Fix ID information on IPSec configuration.

[people/pmueller/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index f303cfbc2cb0ead196690353b841788b1efe57e9..76b408d10f11ead61e7c852220f26d90ae3125ba 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2010  IPFire Team  info@ipfire.org                       #
+# Copyright (C) 2007-2011  IPFire Team  info@ipfire.org                       #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -58,6 +58,17 @@ my %mainsettings = ();
 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
 
 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
+
+my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}");
+my $blue_cidr = "# Blue not defined";
+if ($netsettings{'BLUE_DEV'}) {
+       $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}");
+}
+my $orange_cidr = "# Orange not defined";
+if ($netsettings{'ORANGE_DEV'}) {
+       $orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}");
+}
+
 $cgiparams{'ENABLED'} = 'off';
 $cgiparams{'EDIT_ADVANCED'} = 'off';
 $cgiparams{'ACTION'} = '';
@@ -264,18 +275,16 @@ sub writeipsecfiles {
     # deprecated in ipsec.conf version 2
     #print CONF "\tplutoload=%search\n";
     #print CONF "\tplutostart=%search\n";
-    #Disable IKEv2 deamon
-    print CONF "\tcharonstart=no\n";
     print CONF "\tuniqueids=yes\n";
     print CONF "\tnat_traversal=yes\n";
     print CONF "\toverridemtu=$lvpnsettings{'VPN_OVERRIDE_MTU'}\n" if ($lvpnsettings{'VPN_OVERRIDE_MTU'} ne '');
     print CONF "\tvirtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16";
-    print CONF ",%v4:!$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
+    print CONF ",%v4:!$green_cidr";
     if (length($netsettings{'ORANGE_DEV'}) > 2) {
-       print CONF ",%v4:!$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}";
+       print CONF ",%v4:!$orange_cidr";
     }
     if (length($netsettings{'BLUE_DEV'}) > 2) {
-       print CONF ",%v4:!$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}";
+       print CONF ",%v4:!$blue_cidr";
     }
     foreach my $key (keys %lconfighash) {
        if ($lconfighash{$key}[3] eq 'net') {
@@ -320,13 +329,15 @@ sub writeipsecfiles {
        print CONF "conn $lconfighash{$key}[1]\n";
        print CONF "\tleft=$localside\n";
        print CONF "\tleftnexthop=%defaultroute\n" if ($lconfighash{$key}[26] eq 'RED' && $lvpnsettings{'VPN_IP'} ne '%defaultroute');
-       print CONF "\tleftsubnet=$lconfighash{$key}[8]\n";
+       my $cidr_net=&General::ipcidr($lconfighash{$key}[8]);
+       print CONF "\tleftsubnet=$cidr_net\n";
        print CONF "\tleftfirewall=yes\n";
        print CONF "\tlefthostaccess=yes\n";
 
        print CONF "\tright=$lconfighash{$key}[10]\n";
        if ($lconfighash{$key}[3] eq 'net') {
-           print CONF "\trightsubnet=$lconfighash{$key}[11]\n";
+           my $cidr_net=&General::ipcidr($lconfighash{$key}[11]);
+           print CONF "\trightsubnet=$cidr_net\n";
            print CONF "\trightnexthop=%defaultroute\n";
        } elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed for roadwarriors?
            print CONF "\trightsubnet=vhost:%no,%priv\n";
@@ -384,6 +395,9 @@ sub writeipsecfiles {
            print CONF "\tpfsgroup=$lconfighash{$key}[23]\n";
        }
 
+       # IKE V1
+       print CONF "\tkeyexchange=ikev1\n";
+
        # Lifetimes
        print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
        print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
@@ -1369,15 +1383,15 @@ END
 
        # Allow nothing or a string (DN,FDQN,) beginning with @
        # with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
-       if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d\.\d\.\d\.\d)$/) ||
-           ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d\.\d\.\d\.\d)$/) ||
+       if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
+           ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
            (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
           ) {
            $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
            'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
            'FQDN: @ipfire.org<br />' .
            'USER_FQDN: info@ipfire.org<br />' .
-           'IPV4_ADDR: @123.123.123.123';
+           'IPV4_ADDR: 123.123.123.123';
            goto VPNCONF_ERROR;
        }
        # If Auth is DN, verify existance of Remote ID.
@@ -2386,7 +2400,7 @@ EOF
     &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
     $cgiparams{'CA_NAME'} = '';
 
-    my @status = `/usr/local/bin/ipsecctrl I`;
+    my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
 
     # suggest a default name for this side
     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {