Projet

Général

Profil

« Précédent | Suivant » 

Révision f1bede03

Ajouté par Ermal il y a presque 10 ans

Allow a key to specified for all users as for exmpale when connecting from Apple iOS

Voir les différences:

etc/inc/vpn.inc
500 500 
		/* add PSKs for mobile clients */
501 501 
		if (is_array($ipseccfg['mobilekey'])) {
502 502 
			foreach ($ipseccfg['mobilekey'] as $key) {
503 
				if ($key['ident'] == "allusers")
504 
					$key['ident'] = '';
503 505 
				$pskconf .= "{$key['ident']} : PSK \"{$key['pre-shared-key']}\"\n";
504 506 
			}
505 507 
		}
......
531 533 
					if (isset($ph2ent['disabled']))
532 534 
						continue;
533 535 

  		




  
  536
  
    
					if (isset($ph2ent['mobile']) && !isset($a_client['enable']))


  		




  
  537
  
    
						continue;


  		




  
  538
  
    

  		




  534
  539
  
    
					$ikeid = $ph1ent['ikeid'];


  		




  535
  540
  
    

  		




  536
  541
  
    
					$ep = ipsec_get_phase1_src($ph1ent);


  		




  537
  542
  
    
					if (!$ep)


  		




  538
  543
  
    
						continue;


  		




  539
  544
  
    

  		




  540
  
  
    
					if (!isset($ph1ent['mobile'])) {


  		




  
  545
  
    
					$passive = "start";


  		




  
  546
  
    
					if (isset($ph1ent['mobile'])) {


  		




  
  547
  
    
						$rgip = "%any";


  		




  
  548
  
    
						$passive = 'add';


  		




  
  549
  
    
					} else


  		




  541
  550
  
    
						$rgip = $ph1ent['remote-gateway'];


  		




  542
  
  
    
						//$rgip = $rgmap[$ph1ent['remote-gateway']];


  		




  543
  
  
    
						//if (!$rgip)


  		




  544
  
  
    
						//	continue;


  		




  545
  
  
    
					}


  		




  546
  551
  
    

  		




  547
  
  
    
					$myid_type = $ph1ent['myid_type'];


  		




  
  552
  
    
					$keyexchange = "ikev1";


  		




  
  553
  
    
					if (!empty($ph1ent['iketype']) && $ph1ent['iketype'] != "ikev1")


  		




  
  554
  
    
						$keyexchange = "ikev2";


  		




  548
  555
  
    

  		




  
  556
  
    
					$myid_type = $ph1ent['myid_type'];


  		




  549
  557
  
    
					switch ($myid_type) {


  		




  550
  558
  
    
					case "myaddress":


  		




  551
  559
  
    
						$myid_type = "address";


  		




  ......




  572
  580
  
    
					}


  		




  573
  581
  
    

  		




  574
  582
  
    
					$peerid_type = $ph1ent['peerid_type'];


  		




  575
  
  
    

  		




  576
  583
  
    
					switch ($peerid_type) {


  		




  577
  584
  
    
					case "peeraddress":


  		




  578
  585
  
    
						$peerid_type = "address";


  		




  ......




  593
  600
  
    
						break;


  		




  594
  601
  
    
					}


  		




  595
  602
  
    

  		




  596
  
  
    
					$passive = "start";


  		




  597
  
  
    
					if (isset($ph1ent['mobile'])) {


  		




  598
  
  
    
						$rgip = "%any";


  		




  599
  
  
    
						$passive = "route";


  		




  600
  
  
    
					}


  		




  601
  
  
    

  		




  602
  
  
    
					$keyexchange = "ikev1";


  		




  603
  
  
    
					if (!empty($ph1ent['iketype']) && $ph1ent['iketype'] != "ikev1")


  		




  604
  
  
    
						$keyexchange = "ikev2";


  		




  605
  
  
    

  		




  606
  603
  
    
					if (is_array($ph1ent['encryption-algorithm']) && !empty($ph1ent['encryption-algorithm']['name']) && !empty($ph1ent['hash-algorithm'])) {


  		




  607
  604
  
    
						$ealgosp1 = '';


  		




  608
  605
  
    
						$ealg_id = $ph1ent['encryption-algorithm']['name'];


  		




  ......




  630
  627
  
    
					} else


  		




  631
  628
  
    
						$dpdline = "dpdaction = none";


  		




  632
  629
  
    

  		




  633
  
  
    
					if (!empty($ph1ent['authentication_method']) && (strstr($ph1ent['authentication_method'], "xauth") || strstr($ph1ent['authentication_method'], "hybrid")))


  		




  
  630
  
    
					if (!empty($ph1ent['authentication_method']) && (strpos($ph1ent['authentication_method'], "xauth") || strpos($ph1ent['authentication_method'], "hybrid")))


  		




  634
  631
  
    
						$xauth = "xauth = server";


  		




  635
  632
  
    

  		




  636
  
  
    

  		




  637
  633
  
    
					$lifeline = '';


  		




  638
  634
  
    
					if ($ph1ent['lifetime'])


  		




  639
  635
  
    
						$lifeline = "ikelifetime = {$ph1ent['lifetime']}s";


  		




  ......




  644
  640
  
    
						$peerid_spec = $peerid_data;


  		




  645
  641
  
    
					}


  		




  646
  642
  
    

  		




  647
  
  
    
					if (empty($ph1ent['mode']))


  		




  648
  
  
    
						$aggressive = "no";


  		




  649
  
  
    
					else if ($ph1ent['mode'] == "aggressive")


  		




  
  643
  
    
					if ($ph1ent['mode'] == "aggressive")


  		




  650
  644
  
    
						$aggressive = "yes";


  		




  651
  
  
    
					else if ($ph1ent['mode'] == "main")


  		




  652
  
  
    
						$aggressive = "no";


  		




  653
  645
  
    
					else


  		




  654
  646
  
    
						$aggressive = "no";


  		




  655
  647
  
    

  		




  656
  
  
    
					if (isset($ph2ent['mobile']) && !isset($a_client['enable']))


  		




  657
  
  
    
						continue;


  		




  658
  
  
    

  		




  659
  648
  
    
					if (($ph2ent['mode'] == 'tunnel') or ($ph2ent['mode'] == 'tunnel6')) {


  		




  660
  649
  
    
						$tunneltype = "type = tunnel";


  		




  661
  650
  
    

  		




  ......




  696
  685
  
    

  		




  697
  686
  
    
							$remoteid_data = ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']);


  		




  698
  687
  
    
							$remoteid_spec = $remoteid_data;


  		




  699
  
  
    
						}


  		




  
  688
  
    
						} else


  		




  
  689
  
    
							/* XXX: Should check type of ip used on VPN? */


  		




  
  690
  
    
							$remoteid_spec = "0.0.0.0/0";


  		




  700
  691
  
    

  		




  701
  692
  
    
					} else {


  		




  702
  693
  
    
						$tunneltype = "type = transport";


  		




  703
  
  
    
						//$rgip = $rgmap[$ph1ent['remote-gateway']];


  		




  704
  694
  
    
						$rgip = $ph1ent['remote-gateway'];


  		




  705
  695
  
    

  		




  706
  696
  
    
						if ((($ph1ent['authentication_method'] == "xauth_psk_server") ||


  		




  ......




  712
  702
  
    
							$localid_spec = $ep;


  		




  713
  703
  
    
						}


  		




  714
  704
  
    
						if (!isset($ph2ent['mobile'])) {


  		




  715
  
  
    
							$remoteid_data = $rgmap[$ph1ent['remote-gateway']];


  		




  716
  
  
    
							$remoteid_spec = $remoteid_data;


  		




  
  705
  
    
							$remoteid_spec = $rgip;


  		




  717
  706
  
    
						}


  		




  718
  707
  
    
					}


  		




  719
  708
  
    
					$authentication = "";


  		




  ......




  740
  729
  
    

  		




  741
  730
  
    
					if (isset($a_client['pfs_group']))


  		




  742
  731
  
    
						$ph2ent['pfsgroup'] = $a_client['pfs_group'];


  		




  
  732
  
    

  		




  743
  733
  
    
					$ealgosp2 = '';


  		




  744
  734
  
    
					if ($ph2ent['protocol'] == 'esp') {


  		




  745
  735
  
    
						if (is_array($ph2ent['encryption-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) {


  		












  

    
      usr/local/www/vpn_ipsec_keys.php
    
  





  49
  49
  
    
$userkeys = array();


  		




  50
  50
  
    
foreach ($config['system']['user'] as $id => $user) {


  		




  51
  51
  
    
	if (!empty($user['ipsecpsk'])) {


  		




  52
  
  
    
		$k = array();


  		




  53
  
  
    
		$k["ident"] = $user['name'];


  		




  54
  
  
    
		$k["pre-shared-key"] = $user['ipsecpsk'];


  		




  55
  
  
    
		$k["id"] = $id;


  		




  56
  
  
    
		$userkeys[] = $k;


  		




  
  52
  
    
		$userkeys[] = array('ident' => $user['name'], 'pre-shared-key' => $user['ipsecpsk'], 'id' => $id);;


  		




  57
  53
  
    
	}


  		




  58
  54
  
    
}


  		




  59
  55
  
    

  		




  ......




  115
  111
  
    
			  <?php $i = 0; foreach ($userkeys as $secretent): ?>


  		




  116
  112
  
    
		<tr>


  		




  117
  113
  
    
		<td class="listlr gray">


  		




  118
  
  
    
			<?=htmlspecialchars($secretent['ident']);?>


  		




  
  114
  
    
			<?php


  		




  
  115
  
    
				if ($secretent['ident'] == 'allusers')


  		




  
  116
  
    
					echo gettext("ANY USER");


  		




  
  117
  
    
				else


  		




  
  118
  
    
					echo htmlspecialchars($secretent['ident']);


  		




  
  119
  
    
			?>


  		




  119
  120
  
    
		</td>


  		




  120
  121
  
    
		<td class="listr gray">


  		




  121
  122
  
    
			<?=htmlspecialchars($secretent['pre-shared-key']);?>


  		




  ......




  152
  153
  
    
	</div>


  		




  153
  154
  
    
      </td>


  		




  154
  155
  
    
    </tr>


  		




  
  156
  
    
	<tr>


  		




  
  157
  
    
		<td colspan="4">


  		




  
  158
  
    
			<p>


  		




  
  159
  
    
			<span class="vexpl">


  		




  
  160
  
    
			<span class="red">


  		




  
  161
  
    
				<strong><?=gettext("Note"); ?>:<br /></strong>


  		




  
  162
  
    
			</span>


  		




  
  163
  
    
			<?=gettext("PSK for any user can be set by using an identifier of any/ANY");?>


  		




  
  164
  
    
			</span>


  		




  
  165
  
    
			</p>


  		




  
  166
  
    
		</td>


  		




  
  167
  
    
	</tr>


  		




  155
  168
  
    
</table>


  		




  156
  169
  
    
</form>


  		




  157
  170
  
    
<?php include("fend.inc"); ?>


  		












  

    
      usr/local/www/vpn_ipsec_keys_edit.php
    
  





  76
  76
  
    

  		




  77
  77
  
    
	if (array_key_exists($_POST['ident'], $userids))


  		




  78
  78
  
    
		$input_errors[] = gettext("A user with this name already exists. Add the key to the user instead.");


  		




  
  79
  
    
	unset($userids);


  		




  79
  80
  
    
	


  		




  80
  81
  
    
	if (!$input_errors && !(isset($id) && $a_secret[$id])) {


  		




  81
  82
  
    
		/* make sure there are no dupes */


  		




  ......




  147
  148
  
    
                    <?php endif; ?>


  		




  148
  149
  
    
                  </td>


  		




  149
  150
  
    
                </tr>


  		




  
  151
  
    
		<tr>


  		




  
  152
  
    
			<td colspan="4">


  		




  
  153
  
    
			<p>


  		




  
  154
  
    
				<span class="vexpl">


  		




  
  155
  
    
				<span class="red">


  		




  
  156
  
    
					<strong><?=gettext("Note"); ?>:<br /></strong>


  		




  
  157
  
    
				</span>


  		




  
  158
  
    
				<?=gettext("PSK for any user can be set by using an identifier of any/ANY");?>


  		




  
  159
  
    
				</span>


  		




  
  160
  
    
			</p>


  		




  
  161
  
    
			</td>


  		




  
  162
  
    
		</tr>


  		




  150
  163
  
    
              </table>


  		




  151
  164
  
    
</form>


  		




  152
  165
  
    
<?php include("fend.inc"); ?>


  		












Formats disponibles :  Unified diff