Project

General

Profile

Download (17.6 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
	vpn_ipsec_mobile.php
4
	part of m0n0wall (http://m0n0.ch/wall)
5
	
6
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
7
	All rights reserved.
8
	
9
	Redistribution and use in source and binary forms, with or without
10
	modification, are permitted provided that the following conditions are met:
11
	
12
	1. Redistributions of source code must retain the above copyright notice,
13
	   this list of conditions and the following disclaimer.
14
	
15
	2. Redistributions in binary form must reproduce the above copyright
16
	   notice, this list of conditions and the following disclaimer in the
17
	   documentation and/or other materials provided with the distribution.
18
	
19
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
20
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
21
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
22
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
23
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28
	POSSIBILITY OF SUCH DAMAGE.
29
*/
30

    
31
require("guiconfig.inc");
32

    
33
if (!is_array($config['ipsec']['mobileclients'])) {
34
	$config['ipsec']['mobileclients'] = array();
35
}
36
$a_ipsec = &$config['ipsec']['mobileclients'];
37

    
38
if (count($a_ipsec) == 0) {
39
	/* defaults */
40
	$pconfig['p1mode'] = "aggressive";
41
	$pconfig['p1myidentt'] = "myaddress";
42
	$pconfig['p1ealgo'] = "3des";
43
	$pconfig['p1halgo'] = "sha1";
44
	$pconfig['p1dhgroup'] = "2";
45
	$pconfig['p1authentication_method'] = "pre_shared_key";
46
	$pconfig['p2proto'] = "esp";
47
	$pconfig['p2ealgos'] = explode(",", "3des,blowfish,cast128,rijndael");
48
	$pconfig['p2halgos'] = explode(",", "hmac_sha1,hmac_md5");
49
	$pconfig['p2pfsgroup'] = "0";
50
} else {
51
	$pconfig['enable'] = isset($a_ipsec['enable']);
52
	$pconfig['p1mode'] = $a_ipsec['p1']['mode'];
53
		
54
	if (isset($a_ipsec['p1']['myident']['myaddress']))
55
		$pconfig['p1myidentt'] = 'myaddress';
56
	else if (isset($a_ipsec['p1']['myident']['address'])) {
57
		$pconfig['p1myidentt'] = 'address';
58
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['address'];
59
	} else if (isset($a_ipsec['p1']['myident']['fqdn'])) {
60
		$pconfig['p1myidentt'] = 'fqdn';
61
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['fqdn'];
62
	} else if (isset($a_ipsec['p1']['myident']['ufqdn'])) {
63
		$pconfig['p1myidentt'] = 'user_fqdn';
64
		$pconfig['p1myident'] = $a_ipsec['p1']['myident']['ufqdn'];
65
 	}
66
	
67
	$pconfig['p1ealgo'] = $a_ipsec['p1']['encryption-algorithm'];
68
	$pconfig['p1halgo'] = $a_ipsec['p1']['hash-algorithm'];
69
	$pconfig['p1dhgroup'] = $a_ipsec['p1']['dhgroup'];
70
	$pconfig['p1lifetime'] = $a_ipsec['p1']['lifetime'];
71
	$pconfig['p1authentication_method'] = $a_ipsec['p1']['authentication_method'];
72
	$pconfig['p1cert'] = base64_decode($a_ipsec['p1']['cert']);
73
	$pconfig['p1privatekey'] = base64_decode($a_ipsec['p1']['private-key']);
74
	$pconfig['p2proto'] = $a_ipsec['p2']['protocol'];
75
	$pconfig['p2ealgos'] = $a_ipsec['p2']['encryption-algorithm-option'];
76
	$pconfig['p2halgos'] = $a_ipsec['p2']['hash-algorithm-option'];
77
	$pconfig['p2pfsgroup'] = $a_ipsec['p2']['pfsgroup'];
78
	$pconfig['p2lifetime'] = $a_ipsec['p2']['lifetime'];
79
}
80

    
81
if ($_POST) {
82
	unset($input_errors);
83
	$pconfig = $_POST;
84

    
85
	/* input validation */
86
	$reqdfields = explode(" ", "p2ealgos p2halgos");
87
	$reqdfieldsn = explode(",", "P2 Encryption Algorithms,P2 Hash Algorithms");
88
	
89
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
90
	
91
	if ($_POST['p1authentication_method']== "rsasig") {
92
		if (!strstr($_POST['p1cert'], "BEGIN CERTIFICATE") || !strstr($_POST['p1cert'], "END CERTIFICATE"))
93
			$input_errors[] = "This certificate does not appear to be valid.";
94
		if (!strstr($_POST['p1privatekey'], "BEGIN RSA PRIVATE KEY") || !strstr($_POST['p1privatekey'], "END RSA PRIVATE KEY"))
95
			$input_errors[] = "This key does not appear to be valid.";	
96
	}
97
	
98
	if (($_POST['p1lifetime'] && !is_numeric($_POST['p1lifetime']))) {
99
		$input_errors[] = "The P1 lifetime must be an integer.";
100
	}
101
	if (($_POST['p2lifetime'] && !is_numeric($_POST['p2lifetime']))) {
102
		$input_errors[] = "The P2 lifetime must be an integer.";
103
	}
104
	if ((($_POST['p1myidentt'] == "address") && !is_ipaddr($_POST['p1myident']))) {
105
		$input_errors[] = "A valid IP address for 'My identifier' must be specified.";
106
	}
107
	if ((($_POST['p1myidentt'] == "fqdn") && !is_domain($_POST['p1myident']))) {
108
		$input_errors[] = "A valid domain name for 'My identifier' must be specified.";
109
	}
110
	if ($_POST['p1myidentt'] == "user_fqdn") {
111
		$ufqdn = explode("@",$_POST['p1myident']);
112
		if (!is_domain($ufqdn[1])) 
113
			$input_errors[] = "A valid User FQDN in the form of user@my.domain.com for 'My identifier' must be specified.";
114
	}
115
	
116
	if ($_POST['p1myidentt'] == "myaddress")
117
		$_POST['p1myident'] = "";
118

    
119
	if (!$input_errors) {
120
		$ipsecent = array();
121
		$ipsecent['enable'] = $_POST['enable'] ? true : false;
122
		$ipsecent['p1']['mode'] = $_POST['p1mode'];
123
		
124
		$ipsecent['p1']['myident'] = array();
125
		switch ($_POST['p1myidentt']) {
126
			case 'myaddress':
127
				$ipsecent['p1']['myident']['myaddress'] = true;
128
				break;
129
			case 'address':
130
				$ipsecent['p1']['myident']['address'] = $_POST['p1myident'];
131
				break;
132
			case 'fqdn':
133
				$ipsecent['p1']['myident']['fqdn'] = $_POST['p1myident'];
134
				break;
135
			case 'user_fqdn':
136
				$ipsecent['p1']['myident']['ufqdn'] = $_POST['p1myident'];
137
				break;
138
		}
139
		
140
		$ipsecent['p1']['encryption-algorithm'] = $_POST['p1ealgo'];
141
		$ipsecent['p1']['hash-algorithm'] = $_POST['p1halgo'];
142
		$ipsecent['p1']['dhgroup'] = $_POST['p1dhgroup'];
143
		$ipsecent['p1']['lifetime'] = $_POST['p1lifetime'];
144
		$ipsecent['p1']['private-key'] = base64_encode($_POST['p1privatekey']);
145
		$ipsecent['p1']['cert'] = base64_encode($_POST['p1cert']);
146
		$ipsecent['p1']['authentication_method'] = $_POST['p1authentication_method'];
147
		$ipsecent['p2']['protocol'] = $_POST['p2proto'];
148
		$ipsecent['p2']['encryption-algorithm-option'] = $_POST['p2ealgos'];
149
		$ipsecent['p2']['hash-algorithm-option'] = $_POST['p2halgos'];
150
		$ipsecent['p2']['pfsgroup'] = $_POST['p2pfsgroup'];
151
		$ipsecent['p2']['lifetime'] = $_POST['p2lifetime'];
152
		
153
		$a_ipsec = $ipsecent;
154
		
155
		write_config();
156
		touch($d_ipsecconfdirty_path);
157
		
158
		header("Location: vpn_ipsec_mobile.php");
159
		exit;
160
	}
161
}
162

    
163
$pgtitle = "VPN: IPsec: Mobile";
164
include("head.inc");
165

    
166
?>
167
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
168
<?php include("fbegin.inc"); ?>
169
<p class="pgtitle"><?=$pgtitle?></p>
170
<script language="JavaScript">
171
<!--
172
function methodsel_change() {
173
	switch (document.iform.p1authentication_method.selectedIndex) {
174
		case 1:	/* rsa */
175
			document.iform.p1privatekey.disabled = 0;
176
			document.iform.p1cert.disabled = 0;
177
			break;
178
		default: /* pre-shared */
179
			document.iform.p1privatekey.disabled = 1;
180
			document.iform.p1cert.disabled = 1;
181
			break;
182
	}
183
}
184
//-->
185
</script>
186
<form action="vpn_ipsec.php" method="post">
187
<?php if ($input_errors) print_input_errors($input_errors); ?>
188
<?php if (file_exists($d_ipsecconfdirty_path)): ?><p>
189
<?php print_info_box_np("The IPsec tunnel configuration has been changed.<br>You must apply the changes in order for them to take effect.");?><br>
190
<?php endif; ?>
191
</form>
192
<form action="vpn_ipsec_mobile.php" method="post" name="iform" id="iform">
193
<table width="100%" border="0" cellpadding="0" cellspacing="0">
194
  <tr><td class="tabnavtbl">
195
<?php
196
	$tab_array = array();
197
	$tab_array[0] = array("Tunnels", false, "vpn_ipsec.php");
198
	$tab_array[1] = array("Mobile clients", true, "vpn_ipsec_mobile.php");
199
	$tab_array[2] = array("Pre-shared keys", false, "vpn_ipsec_keys.php");
200
	$tab_array[3] = array("CAs", false, "vpn_ipsec_ca.php");
201
	$tab_array[4] = array("Failover IPSEC", false, "/pkg_edit.php?xml=sasyncd.xml&id=0");
202
	display_top_tabs($tab_array);
203
?>
204
  </td></tr>
205
  <tr> 
206
    <td>
207
	 <div id="mainarea">
208
              <table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
209
			  <tr> 
210
                        <td width="22%" valign="top">&nbsp;</td>
211
                        <td width="78%"> 
212
                    <input name="enable" type="checkbox" id="enable" value="yes" <?php if ($pconfig['enable']) echo "checked"; ?>>
213
                    <strong>Allow mobile clients</strong></td>
214
                </tr>
215
                <tr> 
216
                  <td colspan="2" valign="top" class="listtopic">Phase 1 proposal 
217
                    (Authentication)</td>
218
                </tr>
219
                <tr> 
220
                  <td width="22%" valign="top" class="vncellreq">Negotiation mode</td>
221
                        <td width="78%" class="vtable">
222
					<select name="p1mode" class="formfld">
223
                      <?php $modes = explode(" ", "main aggressive"); foreach ($modes as $mode): ?>
224
                      <option value="<?=$mode;?>" <?php if ($mode == $pconfig['p1mode']) echo "selected"; ?>> 
225
                      <?=htmlspecialchars($mode);?>
226
                      </option>
227
                      <?php endforeach; ?>
228
                    </select> <br> <span class="vexpl">Aggressive is faster, but 
229
                    less secure.</span></td>
230
                </tr>
231
                <tr> 
232
                  <td width="22%" valign="top" class="vncellreq">My identifier</td>
233
                        <td width="78%" class="vtable">
234
					<select name="p1myidentt" class="formfld">
235
                      <?php foreach ($my_identifier_list as $mode => $modename): ?>
236
                      <option value="<?=$mode;?>" <?php if ($mode == $pconfig['p1myidentt']) echo "selected"; ?>> 
237
                      <?=htmlspecialchars($modename);?>
238
                      </option>
239
                      <?php endforeach; ?>
240
                    </select> <input name="p1myident" type="text" class="formfld" id="p1myident" size="30" value="<?=$pconfig['p1myident'];?>"> 
241
                  </td>
242
                </tr>
243
                <tr> 
244
                  <td width="22%" valign="top" class="vncellreq">Encryption algorithm</td>
245
                        <td width="78%" class="vtable">
246
					<select name="p1ealgo" class="formfld">
247
                      <?php foreach ($p1_ealgos as $algo => $algoname): ?>
248
                      <option value="<?=$algo;?>" <?php if ($algo == $pconfig['p1ealgo']) echo "selected"; ?>> 
249
                      <?=htmlspecialchars($algoname);?>
250
                      </option>
251
                      <?php endforeach; ?>
252
                    </select> <br> <span class="vexpl">Must match the setting 
253
                    chosen on the remote side. </span></td>
254
                </tr>
255
                <tr> 
256
                  <td width="22%" valign="top" class="vncellreq">Hash algorithm</td>
257
                        <td width="78%" class="vtable">
258
					<select name="p1halgo" class="formfld">
259
                      <?php foreach ($p1_halgos as $algo => $algoname): ?>
260
                      <option value="<?=$algo;?>" <?php if ($algo == $pconfig['p1halgo']) echo "selected"; ?>> 
261
                      <?=htmlspecialchars($algoname);?>
262
                      </option>
263
                      <?php endforeach; ?>
264
                    </select> <br> <span class="vexpl">Must match the setting 
265
                    chosen on the remote side. </span></td>
266
                </tr>
267
                <tr> 
268
                  <td width="22%" valign="top" class="vncellreq">DH key group</td>
269
                        <td width="78%" class="vtable">
270
					<select name="p1dhgroup" class="formfld">
271
                      <?php $keygroups = explode(" ", "1 2 5"); foreach ($keygroups as $keygroup): ?>
272
                      <option value="<?=$keygroup;?>" <?php if ($keygroup == $pconfig['p1dhgroup']) echo "selected"; ?>> 
273
                      <?=htmlspecialchars($keygroup);?>
274
                      </option>
275
                      <?php endforeach; ?>
276
                    </select> <br> <span class="vexpl"><em>1 = 768 bit, 2 = 1024 
277
                    bit, 5 = 1536 bit</em><br>
278
                    Must match the setting chosen on the remote side. </span></td>
279
                </tr>
280
                <tr> 
281
                  <td width="22%" valign="top" class="vncell">Lifetime</td>
282
                        <td width="78%" class="vtable"> 
283
                    <input name="p1lifetime" type="text" class="formfld" id="p1lifetime" size="20" value="<?=$pconfig['p1lifetime'];?>">
284
                    seconds</td>
285
                </tr>
286
                <tr> 
287
                  <td width="22%" valign="top" class="vncellreq">Authentication method</td>
288
                  <td width="78%" class="vtable">
289
					<select name="p1authentication_method" class="formfld" onChange="methodsel_change()">
290
                      <?php foreach ($p1_authentication_methods as $method => $methodname): ?>
291
                      <option value="<?=$method;?>" <?php if ($method == $pconfig['p1authentication_method']) echo "selected"; ?>> 
292
                      <?=htmlspecialchars($methodname);?>
293
                      </option>
294
                      <?php endforeach; ?>
295
                    </select> <br> <span class="vexpl">Must match the setting 
296
                    chosen on the remote side. </span></td>
297
                </tr>
298
                <tr> 
299
                  <td width="22%" valign="top" class="vncellreq">Certificate</td>
300
                  <td width="78%" class="vtable"> 
301
                    <textarea name="p1cert" cols="65" rows="7" id="p1cert" class="formpre"><?=htmlspecialchars($pconfig['p1cert']);?></textarea>
302
                    <br> 
303
                    Paste a certificate in X.509 PEM format here.</td>
304
                </tr>
305
                <tr> 
306
                  <td width="22%" valign="top" class="vncellreq">Key</td>
307
                  <td width="78%" class="vtable"> 
308
                    <textarea name="p1privatekey" cols="65" rows="7" id="p1privatekey" class="formpre"><?=htmlspecialchars($pconfig['p1privatekey']);?></textarea>
309
                    <br> 
310
                    Paste an RSA private key in PEM format here.</td>
311
                </tr>
312
                <tr> 
313
                  <td colspan="2" class="list" height="12"></td>
314
                </tr>
315
                <tr> 
316
                  <td colspan="2" valign="top" class="listtopic">Phase 2 proposal 
317
                    (SA/Key Exchange)</td>
318
                </tr>
319
                <tr> 
320
                  <td width="22%" valign="top" class="vncellreq">Protocol</td>
321
                        <td width="78%" class="vtable">
322
					<select name="p2proto" class="formfld">
323
                      <?php foreach ($p2_protos as $proto => $protoname): ?>
324
                      <option value="<?=$proto;?>" <?php if ($proto == $pconfig['p2proto']) echo "selected"; ?>> 
325
                      <?=htmlspecialchars($protoname);?>
326
                      </option>
327
                      <?php endforeach; ?>
328
                    </select> <br> <span class="vexpl">ESP is encryption, AH is 
329
                    authentication only </span></td>
330
                </tr>
331
                <tr> 
332
                  <td width="22%" valign="top" class="vncellreq">Encryption algorithms</td>
333
                        <td width="78%" class="vtable"> 
334
                          <?php foreach ($p2_ealgos as $algo => $algoname): ?>
335
                    <input type="checkbox" name="p2ealgos[]" value="<?=$algo;?>" <?php if (in_array($algo, $pconfig['p2ealgos'])) echo "checked"; ?>> 
336
                    <?=htmlspecialchars($algoname);?>
337
                    <br> 
338
                    <?php endforeach; ?>
339
                    <br>
340
                    Hint: use 3DES for best compatibility or if you have a hardware 
341
                    crypto accelerator card. Blowfish is usually the fastest in 
342
                    software encryption. </td>
343
                </tr>
344
                <tr> 
345
                  <td width="22%" valign="top" class="vncellreq">Hash algorithms</td>
346
                        <td width="78%" class="vtable"> 
347
                          <?php foreach ($p2_halgos as $algo => $algoname): ?>
348
                    <input type="checkbox" name="p2halgos[]" value="<?=$algo;?>" <?php if (in_array($algo, $pconfig['p2halgos'])) echo "checked"; ?>> 
349
                    <?=htmlspecialchars($algoname);?>
350
                    <br> 
351
                    <?php endforeach; ?>
352
                  </td>
353
                </tr>
354
                <tr> 
355
                  <td width="22%" valign="top" class="vncellreq">PFS key group</td>
356
                        <td width="78%" class="vtable">
357
					<select name="p2pfsgroup" class="formfld">
358
                      <?php foreach ($p2_pfskeygroups as $keygroup => $keygroupname): ?>
359
                      <option value="<?=$keygroup;?>" <?php if ($keygroup == $pconfig['p2pfsgroup']) echo "selected"; ?>> 
360
                      <?=htmlspecialchars($keygroupname);?>
361
                      </option>
362
                      <?php endforeach; ?>
363
                    </select> <br> <span class="vexpl"><em>1 = 768 bit, 2 = 1024 
364
                    bit, 5 = 1536 bit</em></span></td>
365
                </tr>
366
                <tr> 
367
                  <td width="22%" valign="top" class="vncell">Lifetime</td>
368
                        <td width="78%" class="vtable"> 
369
                    <input name="p2lifetime" type="text" class="formfld" id="p2lifetime" size="20" value="<?=$pconfig['p2lifetime'];?>">
370
                    seconds</td>
371
                </tr>
372
                <tr> 
373
                  <td width="22%" valign="top">&nbsp;</td>
374
                  <td width="78%"> 
375
                    <input name="Submit" type="submit" class="formbtn" value="Save">
376
                  </td>
377
                </tr>
378
              </table>
379
	  </div>
380
	 </td>
381
	</tr>
382
</table>
383
</form>
384
<script language="JavaScript">
385
<!--
386
methodsel_change();
387
//-->
388
</script>
389
<?php include("fend.inc"); ?>
390
</body>
391
</html>
(137-137/155)