]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blobdiff - html/cgi-bin/vpnmain.cgi
projects / people / pmueller / ipfire-2.x.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Updated kernel (2.6.32.23).
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi
diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 9e75c69061f3f0f18ef8c3dee72e4dfda6371d00..8a740635a01f0eb5e3e3f02d2682d417a532a7c4 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007  Michael Tremer & Christian Schmidt                      #
+# Copyright (C) 2007-2010  IPFire Team  info@ipfire.org                       #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -248,18 +248,18 @@ sub writeipsecfiles {
     foreach my $key (keys %lconfighash) {
        next if ($lconfighash{$key}[0] ne 'on');
         $interfaces .= "%defaultroute "                    if ($interfaces !~ /defaultroute/ && $lconfighash{$key}[26] eq 'RED');
-       #$interfaces .= "ipsec1=$netsettings{'GREEN_DEV'} "  if ($interfaces !~ /ipsec1/              && $lconfighash{$key}[26] eq 'GREEN');
-       #$interfaces .= "ipsec2=$netsettings{'BLUE_DEV'} "   if ($interfaces !~ /ipsec2/              && $lconfighash{$key}[26] eq 'BLUE');
-       #$interfaces .= "ipsec3=$netsettings{'ORANGE_DEV'} " if ($interfaces !~ /ipsec3/              && $lconfighash{$key}[26] eq 'ORANGE');
+       $interfaces .= "$netsettings{'GREEN_DEV'} "  if ($interfaces !~ /ipsec1/              && $lconfighash{$key}[26] eq 'GREEN');
+       $interfaces .= "$netsettings{'BLUE_DEV'} "   if ($interfaces !~ /ipsec2/              && $lconfighash{$key}[26] eq 'BLUE');
+       $interfaces .= "$netsettings{'ORANGE_DEV'} " if ($interfaces !~ /ipsec3/              && $lconfighash{$key}[26] eq 'ORANGE');
     }
     print CONF $interfaces . "\"\n";
 
     my $plutodebug = '';                       # build debug list
     map ($plutodebug .= $lvpnsettings{$_} eq 'on' ? lc (substr($_,4)).' ' : '',
        ('DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL',
-        'DBG_KLIPS','DBG_DNS','DBG_NAT_T'));
+        'DBG_DNS'));
     $plutodebug = 'none' if $plutodebug eq '';  # if nothing selected, use 'none'.
-    print CONF "\tklipsdebug=\"none\"\n";
+    #print CONF "\tklipsdebug=\"none\"\n";
     print CONF "\tplutodebug=\"$plutodebug\"\n";
     # deprecated in ipsec.conf version 2
     #print CONF "\tplutoload=%search\n";
@@ -289,6 +289,12 @@ sub writeipsecfiles {
     #print CONF "\tdisablearrivalcheck=no\n";
     print CONF "\n";
 
+    # Add user includes to config file
+    print CONF "include /etc/ipsec.user.conf\n";
+    print CONF "\n";
+
+    print SECRETS "include /etc/ipsec.user.secrets\n";
+
     if (-f "${General::swroot}/certs/hostkey.pem") {
         print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n"
     }
@@ -316,6 +322,7 @@ sub writeipsecfiles {
        print CONF "\tleftnexthop=%defaultroute\n" if ($lconfighash{$key}[26] eq 'RED' && $lvpnsettings{'VPN_IP'} ne '%defaultroute');
        print CONF "\tleftsubnet=$lconfighash{$key}[8]\n";
        print CONF "\tleftfirewall=yes\n";
+       print CONF "\tlefthostaccess=yes\n";
 
        print CONF "\tright=$lconfighash{$key}[10]\n";
        if ($lconfighash{$key}[3] eq 'net') {
@@ -381,9 +388,6 @@ sub writeipsecfiles {
        print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
        print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
 
-       # Aggresive mode
-       print CONF "\taggrmode=yes\n" if ($lconfighash{$key}[12] eq 'on');
-
        # Compression
        print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on');
 
@@ -455,7 +459,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg
 
     map ($vpnsettings{$_} = $cgiparams{$_},
        ('ENABLED','DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL',
-        'DBG_KLIPS','DBG_DNS','DBG_NAT_T'));
+        'DBG_DNS'));
 
     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
     $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'};
@@ -581,6 +585,7 @@ END
     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
     $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
     &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
+
     system('/usr/local/bin/ipsecctrl', 'R');
     sleep $sleepDelay;
 
@@ -1277,7 +1282,6 @@ END
        $cgiparams{'ESP_INTEGRITY'}     = $confighash{$cgiparams{'KEY'}}[22];
        $cgiparams{'ESP_GROUPTYPE'}     = $confighash{$cgiparams{'KEY'}}[23];
        $cgiparams{'ESP_KEYLIFE'}       = $confighash{$cgiparams{'KEY'}}[17];
-       $cgiparams{'AGGRMODE'}          = $confighash{$cgiparams{'KEY'}}[12];
        $cgiparams{'COMPRESSION'}       = $confighash{$cgiparams{'KEY'}}[13];
        $cgiparams{'ONLY_PROPOSED'}     = $confighash{$cgiparams{'KEY'}}[24];
        $cgiparams{'PFS'}               = $confighash{$cgiparams{'KEY'}}[28];
@@ -1782,7 +1786,7 @@ END
        $confighash{$key}[22] = $cgiparams{'ESP_INTEGRITY'};
        $confighash{$key}[23] = $cgiparams{'ESP_GROUPTYPE'};
        $confighash{$key}[17] = $cgiparams{'ESP_KEYLIFE'};
-       $confighash{$key}[12] = $cgiparams{'AGGRMODE'};
+       $confighash{$key}[12] = 'off'; # $cgiparams{'AGGRMODE'};
        $confighash{$key}[13] = $cgiparams{'COMPRESSION'};
        $confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'};
        $confighash{$key}[28] = $cgiparams{'PFS'};
@@ -1843,7 +1847,6 @@ END
        $cgiparams{'ESP_INTEGRITY'}  = 'sha1|md5';      #[22];
        $cgiparams{'ESP_GROUPTYPE'}  = '';              #[23];
        $cgiparams{'ESP_KEYLIFE'}    = '8';             #[17];
-       $cgiparams{'AGGRMODE'}       = 'off';           #[12];
        $cgiparams{'COMPRESSION'}    = 'off';           #[13];
        $cgiparams{'ONLY_PROPOSED'}  = 'off';           #[24];
        $cgiparams{'PFS'}            = 'on';            #[28];
@@ -1906,7 +1909,6 @@ END
        <input type='hidden' name='ESP_INTEGRITY' value='$cgiparams{'ESP_INTEGRITY'}' />
        <input type='hidden' name='ESP_GROUPTYPE' value='$cgiparams{'ESP_GROUPTYPE'}' />
        <input type='hidden' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' />
-       <input type='hidden' name='AGGRMODE' value='$cgiparams{'AGGRMODE'}' />
        <input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' />
        <input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' />
        <input type='hidden' name='PFS' value='$cgiparams{'PFS'}' />
@@ -1952,10 +1954,9 @@ END
            <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
            <td><input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size='30' /></td>
        </tr><tr>
-           <td class='boldbase'>$Lang::tr{'vpn local id'}:&nbsp;<img src='/blob.gif' alt='*' />
-           <br />($Lang::tr{'eg'} <tt>&#64;xy.example.com</tt>)</td>
+           <td class='boldbase'>$Lang::tr{'vpn local id'}:<br />($Lang::tr{'eg'} <tt>&#64;xy.example.com</tt>)</td>
            <td><input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' /></td>
-           <td class='boldbase'>$Lang::tr{'vpn remote id'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
+           <td class='boldbase'>$Lang::tr{'vpn remote id'}:</td>
            <td><input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' /></td>
        </tr><tr>
        </tr><td><br /></td><tr>
@@ -2123,7 +2124,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            goto ADVANCED_ERROR;
        }
        foreach my $val (@temp) {
-           if ($val !~ /^(768|1024|1536|2048|3072|4096|6144|8192)$/) {
+           if ($val !~ /^(1024|1536|2048|3072|4096|6144|8192)$/) {
                $errormessage = $Lang::tr{'invalid input'};
                goto ADVANCED_ERROR;
            }
@@ -2159,7 +2160,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
            }
        }
        if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
-           $cgiparams{'ESP_GROUPTYPE'} !~  /^modp(768|1024|1536|2048|3072|4096)$/) {
+           $cgiparams{'ESP_GROUPTYPE'} !~  /^modp(1024|1536|2048|3072|4096)$/) {
            $errormessage = $Lang::tr{'invalid input'};
            goto ADVANCED_ERROR;
        }
@@ -2174,7 +2175,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        }
 
        if (
-           ($cgiparams{'AGGRMODE'} !~ /^(|on|off)$/) ||
            ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
            ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
            ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
@@ -2192,7 +2192,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        $confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
        $confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
        $confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
-       $confighash{$cgiparams{'KEY'}}[12] = $cgiparams{'AGGRMODE'};
+       $confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'};
        $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
        $confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
        $confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
@@ -2213,7 +2213,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        $cgiparams{'ESP_INTEGRITY'}  = $confighash{$cgiparams{'KEY'}}[22];
        $cgiparams{'ESP_GROUPTYPE'}  = $confighash{$cgiparams{'KEY'}}[23];
        $cgiparams{'ESP_KEYLIFE'}    = $confighash{$cgiparams{'KEY'}}[17];
-       $cgiparams{'AGGRMODE'}       = $confighash{$cgiparams{'KEY'}}[12];
        $cgiparams{'COMPRESSION'}    = $confighash{$cgiparams{'KEY'}}[13];
        $cgiparams{'ONLY_PROPOSED'}  = $confighash{$cgiparams{'KEY'}}[24];
        $cgiparams{'PFS'}            = $confighash{$cgiparams{'KEY'}}[28];
@@ -2246,6 +2245,11 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     $checked{'IKE_GROUPTYPE'}{'8192'} = '';
     @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
     foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; }
+
+    # 768 is not supported by strongswan
+    $checked{'IKE_GROUPTYPE'}{'768'} = '';
+
+
     $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
     $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
     $checked{'ESP_ENCRYPTION'}{'3des'} = '';
@@ -2259,7 +2263,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
     foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
     $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
 
-    $checked{'AGGRMODE'} = $cgiparams{'AGGRMODE'} eq 'on' ? "checked='checked'" : '' ;
     $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
     $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
     $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
@@ -2312,7 +2315,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option>
                <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option>
                <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option>
-               <option value='768'  $checked{'IKE_GROUPTYPE'}{'768'}>MODP-768</option>
                </select></td>
        </tr><tr>
            <td class='boldbase' align='right' valign='top'>$Lang::tr{'ike lifetime'}</td><td class='boldbase' valign='top'>
@@ -2343,9 +2345,6 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        </tr><tr>
            <td colspan='5'><input type='checkbox' name='ONLY_PROPOSED' $checked{'ONLY_PROPOSED'} />
                IKE+ESP: $Lang::tr{'use only proposed settings'}</td>
-       </tr><tr>
-           <td colspan='5'><input type='checkbox' name='AGGRMODE' $checked{'AGGRMODE'} />
-               $Lang::tr{'vpn aggrmode'}</td>
        </tr><tr>
            <td colspan='5'><input type='checkbox' name='PFS' $checked{'PFS'} />
                $Lang::tr{'pfs yes no'}</td>
@@ -2387,7 +2386,7 @@ EOF
     &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
     $cgiparams{'CA_NAME'} = '';
 
-    my @status = `/usr/sbin/ipsec auto --status`;
+    my @status = `/usr/local/bin/ipsecctrl I`;
 
     # suggest a default name for this side
     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
@@ -2408,7 +2407,7 @@ EOF
     $checked{'VPN_WATCH'} = $cgiparams{'VPN_WATCH'} eq 'on' ? "checked='checked'" : '' ;
     map ($checked{$_} = $cgiparams{$_} eq 'on' ? "checked='checked'" : '',
        ('ENABLED','DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL',
-        'DBG_KLIPS','DBG_DNS','DBG_NAT_T'));
+        'DBG_DNS'));
 
 
     &Header::showhttpheaders();
@@ -2452,10 +2451,7 @@ crypt:<input type='checkbox' name='DBG_CRYPT' $checked{'DBG_CRYPT'} />,&nbsp;
 parsing:<input type='checkbox' name='DBG_PARSING' $checked{'DBG_PARSING'} />,&nbsp;
 emitting:<input type='checkbox' name='DBG_EMITTING' $checked{'DBG_EMITTING'} />,&nbsp;
 control:<input type='checkbox' name='DBG_CONTROL' $checked{'DBG_CONTROL'} />,&nbsp;
-klips:<input type='checkbox' name='DBG_KLIPS' $checked{'DBG_KLIPS'} />,&nbsp;
-dns:<input type='checkbox' name='DBG_DNS' $checked{'DBG_DNS'} />,&nbsp;
-nat_t:<input type='checkbox' name='DBG_NAT_T' $checked{'DBG_NAT_T'} /></p>
-
+dns:<input type='checkbox' name='DBG_DNS' $checked{'DBG_DNS'} />&nbsp;
 <hr />
 <table width='100%'>
 <tr>
Peter's tree of IPFire 2.x