From 26a0befd753163d26b8d4d12405ee1b2cba46fd5 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Mon, 10 Feb 2020 15:52:16 +0000 Subject: [PATCH] IPsec: Add prototype to export Apple Configuration profiles Signed-off-by: Michael Tremer --- config/rootfiles/common/web-user-interface | 1 + doc/language_issues.de | 4 + doc/language_issues.en | 4 +- doc/language_issues.es | 4 +- doc/language_issues.fr | 4 + doc/language_issues.it | 4 + doc/language_issues.nl | 4 + doc/language_issues.pl | 4 +- doc/language_issues.ru | 4 +- doc/language_issues.tr | 4 + doc/language_missings | 8 ++ html/cgi-bin/vpnmain.cgi | 135 ++++++++++++++++++++- html/html/images/apple.png | Bin 0 -> 346 bytes langs/en/cgi-bin/en.pl | 1 + 14 files changed, 174 insertions(+), 7 deletions(-) create mode 100644 html/html/images/apple.png diff --git a/config/rootfiles/common/web-user-interface b/config/rootfiles/common/web-user-interface index 4d9f7b52f9..452d6543af 100644 --- a/config/rootfiles/common/web-user-interface +++ b/config/rootfiles/common/web-user-interface @@ -110,6 +110,7 @@ srv/web/ipfire/html/images/add.gif srv/web/ipfire/html/images/addblue.gif srv/web/ipfire/html/images/addgreen.gif srv/web/ipfire/html/images/address-book-new.png +srv/web/ipfire/html/images/apple.png srv/web/ipfire/html/images/application-certificate.png srv/web/ipfire/html/images/application-x-executable.png srv/web/ipfire/html/images/applications-accessories.png diff --git a/doc/language_issues.de b/doc/language_issues.de index 4983e20c6b..460fe62cac 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -828,6 +828,9 @@ WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support +WARNING: translation string unused: wlan clients +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -852,6 +855,7 @@ WARNING: translation string unused: zoneconf val vlan tag range error WARNING: translation string unused: zoneconf val zoneslave amount error WARNING: untranslated string: desired = Desired WARNING: untranslated string: disable = Disable +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: enable = Enable WARNING: untranslated string: error the to date has to be later than the from date = The to date has to be later than the from date! WARNING: untranslated string: fwhost cust locationgrp = unknown string diff --git a/doc/language_issues.en b/doc/language_issues.en index 4e6a201fd3..f093781c6e 100644 --- a/doc/language_issues.en +++ b/doc/language_issues.en @@ -645,6 +645,7 @@ WARNING: untranslated string: downlink = Downlink WARNING: untranslated string: downlink speed = Downlink speed (kbit/sec) WARNING: untranslated string: downlink std class = downlink standard class WARNING: untranslated string: download = download +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: download ca certificate = Download CA certificate WARNING: untranslated string: download certificate = Download file WARNING: untranslated string: download host certificate = Download host certificate @@ -2144,7 +2145,6 @@ WARNING: untranslated string: wlan client wpa mode all = Auto WARNING: untranslated string: wlan client wpa mode ccmp ccmp = CCMP-CCMP WARNING: untranslated string: wlan client wpa mode ccmp tkip = CCMP-TKIP WARNING: untranslated string: wlan client wpa mode tkip tkip = TKIP-TKIP -WARNING: untranslated string: wlan clients = Wireless clients WARNING: untranslated string: wlanap = Access Point WARNING: untranslated string: wlanap 802.11w disabled = Disabled WARNING: untranslated string: wlanap 802.11w enforced = Enforced @@ -2161,8 +2161,6 @@ WARNING: untranslated string: wlanap encryption = Encryption WARNING: untranslated string: wlanap informations = Informations WARNING: untranslated string: wlanap interface = Select interface WARNING: untranslated string: wlanap invalid wpa = Invalid length in WPA Passphrase. Must be between 8 and 63 characters. -WARNING: untranslated string: wlanap link dhcp = Wireless lan DHCP configuration -WARNING: untranslated string: wlanap link wireless = Activate wireless lan clients WARNING: untranslated string: wlanap management frame protection = Management Frame Protection (802.11w) WARNING: untranslated string: wlanap neighbor scan = Neighborhood scan WARNING: untranslated string: wlanap neighbor scan warning = Warning! Disabling may violate regulatory rules! diff --git a/doc/language_issues.es b/doc/language_issues.es index d9c512af45..5282a66d4b 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -773,6 +773,8 @@ WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support WARNING: translation string unused: wlanap access point +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -921,6 +923,7 @@ WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been WARNING: untranslated string: dnssec not supported = DNSSEC Not supported WARNING: untranslated string: dnssec validating = DNSSEC Validating WARNING: untranslated string: downlink = Downlink +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: download tls-auth key = Download tls-auth key WARNING: untranslated string: dpd delay = Delay WARNING: untranslated string: dpd timeout = Timeout @@ -1522,7 +1525,6 @@ WARNING: untranslated string: wlan client wpa mode all = Auto WARNING: untranslated string: wlan client wpa mode ccmp ccmp = CCMP-CCMP WARNING: untranslated string: wlan client wpa mode ccmp tkip = CCMP-TKIP WARNING: untranslated string: wlan client wpa mode tkip tkip = TKIP-TKIP -WARNING: untranslated string: wlan clients = Wireless clients WARNING: untranslated string: wlanap = Access Point WARNING: untranslated string: wlanap 802.11w disabled = Disabled WARNING: untranslated string: wlanap 802.11w enforced = Enforced diff --git a/doc/language_issues.fr b/doc/language_issues.fr index e993c63134..aa35ebd708 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -868,6 +868,9 @@ WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support +WARNING: translation string unused: wlan clients +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -889,6 +892,7 @@ WARNING: translation string unused: zoneconf val stp zone mode error WARNING: translation string unused: zoneconf val vlan amount assignment error WARNING: translation string unused: zoneconf val vlan tag assignment error WARNING: translation string unused: zoneconf val zoneslave amount error +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: fwhost cust locationgrp = unknown string WARNING: untranslated string: fwhost err hostip = unknown string WARNING: untranslated string: guardian block a host = unknown string diff --git a/doc/language_issues.it b/doc/language_issues.it index 15ad4f8964..d26afef65c 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -841,7 +841,10 @@ WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support +WARNING: translation string unused: wlan clients WARNING: translation string unused: wlanap access point +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -943,6 +946,7 @@ WARNING: untranslated string: dns use protocol for dns queries = Protocol for DN WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled WARNING: untranslated string: dnsforward forward_servers = Nameservers WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: duration = Duration WARNING: untranslated string: eight hours = 8 Hours WARNING: untranslated string: email config = Configuration diff --git a/doc/language_issues.nl b/doc/language_issues.nl index 1a60d83a63..75523b52f5 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -835,7 +835,10 @@ WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support +WARNING: translation string unused: wlan clients WARNING: translation string unused: wlanap access point +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -946,6 +949,7 @@ WARNING: untranslated string: dnssec aware = DNSSEC Aware WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been disabled WARNING: untranslated string: dnssec not supported = DNSSEC Not supported WARNING: untranslated string: dnssec validating = DNSSEC Validating +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: download tls-auth key = Download tls-auth key WARNING: untranslated string: drop outgoing = Log dropped outgoing packets WARNING: untranslated string: duration = Duration diff --git a/doc/language_issues.pl b/doc/language_issues.pl index e0fb9fd5e3..1afab9f14a 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -757,6 +757,8 @@ WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support WARNING: translation string unused: wlanap access point +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -936,6 +938,7 @@ WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been WARNING: untranslated string: dnssec not supported = DNSSEC Not supported WARNING: untranslated string: dnssec validating = DNSSEC Validating WARNING: untranslated string: downlink = Downlink +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: download tls-auth key = Download tls-auth key WARNING: untranslated string: dpd delay = Delay WARNING: untranslated string: dpd timeout = Timeout @@ -1530,7 +1533,6 @@ WARNING: untranslated string: wlan client wpa mode all = Auto WARNING: untranslated string: wlan client wpa mode ccmp ccmp = CCMP-CCMP WARNING: untranslated string: wlan client wpa mode ccmp tkip = CCMP-TKIP WARNING: untranslated string: wlan client wpa mode tkip tkip = TKIP-TKIP -WARNING: untranslated string: wlan clients = Wireless clients WARNING: untranslated string: wlanap = Access Point WARNING: untranslated string: wlanap 802.11w disabled = Disabled WARNING: untranslated string: wlanap 802.11w enforced = Enforced diff --git a/doc/language_issues.ru b/doc/language_issues.ru index d5bdbe6589..ed0e78f0ba 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -752,6 +752,8 @@ WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support WARNING: translation string unused: wlanap access point +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -933,6 +935,7 @@ WARNING: untranslated string: dnssec disabled warning = WARNING: DNSSEC has been WARNING: untranslated string: dnssec not supported = DNSSEC Not supported WARNING: untranslated string: dnssec validating = DNSSEC Validating WARNING: untranslated string: downlink = Downlink +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: download tls-auth key = Download tls-auth key WARNING: untranslated string: dpd delay = Delay WARNING: untranslated string: dpd timeout = Timeout @@ -1525,7 +1528,6 @@ WARNING: untranslated string: wlan client wpa mode all = Auto WARNING: untranslated string: wlan client wpa mode ccmp ccmp = CCMP-CCMP WARNING: untranslated string: wlan client wpa mode ccmp tkip = CCMP-TKIP WARNING: untranslated string: wlan client wpa mode tkip tkip = TKIP-TKIP -WARNING: untranslated string: wlan clients = Wireless clients WARNING: untranslated string: wlanap = Access Point WARNING: untranslated string: wlanap 802.11w disabled = Disabled WARNING: untranslated string: wlanap 802.11w enforced = Enforced diff --git a/doc/language_issues.tr b/doc/language_issues.tr index 1445f86413..c8aadd6f17 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -871,6 +871,9 @@ WARNING: translation string unused: weekly firewallhits WARNING: translation string unused: wildcards WARNING: translation string unused: wins server WARNING: translation string unused: wins support +WARNING: translation string unused: wlan clients +WARNING: translation string unused: wlanap link dhcp +WARNING: translation string unused: wlanap link wireless WARNING: translation string unused: wlanap wlan services WARNING: translation string unused: xtaccess all error WARNING: translation string unused: xtaccess bad transfert @@ -922,6 +925,7 @@ WARNING: untranslated string: dns use isp assigned nameservers = Use ISP-assigne WARNING: untranslated string: dns use protocol for dns queries = Protocol for DNS queries WARNING: untranslated string: dnsforward dnssec disabled = DNSSEC Validation is disabled WARNING: untranslated string: dnsforward forward_servers = Nameservers +WARNING: untranslated string: download apple profile = Download Apple Configuration Profile WARNING: untranslated string: duration = Duration WARNING: untranslated string: email tls explicit = explicit (STARTTLS) WARNING: untranslated string: email tls implicit = implicit (TLS) diff --git a/doc/language_missings b/doc/language_missings index a390d1b002..70efc4ad75 100644 --- a/doc/language_missings +++ b/doc/language_missings @@ -34,6 +34,7 @@ < disable < dns could not add server < done +< download apple profile < enable < error the to date has to be later than the from date < g.dtm @@ -218,6 +219,7 @@ < dns use isp assigned nameservers < dns use protocol for dns queries < downlink +< download apple profile < download dh parameter < download tls-auth key < dpd delay @@ -920,6 +922,7 @@ < ansi t1.483 < bewan adsl pci st < bewan adsl usb +< download apple profile < g.dtm < g.lite < upload fcdsl.o @@ -1042,6 +1045,7 @@ < dns tls hostname < dns use isp assigned nameservers < dns use protocol for dns queries +< download apple profile < duration < eight hours < email config @@ -1445,6 +1449,7 @@ < dns tls hostname < dns use isp assigned nameservers < dns use protocol for dns queries +< download apple profile < download dh parameter < download tls-auth key < drop outgoing @@ -1965,6 +1970,7 @@ < dns use isp assigned nameservers < dns use protocol for dns queries < downlink +< download apple profile < download dh parameter < download tls-auth key < dpd delay @@ -2855,6 +2861,7 @@ < dns use isp assigned nameservers < dns use protocol for dns queries < downlink +< download apple profile < download dh parameter < download tls-auth key < dpd delay @@ -3588,6 +3595,7 @@ < dns tls hostname < dns use isp assigned nameservers < dns use protocol for dns queries +< download apple profile < duration < email tls explicit < email tls implicit diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index b5c64dd277..8cd43c3052 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -19,6 +19,7 @@ # # ############################################################################### +use MIME::Base64; use Net::DNS; use File::Copy; use File::Temp qw/ tempfile tempdir /; @@ -1178,6 +1179,122 @@ END print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`; exit (0); +# Export Apple profile to browser +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download apple profile'}) { + &General::readhasharray("${General::swroot}/vpn/config", \%confighash); + my $key = $cgiparams{'KEY'}; + + my $uuid1 = "AAAABBBB"; + my $uuid2 = "CCCCDDDD"; + + my $cert = ""; + my $cert_uuid = "123456789"; + + # Read and encode certificate + if ($confighash{$key}[4] eq "cert") { + my $cert_path = "${General::swroot}/certs/$confighash{$key}[1].p12"; + + # Read certificate and encode it into Base64 + open(CERT, "<${cert_path}"); + local($/) = undef; # slurp + $cert = MIME::Base64::encode_base64(); + close(CERT); + } + + print "Content-Type: application/octet-stream\n"; + print "Content-Disposition: attachment; filename=" . $confighash{$key}[1] . ".mobileconfig\n"; + print "\n"; # end headers + + print "\n"; + print "\n"; + print " \n"; + print " PayloadDisplayName\n"; + print " $confighash{$key}[1]\n"; + print " PayloadIdentifier\n"; + print " $confighash{$key}[1]\n"; + print " PayloadUUID\n"; + print " ${uuid1}\n"; + print " PayloadType\n"; + print " Configuration\n"; + print " PayloadVersion\n"; + print " 1\n"; + print " PayloadContent\n"; + print " \n"; + print " \n"; + print " PayloadIdentifier\n"; + print " org.example.vpn1.conf1\n"; + print " PayloadUUID\n"; + print " ${uuid2}\n"; + print " PayloadType\n"; + print " com.apple.vpn.managed\n"; + print " PayloadVersion\n"; + print " 1\n"; + print " UserDefinedName\n"; + print " $confighash{$key}[1]\n"; + print " VPNType\n"; + print " IKEv2\n"; + print " IKEv2\n"; + print " \n"; + print " RemoteAddress\n"; + print " 18.206.152.26\n"; + + # Left ID + if ($confighash{$key}[9]) { + print " LocalIdentifier\n"; + print " $confighash{$key}[9]\n"; + } + + # Right ID + if ($confighash{$key}[7]) { + print " RemoteIdentifier\n"; + print " $confighash{$key}[7]\n"; + } + + if ($confighash{$key}[4] eq "cert") { + print " AuthenticationMethod\n"; + print " Certificate\n"; + + print " PayloadCertificateUUID\n"; + print " ${cert_uuid}\n"; + } else { + print " AuthenticationMethod\n"; + print " SharedSecret\n"; + print " SharedSecret\n"; + print " $confighash{$key}[5]\n"; + } + + print " ExtendedAuthEnabled\n"; + print " 0\n"; + print " \n"; + print " \n"; + + if ($confighash{$key}[4] eq "cert") { + print " \n"; + print " PayloadIdentifier\n"; + print " org.example.vpn1.client\n"; + print " PayloadUUID\n"; + print " ${cert_uuid}\n"; + print " PayloadType\n"; + print " com.apple.security.pkcs12\n"; + print " PayloadVersion\n"; + print " 1\n"; + print " PayloadContent\n"; + print " \n"; + + foreach (split /\n/,${cert}) { + print " $_\n"; + } + + print " \n"; + print " \n"; + } + + print " \n"; + print " \n"; + print "\n"; + + # Done + exit(0); ### ### Display certificate ### @@ -2982,7 +3099,7 @@ END $Lang::tr{'common name'} $Lang::tr{'remark'} $Lang::tr{'status'} - $Lang::tr{'action'} + $Lang::tr{'action'} END ; @@ -3083,6 +3200,22 @@ END } else { print " "; } + + # Apple Profile + if ($confighash{$key}[3] eq 'host') { + print < +
+ + + +
+ +END + } else { + print " "; + } + print <
diff --git a/html/html/images/apple.png b/html/html/images/apple.png new file mode 100644 index 0000000000000000000000000000000000000000..6571a749b693911b9c616b29a6b749b409935853 GIT binary patch literal 346 zc-rd>@N?(olHy`uVBq!ia0vp^A|TAc1|)ksWqE-VOR5e-as->B0w#;z=wb9XPEh5Wee3MXypEOc8~ondH1Ay2V|w?oEt`%}g2C)Z zCR5BO#0eMt*&6iL??zAj*4dmoA2oFT_P=^$DO_>o$~Ql@9ECz-J>djav!H~Q|CLSb nF$uD(ZyYzx+c=dgd#Qd-dzV1X{ntx?;lSYO>gTe~DWM4fVRMKG literal 0 Hc-jL100001 diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index dc1fd8d67b..b7cbea6324 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -913,6 +913,7 @@ 'downlink speed' => 'Downlink speed (kbit/sec)', 'downlink std class' => 'downlink standard class', 'download' => 'download', +'download apple profile' => 'Download Apple Configuration Profile', 'download ca certificate' => 'Download CA certificate', 'download certificate' => 'Download file', 'download dh parameter' => 'Download Diffie-Hellman parameters', -- 2.39.2