IPsec: Update ipsec.conf for GRE/VTI changes

[people/pmueller/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 02284ddf3529a46c406187db79721900d05ca4eb..c29c5d53d39a2c07435c1b5ef70e387d229eedf1 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -114,6 +114,7 @@ $cgiparams{'INACTIVITY_TIMEOUT'} = 1800;
 $cgiparams{'MODE'} = "tunnel";
 $cgiparams{'INTERFACE_MODE'} = "";
 $cgiparams{'INTERFACE_ADDRESS'} = "";
+$cgiparams{'INTERFACE_MTU'} = 1500;
 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
 
 ###
@@ -294,15 +295,31 @@ sub writeipsecfiles {
                        $localside = $lvpnsettings{'VPN_IP'};
                }
 
+               my $interface_mode = $lconfighash{$key}[36];
+
                print CONF "conn $lconfighash{$key}[1]\n";
                print CONF "\tleft=$localside\n";
-               print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
+
+               if ($interface_mode eq "gre") {
+                       print CONF "\tleftsubnet=%dynamic[gre]\n";
+               } elsif ($interface_mode eq "vti") {
+                       print CONF "\tleftsubnet=0.0.0.0/0\n";
+               } else {
+                       print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
+               }
+
                print CONF "\tleftfirewall=yes\n";
                print CONF "\tlefthostaccess=yes\n";
                print CONF "\tright=$lconfighash{$key}[10]\n";
 
                if ($lconfighash{$key}[3] eq 'net') {
-                       print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
+                       if ($interface_mode eq "gre") {
+                               print CONF "\trightsubnet=%dynamic[gre]\n";
+                       } elsif ($interface_mode eq "vti") {
+                               print CONF "\trightsubnet=0.0.0.0/0\n";
+                       } else {
+                               print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
+                       }
                }
 
                # Local Cert and Remote Cert (unless auth is DN dn-auth)
@@ -322,6 +339,11 @@ sub writeipsecfiles {
                        print CONF "\ttype=tunnel\n";
                }
 
+               # Add mark for VTI
+               if ($interface_mode eq "vti") {
+                       print CONF "\tmark=$key\n";
+               }
+
                # Is PFS enabled?
                my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
 
@@ -1329,6 +1351,7 @@ END
                $cgiparams{'MODE'}                      = $confighash{$cgiparams{'KEY'}}[35];
                $cgiparams{'INTERFACE_MODE'}            = $confighash{$cgiparams{'KEY'}}[36];
                $cgiparams{'INTERFACE_ADDRESS'}         = $confighash{$cgiparams{'KEY'}}[37];
+               $cgiparams{'INTERFACE_MTU'}             = $confighash{$cgiparams{'KEY'}}[38];
 
                if (!$cgiparams{'DPD_DELAY'}) {
                        $cgiparams{'DPD_DELAY'} = 30;
@@ -1828,7 +1851,7 @@ END
        my $key = $cgiparams{'KEY'};
        if (! $key) {
                $key = &General::findhasharraykey (\%confighash);
-               foreach my $i (0 .. 36) { $confighash{$key}[$i] = "";}
+               foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";}
        }
        $confighash{$key}[0] = $cgiparams{'ENABLED'};
        $confighash{$key}[1] = $cgiparams{'NAME'};
@@ -1876,6 +1899,7 @@ END
        $confighash{$key}[35] = $cgiparams{'MODE'};
        $confighash{$key}[36] = $cgiparams{'INTERFACE_MODE'};
        $confighash{$key}[37] = $cgiparams{'INTERFACE_ADDRESS'};
+       $confighash{$key}[38] = $cgiparams{'INTERFACE_MTU'};
 
        # free unused fields!
        $confighash{$key}[6] = 'off';
@@ -1953,6 +1977,7 @@ END
        $cgiparams{'MODE'}                      = "tunnel";
        $cgiparams{'INTERFACE_MODE'}            = "";
        $cgiparams{'INTERFACE_ADDRESS'}         = "";
+       $cgiparams{'INTERFACE_MTU'}             = 1500;
 }
 
 VPNCONF_ERROR:
@@ -2012,6 +2037,7 @@ VPNCONF_ERROR:
        <input type='hidden' name='MODE' value='$cgiparams{'MODE'}' />
        <input type='hidden' name='INTERFACE_MODE' value='$cgiparams{'INTERFACE_MODE'}' />
        <input type='hidden' name='INTERFACE_ADDRESS' value='$cgiparams{'INTERFACE_ADDRESS'}' />
+       <input type='hidden' name='INTERFACE_MTU' value='$cgiparams{'INTERFACE_MTU'}' />
 END
 ;
        if ($cgiparams{'KEY'}) {
@@ -2321,6 +2347,11 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
 
+               if ($cgiparams{'INTERFACE_MTU'} !~ /^\d+$/) {
+                       $errormessage = $Lang::tr{'invalid input for interface mtu'};
+                       goto ADVANCED_ERROR;
+               }
+
                $confighash{$cgiparams{'KEY'}}[29] = $cgiparams{'IKE_VERSION'};
                $confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
                $confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
@@ -2343,6 +2374,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                $confighash{$cgiparams{'KEY'}}[35] = $cgiparams{'MODE'};
                $confighash{$cgiparams{'KEY'}}[36] = $cgiparams{'INTERFACE_MODE'};
                $confighash{$cgiparams{'KEY'}}[37] = $cgiparams{'INTERFACE_ADDRESS'};
+               $confighash{$cgiparams{'KEY'}}[38] = $cgiparams{'INTERFACE_MTU'};
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
                if (&vpnenabled) {
@@ -2375,6 +2407,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                $cgiparams{'MODE'}                      = $confighash{$cgiparams{'KEY'}}[35];
                $cgiparams{'INTERFACE_MODE'}            = $confighash{$cgiparams{'KEY'}}[36];
                $cgiparams{'INTERFACE_ADDRESS'}         = $confighash{$cgiparams{'KEY'}}[37];
+               $cgiparams{'INTERFACE_MTU'}             = $confighash{$cgiparams{'KEY'}}[38];
 
                if (!$cgiparams{'DPD_DELAY'}) {
                        $cgiparams{'DPD_DELAY'} = 30;
@@ -2563,6 +2596,10 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                                        <label>$Lang::tr{'ip address'}/$Lang::tr{'subnet mask'}</label>
                                        <input type="text" name="INTERFACE_ADDRESS" value="$cgiparams{'INTERFACE_ADDRESS'}">
                                </td>
+                               <td>
+                                       <label>$Lang::tr{'mtu'}</label>
+                                       <input type="number" name="INTERFACE_MTU" value="$cgiparams{'INTERFACE_MTU'}" min="576" max="9000">
+                               </td>
                        </tr>
                </tbody>
        </table>