Minor re-work of OpenVPN configuration. Use operational modes to determine

what configuration options are appropriate. The operational mode dictates
the authentication method. They are defines as follows ...

Peer to Peer ( SSL/TLS )
Peer to Peer ( Shared Key )
Remote Access ( SSL/TLS )
Remote Access ( User Auth )
Remote Access ( SSL/TLS + User Auth )

Some of these modes allow for user authentication using passwords. We now
use the etc/inc/openvpn.auth-user.php file to facilitate this by checking
the username and password supplied by OpenVPN against our centralized user
database.

The Server and Client user interfaces have also been updated to support
TLS packet authentication. This is an additional security option that is
optional.

1 files changed, 17 insertions, 0 deletions

diff --git a/etc/inc/config.inc b/etc/inc/config.inc
index 5a52611..0cd4476 100644
--- a/etc/inc/config.inc
+++ b/etc/inc/config.inc
@@ -1747,6 +1747,16 @@ endif;
 					$index++;
 				}
 
+				/* determine operational mode */
+				if ($server['auth_method'] == 'pki') {
+					if($server['nopool'])
+						$server['mode'] = "p2p_tls";
+					else
+						$server['mode'] = "server_tls";
+				} else
+					$server['mode'] = "p2p_shared_key";
+				unset($server['auth_method']);
+
 				/* modify configuration values */
 				unset($server['dh_params']);
 				if (!$server['interface'])
@@ -1829,6 +1839,13 @@ endif;
 					$index++;
 				}
 
+				/* determine operational mode */
+				if ($client['auth_method'] == 'pki')
+					$client['mode'] = "p2p_tls";
+				else
+					$client['mode'] = "p2p_shared_key";
+				unset($client['auth_method']);
+
 				/* modify configuration values */
 				if (!$client['interface'])
 					$client['interface'] = 'wan';