Allow other system authentication types to be used with ipsec. LDAP/RADIUS/local acc

1 files changed, 75 insertions, 126 deletions

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index c5ced75..5e92fe8 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -84,6 +84,7 @@ function vpn_ipsec_configure($ipchg = false)
 
 	if ($g['platform'] == 'jail')
 		return;
+
 	/* get the automatic ping_hosts.sh ready */
 	unlink_if_exists("{$g['vardb_path']}/ipsecpinghosts");
 	touch("{$g['vardb_path']}/ipsecpinghosts");
@@ -97,16 +98,15 @@ function vpn_ipsec_configure($ipchg = false)
 	$a_client = $config['ipsec']['client'];
 
 	if (!isset($ipseccfg['enable'])) {
-		mwexec("/sbin/ifconfig enc0 down");
-
-		/* send a SIGKILL to be sure */
-		sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL");
-
-		/* kill racoon */
-		if(is_process_running("racoon"))
-			mwexec("/usr/bin/killall racoon", true);
+		/* try to stop racoon*/
+		killbypid("{$g['varrun_path']}/racoon.pid");
+		/* Stop dynamic monitoring */
 		killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");
 
+		/* kill racoon forcefully */
+		if (is_process_running("racoon"))
+			mwexec("/usr/bin/killall -9 racoon", true);
+
 		/* wait for racoon process to die */
 		sleep(2);
 
@@ -115,12 +115,20 @@ function vpn_ipsec_configure($ipchg = false)
 		mwexec("/usr/local/sbin/setkey -FP");
 
 		/* disallow IPSEC, it is off */
+		mwexec("/sbin/ifconfig enc0 down");
 		exec("/sbin/sysctl net.inet.ip.ipsec_in_use=0");
 
 		return true;
 	} else {
 		mwexec("/sbin/ifconfig enc0 up");
 		mwexec("/sbin/sysctl net.inet.ip.ipsec_in_use=1");
+		/* needed for racoonctl admin socket */
+		if (!is_dir("/var/db/racoon"))
+			mkdir("/var/db/racoon/");
+		/* needed for config files */
+		if (!is_dir("{$g['varetc_path']}/ipsec"))
+			mkdir("{$g['varetc_path']}/ipsec");
+		
 
 		if ($g['booting'])
 			echo gettext("Configuring IPsec VPN... ");
@@ -218,7 +226,7 @@ function vpn_ipsec_configure($ipchg = false)
 								$ipsecpinghosts[] = "{$srcip}|{$dstip}|3|||||{$family}|\n";
 						}
 					}
-					file_put_contents("{$g['vardb_path']}/ipsecpinghosts", $ipsecpinghosts);
+					@file_put_contents("{$g['vardb_path']}/ipsecpinghosts", $ipsecpinghosts);
 				}
 			}
 		}
@@ -236,21 +244,14 @@ function vpn_ipsec_configure($ipchg = false)
 					log_error(sprintf(gettext("Error: Invalid certificate hash info for %s"), $ca['descr']));
 					continue;
 				}
-				$fname = $g['varetc_path']."/".$x509cert['hash'].".0";
-				if (!file_put_contents($fname, $cert)) {
+				$fname = "{$g['varetc_path']}/ipsec/{$x509cert['hash']}.0";
+				if (!@file_put_contents($fname, $cert)) {
 					log_error(sprintf(gettext("Error: Cannot write IPsec CA file for %s"), $ca['descr']));
 					continue;
 				}
 			}
 		}
 		
-		/* generate psk.txt */
-		$fd = fopen("{$g['varetc_path']}/psk.txt", "w");
-		if (!$fd) {
-			printf(gettext("Error: cannot open psk.txt in vpn_ipsec_configure().") . "\n");
-			return 1;
-		}
-
 		$pskconf = "";
 
 		if (is_array($a_phase1) && count($a_phase1)) {
@@ -300,21 +301,14 @@ function vpn_ipsec_configure($ipchg = false)
 			}
 		}
 
-		fwrite($fd, $pskconf);
-		fclose($fd);
-		chmod("{$g['varetc_path']}/psk.txt", 0600);
+		@file_put_contents("{$g['varetc_path']}/ipsec/psk.txt", $pskconf);
+		chmod("{$g['varetc_path']}/ipsec/psk.txt", 0600);
 			
 		/* begin racoon.conf */
-		if ((is_array($a_phase1) && count($a_phase1)) ||
-			(is_array($a_phase2) && count($a_phase2))) {
-
-			$fd = fopen("{$g['varetc_path']}/racoon.conf", "w");
-			if (!$fd) {
-				printf(gettext("Error: cannot open racoon.conf in vpn_ipsec_configure().") . "\n");
-				return 1;
-			}
+		$racoonconf = "";
+		if ((is_array($a_phase1) && count($a_phase1)) || (is_array($a_phase2) && count($a_phase2))) {
 
-			$racoonconf = "# This file is automatically generated. Do not edit\n";			
+			$racoonconf .= "# This file is automatically generated. Do not edit\n";			
 			$racoonconf .= "path pre_shared_key \"{$g['varetc_path']}/psk.txt\";\n\n";
 			$racoonconf .= "path certificate  \"{$g['varetc_path']}\";\n\n";
 
@@ -336,9 +330,9 @@ function vpn_ipsec_configure($ipchg = false)
 				$racoonconf .= "\nmode_cfg\n";
 				$racoonconf .= "{\n";
 
-				if ($a_client['user_source'])
-					$racoonconf .= "\tauth_source {$a_client['user_source']};\n";
-				if ($a_client['group_source'])
+				if (!empty($a_client['user_source']) && $a_client['user_source'] != "none")
+					$racoonconf .= "\tauth_source external;\n";
+				if (!empty($a_client['group_source']) && $a_client['group_source'] != "none")
 					$racoonconf .= "\tgroup_source {$a_client['group_source']};\n";
 
 				if ($a_client['pool_address'] && $a_client['pool_netbits']) {
@@ -406,16 +400,7 @@ function vpn_ipsec_configure($ipchg = false)
 					$racoonconf .= "\tpfs_group {$a_client['pfs_group']};\n";
 
 				if ($a_client['login_banner']) {
-					$fn = "{$g['varetc_path']}/racoon.motd";
-					$fd1 = fopen($fn, "w");
-					if (!$fd1) {
-						printf(gettext("Error: cannot open server %s in vpn.\n"), $fn);
-						return 1;
-					}
-
-					fwrite($fd1, $a_client['login_banner']);
-					fclose($fd1);
-
+					@file_put_contents("{$g['varetc_path']}/ipsec/racoon.motd", $a_client['login_banner']);
 					$racoonconf .= "\tbanner \"{$fn}\";\n";
 				}
 
@@ -426,33 +411,23 @@ function vpn_ipsec_configure($ipchg = false)
 			}
 			/* end mode_cfg section */
 			
-// Disable this for now, when LDAP support returns it will be via external script auth, 
-//    since we no longer build racoon with LDAP integrated. This is only preventing racoon from running.
-//
-//			if ($a_client['user_source'] != "system") {
-//				if (is_array($config['system']['authserver'])) {
-//					foreach ($config['system']['authserver'] as $authcfg) {
-//						if ($authcfg['type'] == 'ldap' and $authcfg['name'] == $a_client['user_source']) 
-//							$thisauthcfg = $authcfg;
-//					}
-//
-//					/* begin ldapcfg */
-//					$racoonconf .= "ldapcfg {\n";
-//					$racoonconf .= "\tversion 3;\n";
-//					$racoonconf .= "\thost \"".$thisauthcfg['host']."\";\n";
-//					$lport = "389";
-//					if ($authcfg['port'] != "")
-//						$lport = $authcfg['port'];
-//					$racoonconf .= "\tport ".$lport.";\n";
-//					$racoonconf .= "\tbase \"".$thisauthcfg['ldap_basedn']."\";\n";
-//					$racoonconf .= "\tsubtree on;\n";
-//					$racoonconf .= "\tbind_dn \"".$thisauthcfg['ldap_binddn']."\";\n";
-//					$racoonconf .= "\tbind_pw \"".$thisauthcfg['ldap_bindpw']."\";\n";
-//					$racoonconf .= "\tattr_user \"".$thisauthcfg['ldap_attr_user']."\";\n";
-//					$racoonconf .= "}\n\n";
-//					/* end ldapcfg */
-//				}
-//			}
+			if ($a_client['user_source'] != "none") {
+				$authcfgs = explode(",", $a_client['user_source']);
+				$sed = "\$authmodes=array(";
+				$firstsed = 0;
+				foreach ($authcfgs as $authcfg) {
+					if ($firstsed > 0)
+						$sed .= ",";
+					$firstsed = 1;
+					$sed .= "\"{$authcfg}\"";
+				}
+				$sed .= ");\\\n";
+				if ($a_client['strictusercn'])
+					$sed .= "\$strictusercn = true;";
+				mwexec("/bin/cat /etc/inc/ipsec.auth-user.php | /usr/bin/sed 's/\/\/<template>/{$sed}/g' >  {$g['varetc_path']}/ipsec/ipsec.php");
+				mwexec("/bin/chmod a+x {$g['varetc_path']}/ipsec/ipsec.php");
+				$racoonconf .= "extcfg { script \"{$g['varetc_path']}/ipsec/ipsec.php\" }\n";
+			}
 
 			/* begin remote sections */
 			if (is_array($a_phase1) && count($a_phase1)) {
@@ -838,20 +813,12 @@ EOD;
 				/* end sainfo */
 			}
 			/* end sainfo sections */
-
-			fwrite($fd, $racoonconf);
-			fclose($fd);
 		}
+		@file_put_contents("{$g['varetc_path']}/ipsec/racoon.conf", $racoonconf);
 		/* end racoon.conf */
 
 		/* generate IPsec policies */
 		/* generate spd.conf */
-		$fd = fopen("{$g['varetc_path']}/spd.conf", "w");
-		if (!$fd) {
-			printf(gettext("Error: cannot open spd.conf in vpn_ipsec_configure().") . "\n");
-			return 1;
-		}
-
 		$spdconf = "";
 		$natfilterrules = false;
 		if (is_array($a_phase2) && count($a_phase2)) {
@@ -966,19 +933,14 @@ EOD;
 				} 
 			}
 		}
-		fwrite($fd, $spdconf);
-		fclose($fd);
+		@file_put_contents("{$g['varetc_path']}/ipsec/spd.conf", $spdconf);
 
-		/* needed for racoonctl admin socket */
-		if (!is_dir("/var/db/racoon"))
-			mkdir("/var/db/racoon/");
-		
 		/* mange racoon process */
 		if (is_process_running("racoon")) {
 			sleep("0.1");
 			mwexec("/usr/local/sbin/racoonctl -s /var/db/racoon/racoon.sock reload-config", false);
 			/* load SPD without flushing to be safe on config additions or changes. */
-			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);
+			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/ipsec/spd.conf", false);
 		} else {
 			/* flush SA + SPD entries */
 			mwexec("/usr/local/sbin/setkey -FP", false);
@@ -987,10 +949,10 @@ EOD;
  			sleep("0.1");
  			/* start racoon */
 			$ipsecdebug = isset($config['ipsec']['racoondebug']) ? "-d -v" : "";
-			mwexec("/usr/local/sbin/racoon {$ipsecdebug} -f {$g['varetc_path']}/racoon.conf", false);
+			mwexec("/usr/local/sbin/racoon {$ipsecdebug} -f {$g['varetc_path']}/ipsec/racoon.conf", false);
  			sleep("0.1");
  			/* load SPD */
-			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/spd.conf", false);
+			mwexec("/usr/local/sbin/setkey -f {$g['varetc_path']}/ipsec/spd.conf", false);
 
 		}
 		if ($natfilterrules == true)
@@ -1005,11 +967,11 @@ EOD;
 			array_unique($filterdns_list);
 			foreach ($filterdns_list as $hostname)
 				$hostnames .= "cmd {$hostname} '/usr/local/sbin/pfSctl -c \"service reload ipsecdns\"'\n";
-			file_put_contents("{$g['varetc_path']}/filterdns-ipsec.hosts", $hostnames);
+			file_put_contents("{$g['varetc_path']}/ipsec/filterdns-ipsec.hosts", $hostnames);
 
 			killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");
 			sleep(1);
-			mwexec("/usr/local/sbin/filterdns -p {$g['varrun_path']}/filterdns-ipsec.pid -i {$interval} -c {$g['varetc_path']}/filterdns-ipsec.hosts -d 1");
+			mwexec("/usr/local/sbin/filterdns -p {$g['varrun_path']}/filterdns-ipsec.pid -i {$interval} -c {$g['varetc_path']}/ipsec/filterdns-ipsec.hosts -d 1");
 		}
 	
 		vpn_ipsec_failover_configure();
@@ -1021,7 +983,8 @@ EOD;
 	return 0;
 }
 
-/* Forcefully restart IPsec
+/* 
+ * Forcefully restart IPsec
  * This is required for when dynamic interfaces reload
  * For all other occasions the normal vpn_ipsec_configure()
  * will gracefully reload the settings without restarting
@@ -1032,15 +995,15 @@ function vpn_ipsec_force_reload() {
 
 	$ipseccfg = $config['ipsec'];
 
-	/* kill racoon */
-	if(is_process_running("racoon"))
-		mwexec("/usr/bin/killall racoon", true);
+	/* send a SIGKILL to be sure */
+	killbypid("{$g['varrun_path']}/racoon.pid");
 
 	/* wait for process to die */
 	sleep(4);
 
-	/* send a SIGKILL to be sure */
-	sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL");
+	/* kill racoon forcefully */
+	if (is_process_running("racoon"))
+		mwexec("/usr/bin/killall -9 racoon", true);
 
 	/* wait for flushing to finish */
 	sleep(1);
@@ -1050,7 +1013,6 @@ function vpn_ipsec_force_reload() {
 		log_error(gettext("Forcefully reloading IPsec racoon daemon"));
 		vpn_ipsec_configure();
 	}
-
 }
 
 /* master setup for vpn (mpd) */
@@ -1713,54 +1675,41 @@ function vpn_ipsec_refresh_policies() {
 	}
 
 	/* Walk the Ipsec tunnel array */
-	if (!is_array($a_phase1) || (!count($a_phase1))) {
+	if (!is_array($a_phase1) || (!count($a_phase1)))
 		return;
-	}
 
 	foreach ($a_phase1 as $phase1) {
-		if (isset($phase1['disabled'])) {
+		if (isset($phase1['disabled']))
 			continue;
-		}
-		if (is_ipaddr($phase1['remote-gateway'])) {
+		if (is_ipaddr($phase1['remote-gateway']))
 			continue;
-		}
 		if (!is_ipaddr($phase1['remote-gateway'])) {
 			$dnscache = compare_hostname_to_dnscache($phase1['remote-gateway']);
 			$dnscache = trim($dnscache);
 			/* we should have the old IP addresses in the dnscache now */
-			if($dnscache <> "") {
+			if(!empty($dnscache)) {
 				$oldphase1 = $phase1;
-				$oldphase1['remote-gateway'] = trim($dnscache);
+				$oldphase1['remote-gateway'] = $dnscache;
 				/* now we need to find all tunnels for this host */
-				if (!is_array($a_phase2) || (!count($a_phase2))) {
+				if (!is_array($a_phase2) || (!count($a_phase2)))
 					continue;
-				}
 				foreach ($a_phase2 as $phase2) {
-					if($phase2['ikeid'] == $phase1['ikeid']) {
+					if ($phase2['ikeid'] == $phase1['ikeid'])
 						reload_tunnel_spd_policy ($phase1, $phase2, $oldphase1, $oldphase2);
-					}
 				}
 			}
 		}
 	}
 
-	/* process all generated spd.conf files from tmp which are left behind
-	 * behind by either changes of dynamic tunnels or manual edits
-	 * scandir() is only available in PHP5 */
-	$tmpfiles = array();
-	$dh  = opendir($g['tmp_path']);
-	while (false !== ($filename = readdir($dh))) {
-		if(preg_match("/^spd.conf.reload./", $filename)) {
-			$tmpfiles[] = $filename;
-		}
-	}
-	sort($tmpfiles);
+	/* process all generated temporary spd.conf files */
+	$tmpfiles = glob("{$g['tmp_path']}/spd.conf.reload.*");
 	foreach($tmpfiles as $tmpfile) {
-		$ret = mwexec("/usr/local/sbin/setkey -f {$g['tmp_path']}/{$tmpfile} 2>&1", false);
-		if($ret == 0) {
-			unlink_if_exists("{$g['tmp_path']}/{$tmpfile}");
-		} else {
-			rename("{$g['tmp_path']}/{$tmpfile}", ("{$g['tmp_path']}/failed.{$tmpfile}"));
+		$ret = mwexec("/usr/local/sbin/setkey -f {$tmpfile} 2>&1", false);
+		if ($ret == 0)
+			unlink_if_exists($tmpfile);
+		else {
+			$tmpfile = basename($tmpfile);
+			@rename("{$g['tmp_path']}/{$tmpfile}", ("{$g['tmp_path']}/failed.{$tmpfile}"));
 		}
 	}
 }
@@ -1888,7 +1837,7 @@ function reload_tunnel_spd_policy($phase1, $phase2, $old_phase1, $old_phase2) {
 	$now = time();
 	$spdfile = tempnam("{$g['tmp_path']}", "spd.conf.reload.{$now}.");
 	/* generate temporary spd.conf */
-	file_put_contents($spdfile, $spdconf);
+	@file_put_contents($spdfile, $spdconf);
 	return true;
 }