/src/etc/inc/openvpn.inc - Annotate - pfSense - pfSense bugtracker

| Branch: | Tag: | Revision:

root/src/etc/inc/openvpn.inc @ f5736d98

1	5b237745	Scott Ullrich	<?php
2	b1ad443d	Scott Ullrich	/*
3	ac24dc24	Renato Botelho	* openvpn.inc
4			*
5			* part of pfSense (https://www.pfsense.org)
6	c5d81585	Renato Botelho	* Copyright (c) 2006 Fernando Lemos
7	38809d47	Renato Botelho do Couto	* Copyright (c) 2006-2013 BSD Perimeter
8			* Copyright (c) 2013-2016 Electric Sheep Fencing
9	8f585441	Luiz Souza	* Copyright (c) 2014-2021 Rubicon Communications, LLC (Netgate)
10	ac24dc24	Renato Botelho	* All rights reserved.
11			*
12			* This file was rewritten from scratch by Fernando Lemos but
13			* MIGHT contain code previously written by:
14			*
15	c5d81585	Renato Botelho	* Copyright (c) 2005 Peter Allgeyer <allgeyer_AT_web.de>
16			* Copyright (c) 2004 Peter Curran (peter@closeconsultants.com).
17	ac24dc24	Renato Botelho	* All rights reserved.
18			*
19	b12ea3fb	Renato Botelho	* Licensed under the Apache License, Version 2.0 (the "License");
20			* you may not use this file except in compliance with the License.
21			* You may obtain a copy of the License at
22	ac24dc24	Renato Botelho	*
23	b12ea3fb	Renato Botelho	* http://www.apache.org/licenses/LICENSE-2.0
24	ac24dc24	Renato Botelho	*
25	b12ea3fb	Renato Botelho	* Unless required by applicable law or agreed to in writing, software
26			* distributed under the License is distributed on an "AS IS" BASIS,
27			* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
28			* See the License for the specific language governing permissions and
29			* limitations under the License.
30	ac24dc24	Renato Botelho	*/
31	6aa3723a	Renato Botelho
32	8dc3ef67	Scott Ullrich	require_once('config.inc');
33	32a7a1f6	Ermal Lu?i	require_once("certs.inc");
34	36df0acc	Scott Ullrich	require_once('pfsense-utils.inc');
35	c61e4626	Ermal Lu?i	require_once("auth.inc");
36	8dc3ef67	Scott Ullrich
37	f2291484	jim-p	global $openvpn_prots;
38	ca366676	jim-p	$openvpn_prots = array(
39			"UDP4" => "UDP on IPv4 only",
40			"UDP6" => "UDP on IPv6 only",
41			"TCP4" => "TCP on IPv4 only",
42			"TCP6" => "TCP on IPv6 only",
43			"UDP" => "UDP IPv4 and IPv6 on all interfaces (multihome)",
44			"TCP" => "TCP IPv4 and IPv6 on all interfaces (multihome)"
45			);
46	702a4702	Scott Ullrich
47	f2291484	jim-p	global $openvpn_dev_mode;
48	b743ea87	jim-p	$openvpn_dev_mode = array(
49			"tun" => "tun - Layer 3 Tunnel Mode",
50			"tap" => "tap - Layer 2 Tap Mode"
51			);
52	691fbf14	Ermal Lu?i
53	b9e9903d	Dmitriy K.	global $openvpn_verbosity_level;
54			$openvpn_verbosity_level = array(
55	e8c516a0	Phil Davis	0 => gettext("none"),
56			1 => gettext("default"),
57	42bb1bee	Renato Botelho	2 => "2",
58	e8c516a0	Phil Davis	3 => gettext("3 (recommended)"),
59	b9e9903d	Dmitriy K.	4 => "4",
60			5 => "5",
61			6 => "6",
62			7 => "7",
63			8 => "8",
64			9 => "9",
65			10 => "10",
66			11 => "11"
67	42bb1bee	Renato Botelho	);
68	b9e9903d	Dmitriy K.
69	42bb1bee	Renato Botelho	/*
70	3c11bd3c	Matthew Grooms	* The User Auth mode below is disabled because
71			* OpenVPN erroneously requires that we provide
72			* a CA configuration parameter. In this mode,
73			* clients don't send a certificate so there is
74			* no need for a CA. If we require that admins
75			* provide one in the pfSense UI due to a bogus
76			* requirement imposed by OpenVPN, it could be
77			* considered very confusing ( I know I was ).
78			*
79			* -mgrooms
80			*/
81
82	f2291484	jim-p	global $openvpn_dh_lengths;
83	fe787fc7	Matthew Grooms	$openvpn_dh_lengths = array(
84	f888c35a	jim-p	1024 => "1024 bit",
85	4b6bf6aa	Justin Coffman	2048 => "2048 bit",
86			3072 => "3072 bit",
87			4096 => "4096 bit",
88			6144 => "6144 bit",
89	f888c35a	jim-p	7680 => "7680 bit",
90	4b6bf6aa	Justin Coffman	8192 => "8192 bit",
91	f888c35a	jim-p	15360 => "15360 bit",
92			16384 => "16384 bit",
93			"none" => "ECDH Only"
94	0693c967	stilez	);
95	f888c35a	jim-p	foreach ($openvpn_dh_lengths as $idx => $dhlen) {
96			if (is_numeric($idx) && !file_exists("/etc/dh-parameters.{$idx}")) {
97			unset($openvpn_dh_lengths[$idx]);
98			}
99			}
100	fe787fc7	Matthew Grooms
101	f2291484	jim-p	global $openvpn_cert_depths;
102	98963f27	jim-p	$openvpn_cert_depths = array(
103	e8c516a0	Phil Davis	1 => gettext("One (Client+Server)"),
104			2 => gettext("Two (Client+Intermediate+Server)"),
105			3 => gettext("Three (Client+2xIntermediate+Server)"),
106			4 => gettext("Four (Client+3xIntermediate+Server)"),
107			5 => gettext("Five (Client+4xIntermediate+Server)")
108	98963f27	jim-p	);
109
110	f2291484	jim-p	global $openvpn_server_modes;
111	3c11bd3c	Matthew Grooms	$openvpn_server_modes = array(
112	4aa02281	Carlos Eduardo Ramos	'p2p_tls' => gettext("Peer to Peer ( SSL/TLS )"),
113			'p2p_shared_key' => gettext("Peer to Peer ( Shared Key )"),
114			'server_tls' => gettext("Remote Access ( SSL/TLS )"),
115			'server_user' => gettext("Remote Access ( User Auth )"),
116			'server_tls_user' => gettext("Remote Access ( SSL/TLS + User Auth )"));
117	3c11bd3c	Matthew Grooms
118	154b0f80	jim-p	global $openvpn_tls_server_modes;
119			$openvpn_tls_server_modes = array('p2p_tls', 'server_tls', 'server_user', 'server_tls_user');
120
121	f2291484	jim-p	global $openvpn_client_modes;
122	3c11bd3c	Matthew Grooms	$openvpn_client_modes = array(
123	4aa02281	Carlos Eduardo Ramos	'p2p_tls' => gettext("Peer to Peer ( SSL/TLS )"),
124	ef00af3c	Phil Davis	'p2p_shared_key' => gettext("Peer to Peer ( Shared Key )"));
125	3c11bd3c	Matthew Grooms
126	56e031a7	jim-p	global $openvpn_allow_compression;
127			$openvpn_allow_compression = array(
128			'asym' => gettext("Decompress incoming, do not compress outgoing (Asymmetric)"),
129			'no' => gettext("Refuse any non-stub compression (Most secure)"),
130			'yes' => gettext("Compress packets (WARNING: Potentially dangerous!)"),
131			);
132
133	edba1982	jim-p	global $openvpn_compression_modes;
134			$openvpn_compression_modes = array(
135	56e031a7	jim-p	'' => gettext("Disable Compression [Omit Preference]"),
136	38922574	jim-p	'none' => gettext("Disable Compression, retain compression packet framing [compress]"),
137	56e031a7	jim-p	'stub' => gettext("Enable Compression (stub) [compress stub]"),
138			'stub-v2' => gettext("Enable Compression (stub v2) [compress stub-v2]"),
139	a4b36246	jim-p	'lz4' => gettext("LZ4 Compression [compress lz4]"),
140	61a8cc10	jim-p	'lz4-v2' => gettext("LZ4 Compression v2 [compress lz4-v2]"),
141	a4b36246	jim-p	'lzo' => gettext("LZO Compression [compress lzo, equivalent to comp-lzo yes for compatibility]"),
142			'noadapt' => gettext("Omit Preference, + Disable Adaptive LZO Compression [Legacy style, comp-noadapt]"),
143			'adaptive' => gettext("Adaptive LZO Compression [Legacy style, comp-lzo adaptive]"),
144			'yes' => gettext("LZO Compression [Legacy style, comp-lzo yes]"),
145			'no' => gettext("No LZO Compression [Legacy style, comp-lzo no]"),
146			);
147	edba1982	jim-p
148	88cfb255	jim-p	global $openvpn_topologies;
149			$openvpn_topologies = array(
150			'subnet' => gettext("Subnet -- One IP address per client in a common subnet"),
151			'net30' => gettext("net30 -- Isolated /30 network per client")
152			);
153
154	c854afcc	jim-p	global $openvpn_tls_modes;
155			$openvpn_tls_modes = array(
156			'auth' => gettext("TLS Authentication"),
157	feec858c	jim-p	'crypt' => gettext("TLS Encryption and Authentication")
158	c854afcc	jim-p	);
159
160	3bfecc81	Renato Botelho do Couto	global $openvpn_ping_method;
161			$openvpn_ping_method = array(
162			'keepalive' => gettext("keepalive -- Use keepalive helper to define ping configuration"),
163			'ping' => gettext("ping -- Define ping/ping-exit/ping-restart manually")
164			);
165
166			global $openvpn_default_keepalive_interval;
167			$openvpn_default_keepalive_interval = 10;
168
169			global $openvpn_default_keepalive_timeout;
170			$openvpn_default_keepalive_timeout = 60;
171
172			global $openvpn_ping_action;
173			$openvpn_ping_action = array(
174			'ping_restart' => gettext("ping-restart -- Restart OpenVPN after timeout"),
175			'ping_exit' => gettext("ping-exit -- Exit OpenVPN after timeout")
176			);
177
178	7591a72a	jim-p	global $openvpn_exit_notify_server;
179			$openvpn_exit_notify_server = array(
180			'none' => gettext("Disabled"),
181			'1' => gettext("Reconnect to this server / Retry once"),
182			'2' => gettext("Reconnect to next server / Retry twice"),
183			);
184
185			global $openvpn_exit_notify_client;
186			$openvpn_exit_notify_client = array(
187			'none' => gettext("Disabled"),
188			);
189			for ($i=1; $i<=5; $i++) {
190			$openvpn_exit_notify_client[$i] = sprintf(gettext("Retry %dx"), $i);
191			}
192
193	f4eec250	Phil Davis	function openvpn_build_mode_list() {
194			global $openvpn_server_modes;
195
196			$list = array();
197
198	4e322e2c	Phil Davis	foreach ($openvpn_server_modes as $name => $desc) {
199	f4eec250	Phil Davis	$list[$name] = $desc;
200	4e322e2c	Phil Davis	}
201	f4eec250	Phil Davis
202			return($list);
203			}
204
205	adf5849b	PiBa-NL	global $openvpn_interfacenames;
206			function convert_openvpn_interface_to_friendly_descr($if) {
207			global $openvpn_interfacenames;
208			if (!is_array($openvpn_interfacenames)) {
209			$openvpn_interfacenames = openvpn_build_if_list();
210			}
211			foreach($openvpn_interfacenames as $key => $value) {
212			list($item_if, $item_ip) = explode("\|", $key);
213			if ($if == $item_if) {
214			echo "$value";
215			}
216			}
217			}
218
219	f4eec250	Phil Davis	function openvpn_build_if_list() {
220			$list = array();
221
222			$interfaces = get_configured_interface_with_descr();
223	2a5960b0	Luiz Otavio O Souza	$viplist = get_configured_vip_list();
224			foreach ($viplist as $vip => $address) {
225			$interfaces[$vip.'\|'.$address] = $address;
226			if (get_vip_descr($address)) {
227			$interfaces[$vip.'\|'.$address] .= " (";
228			$interfaces[$vip.'\|'.$address] .= get_vip_descr($address);
229			$interfaces[$vip.'\|'.$address] .= ")";
230			}
231	4e322e2c	Phil Davis	}
232	f4eec250	Phil Davis
233			$grouplist = return_gateway_groups_array();
234			foreach ($grouplist as $name => $group) {
235	4e322e2c	Phil Davis	if ($group[0]['vip'] != "") {
236	f4eec250	Phil Davis	$vipif = $group[0]['vip'];
237	4e322e2c	Phil Davis	} else {
238	f4eec250	Phil Davis	$vipif = $group[0]['int'];
239	4e322e2c	Phil Davis	}
240	f4eec250	Phil Davis
241			$interfaces[$name] = "GW Group {$name}";
242			}
243
244			$interfaces['lo0'] = "Localhost";
245			$interfaces['any'] = "any";
246
247	4e322e2c	Phil Davis	foreach ($interfaces as $iface => $ifacename) {
248	f4eec250	Phil Davis	$list[$iface] = $ifacename;
249	4e322e2c	Phil Davis	}
250	f4eec250	Phil Davis
251			return($list);
252			}
253
254			function openvpn_build_crl_list() {
255			global $a_crl;
256
257			$list = array('' => 'None');
258
259			foreach ($a_crl as $crl) {
260			$caname = "";
261			$ca = lookup_ca($crl['caref']);
262
263	4e322e2c	Phil Davis	if ($ca) {
264	f4eec250	Phil Davis	$caname = " (CA: {$ca['descr']})";
265	4e322e2c	Phil Davis	}
266	f4eec250	Phil Davis
267			$list[$crl['refid']] = $crl['descr'] . $caname;
268			}
269
270			return($list);
271			}
272
273	0e9d4a6d	jim-p	function openvpn_build_cert_list($include_none = false, $prioritize_server_certs = false) {
274	f4eec250	Phil Davis	global $a_cert;
275	bc3e78ab	jim-p	$openvpn_compatible_certs = cert_build_list('cert', 'OpenVPN');
276	f4eec250	Phil Davis
277			if ($include_none) {
278	e8c516a0	Phil Davis	$list = array('' => gettext('None (Username and/or Password required)'));
279	f4eec250	Phil Davis	} else {
280			$list = array();
281			}
282
283	a4ba0282	Stephen Beaver	$non_server_list = array();
284
285	0e9d4a6d	jim-p	if ($prioritize_server_certs) {
286	e8c516a0	Phil Davis	$list[' '] = gettext("===== Server Certificates =====");
287			$non_server_list[' '] = gettext("===== Non-Server Certificates =====");
288	0e9d4a6d	jim-p	}
289
290	f4eec250	Phil Davis	foreach ($a_cert as $cert) {
291	bc3e78ab	jim-p	if (!array_key_exists($cert['refid'], $openvpn_compatible_certs)) {
292			continue;
293			}
294	0e9d4a6d	jim-p	$properties = array();
295			$propstr = "";
296	f4eec250	Phil Davis	$ca = lookup_ca($cert['caref']);
297	0e9d4a6d	jim-p	$purpose = cert_get_purpose($cert['crt'], true);
298	f4eec250	Phil Davis
299	0e9d4a6d	jim-p	if ($purpose['server'] == "Yes") {
300	e8c516a0	Phil Davis	$properties[] = gettext("Server: Yes");
301	0e9d4a6d	jim-p	} elseif ($prioritize_server_certs) {
302	e8c516a0	Phil Davis	$properties[] = gettext("Server: NO");
303	0e9d4a6d	jim-p	}
304	de1a3167	jim-p	if ($ca) {
305	e8c516a0	Phil Davis	$properties[] = sprintf(gettext("CA: %s"), $ca['descr']);
306	de1a3167	jim-p	}
307	0e9d4a6d	jim-p	if (cert_in_use($cert['refid'])) {
308	e8c516a0	Phil Davis	$properties[] = gettext("In Use");
309	0e9d4a6d	jim-p	}
310			if (is_cert_revoked($cert)) {
311	e8c516a0	Phil Davis	$properties[] = gettext("Revoked");
312	de1a3167	jim-p	}
313	f4eec250	Phil Davis
314	0e9d4a6d	jim-p	if (!empty($properties)) {
315			$propstr = " (" . implode(", ", $properties) . ")";
316	de1a3167	jim-p	}
317	f4eec250	Phil Davis
318	0e9d4a6d	jim-p	if ($prioritize_server_certs) {
319			if ($purpose['server'] == "Yes") {
320			$list[$cert['refid']] = $cert['descr'] . $propstr;
321			} else {
322			$non_server_list[$cert['refid']] = $cert['descr'] . $propstr;
323			}
324			} else {
325			$list[$cert['refid']] = $cert['descr'] . $propstr;
326	de1a3167	jim-p	}
327	0e9d4a6d	jim-p	}
328	f4eec250	Phil Davis
329	a4ba0282	Stephen Beaver	return(array('server' => $list, 'non-server' => $non_server_list));
330	f4eec250	Phil Davis	}
331
332			function openvpn_build_bridge_list() {
333			$list = array();
334
335			$serverbridge_interface['none'] = "none";
336			$serverbridge_interface = array_merge($serverbridge_interface, get_configured_interface_with_descr());
337	2a5960b0	Luiz Otavio O Souza	$viplist = get_configured_vip_list();
338	f4eec250	Phil Davis
339	2a5960b0	Luiz Otavio O Souza	foreach ($viplist as $vip => $address) {
340			$serverbridge_interface[$vip.'\|'.$address] = $address;
341	d9901ff4	Chris Buechler	if (get_vip_descr($address)) {
342	2a5960b0	Luiz Otavio O Souza	$serverbridge_interface[$vip.'\|'.$address] .= " (". get_vip_descr($address) .")";
343	d9901ff4	Chris Buechler	}
344	4e322e2c	Phil Davis	}
345	f4eec250	Phil Davis
346	4e322e2c	Phil Davis	foreach ($serverbridge_interface as $iface => $ifacename) {
347	f4eec250	Phil Davis	$list[$iface] = htmlspecialchars($ifacename);
348	4e322e2c	Phil Davis	}
349	f4eec250	Phil Davis
350			return($list);
351			}
352
353	3c11bd3c	Matthew Grooms	function openvpn_create_key() {
354
355	a2ba5b6c	Viktor G	$fp = popen("/usr/local/sbin/openvpn --genkey secret /dev/stdout 2>/dev/null", "r");
356	ef00af3c	Phil Davis	if (!$fp) {
357	3c11bd3c	Matthew Grooms	return false;
358	ef00af3c	Phil Davis	}
359	3c11bd3c	Matthew Grooms
360			$rslt = stream_get_contents($fp);
361			pclose($fp);
362
363			return $rslt;
364			}
365	d799787e	Matthew Grooms
366	8411b218	Matthew Grooms	function openvpn_create_dhparams($bits) {
367	34bc1324	Matthew Grooms
368	2ec95f1f	Renato Botelho	$fp = popen("/usr/bin/openssl dhparam {$bits} 2>/dev/null", "r");
369	ef00af3c	Phil Davis	if (!$fp) {
370	34bc1324	Matthew Grooms	return false;
371	ef00af3c	Phil Davis	}
372	34bc1324	Matthew Grooms
373			$rslt = stream_get_contents($fp);
374			pclose($fp);
375
376			return $rslt;
377			}
378
379	d799787e	Matthew Grooms	function openvpn_vpnid_used($vpnid) {
380	8be2d6d3	Ermal Luçi	global $config;
381
382	ef00af3c	Phil Davis	if (is_array($config['openvpn']['openvpn-server'])) {
383			foreach ($config['openvpn']['openvpn-server'] as & $settings) {
384			if ($vpnid == $settings['vpnid']) {
385	d799787e	Matthew Grooms	return true;
386	ef00af3c	Phil Davis	}
387			}
388			}
389	d799787e	Matthew Grooms
390	ef00af3c	Phil Davis	if (is_array($config['openvpn']['openvpn-client'])) {
391			foreach ($config['openvpn']['openvpn-client'] as & $settings) {
392			if ($vpnid == $settings['vpnid']) {
393	d799787e	Matthew Grooms	return true;
394	ef00af3c	Phil Davis	}
395			}
396			}
397	04a6e900	Ermal Luçi
398	d799787e	Matthew Grooms	return false;
399			}
400
401			function openvpn_vpnid_next() {
402
403			$vpnid = 1;
404	ef00af3c	Phil Davis	while (openvpn_vpnid_used($vpnid)) {
405	d799787e	Matthew Grooms	$vpnid++;
406	ef00af3c	Phil Davis	}
407	d799787e	Matthew Grooms
408			return $vpnid;
409			}
410
411	49b76122	Renato Botelho	function openvpn_port_used($prot, $interface, $port, $curvpnid = 0) {
412	f432e364	Matthew Grooms	global $config;
413
414	65d0277d	Renato Botelho	$ovpn_settings = array();
415	49b76122	Renato Botelho	if (is_array($config['openvpn']['openvpn-server'])) {
416	65d0277d	Renato Botelho	$ovpn_settings = $config['openvpn']['openvpn-server'];
417	49b76122	Renato Botelho	}
418			if (is_array($config['openvpn']['openvpn-client'])) {
419	65d0277d	Renato Botelho	$ovpn_settings = array_merge($ovpn_settings,
420			$config['openvpn']['openvpn-client']);
421			}
422	49b76122	Renato Botelho
423	65d0277d	Renato Botelho	foreach ($ovpn_settings as $settings) {
424			if (isset($settings['disable'])) {
425			continue;
426			}
427	49b76122	Renato Botelho
428	65d0277d	Renato Botelho	if ($curvpnid != 0 && $curvpnid == $settings['vpnid']) {
429			continue;
430			}
431
432	f69e098f	Renato Botelho	/* (TCP\|UDP)(4\|6) does not conflict unless interface is any */
433			if (($interface != "any" && $settings['interface'] != "any") &&
434			(strlen($prot) == 4) &&
435			(strlen($settings['protocol']) == 4) &&
436			substr($prot,0,3) == substr($settings['protocol'],0,3) &&
437			substr($prot,3,1) != substr($settings['protocol'],3,1)) {
438			continue;
439			}
440
441	65d0277d	Renato Botelho	if ($port == $settings['local_port'] &&
442	f69e098f	Renato Botelho	substr($prot,0,3) == substr($settings['protocol'],0,3) &&
443	65d0277d	Renato Botelho	($interface == $settings['interface'] \|\|
444			$interface == "any" \|\| $settings['interface'] == "any")) {
445			return $settings['vpnid'];
446	49b76122	Renato Botelho	}
447			}
448	f432e364	Matthew Grooms
449			return 0;
450			}
451
452	49b76122	Renato Botelho	function openvpn_port_next($prot, $interface = "wan") {
453	f432e364	Matthew Grooms
454			$port = 1194;
455	ef00af3c	Phil Davis	while (openvpn_port_used($prot, $interface, $port)) {
456	49b76122	Renato Botelho	$port++;
457	ef00af3c	Phil Davis	}
458			while (openvpn_port_used($prot, "any", $port)) {
459	f432e364	Matthew Grooms	$port++;
460	ef00af3c	Phil Davis	}
461	f432e364	Matthew Grooms
462			return $port;
463			}
464
465	d799787e	Matthew Grooms	function openvpn_get_cipherlist() {
466
467			$ciphers = array();
468	4fd1130f	jim-p	$cipher_out = shell_exec('/usr/local/sbin/openvpn --show-ciphers \| /usr/bin/grep \'(.*key\' \| sed \'s/, TLS client\/server mode only//\'');
469	d799787e	Matthew Grooms	$cipher_lines = explode("\n", trim($cipher_out));
470			sort($cipher_lines);
471			foreach ($cipher_lines as $line) {
472	4fd1130f	jim-p	$words = explode(' ', $line, 2);
473	d799787e	Matthew Grooms	$ciphers[$words[0]] = "{$words[0]} {$words[1]}";
474	8be2d6d3	Ermal Luçi	}
475	4aa02281	Carlos Eduardo Ramos	$ciphers["none"] = gettext("None (No Encryption)");
476	d799787e	Matthew Grooms	return $ciphers;
477			}
478
479	f888c35a	jim-p	function openvpn_get_curvelist() {
480	bc3e78ab	jim-p	global $cert_curve_compatible;
481	f888c35a	jim-p	$curves = array();
482			$curves["none"] = gettext("Use Default");
483	bc3e78ab	jim-p	foreach ($cert_curve_compatible['OpenVPN'] as $curve) {
484			$curves[$curve] = $curve;
485	f888c35a	jim-p	}
486			return $curves;
487			}
488
489			function openvpn_validate_curve($curve) {
490			$curves = openvpn_get_curvelist();
491			return array_key_exists($curve, $curves);
492			}
493
494	f49ef559	jim-p	/* Obtain the list of digest algorithms supported by openssl and their alternate names */
495			function openvpn_get_openssldigestmappings() {
496			$digests = array();
497			$digest_out = shell_exec('/usr/bin/openssl list-message-digest-algorithms \| /usr/bin/grep "=>"');
498			$digest_lines = explode("\n", trim($digest_out));
499			sort($digest_lines);
500			foreach ($digest_lines as $line) {
501			$words = explode(' => ', $line, 2);
502			$digests[$words[0]] = $words[1];
503			}
504			return $digests;
505			}
506	97d5b59b	jim-p
507	f49ef559	jim-p	/* Obtain the list of digest algorithms supported by openvpn */
508			function openvpn_get_digestlist() {
509			/* Grab the list from OpenSSL to check for duplicates or aliases */
510			$openssl_digest_mappings = openvpn_get_openssldigestmappings();
511	97d5b59b	jim-p	$digests = array();
512			$digest_out = shell_exec('/usr/local/sbin/openvpn --show-digests \| /usr/bin/grep "digest size" \| /usr/bin/awk \'{print $1, "(" $2 "-" $3 ")";}\'');
513			$digest_lines = explode("\n", trim($digest_out));
514			sort($digest_lines);
515			foreach ($digest_lines as $line) {
516			$words = explode(' ', $line);
517	f49ef559	jim-p	/* Only add the entry if it is NOT also listed as being an alias/mapping by OpenSSL */
518			if (!array_key_exists($words[0], $openssl_digest_mappings)) {
519			$digests[$words[0]] = "{$words[0]} {$words[1]}";
520			}
521	97d5b59b	jim-p	}
522			$digests["none"] = gettext("None (No Authentication)");
523			return $digests;
524			}
525
526	f49ef559	jim-p	/* Check to see if a digest name is an alias and if so, find the actual digest
527			* algorithm instead. Useful for upgrade code that has to translate aliased
528			* algorithms to their actual names.
529			*/
530			function openvpn_remap_digest($digest) {
531			$openssl_digest_mappings = openvpn_get_openssldigestmappings();
532			if (array_key_exists($digest, $openssl_digest_mappings)) {
533			/* Some mappings point to other mappings, keep going until we find the actual digest algorithm */
534			if (array_key_exists($openssl_digest_mappings[$digest], $openssl_digest_mappings)) {
535			return openvpn_remap_digest($openssl_digest_mappings[$digest]);
536			} else {
537			return $openssl_digest_mappings[$digest];
538			}
539			}
540			return $digest;
541			}
542
543	8698f918	Vito Piserchia	function openvpn_get_keydirlist() {
544			$keydirs = array(
545	d2011b0a	jim-p	'default' => gettext('Use default direction'),
546	8698f918	Vito Piserchia	'0' => gettext('Direction 0'),
547			'1' => gettext('Direction 1'),
548	f08369ec	Vito Piserchia	'2' => gettext('Both directions'),
549	8698f918	Vito Piserchia	);
550			return $keydirs;
551			}
552
553	582c58ae	jim-p	function openvpn_get_engines() {
554	e8c516a0	Phil Davis	$openssl_engines = array('none' => gettext('No Hardware Crypto Acceleration'));
555	2ec95f1f	Renato Botelho	exec("/usr/bin/openssl engine -t -c", $openssl_engine_output);
556	349bf358	jim-p	$openssl_engine_output = implode("\n", $openssl_engine_output);
557			$openssl_engine_output = preg_replace("/\\n\\s+/", "\|", $openssl_engine_output);
558			$openssl_engine_output = explode("\n", $openssl_engine_output);
559
560	582c58ae	jim-p	foreach ($openssl_engine_output as $oeo) {
561	349bf358	jim-p	$keep = true;
562			$details = explode("\|", $oeo);
563			$engine = array_shift($details);
564	582c58ae	jim-p	$linematch = array();
565	349bf358	jim-p	preg_match("/$(.)$\s(.)/", $engine, $linematch);
566			foreach ($details as $dt) {
567	ef00af3c	Phil Davis	if (strpos($dt, "unavailable") !== FALSE) {
568	349bf358	jim-p	$keep = false;
569	ef00af3c	Phil Davis	}
570			if (strpos($dt, "available") !== FALSE) {
571	349bf358	jim-p	continue;
572	ef00af3c	Phil Davis	}
573			if (strpos($dt, "[") !== FALSE) {
574	349bf358	jim-p	$ciphers = trim($dt, "[]");
575	ef00af3c	Phil Davis	}
576	349bf358	jim-p	}
577	ef00af3c	Phil Davis	if (!empty($ciphers)) {
578	349bf358	jim-p	$ciphers = " - " . $ciphers;
579	ef00af3c	Phil Davis	}
580			if (strlen($ciphers) > 60) {
581	349bf358	jim-p	$ciphers = substr($ciphers, 0, 60) . " ... ";
582	ef00af3c	Phil Davis	}
583			if ($keep) {
584	349bf358	jim-p	$openssl_engines[$linematch[1]] = $linematch[2] . $ciphers;
585	ef00af3c	Phil Davis	}
586	582c58ae	jim-p	}
587			return $openssl_engines;
588			}
589
590	7618a842	jim-p	function openvpn_get_buffer_values() {
591			$sendbuf_max = get_single_sysctl('net.inet.tcp.sendbuf_max');
592			$recvbuf_max = get_single_sysctl('net.inet.tcp.recvbuf_max');
593			/* Usually these two are equal, but if they are not, take whichever one is lower. */
594			$buffer_max = ($sendbuf_max <= $recvbuf_max) ? $sendbuf_max : $recvbuf_max;
595			$buffer_values = array('' => gettext('Default'));
596			for ($bs = 32; $bs >= 1; $bs /= 2) {
597			$buffer_values[$buffer_max/$bs] = format_bytes($buffer_max/$bs);
598			}
599			return $buffer_values;
600			}
601
602	582c58ae	jim-p	function openvpn_validate_engine($engine) {
603			$engines = openvpn_get_engines();
604			return array_key_exists($engine, $engines);
605			}
606
607	d799787e	Matthew Grooms	function openvpn_validate_host($value, $name) {
608			$value = trim($value);
609	ef00af3c	Phil Davis	if (empty($value) \|\| (!is_domain($value) && !is_ipaddr($value))) {
610	4aa02281	Carlos Eduardo Ramos	return sprintf(gettext("The field '%s' must contain a valid IP address or domain name."), $name);
611	ef00af3c	Phil Davis	}
612	d799787e	Matthew Grooms	return false;
613	8dc3ef67	Scott Ullrich	}
614
615	39fed386	jim-p	function openvpn_validate_port($value, $name, $first_port = 0) {
616	8dc3ef67	Scott Ullrich	$value = trim($value);
617	39fed386	jim-p	if (!is_numeric($first_port)) {
618			$first_port = 0;
619			}
620			if (empty($value) \|\| !is_numeric($value) \|\| $value < $first_port \|\| ($value > 65535)) {
621	9f2a58b5	Renato Botelho do Couto	return sprintf(gettext("The field '%s' must contain a valid port, ranging from %s to 65535."), $name, $first_port);
622	ef00af3c	Phil Davis	}
623	b398bbca	Martin Fuchs	return false;
624	8dc3ef67	Scott Ullrich	}
625
626	a28d40cb	jim-p	function openvpn_validate_cidr($value, $name, $multiple = false, $ipproto = "ipv4") {
627			$value = trim($value);
628			$error = false;
629	ef00af3c	Phil Davis	if (empty($value)) {
630	a28d40cb	jim-p	return false;
631	ef00af3c	Phil Davis	}
632	a28d40cb	jim-p	$networks = explode(',', $value);
633
634	ef00af3c	Phil Davis	if (!$multiple && (count($networks) > 1)) {
635	e8c516a0	Phil Davis	return sprintf(gettext("The field '%1\$s' must contain a single valid %2\$s CIDR range."), $name, $ipproto);
636	ef00af3c	Phil Davis	}
637	a28d40cb	jim-p
638			foreach ($networks as $network) {
639	ef00af3c	Phil Davis	if ($ipproto == "ipv4") {
640	a28d40cb	jim-p	$error = !openvpn_validate_cidr_ipv4($network);
641	ef00af3c	Phil Davis	} else {
642	a28d40cb	jim-p	$error = !openvpn_validate_cidr_ipv6($network);
643	ef00af3c	Phil Davis	}
644			if ($error) {
645	a28d40cb	jim-p	break;
646	ef00af3c	Phil Davis	}
647	a28d40cb	jim-p	}
648
649	ef00af3c	Phil Davis	if ($error) {
650	e8c516a0	Phil Davis	return sprintf(gettext("The field '%1\$s' must contain only valid %2\$s CIDR range(s) separated by commas."), $name, $ipproto);
651	ef00af3c	Phil Davis	} else {
652	a28d40cb	jim-p	return false;
653	ef00af3c	Phil Davis	}
654	a28d40cb	jim-p	}
655
656			function openvpn_validate_cidr_ipv4($value) {
657	8dc3ef67	Scott Ullrich	$value = trim($value);
658			if (!empty($value)) {
659			list($ip, $mask) = explode('/', $value);
660	ef00af3c	Phil Davis	if (!is_ipaddrv4($ip) or !is_numeric($mask) or ($mask > 32) or ($mask < 0)) {
661	a28d40cb	jim-p	return false;
662	ef00af3c	Phil Davis	}
663	8dc3ef67	Scott Ullrich	}
664	a28d40cb	jim-p	return true;
665			}
666
667			function openvpn_validate_cidr_ipv6($value) {
668			$value = trim($value);
669			if (!empty($value)) {
670			list($ipv6, $prefix) = explode('/', $value);
671	ef00af3c	Phil Davis	if (empty($prefix)) {
672	a28d40cb	jim-p	$prefix = "128";
673	ef00af3c	Phil Davis	}
674			if (!is_ipaddrv6($ipv6) or !is_numeric($prefix) or ($prefix > 128) or ($prefix < 0)) {
675	a28d40cb	jim-p	return false;
676	ef00af3c	Phil Davis	}
677	a28d40cb	jim-p	}
678			return true;
679	afb07cf1	Scott Ullrich	}
680
681	d799787e	Matthew Grooms	function openvpn_add_dhcpopts(& $settings, & $conf) {
682	afb07cf1	Scott Ullrich
683	ef00af3c	Phil Davis	if (!empty($settings['dns_domain'])) {
684	d799787e	Matthew Grooms	$conf .= "push \"dhcp-option DOMAIN {$settings['dns_domain']}\"\n";
685	ef00af3c	Phil Davis	}
686	add2e3f7	Scott Ullrich
687	ef00af3c	Phil Davis	if (!empty($settings['dns_server1'])) {
688	6a638752	jim-p	$dnstype = (is_ipaddrv6($settings['dns_server1'])) ? "DNS6" : "DNS";
689			$conf .= "push \"dhcp-option {$dnstype} {$settings['dns_server1']}\"\n";
690	ef00af3c	Phil Davis	}
691			if (!empty($settings['dns_server2'])) {
692	6a638752	jim-p	$dnstype = (is_ipaddrv6($settings['dns_server2'])) ? "DNS6" : "DNS";
693			$conf .= "push \"dhcp-option {$dnstype} {$settings['dns_server2']}\"\n";
694	ef00af3c	Phil Davis	}
695			if (!empty($settings['dns_server3'])) {
696	6a638752	jim-p	$dnstype = (is_ipaddrv6($settings['dns_server3'])) ? "DNS6" : "DNS";
697			$conf .= "push \"dhcp-option {$dnstype} {$settings['dns_server3']}\"\n";
698	ef00af3c	Phil Davis	}
699			if (!empty($settings['dns_server4'])) {
700	6a638752	jim-p	$dnstype = (is_ipaddrv6($settings['dns_server4'])) ? "DNS6" : "DNS";
701			$conf .= "push \"dhcp-option {$dnstype} {$settings['dns_server4']}\"\n";
702	ef00af3c	Phil Davis	}
703	f9927473	Scott Ullrich
704	01c2735c	jim-p	if (!empty($settings['push_blockoutsidedns'])) {
705			$conf .= "push \"block-outside-dns\"\n";
706			}
707	ef00af3c	Phil Davis	if (!empty($settings['push_register_dns'])) {
708	c38764dc	Dmitriy K.	$conf .= "push \"register-dns\"\n";
709	ef00af3c	Phil Davis	}
710	c38764dc	Dmitriy K.
711	ef00af3c	Phil Davis	if (!empty($settings['ntp_server1'])) {
712	c7f70dbc	Chris Buechler	$conf .= "push \"dhcp-option NTP {$settings['ntp_server1']}\"\n";
713	ef00af3c	Phil Davis	}
714			if (!empty($settings['ntp_server2'])) {
715	c7f70dbc	Chris Buechler	$conf .= "push \"dhcp-option NTP {$settings['ntp_server2']}\"\n";
716	ef00af3c	Phil Davis	}
717	f9927473	Scott Ullrich
718	d799787e	Matthew Grooms	if ($settings['netbios_enable']) {
719	add2e3f7	Scott Ullrich
720	ef00af3c	Phil Davis	if (!empty($settings['dhcp_nbttype']) && ($settings['dhcp_nbttype'] != 0)) {
721	095a95ae	Matthew Grooms	$conf .= "push \"dhcp-option NBT {$settings['dhcp_nbttype']}\"\n";
722	ef00af3c	Phil Davis	}
723			if (!empty($settings['dhcp_nbtscope'])) {
724	d799787e	Matthew Grooms	$conf .= "push \"dhcp-option NBS {$settings['dhcp_nbtscope']}\"\n";
725	ef00af3c	Phil Davis	}
726	8dc3ef67	Scott Ullrich
727	ef00af3c	Phil Davis	if (!empty($settings['wins_server1'])) {
728	d799787e	Matthew Grooms	$conf .= "push \"dhcp-option WINS {$settings['wins_server1']}\"\n";
729	ef00af3c	Phil Davis	}
730			if (!empty($settings['wins_server2'])) {
731	d799787e	Matthew Grooms	$conf .= "push \"dhcp-option WINS {$settings['wins_server2']}\"\n";
732	ef00af3c	Phil Davis	}
733	add2e3f7	Scott Ullrich
734	ef00af3c	Phil Davis	if (!empty($settings['nbdd_server1'])) {
735	d799787e	Matthew Grooms	$conf .= "push \"dhcp-option NBDD {$settings['nbdd_server1']}\"\n";
736	ef00af3c	Phil Davis	}
737	d799787e	Matthew Grooms	}
738	8dc3ef67	Scott Ullrich
739	ef00af3c	Phil Davis	if ($settings['gwredir']) {
740	d799787e	Matthew Grooms	$conf .= "push \"redirect-gateway def1\"\n";
741	ef00af3c	Phil Davis	}
742	37f05e97	jim-p	if ($settings['gwredir6']) {
743			$conf .= "push \"redirect-gateway ipv6\"\n";
744			}
745	d799787e	Matthew Grooms	}
746	24012690	Scott Ullrich
747	d799787e	Matthew Grooms	function openvpn_add_custom(& $settings, & $conf) {
748	add2e3f7	Scott Ullrich
749	d799787e	Matthew Grooms	if ($settings['custom_options']) {
750	8dc3ef67	Scott Ullrich
751	d799787e	Matthew Grooms	$options = explode(';', $settings['custom_options']);
752
753			if (is_array($options)) {
754	ef00af3c	Phil Davis	foreach ($options as $option) {
755	d799787e	Matthew Grooms	$conf .= "$option\n";
756	ef00af3c	Phil Davis	}
757			} else {
758	d799787e	Matthew Grooms	$conf .= "{$settings['custom_options']}\n";
759	ef00af3c	Phil Davis	}
760	add2e3f7	Scott Ullrich	}
761			}
762
763	691fbf14	Ermal Lu?i	function openvpn_add_keyfile(& $data, & $conf, $mode_id, $directive, $opt = "") {
764	d799787e	Matthew Grooms	global $g;
765	add2e3f7	Scott Ullrich
766	348c2af1	jim-p	$fpath = "{$g['openvpn_base']}/{$mode_id}/{$directive}";
767	a8f538a8	jim-p	openvpn_create_dirs();
768	d799787e	Matthew Grooms	file_put_contents($fpath, base64_decode($data));
769	f9ac3784	Ermal Lu?i	//chown($fpath, 'nobody');
770			//chgrp($fpath, 'nobody');
771	6f27412f	Ermal Lu?i	@chmod($fpath, 0600);
772	d799787e	Matthew Grooms
773	691fbf14	Ermal Lu?i	$conf .= "{$directive} {$fpath} {$opt}\n";
774	4eefa6e8	Scott Ullrich	}
775
776	fc05822b	jim-p	function openvpn_reconfigure($mode, $settings) {
777	99d7e8c1	jim-p	global $g, $config, $openvpn_tls_server_modes, $openvpn_dh_lengths, $openvpn_default_keepalive_interval, $openvpn_default_keepalive_timeout;
778	afb07cf1	Scott Ullrich
779	ef00af3c	Phil Davis	if (empty($settings)) {
780	93a0a028	Ermal Luçi	return;
781	ef00af3c	Phil Davis	}
782			if (isset($settings['disable'])) {
783	4eefa6e8	Scott Ullrich	return;
784	ef00af3c	Phil Davis	}
785	a8f538a8	jim-p	openvpn_create_dirs();
786	fdd725f0	Ermal Luçi	/*
787	d799787e	Matthew Grooms	* NOTE: Deleting tap devices causes spontaneous reboots. Instead,
788			* we use a vpnid number which is allocated for a particular client
789			* or server configuration. ( see openvpn_vpnid_next() )
790	fdd725f0	Ermal Luçi	*/
791	8874c692	Ermal Luçi
792	d799787e	Matthew Grooms	$vpnid = $settings['vpnid'];
793			$mode_id = $mode.$vpnid;
794	8874c692	Ermal Luçi
795	ef00af3c	Phil Davis	if (isset($settings['dev_mode'])) {
796	4936ff53	jim-p	$tunname = "{$settings['dev_mode']}{$vpnid}";
797	ef00af3c	Phil Davis	} else {
798			/* defaults to tun */
799	bd7ca506	jim-p	$tunname = "tun{$vpnid}";
800	4936ff53	jim-p	$settings['dev_mode'] = "tun";
801	691fbf14	Ermal Lu?i	}
802
803	ef00af3c	Phil Davis	if ($mode == "server") {
804	bd7ca506	jim-p	$devname = "ovpns{$vpnid}";
805	ef00af3c	Phil Davis	} else {
806	bd7ca506	jim-p	$devname = "ovpnc{$vpnid}";
807	ef00af3c	Phil Davis	}
808	8874c692	Ermal Luçi
809	bd7ca506	jim-p	/* is our device already configured */
810	4a97aa34	Ermal	if (!does_interface_exist($devname)) {
811	dc408939	Matthew Grooms
812	bd7ca506	jim-p	/* create the tap device if required */
813	ef00af3c	Phil Davis	if (!file_exists("/dev/{$tunname}")) {
814	873c1701	Renato Botelho	exec("/sbin/ifconfig " . escapeshellarg($tunname) . " create");
815	ef00af3c	Phil Davis	}
816	98872d89	Ermal Luçi
817	bd7ca506	jim-p	/* rename the device */
818	873c1701	Renato Botelho	mwexec("/sbin/ifconfig " . escapeshellarg($tunname) . " name " . escapeshellarg($devname));
819	095a95ae	Matthew Grooms
820	4ab1ffa0	Renato Botelho	/* add the device to the openvpn group and make sure it's UP*/
821			mwexec("/sbin/ifconfig " . escapeshellarg($devname) . " group openvpn up");
822	da4f91a9	Renato Botelho
823	bd1a6267	Renato Botelho	$ifname = convert_real_interface_to_friendly_interface_name($devname);
824			$grouptmp = link_interface_to_group($ifname);
825	ef00af3c	Phil Davis	if (!empty($grouptmp)) {
826	bd1a6267	Renato Botelho	array_walk($grouptmp, 'interface_group_add_member');
827	ef00af3c	Phil Davis	}
828	bd1a6267	Renato Botelho	unset($grouptmp, $ifname);
829	dc408939	Matthew Grooms	}
830	d799787e	Matthew Grooms
831	dc408939	Matthew Grooms	$pfile = $g['varrun_path'] . "/openvpn_{$mode_id}.pid";
832	6714bbdc	jim-p	$proto = strtolower($settings['protocol']);
833	ef00af3c	Phil Davis	if (substr($settings['protocol'], 0, 3) == "TCP") {
834	6714bbdc	jim-p	$proto = "{$proto}-{$mode}";
835	ef00af3c	Phil Davis	}
836	4936ff53	jim-p	$dev_mode = $settings['dev_mode'];
837	189edaf3	jim-p	$fbcipher = $settings['data_ciphers_fallback'];
838	97d5b59b	jim-p	// OpenVPN defaults to SHA1, so use it when unset to maintain compatibility.
839			$digest = !empty($settings['digest']) ? $settings['digest'] : "SHA1";
840	d799787e	Matthew Grooms
841	47c48e28	smos	$interface = get_failover_interface($settings['interface']);
842	e27bc6cf	Phil Davis	// The IP address in the settings can be an IPv4 or IPv6 address associated with the interface
843	d7a0c22a	bcyrill	$ipaddr = $settings['ipaddr'];
844	d799787e	Matthew Grooms
845	67b0902f	pierrepomes	// If a specific ip address (VIP) is requested, use it.
846			// Otherwise, if a specific interface is requested, use it
847	ef00af3c	Phil Davis	// If "any" interface was selected, local directive will be omitted.
848	97ffc513	Seth Mos	if (is_ipaddrv4($ipaddr)) {
849	4de8f7ba	Phil Davis	$iface_ip = $ipaddr;
850	af0257cf	Renato Botelho	} elseif (!empty($interface) && strcmp($interface, "any")) {
851	51e7132e	Renato Botelho	$iface_ip=get_interface_ip($interface);
852	47c48e28	smos	}
853	e27bc6cf	Phil Davis	if (is_ipaddrv6($ipaddr)) {
854	6c07db48	Phil Davis	$iface_ipv6 = $ipaddr;
855	af0257cf	Renato Botelho	} elseif (!empty($interface) && strcmp($interface, "any")) {
856	51e7132e	Renato Botelho	$iface_ipv6=get_interface_ipv6($interface);
857	3d06e8f0	pierrepomes	}
858	d799787e	Matthew Grooms
859	b1e8e675	Dmitriy K.	$conf = "dev {$devname}\n";
860	5b3c0116	Dmitriy K.	if (isset($settings['verbosity_level'])) {
861	b1e8e675	Dmitriy K.	$conf .= "verb {$settings['verbosity_level']}\n";
862	5b3c0116	Dmitriy K.	}
863	42bb1bee	Renato Botelho
864	4936ff53	jim-p	$conf .= "dev-type {$settings['dev_mode']}\n";
865	bd7ca506	jim-p	$conf .= "dev-node /dev/{$tunname}\n";
866	3c11bd3c	Matthew Grooms	$conf .= "writepid {$pfile}\n";
867			$conf .= "#user nobody\n";
868			$conf .= "#group nobody\n";
869	d1014c18	Chris Buechler	$conf .= "script-security 3\n";
870	3c11bd3c	Matthew Grooms	$conf .= "daemon\n";
871	3bfecc81	Renato Botelho do Couto
872			if (!empty($settings['inactive_seconds'])) {
873			$conf .= "inactive {$settings['inactive_seconds']}\n";
874			}
875
876			if (!empty($settings['ping_method']) &&
877			$settings['ping_method'] == 'ping') {
878			$conf .= "ping {$settings['ping_seconds']}\n";
879
880			if (!empty($settings['ping_push'])) {
881			$conf .= "push \"ping {$settings['ping_seconds']}\"\n";
882			}
883
884			$action = str_replace("_", "-", $settings['ping_action']);
885			$conf .= "{$action} {$settings['ping_action_seconds']}\n";
886
887			if (!empty($settings['ping_action_push'])) {
888			$conf .= "push \"{$action} " .
889			"{$settings['ping_action_seconds']}\"\n";
890			}
891			} else {
892			$conf .= "keepalive " .
893			($settings['keepalive_interval']
894			?: $openvpn_default_keepalive_interval) . " " .
895			($settings['keepalive_timeout']
896			?: $openvpn_default_keepalive_timeout) . "\n";
897			}
898
899	3c11bd3c	Matthew Grooms	$conf .= "ping-timer-rem\n";
900			$conf .= "persist-tun\n";
901			$conf .= "persist-key\n";
902			$conf .= "proto {$proto}\n";
903	97d5b59b	jim-p	$conf .= "auth {$digest}\n";
904	8d964cea	Ermal	$conf .= "up /usr/local/sbin/ovpn-linkup\n";
905			$conf .= "down /usr/local/sbin/ovpn-linkdown\n";
906	1492e02c	Ermal	if (file_exists("/usr/local/sbin/openvpn.attributes.sh")) {
907	ef00af3c	Phil Davis	switch ($settings['mode']) {
908	a1b9105b	jim-p	case 'server_user':
909			case 'server_tls_user':
910			$conf .= "client-connect /usr/local/sbin/openvpn.attributes.sh\n";
911			$conf .= "client-disconnect /usr/local/sbin/openvpn.attributes.sh\n";
912			break;
913			}
914	1492e02c	Ermal	}
915	4f4de341	Lorenz Schori	if ($settings['dev_mode'] === 'tun' && isset($config['unbound']['enable']) && isset($config['unbound']['regovpnclients'])) {
916	3b88d971	Viktor G	if (($settings['mode'] == 'server_tls') \|\| ($settings['mode'] == 'server_tls_user') \|\|
917			(($settings['mode'] == 'server_user') && ($settings['username_as_common_name'] == 'enabled'))) {
918			$domain = !empty($settings['dns_domain']) ? $settings['dns_domain'] : $config['system']['domain'];
919			if (is_domain($domain)) {
920			$conf .= "learn-address \"/usr/local/sbin/openvpn.learn-address.sh $domain\"\n";
921			}
922	0cc17a06	Lorenz Schori	}
923			}
924	3c11bd3c	Matthew Grooms
925	5280fd8d	Renato Botelho	/*
926			* When binding specific address, wait cases where interface is in
927			* tentative state otherwise it will fail
928			*/
929			$wait_tentative = false;
930
931	6714bbdc	jim-p	/* Determine the local IP to use - and make sure it matches with the selected protocol. */
932	ca366676	jim-p	switch ($settings['protocol']) {
933			case 'UDP':
934			case 'TCP':
935			$conf .= "multihome\n";
936			break;
937			case 'UDP4':
938			case 'TCP4':
939			if (is_ipaddrv4($iface_ip)) {
940			$conf .= "local {$iface_ip}\n";
941			}
942			if ($settings['interface'] == "any") {
943			$conf .= "multihome\n";
944			}
945			break;
946			case 'UDP6':
947			case 'TCP6':
948			if (is_ipaddrv6($iface_ipv6)) {
949			$conf .= "local {$iface_ipv6}\n";
950	5280fd8d	Renato Botelho	$wait_tentative = true;
951	ca366676	jim-p	}
952			if ($settings['interface'] == "any") {
953			$conf .= "multihome\n";
954			}
955			break;
956			default:
957	97ffc513	Seth Mos	}
958	d799787e	Matthew Grooms
959	ef00af3c	Phil Davis	if (openvpn_validate_engine($settings['engine']) && ($settings['engine'] != "none")) {
960	582c58ae	jim-p	$conf .= "engine {$settings['engine']}\n";
961	ef00af3c	Phil Davis	}
962	582c58ae	jim-p
963	67b0902f	pierrepomes	// server specific settings
964	8dc3ef67	Scott Ullrich	if ($mode == 'server') {
965	d799787e	Matthew Grooms
966	966cdb43	jim-p	list($ip, $cidr) = explode('/', trim($settings['tunnel_network']));
967			list($ipv6, $prefix) = explode('/', trim($settings['tunnel_networkv6']));
968	5dc6c910	jim-p	$mask = gen_subnet_mask($cidr);
969	8dc3ef67	Scott Ullrich
970	3c11bd3c	Matthew Grooms	// configure tls modes
971	ef00af3c	Phil Davis	switch ($settings['mode']) {
972	3c11bd3c	Matthew Grooms	case 'p2p_tls':
973			case 'server_tls':
974	e62e2f8b	Ermal Lu?i	case 'server_user':
975	3c11bd3c	Matthew Grooms	case 'server_tls_user':
976	d799787e	Matthew Grooms	$conf .= "tls-server\n";
977	3c11bd3c	Matthew Grooms	break;
978	8dc3ef67	Scott Ullrich	}
979	d799787e	Matthew Grooms
980	3c11bd3c	Matthew Grooms	// configure p2p/server modes
981	ef00af3c	Phil Davis	switch ($settings['mode']) {
982	6c9cf466	jim-p	case 'p2p_tls':
983	5dc6c910	jim-p	// If the CIDR is less than a /30, OpenVPN will complain if you try to
984			// use the server directive. It works for a single client without it.
985			// See ticket #1417
986	4af6affa	jim-p	if ((!empty($ip) && !empty($mask)) \|\|
987			(!empty($ipv6) && !empty($prefix))) {
988			$add_ccd = false;
989			if (is_ipaddr($ip) && ($cidr < 30)) {
990			$add_ccd = true;
991			$conf .= "server {$ip} {$mask}\n";
992			}
993	ef00af3c	Phil Davis	if (is_ipaddr($ipv6)) {
994	4af6affa	jim-p	$add_ccd = true;
995	a0e3ee98	jim-p	$conf .= "server-ipv6 {$ipv6}/{$prefix}\n";
996	ef00af3c	Phil Davis	}
997	4af6affa	jim-p	if ($add_ccd) {
998			$conf .= "client-config-dir {$g['openvpn_base']}/server{$vpnid}/csc\n";
999			}
1000	5dc6c910	jim-p	}
1001	3c11bd3c	Matthew Grooms	case 'p2p_shared_key':
1002	74a556a3	jim-p	if (!empty($ip) && !empty($mask)) {
1003	30c8a290	Renato Botelho	list($ip1, $ip2) = openvpn_get_interface_ip($ip, $cidr);
1004	ef00af3c	Phil Davis	if ($settings['dev_mode'] == 'tun') {
1005	459e9333	jim-p	$conf .= "ifconfig {$ip1} {$ip2}\n";
1006	ef00af3c	Phil Davis	} else {
1007	459e9333	jim-p	$conf .= "ifconfig {$ip1} {$mask}\n";
1008	ef00af3c	Phil Davis	}
1009	1ab6bdb5	jim-p	}
1010	a0e3ee98	jim-p	if (!empty($ipv6) && !empty($prefix)) {
1011	91c44185	jim-p	list($ipv6_1, $ipv6_2) = openvpn_get_interface_ipv6($ipv6, $prefix);
1012	ef00af3c	Phil Davis	if ($settings['dev_mode'] == 'tun') {
1013	a0e3ee98	jim-p	$conf .= "ifconfig-ipv6 {$ipv6_1} {$ipv6_2}\n";
1014	ef00af3c	Phil Davis	} else {
1015	60f501ec	Phil Davis	$conf .= "ifconfig-ipv6 {$ipv6_1} {$prefix}\n";
1016	ef00af3c	Phil Davis	}
1017	a0e3ee98	jim-p	}
1018	3c11bd3c	Matthew Grooms	break;
1019			case 'server_tls':
1020			case 'server_user':
1021			case 'server_tls_user':
1022	4af6affa	jim-p	if ((!empty($ip) && !empty($mask)) \|\|
1023			(!empty($ipv6) && !empty($prefix))) {
1024			if (is_ipaddr($ip)) {
1025			$conf .= "server {$ip} {$mask}\n";
1026			}
1027	ef00af3c	Phil Davis	if (is_ipaddr($ipv6)) {
1028	1ab6bdb5	jim-p	$conf .= "server-ipv6 {$ipv6}/{$prefix}\n";
1029	ef00af3c	Phil Davis	}
1030	348c2af1	jim-p	$conf .= "client-config-dir {$g['openvpn_base']}/server{$vpnid}/csc\n";
1031	1ab6bdb5	jim-p	} else {
1032			if ($settings['serverbridge_dhcp']) {
1033			if ((!empty($settings['serverbridge_interface'])) && (strcmp($settings['serverbridge_interface'], "none"))) {
1034			$biface_ip=get_interface_ip($settings['serverbridge_interface']);
1035			$biface_sm=gen_subnet_mask(get_interface_subnet($settings['serverbridge_interface']));
1036			if (is_ipaddrv4($biface_ip) && is_ipaddrv4($settings['serverbridge_dhcp_start']) && is_ipaddrv4($settings['serverbridge_dhcp_end'])) {
1037			$conf .= "server-bridge {$biface_ip} {$biface_sm} {$settings['serverbridge_dhcp_start']} {$settings['serverbridge_dhcp_end']}\n";
1038	348c2af1	jim-p	$conf .= "client-config-dir {$g['openvpn_base']}/server{$vpnid}/csc\n";
1039	1ab6bdb5	jim-p	} else {
1040			$conf .= "mode server\n";
1041			}
1042	498f7e20	jim-p	if (!empty($settings['serverbridge_routegateway']) && is_ipaddrv4($biface_ip)) {
1043			$conf .= "push \"route-gateway {$biface_ip}\"\n";
1044			}
1045			/* OpenVPN doesn't support this yet, clients do not recognize the option fully.
1046			$biface_ip6=get_interface_ipv6($settings['serverbridge_interface']);
1047			if (!empty($settings['serverbridge_routegateway']) && is_ipaddrv6($biface_ip6)) {
1048			$conf .= "push \"route-ipv6-gateway {$biface_ip6}\"\n";
1049			}
1050			*/
1051	1ab6bdb5	jim-p	} else {
1052			$conf .= "mode server\n";
1053			}
1054			}
1055			}
1056	3c11bd3c	Matthew Grooms	break;
1057	8dc3ef67	Scott Ullrich	}
1058
1059	3c11bd3c	Matthew Grooms	// configure user auth modes
1060	ef00af3c	Phil Davis	switch ($settings['mode']) {
1061	3c11bd3c	Matthew Grooms	case 'server_user':
1062	4cfd15a9	jim-p	$conf .= "verify-client-cert none\n";
1063	3c11bd3c	Matthew Grooms	case 'server_tls_user':
1064	9eced774	jim-p	/* username-as-common-name is not compatible with server-bridge */
1065	e5c4f2a7	jim-p	if ((stristr($conf, "server-bridge") === false) &&
1066			($settings['username_as_common_name'] != 'disabled')) {
1067	9eced774	jim-p	$conf .= "username-as-common-name\n";
1068	ef00af3c	Phil Davis	}
1069	8a47c190	Ermal Lu?i	if (!empty($settings['authmode'])) {
1070	5e28dad4	Ermal	$strictusercn = "false";
1071	ef00af3c	Phil Davis	if ($settings['strictusercn']) {
1072	5e28dad4	Ermal	$strictusercn = "true";
1073	ef00af3c	Phil Davis	}
1074	db30293e	Phil DeMonaco	$conf .= "plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-script.so /usr/local/sbin/ovpn_auth_verify_async user " . base64_encode($settings['authmode']) . " {$strictusercn} {$mode_id} {$settings['local_port']}\n";
1075	e8a58de4	Ermal Lu?i	}
1076	3c11bd3c	Matthew Grooms	break;
1077	8dc3ef67	Scott Ullrich	}
1078	ef00af3c	Phil Davis	if (!isset($settings['cert_depth']) && (strstr($settings['mode'], 'tls'))) {
1079	41936acc	jim-p	$settings['cert_depth'] = 1;
1080	ef00af3c	Phil Davis	}
1081	98963f27	jim-p	if (is_numeric($settings['cert_depth'])) {
1082	ef00af3c	Phil Davis	if (($mode == 'client') && empty($settings['certref'])) {
1083	2da48592	jim-p	$cert = "";
1084	ef00af3c	Phil Davis	} else {
1085	2da48592	jim-p	$cert = lookup_cert($settings['certref']);
1086			/* XXX: Seems not used at all! */
1087			$servercn = urlencode(cert_get_cn($cert['crt']));
1088			$conf .= "tls-verify \"/usr/local/sbin/ovpn_auth_verify tls '{$servercn}' {$settings['cert_depth']}\"\n";
1089			}
1090	98963f27	jim-p	}
1091	8dc3ef67	Scott Ullrich
1092	63084885	Matthew Grooms	// The local port to listen on
1093	d799787e	Matthew Grooms	$conf .= "lport {$settings['local_port']}\n";
1094	c0cf27aa	Scott Ullrich
1095	63084885	Matthew Grooms	// The management port to listen on
1096	71ca2cb2	Ermal	// Use unix socket to overcome the problem on any type of server
1097	348c2af1	jim-p	$conf .= "management {$g['openvpn_base']}/{$mode_id}/sock unix\n";
1098	71ca2cb2	Ermal	//$conf .= "management 127.0.0.1 {$settings['local_port']}\n";
1099	63084885	Matthew Grooms
1100	ef00af3c	Phil Davis	if ($settings['maxclients']) {
1101	d799787e	Matthew Grooms	$conf .= "max-clients {$settings['maxclients']}\n";
1102	ef00af3c	Phil Davis	}
1103	d799787e	Matthew Grooms
1104	37f05e97	jim-p	// Can we push routes, and should we?
1105			if ($settings['local_network'] && !$settings['gwredir']) {
1106	a28d40cb	jim-p	$conf .= openvpn_gen_routes($settings['local_network'], "ipv4", true);
1107	3c11bd3c	Matthew Grooms	}
1108	37f05e97	jim-p	if ($settings['local_networkv6'] && !$settings['gwredir6']) {
1109	a28d40cb	jim-p	$conf .= openvpn_gen_routes($settings['local_networkv6'], "ipv6", true);
1110	787de45a	Seth Mos	}
1111	3c11bd3c	Matthew Grooms
1112	ef00af3c	Phil Davis	switch ($settings['mode']) {
1113	3c11bd3c	Matthew Grooms	case 'server_tls':
1114			case 'server_user':
1115			case 'server_tls_user':
1116	5d8cd81a	jim-p	// Configure client dhcp options
1117	3c11bd3c	Matthew Grooms	openvpn_add_dhcpopts($settings, $conf);
1118	ef00af3c	Phil Davis	if ($settings['client2client']) {
1119	5d8cd81a	jim-p	$conf .= "client-to-client\n";
1120	ef00af3c	Phil Davis	}
1121	3c11bd3c	Matthew Grooms	break;
1122			}
1123	4e42da90	Renato Botelho do Couto	if ($settings['mode'] != 'p2p_shared_key' &&
1124			isset($settings['duplicate_cn'])) {
1125	bca35cff	jim-p	$conf .= "duplicate-cn\n";
1126	ef00af3c	Phil Davis	}
1127	d799787e	Matthew Grooms	}
1128
1129	3c11bd3c	Matthew Grooms	// client specific settings
1130	d799787e	Matthew Grooms
1131	3c11bd3c	Matthew Grooms	if ($mode == 'client') {
1132	d799787e	Matthew Grooms
1133	3c11bd3c	Matthew Grooms	// configure p2p mode
1134	ef00af3c	Phil Davis	switch ($settings['mode']) {
1135	3c11bd3c	Matthew Grooms	case 'p2p_tls':
1136			$conf .= "tls-client\n";
1137			case 'shared_key':
1138			$conf .= "client\n";
1139			break;
1140			}
1141	d799787e	Matthew Grooms
1142	e3924384	jim-p	// If there is no bind option at all (ip and/or port), add "nobind" directive
1143	42bb1bee	Renato Botelho	// Otherwise, use the local port if defined, failing that, use lport 0 to
1144	e3924384	jim-p	// ensure a random source port.
1145	b42ccf15	jim-p	if ((empty($iface_ip)) && empty($iface_ipv6) && (!$settings['local_port'])) {
1146	e3924384	jim-p	$conf .= "nobind\n";
1147	ef00af3c	Phil Davis	} elseif ($settings['local_port']) {
1148	e3924384	jim-p	$conf .= "lport {$settings['local_port']}\n";
1149	ef00af3c	Phil Davis	} else {
1150	e3924384	jim-p	$conf .= "lport 0\n";
1151	ef00af3c	Phil Davis	}
1152	5708241f	jim-p
1153	4b887ef4	jim-p	// Use unix socket to overcome the problem on any type of server
1154	348c2af1	jim-p	$conf .= "management {$g['openvpn_base']}/{$mode_id}/sock unix\n";
1155	48a458d2	pierrepomes
1156	3c11bd3c	Matthew Grooms	// The remote server
1157	bd1291d0	Viktor Gurov	$remoteproto = strtolower($settings['protocol']);
1158	6ac20ad3	Viktor G	if (substr($remoteproto, 0, 3) == "tcp") {
1159			$remoteproto .= "-{$mode}";
1160			}
1161	bd1291d0	Viktor Gurov	$conf .= "remote {$settings['server_addr']} {$settings['server_port']} {$remoteproto}\n";
1162	3c11bd3c	Matthew Grooms
1163	ef00af3c	Phil Davis	if (!empty($settings['use_shaper'])) {
1164	d799787e	Matthew Grooms	$conf .= "shaper {$settings['use_shaper']}\n";
1165	ef00af3c	Phil Davis	}
1166	ee506044	Scott Ullrich
1167	d799787e	Matthew Grooms	if (!empty($settings['tunnel_network'])) {
1168	966cdb43	jim-p	list($ip, $cidr) = explode('/', trim($settings['tunnel_network']));
1169	30c8a290	Renato Botelho	$mask = gen_subnet_mask($cidr);
1170	636918c9	Chris Buechler	list($ip1, $ip2) = openvpn_get_interface_ip($ip, $cidr);
1171	ef00af3c	Phil Davis	if ($settings['dev_mode'] == 'tun') {
1172	459e9333	jim-p	$conf .= "ifconfig {$ip2} {$ip1}\n";
1173	ef00af3c	Phil Davis	} else {
1174	459e9333	jim-p	$conf .= "ifconfig {$ip2} {$mask}\n";
1175	ef00af3c	Phil Davis	}
1176	8dc3ef67	Scott Ullrich	}
1177	d799787e	Matthew Grooms
1178	a0e3ee98	jim-p	if (!empty($settings['tunnel_networkv6'])) {
1179	966cdb43	jim-p	list($ipv6, $prefix) = explode('/', trim($settings['tunnel_networkv6']));
1180	91c44185	jim-p	list($ipv6_1, $ipv6_2) = openvpn_get_interface_ipv6($ipv6, $prefix);
1181	ef00af3c	Phil Davis	if ($settings['dev_mode'] == 'tun') {
1182	a0e3ee98	jim-p	$conf .= "ifconfig-ipv6 {$ipv6_2} {$ipv6_1}\n";
1183	ef00af3c	Phil Davis	} else {
1184	60f501ec	Phil Davis	$conf .= "ifconfig-ipv6 {$ipv6_2} {$prefix}\n";
1185	ef00af3c	Phil Davis	}
1186	a0e3ee98	jim-p	}
1187
1188	a6d55c23	Chris Buechler	if (($settings['auth_user'] \|\| $settings['auth_pass']) && $settings['mode'] == "p2p_tls") {
1189	348c2af1	jim-p	$up_file = "{$g['openvpn_base']}/{$mode_id}/up";
1190	5f242576	PiBa-NL	$conf .= "auth-user-pass {$up_file}\n";
1191	a69a9182	jim-p	if (!$settings['auth-retry-none']) {
1192			$conf .= "auth-retry nointeract\n";
1193			}
1194	7304c023	Phil Davis	if ($settings['auth_user']) {
1195	4de8f7ba	Phil Davis	$userpass = "{$settings['auth_user']}\n";
1196	7304c023	Phil Davis	} else {
1197			$userpass = "";
1198			}
1199			if ($settings['auth_pass']) {
1200	4de8f7ba	Phil Davis	$userpass .= "{$settings['auth_pass']}\n";
1201	7304c023	Phil Davis	}
1202			// If only auth_pass is given, then it acts like a user name and we put a blank line where pass would normally go.
1203			if (!($settings['auth_user'] && $settings['auth_pass'])) {
1204			$userpass .= "\n";
1205			}
1206	5f242576	PiBa-NL	file_put_contents($up_file, $userpass);
1207			}
1208	42bb1bee	Renato Botelho
1209	762a24a3	Ermal Lu?i	if ($settings['proxy_addr']) {
1210			$conf .= "http-proxy {$settings['proxy_addr']} {$settings['proxy_port']}";
1211			if ($settings['proxy_authtype'] != "none") {
1212	348c2af1	jim-p	$conf .= " {$g['openvpn_base']}/{$mode_id}/proxy_auth {$settings['proxy_authtype']}";
1213	762a24a3	Ermal Lu?i	$proxypas = "{$settings['proxy_user']}\n";
1214			$proxypas .= "{$settings['proxy_passwd']}\n";
1215	348c2af1	jim-p	file_put_contents("{$g['openvpn_base']}/{$mode_id}/proxy_auth", $proxypas);
1216	762a24a3	Ermal Lu?i	}
1217			$conf .= " \n";
1218			}
1219	8dc3ef67	Scott Ullrich	}
1220
1221	17c98ba9	jim-p	// Add a remote network route if set, and only for p2p modes.
1222	54285411	jim-p	if ((substr($settings['mode'], 0, 3) == "p2p") && (openvpn_validate_cidr($settings['remote_network'], "", true, "ipv4") === FALSE)) {
1223	a28d40cb	jim-p	$conf .= openvpn_gen_routes($settings['remote_network'], "ipv4", false);
1224	8dc3ef67	Scott Ullrich	}
1225	4856df9b	jim-p	// Add a remote network route if set, and only for p2p modes.
1226	54285411	jim-p	if ((substr($settings['mode'], 0, 3) == "p2p") && (openvpn_validate_cidr($settings['remote_networkv6'], "", true, "ipv6") === FALSE)) {
1227	a28d40cb	jim-p	$conf .= openvpn_gen_routes($settings['remote_networkv6'], "ipv6", false);
1228	4856df9b	jim-p	}
1229	afb07cf1	Scott Ullrich
1230	d799787e	Matthew Grooms	// Write the settings for the keys
1231	ef00af3c	Phil Davis	switch ($settings['mode']) {
1232	3c11bd3c	Matthew Grooms	case 'p2p_shared_key':
1233			openvpn_add_keyfile($settings['shared_key'], $conf, $mode_id, "secret");
1234			break;
1235			case 'p2p_tls':
1236			case 'server_tls':
1237			case 'server_tls_user':
1238	e62e2f8b	Ermal Lu?i	case 'server_user':
1239	348c2af1	jim-p	// ca_chain_array() expects parameter to be passed by reference.
1240	179377b0	robjarsen	// avoid passing the whole settings array, as param names or
1241			// types might change in future releases.
1242			$param = array('caref' => $settings['caref']);
1243	348c2af1	jim-p	$cas = ca_chain_array($param);
1244			$capath = "{$g['openvpn_base']}/{$mode_id}/ca";
1245			/* Cleanup old CA/CRL references */
1246			@unlink_if_exists("{$capath}.*0");
1247			/* Find the CRL listed in the settings */
1248			if (!empty($settings['crlref'])) {
1249			$crl = lookup_crl($settings['crlref']);
1250			crl_update($crl);
1251			}
1252			/* For each CA in the chain, setup the CApath */
1253			foreach ($cas as $ca) {
1254			ca_setup_capath($ca, $capath, $crl);
1255			}
1256			$conf .= "capath {$capath}\n";
1257			unset($cas, $param);
1258	2da48592	jim-p
1259			if (!empty($settings['certref'])) {
1260			$cert = lookup_cert($settings['certref']);
1261			openvpn_add_keyfile($cert['crt'], $conf, $mode_id, "cert");
1262			openvpn_add_keyfile($cert['prv'], $conf, $mode_id, "key");
1263			}
1264	ef00af3c	Phil Davis	if ($mode == 'server') {
1265	f888c35a	jim-p	if (is_numeric($settings['dh_length'])) {
1266	c6668aba	Phil Davis	if (!in_array($settings['dh_length'], array_keys($openvpn_dh_lengths))) {
1267	f888c35a	jim-p	/* The user selected a DH parameter length that does not have a corresponding file. */
1268			log_error(gettext("Failed to construct OpenVPN server configuration. The selected DH Parameter length cannot be used."));
1269			return;
1270			}
1271			$dh_file = "{$g['etc_path']}/dh-parameters.{$settings['dh_length']}";
1272			} else {
1273			$dh_file = $settings['dh_length'];
1274			}
1275			$conf .= "dh {$dh_file}\n";
1276			if (!empty($settings['ecdh_curve']) && ($settings['ecdh_curve'] != "none") && openvpn_validate_curve($settings['ecdh_curve'])) {
1277			$conf .= "ecdh-curve {$settings['ecdh_curve']}\n";
1278			}
1279	ef00af3c	Phil Davis	}
1280	db746ce2	Ermal Lu?i	if ($settings['tls']) {
1281	c854afcc	jim-p	if ($settings['tls_type'] == "crypt") {
1282			$tls_directive = "tls-crypt";
1283			$tlsopt = "";
1284	ef00af3c	Phil Davis	} else {
1285	c854afcc	jim-p	$tls_directive = "tls-auth";
1286			if ($mode == "server") {
1287	8698f918	Vito Piserchia	switch($settings['tlsauth_keydir']){
1288			case '1':
1289			$tlsopt = 1;
1290			break;
1291			case '2':
1292			$tlsopt = '';
1293			break;
1294			default:
1295			$tlsopt = 0;
1296			break;
1297			}
1298	c854afcc	jim-p	} else {
1299	8698f918	Vito Piserchia	switch($settings['tlsauth_keydir']){
1300			case '0':
1301			$tlsopt = 0;
1302			break;
1303			case '2':
1304			$tlsopt = '';
1305			break;
1306			default:
1307			$tlsopt = 1;
1308			break;
1309			}
1310	c854afcc	jim-p	}
1311	ef00af3c	Phil Davis	}
1312	c854afcc	jim-p	openvpn_add_keyfile($settings['tls'], $conf, $mode_id, $tls_directive, $tlsopt);
1313	db746ce2	Ermal Lu?i	}
1314	3c11bd3c	Matthew Grooms	break;
1315	8dc3ef67	Scott Ullrich	}
1316
1317	924eeefb	jim-p	/* Data encryption cipher support.
1318			* If it is not set, assume enabled since that is OpenVPN's default.
1319			* Note that diabling this is now deprecated and will be removed in a future version of OpenVPN */
1320			if ($settings['ncp_enable'] == "disabled") {
1321			$conf .= "ncp-disable\n";
1322			$conf .= "cipher {$fbcipher}\n";
1323			} else {
1324			$conf .= "data-ciphers " . str_replace(',', ':', openvpn_build_data_cipher_list($settings['data_ciphers'], $fbcipher)) . "\n";
1325			$conf .= "data-ciphers-fallback {$fbcipher}\n";
1326			}
1327
1328	56e031a7	jim-p	if (!empty($settings['allow_compression'])) {
1329			$conf .= "allow-compression {$settings['allow_compression']}\n";
1330			}
1331
1332	a4b36246	jim-p	$compression = "";
1333			switch ($settings['compression']) {
1334	38922574	jim-p	case 'none':
1335			$settings['compression'] = '';
1336	a4b36246	jim-p	case 'lz4':
1337			case 'lz4-v2':
1338			case 'lzo':
1339			case 'stub':
1340	38922574	jim-p	case 'stub-v2':
1341	a4b36246	jim-p	$compression .= "compress {$settings['compression']}";
1342			break;
1343			case 'noadapt':
1344			$compression .= "comp-noadapt";
1345			break;
1346			case 'adaptive':
1347			case 'yes':
1348			case 'no':
1349			$compression .= "comp-lzo {$settings['compression']}";
1350			break;
1351			default:
1352			/* Add nothing to the configuration */
1353			break;
1354			}
1355
1356	16fe7982	jim-p	if (($settings['allow_compression'] != 'no') &&
1357			!empty($compression)) {
1358	a4b36246	jim-p	$conf .= "{$compression}\n";
1359			if ($settings['compression_push']) {
1360			$conf .= "push \"{$compression}\"\n";
1361	9446ee68	jim-p	}
1362	ef00af3c	Phil Davis	}
1363	d799787e	Matthew Grooms
1364	ef00af3c	Phil Davis	if ($settings['passtos']) {
1365	d799787e	Matthew Grooms	$conf .= "passtos\n";
1366	ef00af3c	Phil Davis	}
1367	d799787e	Matthew Grooms
1368	919a0f4a	jim-p	if ($mode == 'client') {
1369	30640018	Chris Buechler	$conf .= "resolv-retry infinite\n";
1370	ef00af3c	Phil Davis	}
1371	d799787e	Matthew Grooms
1372			if ($settings['dynamic_ip']) {
1373			$conf .= "persist-remote-ip\n";
1374			$conf .= "float\n";
1375	8dc3ef67	Scott Ullrich	}
1376	afb07cf1	Scott Ullrich
1377	ef378560	jim-p	// If the server is not a TLS server or it has a tunnel network CIDR less than a /30, skip this.
1378	4742e635	Chris Buechler	if (in_array($settings['mode'], $openvpn_tls_server_modes) && (!empty($ip) && !empty($mask) && ($cidr < 30)) && $settings['dev_mode'] != "tap") {
1379	63646f4d	jim-p	if (empty($settings['topology'])) {
1380			$settings['topology'] = "subnet";
1381			}
1382			$conf .= "topology {$settings['topology']}\n";
1383	ee55ce7d	jim-p	}
1384
1385	b9e9903d	Dmitriy K.	// New client features
1386			if ($mode == "client") {
1387			// Dont pull routes checkbox
1388			if ($settings['route_no_pull']) {
1389			$conf .= "route-nopull\n";
1390			}
1391
1392			// Dont add/remove routes checkbox
1393			if ($settings['route_no_exec']) {
1394			$conf .= "route-noexec\n";
1395			}
1396			}
1397
1398	2df5d9ee	jim-p	/* UDP Fast I/O. Only compatible with UDP and also not compatible with OpenVPN's "shaper" directive. */
1399			if ($settings['udp_fast_io']
1400			&& (strtolower(substr($settings['protocol'], 0, 3)) == "udp")
1401			&& (empty($settings['use_shaper']))) {
1402			$conf .= "fast-io\n";
1403			}
1404
1405	7591a72a	jim-p	/* Exit Notify. Only compatible with UDP. */
1406			if (!empty($settings['exit_notify']) &&
1407			is_numericint($settings['exit_notify']) &&
1408			(strtolower(substr($settings['protocol'], 0, 3)) == "udp")) {
1409			$conf .= "explicit-exit-notify {$settings['exit_notify']}\n";
1410			}
1411
1412	7618a842	jim-p	/* Send and Receive Buffer Settings */
1413			if (is_numericint($settings['sndrcvbuf'])
1414			&& ($settings['sndrcvbuf'] > 0)
1415			&& ($settings['sndrcvbuf'] <= get_single_sysctl('net.inet.tcp.sendbuf_max'))
1416			&& ($settings['sndrcvbuf'] <= get_single_sysctl('net.inet.tcp.recvbuf_max'))) {
1417			$conf .= "sndbuf {$settings['sndrcvbuf']}\n";
1418			$conf .= "rcvbuf {$settings['sndrcvbuf']}\n";
1419			}
1420
1421	d799787e	Matthew Grooms	openvpn_add_custom($settings, $conf);
1422
1423	a8f538a8	jim-p	openvpn_create_dirs();
1424	348c2af1	jim-p	$fpath = "{$g['openvpn_base']}/{$mode_id}/config.ovpn";
1425	d799787e	Matthew Grooms	file_put_contents($fpath, $conf);
1426	938fc5b0	Ermal	unset($conf);
1427	348c2af1	jim-p	$fpath = "{$g['openvpn_base']}/{$mode_id}/interface";
1428	be00850b	Phil Davis	file_put_contents($fpath, $interface);
1429	f9ac3784	Ermal Lu?i	//chown($fpath, 'nobody');
1430			//chgrp($fpath, 'nobody');
1431	348c2af1	jim-p	@chmod("{$g['openvpn_base']}/{$mode_id}/config.ovpn", 0600);
1432			@chmod("{$g['openvpn_base']}/{$mode_id}/interface", 0600);
1433			@chmod("{$g['openvpn_base']}/{$mode_id}/key", 0600);
1434			@chmod("{$g['openvpn_base']}/{$mode_id}/tls-auth", 0600);
1435			@chmod("{$g['openvpn_base']}/{$mode_id}/conf", 0600);
1436	5280fd8d	Renato Botelho
1437			if ($wait_tentative) {
1438			interface_wait_tentative($interface);
1439			}
1440	d799787e	Matthew Grooms	}
1441
1442	fc05822b	jim-p	function openvpn_restart($mode, $settings) {
1443	d799787e	Matthew Grooms	global $g, $config;
1444
1445			$vpnid = $settings['vpnid'];
1446			$mode_id = $mode.$vpnid;
1447	ce983754	PiBa-NL	$lockhandle = lock("openvpnservice{$mode_id}", LOCK_EX);
1448	8845e137	PiBa-NL	openvpn_reconfigure($mode, $settings);
1449	76369bfc	Matthew Grooms	/* kill the process if running */
1450	705c8ec9	Matthew Grooms	$pfile = $g['varrun_path']."/openvpn_{$mode_id}.pid";
1451	76369bfc	Matthew Grooms	if (file_exists($pfile)) {
1452	705c8ec9	Matthew Grooms
1453	76369bfc	Matthew Grooms	/* read the pid file */
1454			$pid = rtrim(file_get_contents($pfile));
1455			unlink($pfile);
1456	8845e137	PiBa-NL	syslog(LOG_INFO, "OpenVPN terminate old pid: {$pid}");
1457	705c8ec9	Matthew Grooms
1458	76369bfc	Matthew Grooms	/* send a term signal to the process */
1459			posix_kill($pid, SIGTERM);
1460
1461	93ead355	Chris Buechler	/* wait until the process exits, or timeout and kill it */
1462			$i = 0;
1463	ef00af3c	Phil Davis	while (posix_kill($pid, 0)) {
1464	76369bfc	Matthew Grooms	usleep(250000);
1465	93ead355	Chris Buechler	if ($i > 10) {
1466	e8c516a0	Phil Davis	log_error(sprintf(gettext('OpenVPN ID %1$s PID %2$s still running, killing.'), $mode_id, $pid));
1467	93ead355	Chris Buechler	posix_kill($pid, SIGKILL);
1468	02a2bffa	Chris Buechler	usleep(500000);
1469	93ead355	Chris Buechler	}
1470			$i++;
1471			}
1472	76369bfc	Matthew Grooms	}
1473	d799787e	Matthew Grooms
1474	ef00af3c	Phil Davis	if (isset($settings['disable'])) {
1475	ce983754	PiBa-NL	unlock($lockhandle);
1476	d799787e	Matthew Grooms	return;
1477	ef00af3c	Phil Davis	}
1478	d799787e	Matthew Grooms
1479	f003f8db	jim-p	/* Do not start an instance if we are not CARP master on this vip! */
1480	ddf99718	Phil Davis	if (strstr($settings['interface'], "_vip") && !in_array(get_carp_interface_status($settings['interface']), array("MASTER", ""))) {
1481	ce983754	PiBa-NL	unlock($lockhandle);
1482	9ea0cb90	jim-p	return;
1483	ef00af3c	Phil Davis	}
1484	42bb1bee	Renato Botelho
1485			/* Check if client is bound to a gateway group */
1486	43a9b03d	PiBa-NL	$a_groups = return_gateway_groups_array(true);
1487	330ecea1	Shahid Sheikh	if (is_array($a_groups[$settings['interface']])) {
1488	ef00af3c	Phil Davis	/* the interface is a gateway group. If a vip is defined and its a CARP backup then do not start */
1489	ddf99718	Phil Davis	if (($a_groups[$settings['interface']][0]['vip'] <> "") && (!in_array(get_carp_interface_status($a_groups[$settings['interface']][0]['vip']), array("MASTER", "")))) {
1490	ce983754	PiBa-NL	unlock($lockhandle);
1491	330ecea1	Shahid Sheikh	return;
1492	ef00af3c	Phil Davis	}
1493	330ecea1	Shahid Sheikh	}
1494	9ea0cb90	jim-p
1495	705c8ec9	Matthew Grooms	/* start the new process */
1496	348c2af1	jim-p	$fpath = "{$g['openvpn_base']}/{$mode_id}/config.ovpn";
1497	91c44185	jim-p	openvpn_clear_route($mode, $settings);
1498	8845e137	PiBa-NL	$res = mwexec("/usr/local/sbin/openvpn --config " . escapeshellarg($fpath));
1499			if ($res == 0) {
1500			$i = 0;
1501			$pid = "--";
1502			while ($i < 3000) {
1503	a1b39e94	PiBa-NL	if (isvalidpid($pfile)) {
1504	8845e137	PiBa-NL	$pid = rtrim(file_get_contents($pfile));
1505	a1b39e94	PiBa-NL	break;
1506	8845e137	PiBa-NL	}
1507			usleep(1000);
1508			$i++;
1509			}
1510			syslog(LOG_INFO, "OpenVPN PID written: {$pid}");
1511			} else {
1512			syslog(LOG_ERR, "OpenVPN failed to start");
1513			}
1514	ef00af3c	Phil Davis	if (!platform_booting()) {
1515	847cd48d	Ermal	send_event("filter reload");
1516	ef00af3c	Phil Davis	}
1517	ce983754	PiBa-NL	unlock($lockhandle);
1518	afb07cf1	Scott Ullrich	}
1519
1520	9272a448	Renato Botelho	function openvpn_delete($mode, $settings) {
1521	d799787e	Matthew Grooms	global $g, $config;
1522
1523			$vpnid = $settings['vpnid'];
1524			$mode_id = $mode.$vpnid;
1525
1526	ef00af3c	Phil Davis	if ($mode == "server") {
1527	095a95ae	Matthew Grooms	$devname = "ovpns{$vpnid}";
1528	ef00af3c	Phil Davis	} else {
1529	095a95ae	Matthew Grooms	$devname = "ovpnc{$vpnid}";
1530	ef00af3c	Phil Davis	}
1531	dc408939	Matthew Grooms
1532	76369bfc	Matthew Grooms	/* kill the process if running */
1533	dc408939	Matthew Grooms	$pfile = "{$g['varrun_path']}/openvpn_{$mode_id}.pid";
1534	76369bfc	Matthew Grooms	if (file_exists($pfile)) {
1535	dc408939	Matthew Grooms
1536	76369bfc	Matthew Grooms	/* read the pid file */
1537			$pid = trim(file_get_contents($pfile));
1538			unlink($pfile);
1539
1540			/* send a term signal to the process */
1541			posix_kill($pid, SIGTERM);
1542			}
1543	705c8ec9	Matthew Grooms
1544	3b1642ff	Renato Botelho	/* destroy the device */
1545			pfSense_interface_destroy($devname);
1546	dc408939	Matthew Grooms
1547	7d813139	batnas	/* Invalidate cache */
1548			get_interface_arr(true);
1549
1550	dc408939	Matthew Grooms	/* remove the configuration files */
1551	93830bec	Viktor G	unlink_if_exists("{$g['openvpn_base']}/{$mode_id}//");
1552			unlink_if_exists("{$g['openvpn_base']}/{$mode_id}/*");
1553	d799787e	Matthew Grooms	}
1554	afb07cf1	Scott Ullrich
1555	dc408939	Matthew Grooms	function openvpn_resync_csc(& $settings) {
1556	154b0f80	jim-p	global $g, $config, $openvpn_tls_server_modes;
1557	a1cab2c7	Ermal	if (isset($settings['disable'])) {
1558	4e5e7540	jim-p	openvpn_delete_csc($settings);
1559	c876662c	Scott Ullrich	return;
1560			}
1561	a8f538a8	jim-p	openvpn_create_dirs();
1562	d799787e	Matthew Grooms
1563	154b0f80	jim-p	if (empty($settings['server_list'])) {
1564			$csc_server_list = array();
1565			} else {
1566			$csc_server_list = explode(",", $settings['server_list']);
1567			}
1568
1569	8dc3ef67	Scott Ullrich	$conf = '';
1570	ef00af3c	Phil Davis	if ($settings['block']) {
1571	d799787e	Matthew Grooms	$conf .= "disable\n";
1572	ef00af3c	Phil Davis	}
1573	d799787e	Matthew Grooms
1574	ef00af3c	Phil Davis	if ($settings['push_reset']) {
1575	d799787e	Matthew Grooms	$conf .= "push-reset\n";
1576	ef00af3c	Phil Davis	}
1577	d799787e	Matthew Grooms
1578	8d44d56a	Viktor G	if ($settings['remove_route']) {
1579			$conf .= "push-remove route\n";
1580			}
1581
1582	5c427ce7	jim-p	if ($settings['local_network']) {
1583			$conf .= openvpn_gen_routes($settings['local_network'], "ipv4", true);
1584			}
1585			if ($settings['local_networkv6']) {
1586			$conf .= openvpn_gen_routes($settings['local_networkv6'], "ipv6", true);
1587			}
1588
1589			// Add a remote network iroute if set
1590			if (openvpn_validate_cidr($settings['remote_network'], "", true, "ipv4") === FALSE) {
1591			$conf .= openvpn_gen_routes($settings['remote_network'], "ipv4", false, true);
1592			}
1593			// Add a remote network iroute if set
1594			if (openvpn_validate_cidr($settings['remote_networkv6'], "", true, "ipv6") === FALSE) {
1595			$conf .= openvpn_gen_routes($settings['remote_networkv6'], "ipv6", false, true);
1596			}
1597
1598	d799787e	Matthew Grooms	openvpn_add_dhcpopts($settings, $conf);
1599	8dc3ef67	Scott Ullrich
1600	d799787e	Matthew Grooms	openvpn_add_custom($settings, $conf);
1601	154b0f80	jim-p	/* Loop through servers, find which ones can use this CSC */
1602			if (is_array($config['openvpn']['openvpn-server'])) {
1603			foreach ($config['openvpn']['openvpn-server'] as $serversettings) {
1604			if (isset($serversettings['disable'])) {
1605			continue;
1606			}
1607			if (in_array($serversettings['mode'], $openvpn_tls_server_modes)) {
1608			if ($serversettings['vpnid'] && (empty($csc_server_list) \|\| in_array($serversettings['vpnid'], $csc_server_list))) {
1609	348c2af1	jim-p	$csc_path = "{$g['openvpn_base']}/server{$serversettings['vpnid']}/csc/" . basename($settings['common_name']);
1610	154b0f80	jim-p	$csc_conf = $conf;
1611
1612	cd8f2f2b	jim-p	if (!empty($serversettings['tunnel_network']) && !empty($settings['tunnel_network'])) {
1613	966cdb43	jim-p	list($ip, $mask) = explode('/', trim($settings['tunnel_network']));
1614	154b0f80	jim-p	if (($serversettings['dev_mode'] == 'tap') \|\| ($serversettings['topology'] == "subnet")) {
1615			$csc_conf .= "ifconfig-push {$ip} " . gen_subnet_mask($mask) . "\n";
1616			} else {
1617			/* Because this is being pushed, the order from the client's point of view. */
1618	493e6807	stilez	$baselong = gen_subnetv4($ip, $mask);
1619			$serverip = ip_after($baselong, 1);
1620			$clientip = ip_after($baselong, 2);
1621	154b0f80	jim-p	$csc_conf .= "ifconfig-push {$clientip} {$serverip}\n";
1622			}
1623			}
1624	b6dd335e	jim-p
1625			if (!empty($serversettings['tunnel_networkv6']) && !empty($settings['tunnel_networkv6'])) {
1626			list($ipv6, $prefix) = explode('/', trim($serversettings['tunnel_networkv6']));
1627			list($ipv6_1, $ipv6_2) = openvpn_get_interface_ipv6($ipv6, $prefix);
1628			$csc_conf .= "ifconfig-ipv6-push {$settings['tunnel_networkv6']} {$ipv6_1}\n";
1629			}
1630
1631	154b0f80	jim-p	file_put_contents($csc_path, $csc_conf);
1632			chown($csc_path, 'nobody');
1633			chgrp($csc_path, 'nobody');
1634			}
1635			}
1636			}
1637			}
1638	d799787e	Matthew Grooms	}
1639	8dc3ef67	Scott Ullrich
1640	1f954318	jim-p	function openvpn_resync_csc_all() {
1641			global $config;
1642			if (is_array($config['openvpn']['openvpn-csc'])) {
1643			foreach ($config['openvpn']['openvpn-csc'] as & $settings) {
1644			openvpn_resync_csc($settings);
1645			}
1646			}
1647			}
1648
1649	dc408939	Matthew Grooms	function openvpn_delete_csc(& $settings) {
1650	154b0f80	jim-p	global $g, $config, $openvpn_tls_server_modes;
1651			if (empty($settings['server_list'])) {
1652			$csc_server_list = array();
1653			} else {
1654			$csc_server_list = explode(",", $settings['server_list']);
1655			}
1656	3c2e5528	Scott Ullrich
1657	154b0f80	jim-p	/* Loop through servers, find which ones used this CSC */
1658			if (is_array($config['openvpn']['openvpn-server'])) {
1659			foreach ($config['openvpn']['openvpn-server'] as $serversettings) {
1660			if (isset($serversettings['disable'])) {
1661			continue;
1662			}
1663			if (in_array($serversettings['mode'], $openvpn_tls_server_modes)) {
1664			if ($serversettings['vpnid'] && (empty($csc_server_list) \|\| in_array($serversettings['vpnid'], $csc_server_list))) {
1665	348c2af1	jim-p	$csc_path = "{$g['openvpn_base']}/server{$serversettings['vpnid']}/csc/" . basename($settings['common_name']);
1666	154b0f80	jim-p	unlink_if_exists($csc_path);
1667			}
1668			}
1669			}
1670			}
1671	267ab13f	Ermal Luçi	}
1672	afb07cf1	Scott Ullrich
1673	24012690	Scott Ullrich	// Resync the configuration and restart the VPN
1674	fc05822b	jim-p	function openvpn_resync($mode, $settings) {
1675	dc408939	Matthew Grooms	openvpn_restart($mode, $settings);
1676	afb07cf1	Scott Ullrich	}
1677
1678	add2e3f7	Scott Ullrich	// Resync and restart all VPNs
1679	c7f60193	Ermal	function openvpn_resync_all($interface = "") {
1680	d799787e	Matthew Grooms	global $g, $config;
1681	267ab13f	Ermal Luçi
1682	a8f538a8	jim-p	openvpn_create_dirs();
1683	3cb54b54	Matthew Grooms
1684	ef00af3c	Phil Davis	if (!is_array($config['openvpn'])) {
1685	34bc1324	Matthew Grooms	$config['openvpn'] = array();
1686	ef00af3c	Phil Davis	}
1687	34bc1324	Matthew Grooms
1688	ef00af3c	Phil Davis	if ($interface <> "") {
1689	e8c516a0	Phil Davis	log_error(sprintf(gettext("Resyncing OpenVPN instances for interface %s."), convert_friendly_interface_to_friendly_descr($interface)));
1690	ef00af3c	Phil Davis	} else {
1691	e8c516a0	Phil Davis	log_error(gettext("Resyncing OpenVPN instances."));
1692	ef00af3c	Phil Davis	}
1693	34bc1324	Matthew Grooms
1694	7071aab3	James Webb	// Check if OpenVPN clients and servers require a resync.
1695	f7335af3	Renato Botelho do Couto	foreach (array("server", "client") as $type) {
1696			if (!is_array($config['openvpn']["openvpn-{$type}"])) {
1697			continue;
1698	c7f60193	Ermal	}
1699	f7335af3	Renato Botelho do Couto	foreach ($config['openvpn']["openvpn-{$type}"] as & $settings) {
1700	348c2af1	jim-p	$fpath = "{$g['openvpn_base']}/{$type}{$settings['vpnid']}/interface";
1701	7071aab3	James Webb	$gw_group_change = FALSE;
1702	f7335af3	Renato Botelho do Couto	$ip_change = ($interface === "") \|\|
1703			($interface === $settings['interface']);
1704
1705	15f8062b	James Webb	if (!$ip_change && file_exists($fpath)) {
1706	f7335af3	Renato Botelho do Couto	$gw_group_change =
1707			(trim(file_get_contents($fpath), " \t\n") !=
1708			get_failover_interface(
1709			$settings['interface']));
1710	7071aab3	James Webb	}
1711	f7335af3	Renato Botelho do Couto
1712	15f8062b	James Webb	if ($ip_change \|\| $gw_group_change) {
1713	f7335af3	Renato Botelho do Couto	openvpn_resync($type, $settings);
1714	ef00af3c	Phil Davis	}
1715	c7f60193	Ermal	}
1716			}
1717	afb07cf1	Scott Ullrich
1718	1f954318	jim-p	openvpn_resync_csc_all();
1719	afb07cf1	Scott Ullrich
1720	5b237745	Scott Ullrich	}
1721	702a4702	Scott Ullrich
1722	99cc103b	Phil Davis	// Resync and restart all VPNs using a gateway group.
1723			function openvpn_resync_gwgroup($gwgroupname = "") {
1724			global $g, $config;
1725
1726			if ($gwgroupname <> "") {
1727			if (is_array($config['openvpn']['openvpn-server'])) {
1728			foreach ($config['openvpn']['openvpn-server'] as & $settings) {
1729			if ($gwgroupname == $settings['interface']) {
1730	e8c516a0	Phil Davis	log_error(sprintf(gettext('Resyncing OpenVPN for gateway group %1$s server %2$s.'), $gwgroupname, $settings["description"]));
1731	99cc103b	Phil Davis	openvpn_resync('server', $settings);
1732			}
1733			}
1734			}
1735
1736			if (is_array($config['openvpn']['openvpn-client'])) {
1737			foreach ($config['openvpn']['openvpn-client'] as & $settings) {
1738			if ($gwgroupname == $settings['interface']) {
1739	e8c516a0	Phil Davis	log_error(sprintf(gettext('Resyncing OpenVPN for gateway group %1$s client %2$s.'), $gwgroupname, $settings["description"]));
1740	99cc103b	Phil Davis	openvpn_resync('client', $settings);
1741			}
1742			}
1743			}
1744
1745			// Note: no need to resysnc Client Specific (csc) here, as changes to the OpenVPN real interface do not effect these.
1746
1747	ef00af3c	Phil Davis	} else {
1748	e8c516a0	Phil Davis	log_error(gettext("openvpn_resync_gwgroup called with null gwgroup parameter."));
1749	ef00af3c	Phil Davis	}
1750	99cc103b	Phil Davis	}
1751
1752	453d9c96	jim-p	function openvpn_get_active_servers($type="multipoint") {
1753	71ca2cb2	Ermal	global $config, $g;
1754
1755	53663f57	jim-p	$servers = array();
1756			if (is_array($config['openvpn']['openvpn-server'])) {
1757			foreach ($config['openvpn']['openvpn-server'] as & $settings) {
1758	ef00af3c	Phil Davis	if (empty($settings) \|\| isset($settings['disable'])) {
1759	6b2dcac5	Ermal	continue;
1760	ef00af3c	Phil Davis	}
1761	6b2dcac5	Ermal
1762	53663f57	jim-p	$prot = $settings['protocol'];
1763			$port = $settings['local_port'];
1764	42bb1bee	Renato Botelho
1765	53663f57	jim-p	$server = array();
1766	95305736	jim-p	$server['port'] = ($settings['local_port']) ? $settings['local_port'] : 1194;
1767	41be629f	jim-p	$server['mode'] = $settings['mode'];
1768	ef00af3c	Phil Davis	if ($settings['description']) {
1769	53663f57	jim-p	$server['name'] = "{$settings['description']} {$prot}:{$port}";
1770	ef00af3c	Phil Davis	} else {
1771	53663f57	jim-p	$server['name'] = "Server {$prot}:{$port}";
1772	ef00af3c	Phil Davis	}
1773	53663f57	jim-p	$server['conns'] = array();
1774	2eaa97b9	jim-p	$server['vpnid'] = $settings['vpnid'];
1775			$server['mgmt'] = "server{$server['vpnid']}";
1776	348c2af1	jim-p	$socket = "unix://{$g['openvpn_base']}/{$server['mgmt']}/sock";
1777	966cdb43	jim-p	list($tn, $sm) = explode('/', trim($settings['tunnel_network']));
1778	453d9c96	jim-p
1779	ef00af3c	Phil Davis	if ((($server['mode'] == "p2p_shared_key") \|\| ($sm >= 30)) && ($type == "p2p")) {
1780	95305736	jim-p	$servers[] = openvpn_get_client_status($server, $socket);
1781	ef00af3c	Phil Davis	} elseif (($server['mode'] != "p2p_shared_key") && ($type == "multipoint") && ($sm < 30)) {
1782	95305736	jim-p	$servers[] = openvpn_get_server_status($server, $socket);
1783	ef00af3c	Phil Davis	}
1784	95305736	jim-p	}
1785			}
1786			return $servers;
1787			}
1788	b0140675	Ermal
1789	95305736	jim-p	function openvpn_get_server_status($server, $socket) {
1790	247c417f	Sjon Hortensius	$errval = null;
1791			$errstr = null;
1792	95305736	jim-p	$fp = @stream_socket_client($socket, $errval, $errstr, 1);
1793			if ($fp) {
1794			stream_set_timeout($fp, 1);
1795
1796			/* send our status request */
1797			fputs($fp, "status 2\n");
1798
1799			/* recv all response lines */
1800			while (!feof($fp)) {
1801
1802			/* read the next line */
1803			$line = fgets($fp, 1024);
1804
1805			$info = stream_get_meta_data($fp);
1806	ef00af3c	Phil Davis	if ($info['timed_out']) {
1807	95305736	jim-p	break;
1808	ef00af3c	Phil Davis	}
1809	95305736	jim-p
1810			/* parse header list line */
1811	ef00af3c	Phil Davis	if (strstr($line, "HEADER")) {
1812	95305736	jim-p	continue;
1813	ef00af3c	Phil Davis	}
1814	95305736	jim-p
1815			/* parse end of output line */
1816	ef00af3c	Phil Davis	if (strstr($line, "END") \|\| strstr($line, "ERROR")) {
1817	95305736	jim-p	break;
1818	ef00af3c	Phil Davis	}
1819	95305736	jim-p
1820			/* parse client list line */
1821			if (strstr($line, "CLIENT_LIST")) {
1822			$list = explode(",", $line);
1823	53663f57	jim-p	$conn = array();
1824	95305736	jim-p	$conn['common_name'] = $list[1];
1825			$conn['remote_host'] = $list[2];
1826			$conn['virtual_addr'] = $list[3];
1827	6f17547a	jim-p	$conn['virtual_addr6'] = $list[4];
1828			$conn['bytes_recv'] = $list[5];
1829			$conn['bytes_sent'] = $list[6];
1830			$conn['connect_time'] = $list[7];
1831			$conn['connect_time_unix'] = $list[8];
1832			$conn['user_name'] = $list[9];
1833			$conn['client_id'] = $list[10];
1834			$conn['peer_id'] = $list[11];
1835	f5736d98	Viktor G	$conn['cipher'] = $list[12];
1836	53663f57	jim-p	$server['conns'][] = $conn;
1837			}
1838	ec970b50	jim-p	/* parse routing table lines */
1839			if (strstr($line, "ROUTING_TABLE")) {
1840			$list = explode(",", $line);
1841			$conn = array();
1842			$conn['virtual_addr'] = $list[1];
1843			$conn['common_name'] = $list[2];
1844			$conn['remote_host'] = $list[3];
1845			$conn['last_time'] = $list[4];
1846			$server['routes'][] = $conn;
1847			}
1848	53663f57	jim-p	}
1849	95305736	jim-p
1850			/* cleanup */
1851			fclose($fp);
1852			} else {
1853			$conn = array();
1854			$conn['common_name'] = "[error]";
1855	e8c516a0	Phil Davis	$conn['remote_host'] = gettext("Unable to contact daemon");
1856			$conn['virtual_addr'] = gettext("Service not running?");
1857	95305736	jim-p	$conn['bytes_recv'] = 0;
1858			$conn['bytes_sent'] = 0;
1859			$conn['connect_time'] = 0;
1860			$server['conns'][] = $conn;
1861	53663f57	jim-p	}
1862	95305736	jim-p	return $server;
1863	53663f57	jim-p	}
1864
1865			function openvpn_get_active_clients() {
1866	71ca2cb2	Ermal	global $config, $g;
1867
1868	53663f57	jim-p	$clients = array();
1869			if (is_array($config['openvpn']['openvpn-client'])) {
1870			foreach ($config['openvpn']['openvpn-client'] as & $settings) {
1871	42bb1bee	Renato Botelho
1872	ef00af3c	Phil Davis	if (empty($settings) \|\| isset($settings['disable'])) {
1873	6b2dcac5	Ermal	continue;
1874	ef00af3c	Phil Davis	}
1875	6b2dcac5	Ermal
1876	53663f57	jim-p	$prot = $settings['protocol'];
1877	95305736	jim-p	$port = ($settings['local_port']) ? ":{$settings['local_port']}" : "";
1878	42bb1bee	Renato Botelho
1879	53663f57	jim-p	$client = array();
1880			$client['port'] = $settings['local_port'];
1881	ef00af3c	Phil Davis	if ($settings['description']) {
1882	95305736	jim-p	$client['name'] = "{$settings['description']} {$prot}{$port}";
1883	ef00af3c	Phil Davis	} else {
1884	95305736	jim-p	$client['name'] = "Client {$prot}{$port}";
1885	ef00af3c	Phil Davis	}
1886	42bb1bee	Renato Botelho
1887	2eaa97b9	jim-p	$client['vpnid'] = $settings['vpnid'];
1888			$client['mgmt'] = "client{$client['vpnid']}";
1889	348c2af1	jim-p	$socket = "unix://{$g['openvpn_base']}/{$client['mgmt']}/sock";
1890	53663f57	jim-p	$client['status']="down";
1891	95305736	jim-p
1892			$clients[] = openvpn_get_client_status($client, $socket);
1893			}
1894			}
1895			return $clients;
1896			}
1897
1898			function openvpn_get_client_status($client, $socket) {
1899	247c417f	Sjon Hortensius	$errval = null;
1900			$errstr = null;
1901	95305736	jim-p	$fp = @stream_socket_client($socket, $errval, $errstr, 1);
1902			if ($fp) {
1903			stream_set_timeout($fp, 1);
1904			/* send our status request */
1905			fputs($fp, "state 1\n");
1906
1907			/* recv all response lines */
1908			while (!feof($fp)) {
1909			/* read the next line */
1910			$line = fgets($fp, 1024);
1911
1912			$info = stream_get_meta_data($fp);
1913	ef00af3c	Phil Davis	if ($info['timed_out']) {
1914	95305736	jim-p	break;
1915	ef00af3c	Phil Davis	}
1916	95305736	jim-p
1917			/* Get the client state */
1918	4de8f7ba	Phil Davis	if (strstr($line, "CONNECTED")) {
1919			$client['status'] = "up";
1920	95305736	jim-p	$list = explode(",", $line);
1921
1922	4de8f7ba	Phil Davis	$client['connect_time'] = date("D M j G:i:s Y", $list[0]);
1923			$client['virtual_addr'] = $list[3];
1924	95305736	jim-p	$client['remote_host'] = $list[4];
1925	cbfd0754	jim-p	$client['remote_port'] = $list[5];
1926			$client['local_host'] = $list[6];
1927			$client['local_port'] = $list[7];
1928			$client['virtual_addr6'] = $list[8];
1929	95305736	jim-p	}
1930	4de8f7ba	Phil Davis	if (strstr($line, "CONNECTING")) {
1931			$client['status'] = "connecting";
1932	453d9c96	jim-p	}
1933	4de8f7ba	Phil Davis	if (strstr($line, "ASSIGN_IP")) {
1934			$client['status'] = "waiting";
1935	453d9c96	jim-p	$list = explode(",", $line);
1936
1937	4de8f7ba	Phil Davis	$client['connect_time'] = date("D M j G:i:s Y", $list[0]);
1938			$client['virtual_addr'] = $list[3];
1939	453d9c96	jim-p	}
1940	4de8f7ba	Phil Davis	if (strstr($line, "RECONNECTING")) {
1941			$client['status'] = "reconnecting";
1942	453d9c96	jim-p	$list = explode(",", $line);
1943
1944	4de8f7ba	Phil Davis	$client['connect_time'] = date("D M j G:i:s Y", $list[0]);
1945	453d9c96	jim-p	$client['status'] .= "; " . $list[2];
1946			}
1947	95305736	jim-p	/* parse end of output line */
1948	ef00af3c	Phil Davis	if (strstr($line, "END") \|\| strstr($line, "ERROR")) {
1949	95305736	jim-p	break;
1950	ef00af3c	Phil Davis	}
1951	95305736	jim-p	}
1952
1953			/* If up, get read/write stats */
1954			if (strcmp($client['status'], "up") == 0) {
1955			fputs($fp, "status 2\n");
1956			/* recv all response lines */
1957			while (!feof($fp)) {
1958			/* read the next line */
1959			$line = fgets($fp, 1024);
1960
1961			$info = stream_get_meta_data($fp);
1962	ef00af3c	Phil Davis	if ($info['timed_out']) {
1963	95305736	jim-p	break;
1964	ef00af3c	Phil Davis	}
1965	95305736	jim-p
1966	4de8f7ba	Phil Davis	if (strstr($line, "TCP/UDP read bytes")) {
1967	95305736	jim-p	$list = explode(",", $line);
1968			$client['bytes_recv'] = $list[1];
1969	53663f57	jim-p	}
1970	95305736	jim-p
1971	4de8f7ba	Phil Davis	if (strstr($line, "TCP/UDP write bytes")) {
1972	95305736	jim-p	$list = explode(",", $line);
1973			$client['bytes_sent'] = $list[1];
1974	53663f57	jim-p	}
1975	95305736	jim-p
1976			/* parse end of output line */
1977	ef00af3c	Phil Davis	if (strstr($line, "END")) {
1978	95305736	jim-p	break;
1979	ef00af3c	Phil Davis	}
1980	53663f57	jim-p	}
1981			}
1982	95305736	jim-p
1983			fclose($fp);
1984
1985			} else {
1986	e8c516a0	Phil Davis	$client['remote_host'] = gettext("Unable to contact daemon");
1987			$client['virtual_addr'] = gettext("Service not running?");
1988	95305736	jim-p	$client['bytes_recv'] = 0;
1989			$client['bytes_sent'] = 0;
1990			$client['connect_time'] = 0;
1991	53663f57	jim-p	}
1992	95305736	jim-p	return $client;
1993	53663f57	jim-p	}
1994	8e022a76	jim-p
1995	61fce4a6	Phil Davis	function openvpn_kill_client($port, $remipp) {
1996			global $g;
1997
1998			//$tcpsrv = "tcp://127.0.0.1:{$port}";
1999	348c2af1	jim-p	$tcpsrv = "unix://{$g['openvpn_base']}/{$port}/sock";
2000	61fce4a6	Phil Davis	$errval = null;
2001			$errstr = null;
2002
2003			/* open a tcp connection to the management port of each server */
2004			$fp = @stream_socket_client($tcpsrv, $errval, $errstr, 1);
2005			$killed = -1;
2006			if ($fp) {
2007			stream_set_timeout($fp, 1);
2008			fputs($fp, "kill {$remipp}\n");
2009			while (!feof($fp)) {
2010			$line = fgets($fp, 1024);
2011
2012			$info = stream_get_meta_data($fp);
2013			if ($info['timed_out']) {
2014			break;
2015			}
2016
2017			/* parse header list line */
2018			if (strpos($line, "INFO:") !== false) {
2019			continue;
2020			}
2021			if (strpos($line, "SUCCESS") !== false) {
2022			$killed = 0;
2023			}
2024			break;
2025			}
2026			fclose($fp);
2027			}
2028			return $killed;
2029			}
2030
2031	8e022a76	jim-p	function openvpn_refresh_crls() {
2032			global $g, $config;
2033
2034	a8f538a8	jim-p	openvpn_create_dirs();
2035	8e022a76	jim-p
2036			if (is_array($config['openvpn']['openvpn-server'])) {
2037			foreach ($config['openvpn']['openvpn-server'] as $settings) {
2038	ef00af3c	Phil Davis	if (empty($settings)) {
2039	8e022a76	jim-p	continue;
2040	ef00af3c	Phil Davis	}
2041			if (isset($settings['disable'])) {
2042	8e022a76	jim-p	continue;
2043	ef00af3c	Phil Davis	}
2044	8e022a76	jim-p	// Write the settings for the keys
2045	ef00af3c	Phil Davis	switch ($settings['mode']) {
2046	8e022a76	jim-p	case 'p2p_tls':
2047			case 'server_tls':
2048			case 'server_tls_user':
2049			case 'server_user':
2050	348c2af1	jim-p	$param = array('caref' => $settings['caref']);
2051			$cas = ca_chain_array($param);
2052	475d712b	jim-p	$capath = "{$g['openvpn_base']}/server{$settings['vpnid']}/ca";
2053	8e022a76	jim-p	if (!empty($settings['crlref'])) {
2054			$crl = lookup_crl($settings['crlref']);
2055	728003c8	jim-p	crl_update($crl);
2056	348c2af1	jim-p	}
2057			foreach ($cas as $ca) {
2058	475d712b	jim-p	ca_setup_capath($ca, $capath, $crl, true);
2059	8e022a76	jim-p	}
2060	f61a794a	jim-p	unset($cas, $param, $capath, $crl);
2061	8e022a76	jim-p	break;
2062			}
2063			}
2064			}
2065			}
2066
2067	a8f538a8	jim-p	function openvpn_create_dirs() {
2068	154b0f80	jim-p	global $g, $config, $openvpn_tls_server_modes;
2069	348c2af1	jim-p	if (!is_dir($g['openvpn_base'])) {
2070			safe_mkdir($g['openvpn_base'], 0750);
2071	ef00af3c	Phil Davis	}
2072	154b0f80	jim-p
2073	348c2af1	jim-p	init_config_arr(array('openvpn', 'openvpn-server'));
2074			init_config_arr(array('openvpn', 'openvpn-client'));
2075			foreach(array('server', 'client') as $mode) {
2076			foreach ($config['openvpn']["openvpn-{$mode}"] as $settings) {
2077			$target = "{$g['openvpn_base']}/{$mode}{$settings['vpnid']}";
2078			@unlink_if_exists($csctarget);
2079			@safe_mkdir($target);
2080	154b0f80	jim-p	if (in_array($settings['mode'], $openvpn_tls_server_modes)) {
2081			if ($settings['vpnid']) {
2082	348c2af1	jim-p	$csctarget = "{$target}/csc/";
2083			@unlink_if_exists($csctarget);
2084			@safe_mkdir($csctarget);
2085	154b0f80	jim-p	}
2086			}
2087			}
2088			}
2089	a8f538a8	jim-p	}
2090
2091	30c8a290	Renato Botelho	function openvpn_get_interface_ip($ip, $cidr) {
2092			$subnet = gen_subnetv4($ip, $cidr);
2093	10a8b5ee	PiBa-NL	if ($cidr == 31) {
2094			$ip1 = $subnet;
2095			} else {
2096			$ip1 = ip_after($subnet);
2097			}
2098	30c8a290	Renato Botelho	$ip2 = ip_after($ip1);
2099	91c44185	jim-p	return array($ip1, $ip2);
2100			}
2101
2102			function openvpn_get_interface_ipv6($ipv6, $prefix) {
2103			$basev6 = gen_subnetv6($ipv6, $prefix);
2104			// Is there a better way to do this math?
2105			$ipv6_arr = explode(':', $basev6);
2106			$last = hexdec(array_pop($ipv6_arr));
2107	10a8b5ee	PiBa-NL	if ($prefix == 127) {
2108			$last--;
2109			}
2110	587995fb	Phil Davis	$ipv6_1 = text_to_compressed_ip6(implode(':', $ipv6_arr) . ':' . dechex($last + 1));
2111			$ipv6_2 = text_to_compressed_ip6(implode(':', $ipv6_arr) . ':' . dechex($last + 2));
2112	91c44185	jim-p	return array($ipv6_1, $ipv6_2);
2113			}
2114
2115			function openvpn_clear_route($mode, $settings) {
2116	ef00af3c	Phil Davis	if (empty($settings['tunnel_network'])) {
2117	91c44185	jim-p	return;
2118	ef00af3c	Phil Davis	}
2119	966cdb43	jim-p	list($ip, $cidr) = explode('/', trim($settings['tunnel_network']));
2120	91c44185	jim-p	$mask = gen_subnet_mask($cidr);
2121	6ca938cf	jim-p	$clear_route = false;
2122
2123	ef00af3c	Phil Davis	switch ($settings['mode']) {
2124	6ca938cf	jim-p	case 'shared_key':
2125			$clear_route = true;
2126			break;
2127	91c44185	jim-p	case 'p2p_tls':
2128			case 'p2p_shared_key':
2129	a0f991ec	PiBa-NL	if ($cidr >= 30) {
2130	6ca938cf	jim-p	$clear_route = true;
2131	ef00af3c	Phil Davis	}
2132	91c44185	jim-p	break;
2133			}
2134	6ca938cf	jim-p
2135	6d0b9fe9	jim-p	if ($clear_route && !empty($ip) && !empty($mask)) {
2136	30c8a290	Renato Botelho	list($ip1, $ip2) = openvpn_get_interface_ip($ip, $cidr);
2137	6ca938cf	jim-p	$ip_to_clear = ($mode == "server") ? $ip1 : $ip2;
2138	615d7f0a	Ermal	/* XXX: Family for route? */
2139	6ca938cf	jim-p	mwexec("/sbin/route -q delete {$ip_to_clear}");
2140			}
2141	91c44185	jim-p	}
2142
2143	5c427ce7	jim-p	function openvpn_gen_routes($value, $ipproto = "ipv4", $push = false, $iroute = false) {
2144	a28d40cb	jim-p	$routes = "";
2145	ef00af3c	Phil Davis	if (empty($value)) {
2146	a28d40cb	jim-p	return "";
2147	ef00af3c	Phil Davis	}
2148	a28d40cb	jim-p	$networks = explode(',', $value);
2149
2150			foreach ($networks as $network) {
2151	ef00af3c	Phil Davis	if ($ipproto == "ipv4") {
2152	5c427ce7	jim-p	$route = openvpn_gen_route_ipv4($network, $iroute);
2153	ef00af3c	Phil Davis	} else {
2154	5c427ce7	jim-p	$route = openvpn_gen_route_ipv6($network, $iroute);
2155	ef00af3c	Phil Davis	}
2156	a28d40cb	jim-p
2157	ef00af3c	Phil Davis	if ($push) {
2158	a28d40cb	jim-p	$routes .= "push \"{$route}\"\n";
2159	ef00af3c	Phil Davis	} else {
2160	a28d40cb	jim-p	$routes .= "{$route}\n";
2161	ef00af3c	Phil Davis	}
2162	a28d40cb	jim-p	}
2163			return $routes;
2164			}
2165
2166	5c427ce7	jim-p	function openvpn_gen_route_ipv4($network, $iroute = false) {
2167			$i = ($iroute) ? "i" : "";
2168	a28d40cb	jim-p	list($ip, $mask) = explode('/', trim($network));
2169			$mask = gen_subnet_mask($mask);
2170	5c427ce7	jim-p	return "{$i}route $ip $mask";
2171	a28d40cb	jim-p	}
2172
2173	5c427ce7	jim-p	function openvpn_gen_route_ipv6($network, $iroute = false) {
2174			$i = ($iroute) ? "i" : "";
2175	a28d40cb	jim-p	list($ipv6, $prefix) = explode('/', trim($network));
2176	3000b44d	Renato Botelho	if (empty($prefix) && !is_numeric($prefix)) {
2177	a28d40cb	jim-p	$prefix = "128";
2178	ef00af3c	Phil Davis	}
2179	5c427ce7	jim-p	return "{$i}route-ipv6 ${ipv6}/${prefix}";
2180	a28d40cb	jim-p	}
2181
2182	699125b1	jim-p	function openvpn_get_settings($mode, $vpnid) {
2183			global $config;
2184
2185			if (is_array($config['openvpn']['openvpn-server'])) {
2186			foreach ($config['openvpn']['openvpn-server'] as $settings) {
2187	ef00af3c	Phil Davis	if (isset($settings['disable'])) {
2188	699125b1	jim-p	continue;
2189	ef00af3c	Phil Davis	}
2190	699125b1	jim-p
2191	ef00af3c	Phil Davis	if ($vpnid != 0 && $vpnid == $settings['vpnid']) {
2192	699125b1	jim-p	return $settings;
2193	ef00af3c	Phil Davis	}
2194	699125b1	jim-p	}
2195			}
2196
2197			if (is_array($config['openvpn']['openvpn-client'])) {
2198			foreach ($config['openvpn']['openvpn-client'] as $settings) {
2199	ef00af3c	Phil Davis	if (isset($settings['disable'])) {
2200	699125b1	jim-p	continue;
2201	ef00af3c	Phil Davis	}
2202	699125b1	jim-p
2203	ef00af3c	Phil Davis	if ($vpnid != 0 && $vpnid == $settings['vpnid']) {
2204	699125b1	jim-p	return $settings;
2205	ef00af3c	Phil Davis	}
2206	699125b1	jim-p	}
2207			}
2208
2209			return array();
2210			}
2211
2212			function openvpn_restart_by_vpnid($mode, $vpnid) {
2213			$settings = openvpn_get_settings($mode, $vpnid);
2214			openvpn_restart($mode, $settings);
2215			}
2216
2217	19a0636d	jim-p	/***f certs/openvpn_is_tunnel_network_in_use
2218			* NAME
2219			* openvpn_is_tunnel_network_in_use
2220			* Check if the supplied network is in use as an OpenVPN server or client
2221			* tunnel network
2222			* INPUTS
2223			* $net : The IPv4 or IPv6 network to check
2224			* RESULT
2225			* boolean value: true if the network is in use, false otherwise.
2226			******/
2227
2228			function openvpn_is_tunnel_network_in_use($net) {
2229			global $config;
2230			init_config_arr(array('openvpn', 'openvpn-server'));
2231			init_config_arr(array('openvpn', 'openvpn-client'));
2232			/* Determine whether to check IPv4 or IPv6 tunnel networks */
2233			$tocheck = 'tunnel_network';
2234			if (is_v6($net)) {
2235			$tocheck .= "v6";
2236			}
2237			/* Check all OpenVPN clients and servers for this tunnel network */
2238			foreach(array('server', 'client') as $mode) {
2239			foreach ($config['openvpn']["openvpn-{$mode}"] as $ovpn) {
2240			if (!empty($ovpn[$tocheck]) &&
2241			($ovpn[$tocheck] == $net)) {
2242			return true;
2243			}
2244			}
2245			}
2246			return false;
2247			}
2248	924eeefb	jim-p
2249	3adc4134	jim-p	function openvpn_build_data_cipher_list($data_ciphers = 'AES-256-GCM,AES-128-GCM,CHACHA20-POLY1305', $fallback_cipher = 'AES-256-GBC', $ncp_enabled = true) {
2250	924eeefb	jim-p	/* If the data_ciphers list is empty, populate it with the fallback cipher. */
2251	3adc4134	jim-p	if (empty($data_ciphers) \|\| !$ncp_enabled) {
2252	924eeefb	jim-p	$data_ciphers = $fallback_cipher;
2253			}
2254			/* Add the fallback cipher to the data ciphers list if it isn't already present */
2255			if (!in_array($fallback_cipher, explode(',', $data_ciphers))) {
2256			$data_ciphers .= ',' . $fallback_cipher;
2257			}
2258			return $data_ciphers;
2259			}
2260
2261	756720e2	Pierre POMES	?>

Project

General

Profile

pfSense