IPsec: Add selection for transport/tunnel mode

[ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index e557122dffa271c60bc5e2ffceb8c96552612433..f7a1c5e52d7f0a6be2057ac790bc9e2e0f41c1a2 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -111,6 +111,7 @@ $cgiparams{'DPD_TIMEOUT'} = '120';
 $cgiparams{'FORCE_MOBIKE'} = 'off';
 $cgiparams{'START_ACTION'} = 'start';
 $cgiparams{'INACTIVITY_TIMEOUT'} = 900;
+$cgiparams{'MODE'} = "tunnel";
 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
 
 ###
@@ -149,7 +150,12 @@ sub cleanssldatabase {
                print FILE "";
                close FILE;
        }
+       if (open(FILE, ">${General::swroot}/certs/index.txt.attr")) {
+               print FILE "";
+               close FILE;
+       }
        unlink ("${General::swroot}/certs/index.txt.old");
+       unlink ("${General::swroot}/certs/index.txt.attr.old");
        unlink ("${General::swroot}/certs/serial.old");
        unlink ("${General::swroot}/certs/01.pem");
 }
@@ -162,7 +168,11 @@ sub newcleanssldatabase {
        if (! -s ">${General::swroot}/certs/index.txt") {
                system ("touch ${General::swroot}/certs/index.txt");
        }
+       if (! -s ">${General::swroot}/certs/index.txt.attr") {
+               system ("touch ${General::swroot}/certs/index.txt.attr");
+       }
        unlink ("${General::swroot}/certs/index.txt.old");
+       unlink ("${General::swroot}/certs/index.txt.attr.old");
        unlink ("${General::swroot}/certs/serial.old");
 #      unlink ("${General::swroot}/certs/01.pem");             numbering evolves. Wrong place to delete
 }
@@ -1307,6 +1317,7 @@ END
                $cgiparams{'DPD_DELAY'}                 = $confighash{$cgiparams{'KEY'}}[31];
                $cgiparams{'FORCE_MOBIKE'}              = $confighash{$cgiparams{'KEY'}}[32];
                $cgiparams{'INACTIVITY_TIMEOUT'}        = $confighash{$cgiparams{'KEY'}}[34];
+               $cgiparams{'MODE'}                      = $confighash{$cgiparams{'KEY'}}[35];
 
                if (!$cgiparams{'DPD_DELAY'}) {
                        $cgiparams{'DPD_DELAY'} = 30;
@@ -1320,6 +1331,10 @@ END
                        $cgiparams{'INACTIVITY_TIMEOUT'} = 900;
                }
 
+               if ($cgiparams{'MODE'} eq "") {
+                       $cgiparams{'MODE'} = "tunnel";
+               }
+
        } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
                $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
                if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
@@ -1802,7 +1817,7 @@ END
        my $key = $cgiparams{'KEY'};
        if (! $key) {
                $key = &General::findhasharraykey (\%confighash);
-               foreach my $i (0 .. 34) { $confighash{$key}[$i] = "";}
+               foreach my $i (0 .. 35) { $confighash{$key}[$i] = "";}
        }
        $confighash{$key}[0] = $cgiparams{'ENABLED'};
        $confighash{$key}[1] = $cgiparams{'NAME'};
@@ -1847,6 +1862,7 @@ END
        $confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
        $confighash{$key}[32] = $cgiparams{'FORCE_MOBIKE'};
        $confighash{$key}[34] = $cgiparams{'INACTIVITY_TIMEOUT'};
+       $confighash{$key}[35] = $cgiparams{'MODE'};
 
        # free unused fields!
        $confighash{$key}[6] = 'off';
@@ -1921,6 +1937,7 @@ END
        $cgiparams{'ONLY_PROPOSED'}             = 'on'; #[24];
        $cgiparams{'PFS'}                               = 'on'; #[28];
        $cgiparams{'INACTIVITY_TIMEOUT'}        = 900;
+       $cgiparams{'MODE'}                      = "tunnel";
 }
 
 VPNCONF_ERROR:
@@ -1976,6 +1993,7 @@ VPNCONF_ERROR:
        <input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' />
        <input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' />
        <input type='hidden' name='FORCE_MOBIKE' value='$cgiparams{'FORCE_MOBIKE'}' />
+       <input type='hidden' name='MODE' value='$cgiparams{'MODE'}' />
 END
 ;
        if ($cgiparams{'KEY'}) {
@@ -2270,6 +2288,11 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
 
+               if ($cgiparams{'MODE'} !~ /^(tunnel|transport)$/) {
+                       $errormessage = $Lang::tr{'invalid input for mode'};
+                       goto ADVANCED_ERROR;
+               }
+
                $confighash{$cgiparams{'KEY'}}[29] = $cgiparams{'IKE_VERSION'};
                $confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
                $confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
@@ -2289,6 +2312,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                $confighash{$cgiparams{'KEY'}}[32] = $cgiparams{'FORCE_MOBIKE'};
                $confighash{$cgiparams{'KEY'}}[33] = $cgiparams{'START_ACTION'};
                $confighash{$cgiparams{'KEY'}}[34] = $cgiparams{'INACTIVITY_TIMEOUT'};
+               $confighash{$cgiparams{'KEY'}}[35] = $cgiparams{'MODE'};
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
                if (&vpnenabled) {
@@ -2318,6 +2342,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                $cgiparams{'FORCE_MOBIKE'}              = $confighash{$cgiparams{'KEY'}}[32];
                $cgiparams{'START_ACTION'}              = $confighash{$cgiparams{'KEY'}}[33];
                $cgiparams{'INACTIVITY_TIMEOUT'}        = $confighash{$cgiparams{'KEY'}}[34];
+               $cgiparams{'MODE'}                      = $confighash{$cgiparams{'KEY'}}[35];
 
                if (!$cgiparams{'DPD_DELAY'}) {
                        $cgiparams{'DPD_DELAY'} = 30;
@@ -2334,6 +2359,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                if ($cgiparams{'INACTIVITY_TIMEOUT'} eq "") {
                        $cgiparams{'INACTIVITY_TIMEOUT'} = 900; # 15 min
                }
+
+               if ($cgiparams{'MODE'} eq "") {
+                       $cgiparams{'MODE'} = "tunnel";
+               }
        }
 
        ADVANCED_ERROR:
@@ -2442,6 +2471,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        }
        $selected{'INACTIVITY_TIMEOUT'}{$cgiparams{'INACTIVITY_TIMEOUT'}} = "selected";
 
+       $selected{'MODE'}{'tunnel'} = '';
+       $selected{'MODE'}{'transport'} = '';
+       $selected{'MODE'}{$cgiparams{'MODE'}} = "selected='selected'";
+
        &Header::showhttpheaders();
        &Header::openpage($Lang::tr{'ipsec'}, 1, '');
        &Header::openbigbox('100%', 'left', '', $errormessage);
@@ -2466,6 +2499,24 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        <input type='hidden' name='ADVANCED' value='yes' />
        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
 
+       <table width="100%">
+               <tbody>
+                       <tr>
+                               <td width="15%">$Lang::tr{'mode'}:</td>
+                               <td>
+                                       <select name='MODE'>
+                                               <option value='tunnel' $selected{'MODE'}{'tunnel'}>$Lang::tr{'ipsec mode tunnel'}</option>
+                                               <option value='transport' $selected{'MODE'}{'transport'}>$Lang::tr{'ipsec mode transport'}</option>
+                                       </select>
+                               </td>
+                       </tr>
+               </tbody>
+       </table>
+
+       <br><br>
+
+       <h2>$Lang::tr{'cryptographic settings'}</h2>
+
        <table width='100%'>
        <thead>
                <tr>
@@ -2844,8 +2895,11 @@ END
        }
        print "<td align='center' $col>$confighash{$key}[25]</td>";
        my $col1="bgcolor='${Header::colourred}'";
-       # get real state
        my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
+       if ($confighash{$key}[33] eq "add") {
+               $col1="bgcolor='${Header::colourorange}'";
+               $active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn wait'}</font></b>";
+       }
        foreach my $line (@status) {
                if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
                ($line =~ /$confighash{$key}[1]\{.*INSTALLED/)) {
@@ -2857,9 +2911,6 @@ END
                } elsif ($line =~ /$confighash{$key}[1]\{.*ROUTED/) {
                        $col1="bgcolor='${Header::colourorange}'";
                        $active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn on-demand'}</font></b>";
-               } elsif ($confighash{$key}[33] eq "add") {
-                       $col1="bgcolor='${Header::colourorange}'";
-                       $active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn wait'}</font></b>";
                }
        }
        # move to blue if really down