valid.";	
98
	}
99
	
100
	if (($_POST['p1lifetime'] && !is_numeric($_POST['p1lifetime']))) {
101
		$input_errors[] = "The P1 lifetime must be an integer.";
102
	}
103
	if (($_POST['p2lifetime'] && !is_numeric($_POST['p2lifetime']))) {
104
		$input_errors[] = "The P2 lifetime must be an integer.";
105
	}
106
	if ((($_POST['p1myidentt'] == "address") && !is_ipaddr($_POST['p1myident']))) {
107
		$input_errors[] = "A valid IP address for 'My identifier' must be specified.";
108
	}
109
	if ((($_POST['p1myidentt'] == "fqdn") && !is_domain($_POST['p1myident']))) {
110
		$input_errors[] = "A valid domain name for 'My identifier' must be specified.";
111
	}
112
	if ($_POST['p1myidentt'] == "user_fqdn") {
113
		$ufqdn = explode("@",$_POST['p1myident']);
114
		if (!is_domain($ufqdn[1])) 
115
			$input_errors[] = "A valid User FQDN in the form of user@my.domain.com for 'My identifier' must be specified.";
116
	}
117
	
118
	if ($_POST['p1myidentt'] == "myaddress")
119
		$_POST['p1myident'] = "";
120

    
121
	if (!$input_errors) {
122
		$ipsecent = array();
123
		$ipsecent['enable'] = $_POST['enable'] ? true : false;
124
		$ipsecent['p1']['mode'] = $_POST['p1mode'];
125
		
126
		$ipsecent['p1']['myident'] = array();
127
		switch ($_POST['p1myidentt']) {
128
			case 'myaddress':
129
				$ipsecent['p1']['myident']['myaddress'] = true;
130
				break;
131
			case 'address':
132
				$ipsecent['p1']['myident']['address'] = $_POST['p1myident'];
133
				break;
134
			case 'fqdn':
135
				$ipsecent['p1']['myident']['fqdn'] = $_POST['p1myident'];
136
				break;
137
			case 'user_fqdn':
138
				$ipsecent['p1']['myident']['ufqdn'] = $_POST['p1myident'];
139
				break;
140
		}
141
		
142
		$ipsecent['p1']['encryption-algorithm'] = $_POST['p1ealgo'];
143
		$ipsecent['p1']['hash-algorithm'] = $_POST['p1halgo'];
144
		$ipsecent['p1']['dhgroup'] = $_POST['p1dhgroup'];
145
		$ipsecent['p1']['lifetime'] = $_POST['p1lifetime'];
146
		$ipsecent['p1']['private-key'] = base64_encode($_POST['p1privatekey']);
147
		$ipsecent['p1']['cert'] = base64_encode($_POST['p1cert']);
148
		$ipsecent['p1']['authentication_method'] = $_POST['p1authentication_method'];
149
		$ipsecent['p2']['protocol'] = $_POST['p2proto'];
150
		$ipsecent['p2']['encryption-algorithm-option'] = $_POST['p2ealgos'];
151
		$ipsecent['p2']['hash-algorithm-option'] = $_POST['p2halgos'];
152
		$ipsecent['p2']['pfsgroup'] = $_POST['p2pfsgroup'];
153
		$ipsecent['p2']['lifetime'] = $_POST['p2lifetime'];
154
		
155
		$a_ipsec = $ipsecent;
156
		
157
		write_config();
158
		touch($d_ipsecconfdirty_path);
159
		
160
		header("Location: vpn_ipsec_mobile.php");
161
		exit;
162
	}
163
}
164

    
165
include("head.inc");
166

    
167
?>
168
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
169
<?php include("fbegin.inc"); ?>
170
<p class="pgtitle"><?php echo $pgtitle; ?></p>
171
<script language="JavaScript">
172
<!--
173
function methodsel_change() {
174
	switch (document.iform.p1authentication_method.selectedIndex) {
175
		case 1:	/* rsa */
176
			document.iform.p1privatekey.disabled = 0;
177
			document.iform.p1cert.disabled = 0;
178
			break;
179
		default: /* pre-shared */
180
			document.iform.p1privatekey.disabled = 1;
181
			document.iform.p1cert.disabled = 1;
182
			break;
183
	}
184
}
185
//-->
186
</script>
187
<form action="vpn_ipsec.php" method="post">
188
<?php if ($input_errors) print_input_errors($input_errors); ?>
189
<?php if (file_exists($d_ipsecconfdirty_path)): ?><p>
190
<?php print_info_box_np("The IPsec tunnel configuration has been changed.<br>You must apply the changes in order for them to take effect.");?><br>
191
<input name="apply" type="submit" class="formbtn" id="apply" value="Apply changes"></p>
192
<?php endif; ?>
193
</form>
194
<form action="vpn_ipsec_mobile.php" method="post" name="iform" id="iform">
195
<div id="mainarea">
196
<table width="100%" border="0" cellpadding="0" cellspacing="0">
197
  <tr><td class="tabnavtbl">
198
<?php
199
	$tab_array = array();
200
	$tab_array[0] = array("Tunnels", false, "vpn_ipsec.php");
201
	$tab_array[1] = array("Mobile clients", true, "vpn_ipsec_mobile.php");
202
	$tab_array[2] = array("Pre-shared keys", false, "vpn_ipsec_keys.php");
203
	$tab_array[3] = array("CAs", false, "vpn_ipsec_ca.php");
204
	display_top_tabs($tab_array);
205
?>
206
  </td></tr>
207
  <tr> 
208
    <td class="tabcont">
209
              <table width="100%" border="0" cellpadding="6" cellspacing="0">
210
			  <tr> 
211
                        <td width="22%" valign="top">&nbsp;</td>
212
                        <td width="78%"> 
213
                    <input name="enable" type="checkbox" id="enable" value="yes" <?php if ($pconfig['enable']) echo "checked"; ?>>
214
                    <strong>Allow mobile clients</strong></td>
215
                </tr>
216
                <tr> 
217
                  <td colspan="2" valign="top" class="listtopic">Phase 1 proposal 
218
                    (Authentication)</td>
219
                </tr>
220
                <tr> 
221
                  <td width="22%" valign="top" class="vncellreq">Negotiation mode</td>
222
                        <td width="78%" class="vtable">
223
					<select name="p1mode" class="formfld">
224
                      <?php $modes = explode(" ", "main aggressive"); foreach ($modes as $mode): ?>
225
                      <option value="<?=$mode;?>" <?php if ($mode == $pconfig['p1mode']) echo "selected"; ?>> 
226
                      <?=htmlspecialchars($mode);?>
227
                      </option>
228
                      <?php endforeach; ?>
229
                    </select> <br> <span class="vexpl">Aggressive is faster, but 
230
                    less secure.</span></td>
231
                </tr>
232
                <tr> 
233
                  <td width="22%" valign="top" class="vncellreq">My identifier</td>
234
                        <td width="78%" class="vtable">
235
					<select name="p1myidentt" class="formfld">
236
                      <?php foreach ($my_identifier_list as $mode => $modename): ?>
237
                      <option value="<?=$mode;?>" <?php if ($mode == $pconfig['p1myidentt']) echo "selected"; ?>> 
238
                      <?=htmlspecialchars($modename);?>
239
                      </option>
240
                      <?php endforeach; ?>
241
                    </select> <input name="p1myident" type="text" class="formfld" id="p1myident" size="30" value="<?=$pconfig['p1myident'];?>"> 
242
                  </td>
243
                </tr>
244
                <tr> 
245
                  <td width="22%" valign="top" class="vncellreq">Encryption algorithm</td>
246
                        <td width="78%" class="vtable">
247
					<select name="p1ealgo" class="formfld">
248
                      <?php foreach ($p1_ealgos as $algo => $algoname): ?>
249
                      <option value="<?=$algo;?>" <?php if ($algo == $pconfig['p1ealgo']) echo "selected"; ?>> 
250
                      <?=htmlspecialchars($algoname);?>
251
                      </option>
252
                      <?php endforeach; ?>
253
                    </select> <br> <span class="vexpl">Must match the setting 
254
                    chosen on the remote side. </span></td>
255
                </tr>
256
                <tr> 
257
                  <td width="22%" valign="top" class="vncellreq">Hash algorithm</td>
258
                        <td width="78%" class="vtable">
259
					<select name="p1halgo" class="formfld">
260
                      <?php foreach ($p1_halgos as $algo => $algoname): ?>
261
                      <option value="<?=$algo;?>" <?php if ($algo == $pconfig['p1halgo']) echo "selected"; ?>> 
262
                      <?=htmlspecialchars($algoname);?>
263
                      </option>
264
                      <?php endforeach; ?>
265
                    </select> <br> <span class="vexpl">Must match the setting 
266
                    chosen on the remote side. </span></td>
267
                </tr>
268
                <tr> 
269
                  <td width="22%" valign="top" class="vncellreq">DH key group</td>
270
                        <td width="78%" class="vtable">
271
					<select name="p1dhgroup" class="formfld">
272
                      <?php $keygroups = explode(" ", "1 2 5"); foreach ($keygroups as $keygroup): ?>
273
                      <option value="<?=$keygroup;?>" <?php if ($keygroup == $pconfig['p1dhgroup']) echo "selected"; ?>> 
274
                      <?=htmlspecialchars($keygroup);?>
275
                      </option>
276
                      <?php endforeach; ?>
277
                    </select> <br> <span class="vexpl"><em>1 = 768 bit, 2 = 1024 
278
                    bit, 5 = 1536 bit</em><br>
279
                    Must match the setting chosen on the remote side. </span></td>
280
                </tr>
281
                <tr> 
282
                  <td width="22%" valign="top" class="vncell">Lifetime</td>
283
                        <td width="78%" class="vtable"> 
284
                    <input name="p1lifetime" type="text" class="formfld" id="p1lifetime" size="20" value="<?=$pconfig['p1lifetime'];?>">
285
                    seconds</td>
286
                </tr>
287
                <tr> 
288
                  <td width="22%" valign="top" class="vncellreq">Authentication method</td>
289
                  <td width="78%" class="vtable">
290
					<select name="p1authentication_method" class="formfld" onChange="methodsel_change()">
291
                      <?php foreach ($p1_authentication_methods as $method => $methodname): ?>
292
                      <option value="<?=$method;?>" <?php if ($method == $pconfig['p1authentication_method']) echo "selected"; ?>> 
293
                      <?=htmlspecialchars($methodname);?>
294
                      </option>
295
                      <?php endforeach; ?>
296
                    </select> <br> <span class="vexpl">Must match the setting 
297
                    chosen on the remote side. </span></td>
298
                </tr>
299
                <tr> 
300
                  <td width="22%" valign="top" class="vncellreq">Certificate</td>
301
                  <td width="78%" class="vtable"> 
302
                    <textarea name="p1cert" cols="65" rows="7" id="p1cert" class="formpre"><?=htmlspecialchars($pconfig['p1cert']);?></textarea>
303
                    <br> 
304
                    Paste a certificate in X.509 PEM format here.</td>
305
                </tr>
306
                <tr> 
307
                  <td width="22%" valign="top" class="vncellreq">Key</td>
308
                  <td width="78%" class="vtable"> 
309
                    <textarea name="p1privatekey" cols="65" rows="7" id="p1privatekey" class="formpre"><?=htmlspecialchars($pconfig['p1privatekey']);?></textarea>
310
                    <br> 
311
                    Paste an RSA private key in PEM format here.</td>
312
                </tr>
313
                <tr> 
314
                  <td colspan="2" class="list" height="12"></td>
315
                </tr>
316
                <tr> 
317
                  <td colspan="2" valign="top" class="listtopic">Phase 2 proposal 
318
                    (SA/Key Exchange)</td>
319
                </tr>
320
                <tr> 
321
                  <td width="22%" valign="top" class="vncellreq">Protocol</td>
322
                        <td width="78%" class="vtable">
323
					<select name="p2proto" class="formfld">
324
                      <?php foreach ($p2_protos as $proto => $protoname): ?>
325
                      <option value="<?=$proto;?>" <?php if ($proto == $pconfig['p2proto']) echo "selected"; ?>> 
326
                      <?=htmlspecialchars($protoname);?>
327
                      </option>
328
                      <?php endforeach; ?>
329
                    </select> <br> <span class="vexpl">ESP is encryption, AH is 
330
                    authentication only </span></td>
331
                </tr>
332
                <tr> 
333
                  <td width="22%" valign="top" class="vncellreq">Encryption algorithms</td>
334
                        <td width="78%" class="vtable"> 
335
                          <?php foreach ($p2_ealgos as $algo => $algoname): ?>
336
                    <input type="checkbox" name="p2ealgos[]" value="<?=$algo;?>" <?php if (in_array($algo, $pconfig['p2ealgos'])) echo "checked"; ?>> 
337
                    <?=htmlspecialchars($algoname);?>
338
                    <br> 
339
                    <?php endforeach; ?>
340
                    <br>
341
                    Hint: use 3DES for best compatibility or if you have a hardware 
342
                    crypto accelerator card. Blowfish is usually the fastest in 
343
                    software encryption. </td>
344
                </tr>
345
                <tr> 
346
                  <td width="22%" valign="top" class="vncellreq">Hash algorithms</td>
347
                        <td width="78%" class="vtable"> 
348
                          <?php foreach ($p2_halgos as $algo => $algoname): ?>
349
                    <input type="checkbox" name="p2halgos[]" value="<?=$algo;?>" <?php if (in_array($algo, $pconfig['p2halgos'])) echo "checked"; ?>> 
350
                    <?=htmlspecialchars($algoname);?>
351
                    <br> 
352
                    <?php endforeach; ?>
353
                  </td>
354
                </tr>
355
                <tr> 
356
                  <td width="22%" valign="top" class="vncellreq">PFS key group</td>
357
                        <td width="78%" class="vtable">
358
					<select name="p2pfsgroup" class="formfld">
359
                      <?php foreach ($p2_pfskeygroups as $keygroup => $keygroupname): ?>
360
                      <option value="<?=$keygroup;?>" <?php if ($keygroup == $pconfig['p2pfsgroup']) echo "selected"; ?>> 
361
                      <?=htmlspecialchars($keygroupname);?>
362
                      </option>
363
                      <?php endforeach; ?>
364
                    </select> <br> <span class="vexpl"><em>1 = 768 bit, 2 = 1024 
365
                    bit, 5 = 1536 bit</em></span></td>
366
                </tr>
367
                <tr> 
368
                  <td width="22%" valign="top" class="vncell">Lifetime</td>
369
                        <td width="78%" class="vtable"> 
370
                    <input name="p2lifetime" type="text" class="formfld" id="p2lifetime" size="20" value="<?=$pconfig['p2lifetime'];?>">
371
                    seconds</td>
372
                </tr>
373
                <tr> 
374
                  <td width="22%" valign="top">&nbsp;</td>
375
                  <td width="78%"> 
376
                    <input name="Submit" type="submit" class="formbtn" value="Save">
377
                  </td>
378
                </tr>
379
              </table>
380
			 </td>
381
			</tr>
382
		</table>
383
		</div>
384
</form>
385
<script language="JavaScript">
386
<!--
387
methodsel_change();
388
//-->
389
</script>
390
<?php include("fend.inc"); ?>
391
<script type="text/javascript">
392
NiftyCheck();
393
Rounded("div#mainarea","bl br","#FFF","#eeeeee","smooth");
394
</script>
395

    
396
</body>
397
</html>
(118-118/127)