]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blobdiff - html/cgi-bin/vpnmain.cgi
projects / people / pmueller / ipfire-2.x.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Fix server error at certificate upload.
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 627fcfe22b30dd9bf5e2e0ba2977af5983891c27..0294b1cc3493b32bc784cab48bf620340f06209b 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -1,4 +1,23 @@
 #!/usr/bin/perl
+###############################################################################
+#                                                                             #
+# IPFire.org - A linux based firewall                                         #
+# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+#                                                                             #
+# This program is free software: you can redistribute it and/or modify        #
+# it under the terms of the GNU General Public License as published by        #
+# the Free Software Foundation, either version 3 of the License, or           #
+# (at your option) any later version.                                         #
+#                                                                             #
+# This program is distributed in the hope that it will be useful,             #
+# but WITHOUT ANY WARRANTY; without even the implied warranty of              #
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
+# GNU General Public License for more details.                                #
+#                                                                             #
+# You should have received a copy of the GNU General Public License           #
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
+#                                                                             #
+###############################################################################
 
 use Net::DNS;
 use File::Copy;
@@ -229,9 +248,9 @@ sub writeipsecfiles {
     foreach my $key (keys %lconfighash) {
        next if ($lconfighash{$key}[0] ne 'on');
         $interfaces .= "%defaultroute "                    if ($interfaces !~ /defaultroute/ && $lconfighash{$key}[26] eq 'RED');
-       $interfaces .= "ipsec1=$netsettings{'GREEN_DEV'} "  if ($interfaces !~ /ipsec1/       && $lconfighash{$key}[26] eq 'GREEN');
-       $interfaces .= "ipsec2=$netsettings{'BLUE_DEV'} "   if ($interfaces !~ /ipsec2/       && $lconfighash{$key}[26] eq 'BLUE');
-       $interfaces .= "ipsec3=$netsettings{'ORANGE_DEV'} " if ($interfaces !~ /ipsec3/       && $lconfighash{$key}[26] eq 'ORANGE');
+       $interfaces .= "$netsettings{'GREEN_DEV'} "  if ($interfaces !~ /ipsec1/              && $lconfighash{$key}[26] eq 'GREEN');
+       $interfaces .= "$netsettings{'BLUE_DEV'} "   if ($interfaces !~ /ipsec2/              && $lconfighash{$key}[26] eq 'BLUE');
+       $interfaces .= "$netsettings{'ORANGE_DEV'} " if ($interfaces !~ /ipsec3/              && $lconfighash{$key}[26] eq 'ORANGE');
     }
     print CONF $interfaces . "\"\n";
 
@@ -245,6 +264,8 @@ sub writeipsecfiles {
     # deprecated in ipsec.conf version 2
     #print CONF "\tplutoload=%search\n";
     #print CONF "\tplutostart=%search\n";
+    #Disable IKEv2 deamon
+    print CONF "\tcharonstart=no\n";
     print CONF "\tuniqueids=yes\n";
     print CONF "\tnat_traversal=yes\n";
     print CONF "\toverridemtu=$lvpnsettings{'VPN_OVERRIDE_MTU'}\n" if ($lvpnsettings{'VPN_OVERRIDE_MTU'} ne '');
@@ -264,7 +285,8 @@ sub writeipsecfiles {
     print CONF "\n\n";
     print CONF "conn %default\n";
     print CONF "\tkeyingtries=0\n";
-    print CONF "\tdisablearrivalcheck=no\n";
+    #strongswan doesn't know this
+    #print CONF "\tdisablearrivalcheck=no\n";
     print CONF "\n";
 
     if (-f "${General::swroot}/certs/hostkey.pem") {
@@ -293,6 +315,7 @@ sub writeipsecfiles {
        print CONF "\tleft=$localside\n";
        print CONF "\tleftnexthop=%defaultroute\n" if ($lconfighash{$key}[26] eq 'RED' && $lvpnsettings{'VPN_IP'} ne '%defaultroute');
        print CONF "\tleftsubnet=$lconfighash{$key}[8]\n";
+       print CONF "\tleftfirewall=yes\n";
 
        print CONF "\tright=$lconfighash{$key}[10]\n";
        if ($lconfighash{$key}[3] eq 'net') {
@@ -558,7 +581,8 @@ END
     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
     $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
     &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-    system('/usr/local/bin/ipsecctrl', 'R');
+
+    my $temp = `/usr/local/bin/ipsecctrl R`;
     sleep $sleepDelay;
 
     UPLOADCA_ERROR:
@@ -1929,10 +1953,9 @@ END
            <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
            <td><input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size='30' /></td>
        </tr><tr>
-           <td class='boldbase'>$Lang::tr{'vpn local id'}:&nbsp;<img src='/blob.gif' alt='*' />
-           <br />($Lang::tr{'eg'} <tt>&#64;xy.example.com</tt>)</td>
+           <td class='boldbase'>$Lang::tr{'vpn local id'}:<br />($Lang::tr{'eg'} <tt>&#64;xy.example.com</tt>)</td>
            <td><input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' /></td>
-           <td class='boldbase'>$Lang::tr{'vpn remote id'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+           <td class='boldbase'>$Lang::tr{'vpn remote id'}:</td>
            <td><input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' /></td>
        </tr><tr>
        </tr><td><br /></td><tr>
@@ -2078,7 +2101,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(aes256|aes128|3des|twofish256|twofish128|serpent256|serpent128|blowfish256|blowfish128|cast128)$/) {
+           if ($val !~ /^(aes256|aes128|3des)$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }
@@ -2119,7 +2142,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(aes256|aes128|3des|twofish256|twofish128|serpent256|serpent128|blowfish256|blowfish128)$/) {
+           if ($val !~ /^(aes256|aes128|3des)$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }
@@ -2205,13 +2228,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'IKE_ENCRYPTION'}{'aes256'} = '';
     $checked{'IKE_ENCRYPTION'}{'aes128'} = '';
     $checked{'IKE_ENCRYPTION'}{'3des'} = '';
-    $checked{'IKE_ENCRYPTION'}{'twofish256'} = '';
-    $checked{'IKE_ENCRYPTION'}{'twofish128'} = '';
-    $checked{'IKE_ENCRYPTION'}{'serpent256'} = '';
-    $checked{'IKE_ENCRYPTION'}{'serpent128'} = '';
-    $checked{'IKE_ENCRYPTION'}{'blowfish256'} = '';
-    $checked{'IKE_ENCRYPTION'}{'blowfish128'} = '';
-    $checked{'IKE_ENCRYPTION'}{'cast128'} = '';
     my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
     foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; }
     $checked{'IKE_INTEGRITY'}{'sha2_512'} = '';
@@ -2233,12 +2249,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
     $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
     $checked{'ESP_ENCRYPTION'}{'3des'} = '';
-    $checked{'ESP_ENCRYPTION'}{'twofish256'} = '';
-    $checked{'ESP_ENCRYPTION'}{'twofish128'} = '';
-    $checked{'ESP_ENCRYPTION'}{'serpent256'} = '';
-    $checked{'ESP_ENCRYPTION'}{'serpent128'} = '';
-    $checked{'ESP_ENCRYPTION'}{'blowfish256'} = '';
-    $checked{'ESP_ENCRYPTION'}{'blowfish128'} = '';
     @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
     foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; }
     $checked{'ESP_INTEGRITY'}{'sha2_512'} = '';
@@ -2247,12 +2257,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'ESP_INTEGRITY'}{'md5'} = '';
     @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
     foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
-    $checked{'ESP_GROUPTYPE'}{'modp768'} = '';
-    $checked{'ESP_GROUPTYPE'}{'modp1024'} = '';
-    $checked{'ESP_GROUPTYPE'}{'modp1536'} = '';
-    $checked{'ESP_GROUPTYPE'}{'modp2048'} = '';
-    $checked{'ESP_GROUPTYPE'}{'modp3072'} = '';
-    $checked{'ESP_GROUPTYPE'}{'modp4096'} = '';
     $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
 
     $checked{'AGGRMODE'} = $cgiparams{'AGGRMODE'} eq 'on' ? "checked='checked'" : '' ;
@@ -2291,19 +2295,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
                <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
                <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>3DES</option>
-               <option value='twofish256' $checked{'IKE_ENCRYPTION'}{'twofish256'}>Twofish (256 bit)</option>
-               <option value='twofish128' $checked{'IKE_ENCRYPTION'}{'twofish128'}>Twofish (128 bit)</option>
-               <option value='serpent256' $checked{'IKE_ENCRYPTION'}{'serpent256'}>Serpent (256 bit)</option>
-               <option value='serpent128' $checked{'IKE_ENCRYPTION'}{'serpent128'}>Serpent (128 bit)</option>
-               <option value='blowfish256' $checked{'IKE_ENCRYPTION'}{'blowfish256'}>Blowfish (256 bit)</option>
-               <option value='blowfish128' $checked{'IKE_ENCRYPTION'}{'blowfish128'}>Blowfish (128 bit)</option>
-               <option value='cast128' $checked{'IKE_ENCRYPTION'}{'cast128'}>Cast (128 bit)</option>
                </select></td>
 
            <td class='boldbase' align='right' valign='top'>$Lang::tr{'ike integrity'}</td><td class='boldbase' valign='top'>
                <select name='IKE_INTEGRITY' multiple='multiple' size='4'>
-               <option value='sha2_512' $checked{'IKE_INTEGRITY'}{'sha2_512'}>SHA2 (512)</option>
-               <option value='sha2_256' $checked{'IKE_INTEGRITY'}{'sha2_256'}>SHA2 (256)</option>
                <option value='sha' $checked{'IKE_INTEGRITY'}{'sha'}>SHA</option>
                <option value='md5' $checked{'IKE_INTEGRITY'}{'md5'}>MD5</option>
                </select></td>
@@ -2331,29 +2326,15 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
                <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
                <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>3DES</option>
-               <option value='twofish256' $checked{'ESP_ENCRYPTION'}{'twofish256'}>Twofish (256 bit)</option>
-               <option value='twofish128' $checked{'ESP_ENCRYPTION'}{'twofish128'}>Twofish (128 bit)</option>
-               <option value='serpent256' $checked{'ESP_ENCRYPTION'}{'serpent256'}>Serpent (256 bit)</option>
-               <option value='serpent128' $checked{'ESP_ENCRYPTION'}{'serpent128'}>Serpent (128 bit)</option>
-               <option value='blowfish256' $checked{'ESP_ENCRYPTION'}{'blowfish256'}>Blowfish (256 bit)</option>
-               <option value='blowfish128' $checked{'ESP_ENCRYPTION'}{'blowfish128'}>Blowfish (128 bit)</option></select></td>
 
            <td class='boldbase' align='right' valign='top'>$Lang::tr{'esp integrity'}</td><td class='boldbase' valign='top'>
                <select name='ESP_INTEGRITY' multiple='multiple' size='4'>
-               <option value='sha2_512' $checked{'ESP_INTEGRITY'}{'sha2_512'}>SHA2 (512)</option>
-               <option value='sha2_256' $checked{'ESP_INTEGRITY'}{'sha2_256'}>SHA2 (256)</option>
                <option value='sha1' $checked{'ESP_INTEGRITY'}{'sha1'}>SHA1</option>
                <option value='md5' $checked{'ESP_INTEGRITY'}{'md5'}>MD5</option></select></td>
 
            <td class='boldbase' align='right' valign='top'>$Lang::tr{'esp grouptype'}</td><td class='boldbase' valign='top'>
                <select name='ESP_GROUPTYPE'>
-               <option value=''>$Lang::tr{'phase1 group'}</option>
-               <option value='modp4096' $checked{'ESP_GROUPTYPE'}{'modp4096'}>MODP-4096</option>
-               <option value='modp3072' $checked{'ESP_GROUPTYPE'}{'modp3072'}>MODP-3072</option>
-               <option value='modp2048' $checked{'ESP_GROUPTYPE'}{'modp2048'}>MODP-2048</option>
-               <option value='modp1536' $checked{'ESP_GROUPTYPE'}{'modp1536'}>MODP-1536</option>
-               <option value='modp1024' $checked{'ESP_GROUPTYPE'}{'modp1024'}>MODP-1024</option>
-               <option value='modp768'  $checked{'ESP_GROUPTYPE'}{'modp768'}>MODP-768</option></select></td>
+               <option value=''>$Lang::tr{'phase1 group'}</option></select></td>
        </tr><tr>
            <td class='boldbase' align='right' valign='top'>$Lang::tr{'esp keylife'}</td><td class='boldbase' valign='top'>
                <input type='text' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' size='5' /> $Lang::tr{'hours'}</td>
@@ -2406,7 +2387,7 @@ EOF
     &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
     $cgiparams{'CA_NAME'} = '';
 
-    my @status = `/usr/sbin/ipsec auto --status`;
+    my @status = `/usr/local/bin/ipsecctrl I`;
 
     # suggest a default name for this side
     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
Peter's tree of IPFire 2.x