diff options
author | Scott Ullrich <sullrich@pfsense.org> | 2005-07-03 19:08:12 +0000 |
---|---|---|
committer | Scott Ullrich <sullrich@pfsense.org> | 2005-07-03 19:08:12 +0000 |
commit | bd9548e05a9b536806e0ade405c7327ef80954eb (patch) | |
tree | 45f899ac2cd4a4eec6e38a2c5effd1475aac2d81 /etc | |
parent | 6948fa96431716dce7e5b776f2f5d840d016fe1d (diff) | |
download | pfsense-bd9548e05a9b536806e0ade405c7327ef80954eb.zip pfsense-bd9548e05a9b536806e0ade405c7327ef80954eb.tar.gz |
Import m0n0wall's backend vpn.inc which has certificate support.
Diffstat (limited to 'etc')
-rw-r--r-- | etc/inc/vpn.inc | 442 |
1 files changed, 257 insertions, 185 deletions
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 577cd53..b89f239 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -1,24 +1,21 @@ <?php -/* $Id$ */ /* vpn.inc - Copyright (C) 2004 Scott Ullrich + part of m0n0wall (http://m0n0.ch/wall) + + Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>. All rights reserved. - - originally part of m0n0wall (http://m0n0.ch/wall) - Copyright (C) 2003-2004 Manuel Kasper <mk@neon1.net>. - All rights reserved. - + Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - + 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - + 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE @@ -30,173 +27,149 @@ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ - + /* include all configuration functions */ require_once("functions.inc"); - -function find_last_gif_device() { - $last_gif_found = -1; - if (!($fp = popen("/sbin/ifconfig -l", "r"))) return -1; - $ifconfig_data = fread($fp, 4096); - pclose($fp); - $ifconfig_array = split(" ", $ifconfig_data); - foreach ($ifconfig_array as $ifconfig) { - ereg("gif(.)", $ifconfig, $regs); - if($regs[0]) { - if($regs[0] > $last_gif_found) - $last_gif_found = $regs[1]; - } - } - return $last_gif_found; -} - + function vpn_ipsec_configure($ipchg = false) { global $config, $g; - - if(isset($config['ipsec']['preferredoldsa'])) { - mwexec("/sbin/sysctl net.key.preferred_oldsa=0"); - } else { - mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30"); - } - - $number_of_gifs = find_last_gif_device(); - for($x=0; $x<$number_of_gifs; $x++) { - mwexec("/sbin/ifconfig gif" . $x . " delete"); - } - + $curwanip = get_current_wan_address(); - if($config['ipsec']['ip'] <> "") - $curwanip = $config['ipsec']['ip']; - + $syscfg = $config['system']; $ipseccfg = $config['ipsec']; $lancfg = $config['interfaces']['lan']; $lanip = $lancfg['ipaddr']; $lansa = gen_subnet($lancfg['ipaddr'], $lancfg['subnet']); $lansn = $lancfg['subnet']; - + if ($g['booting']) { if (!isset($ipseccfg['enable'])) return 0; - + echo "Configuring IPsec VPN... "; } else { /* kill racoon */ killbypid("{$g['varrun_path']}/racoon.pid"); - + /* wait for process to die */ sleep(2); - + /* send a SIGKILL to be sure */ sigkillbypid("{$g['varrun_path']}/racoon.pid", "KILL"); } - + /* flush SPD and SAD */ mwexec("/usr/sbin/setkey -FP"); mwexec("/usr/sbin/setkey -F"); - + + /* prefer old SAs only for 30 seconds, then use the new one */ + if (!isset($config['ipsec']['preferoldsa'])) + mwexec("/sbin/sysctl -w net.key.preferred_oldsa=-30"); + else + mwexec("/sbin/sysctl -w net.key.preferred_oldsa=1"); + if (isset($ipseccfg['enable'])) { - - /* fastforwarding is not compatible with ipsec tunnels */ - system("/sbin/sysctl net.inet.ip.fastforwarding=0 >/dev/null 2>&1"); - + if (!$curwanip) { /* IP address not configured yet, exit */ if ($g['booting']) - echo "done.\n"; + echo "done\n"; return 0; } - + if ((is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) || isset($ipseccfg['mobileclients']['enable'])) { - + if (is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) { - + /* generate spd.conf */ $fd = fopen("{$g['varetc_path']}/spd.conf", "w"); if (!$fd) { printf("Error: cannot open spd.conf in vpn_ipsec_configure().\n"); return 1; } - + $spdconf = ""; - + $spdconf .= "spdadd {$lansa}/{$lansn} {$lanip}/32 any -P in none;\n"; $spdconf .= "spdadd {$lanip}/32 {$lansa}/{$lansn} any -P out none;\n"; - + foreach ($ipseccfg['tunnel'] as $tunnel) { - + if (isset($tunnel['disabled'])) continue; - + $ep = vpn_endpoint_determine($tunnel, $curwanip); if (!$ep) continue; - + vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn); - - if(isset($tunnel['creategif'])) { - $number_of_gifs = find_last_gif_device(); - $number_of_gifs++; - $curwanip = get_current_wan_address(); - if($config['ipsec']['ip'] <> "") - $curwanip = $config['ipsec']['ip']; - mwexec("/sbin/ifconfig gif" . $number_of_gifs . " tunnel" . $curwanip . " " . $tunnel['remote-gateway']); - mwexec("/sbin/ifconfig gif" . $number_of_gifs . " {$lansa}/{$lansn} {$lanip}/32"); - } - - $spdconf .= "spdadd {$sa}/{$sn} " . - "{$tunnel['remote-subnet']} any -P out ipsec " . + + $spdconf .= "spdadd {$sa}/{$sn} " . + "{$tunnel['remote-subnet']} any -P out ipsec " . "{$tunnel['p2']['protocol']}/tunnel/{$ep}-" . "{$tunnel['remote-gateway']}/unique;\n"; - - $spdconf .= "spdadd {$tunnel['remote-subnet']} " . - "{$sa}/{$sn} any -P in ipsec " . + + $spdconf .= "spdadd {$tunnel['remote-subnet']} " . + "{$sa}/{$sn} any -P in ipsec " . "{$tunnel['p2']['protocol']}/tunnel/{$tunnel['remote-gateway']}-" . "{$ep}/unique;\n"; } - + fwrite($fd, $spdconf); fclose($fd); - + /* load SPD */ mwexec("/usr/sbin/setkey -c < {$g['varetc_path']}/spd.conf"); } - + /* generate racoon.conf */ $fd = fopen("{$g['varetc_path']}/racoon.conf", "w"); if (!$fd) { printf("Error: cannot open racoon.conf in vpn_ipsec_configure().\n"); return 1; } - - $racoonconf = ""; - - if($config['ipsec']['ip'] <> "") { - - $interface_ip = $config['ipsec']['ip']; - $racoonconf .= <<<EOD -listen { - isakmp {$interface_ip} [500]; -} - -EOD; - } - - $racoonconf .= "path pre_shared_key \"{$g['varetc_path']}/psk.txt\";\n\n"; - + + $racoonconf = "path pre_shared_key \"{$g['varetc_path']}/psk.txt\";\n\n"; + $racoonconf .= "path certificate \"{$g['varetc_path']}\";\n\n"; + + /* generate CA certificates files */ + $cacertnum = 0; + if (is_array($ipseccfg['cacert']) && count($ipseccfg['cacert'])) + foreach ($ipseccfg['cacert'] as $cacert) { + ++$cacertnum; + if (isset($cacert['cert'])) { + $cert = base64_decode($cacert['cert']); + $x509cert = openssl_x509_parse(openssl_x509_read($cert)); + if(is_array($x509cert) && isset($x509cert['hash'])) { + $fd1 = fopen("{$g['varetc_path']}/{$x509cert['hash']}.0", "w"); + if (!$fd1) { + printf("Error: cannot open {$x509cert['hash']}.0 in vpn.\n"); + return 1; + } + chmod("{$g['varetc_path']}/{$x509cert['hash']}.0", 0600); + fwrite($fd1, $cert); + fclose($fd1); + } + } + } + + $tunnelnumber = 0; if (is_array($ipseccfg['tunnel']) && count($ipseccfg['tunnel'])) foreach ($ipseccfg['tunnel'] as $tunnel) { - + + ++$tunnelnumber; + if (isset($tunnel['disabled'])) continue; - + $ep = vpn_endpoint_determine($tunnel, $curwanip); if (!$ep) continue; - + vpn_localnet_determine($tunnel['local-subnet'], $sa, $sn); - + if (isset($tunnel['p1']['myident']['myaddress'])) { $myidentt = "address"; $myident = $ep; @@ -210,11 +183,68 @@ EOD; $myidentt = "user_fqdn"; $myident = $tunnel['p1']['myident']['ufqdn']; } - + + if (isset($tunnel['p1']['authentication_method'])) { + $authmethod = $tunnel['p1']['authentication_method']; + } else {$authmethod = 'pre_shared_key';} + + $certline = ''; + + if ($authmethod == 'rsasig') { + if ($tunnel['p1']['cert'] && $tunnel['p1']['private-key']) { + $cert = base64_decode($tunnel['p1']['cert']); + $private_key = base64_decode($tunnel['p1']['private-key']); + } else { + /* null certificate/key */ + $cert = ''; + $private_key = ''; + } + + if ($tunnel['p1']['peercert']) + $peercert = base64_decode($tunnel['p1']['peercert']); + else + $peercert = ''; + + $fd1 = fopen("{$g['varetc_path']}/server{$tunnelnumber}-signed.pem", "w"); + if (!$fd1) { + printf("Error: cannot open server{$tunnelnumber}-signed.pem in vpn.\n"); + return 1; + } + chmod("{$g['varetc_path']}/server{$tunnelnumber}-signed.pem", 0600); + fwrite($fd1, $cert); + fclose($fd1); + + $fd1 = fopen("{$g['varetc_path']}/server{$tunnelnumber}-key.pem", "w"); + if (!$fd1) { + printf("Error: cannot open server{$tunnelnumber}-key.pem in vpn.\n"); + return 1; + } + chmod("{$g['varetc_path']}/server{$tunnelnumber}-key.pem", 0600); + fwrite($fd1, $private_key); + fclose($fd1); + + $certline = "certificate_type x509 \"server{$tunnelnumber}-signed.pem\" \"server{$tunnelnumber}-key.pem\";"; + + if ($peercert!=''){ + $fd1 = fopen("{$g['varetc_path']}/peer{$tunnelnumber}-signed.pem", "w"); + if (!$fd1) { + printf("Error: cannot open server{$tunnelnumber}-signed.pem in vpn.\n"); + return 1; + } + chmod("{$g['varetc_path']}/peer{$tunnelnumber}-signed.pem", 0600); + fwrite($fd1, $peercert); + fclose($fd1); + $certline .= <<<EOD + + peers_certfile "peer{$tunnelnumber}-signed.pem"; +EOD; + } + } $racoonconf .= <<<EOD remote {$tunnel['remote-gateway']} \{ exchange_mode {$tunnel['p1']['mode']}; my_identifier {$myidentt} "{$myident}"; + {$certline} peers_identifier address {$tunnel['remote-gateway']}; initial_contact on; support_proxy on; @@ -223,23 +253,23 @@ remote {$tunnel['remote-gateway']} \{ proposal \{ encryption_algorithm {$tunnel['p1']['encryption-algorithm']}; hash_algorithm {$tunnel['p1']['hash-algorithm']}; - authentication_method pre_shared_key; + authentication_method {$authmethod}; dh_group {$tunnel['p1']['dhgroup']}; EOD; if ($tunnel['p1']['lifetime']) $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; - + $racoonconf .= " }\n"; - + if ($tunnel['p1']['lifetime']) $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; - + $racoonconf .= "}\n\n"; - + $p2ealgos = join(",", $tunnel['p2']['encryption-algorithm-option']); $p2halgos = join(",", $tunnel['p2']['hash-algorithm-option']); - + $racoonconf .= <<<EOD sainfo address {$sa}/{$sn} any address {$tunnel['remote-subnet']} any \{ encryption_algorithm {$p2ealgos}; @@ -250,18 +280,18 @@ EOD; if ($tunnel['p2']['pfsgroup']) $racoonconf .= " pfs_group {$tunnel['p2']['pfsgroup']};\n"; - + if ($tunnel['p2']['lifetime']) $racoonconf .= " lifetime time {$tunnel['p2']['lifetime']} secs;\n"; - + $racoonconf .= "}\n\n"; } - + /* mobile clients? */ if (isset($ipseccfg['mobileclients']['enable'])) { - + $tunnel = $ipseccfg['mobileclients']; - + if (isset($tunnel['p1']['myident']['myaddress'])) { $myidentt = "address"; $myident = $curwanip; @@ -275,11 +305,52 @@ EOD; $myidentt = "user_fqdn"; $myident = $tunnel['p1']['myident']['ufqdn']; } + + if (isset($tunnel['p1']['authentication_method'])) { + $authmethod = $tunnel['p1']['authentication_method']; + } else {$authmethod = 'pre_shared_key';} + + $certline = ''; + if ($authmethod == 'rsasig') { + if ($tunnel['p1']['cert'] && $tunnel['p1']['private-key']) { + $cert = base64_decode($tunnel['p1']['cert']); + $private_key = base64_decode($tunnel['p1']['private-key']); + } else { + /* null certificate/key */ + $cert = ''; + $private_key = ''; + } + + if ($tunnel['p1']['peercert']) + $peercert = base64_decode($tunnel['p1']['peercert']); + else + $peercert = ''; + + $fd1 = fopen("{$g['varetc_path']}/server-mobile{$tunnelnumber}-signed.pem", "w"); + if (!$fd1) { + printf("Error: cannot open server-mobile{$tunnelnumber}-signed.pem in vpn.\n"); + return 1; + } + chmod("{$g['varetc_path']}/server-mobile{$tunnelnumber}-signed.pem", 0600); + fwrite($fd1, $cert); + fclose($fd1); + + $fd1 = fopen("{$g['varetc_path']}/server-mobile{$tunnelnumber}-key.pem", "w"); + if (!$fd1) { + printf("Error: cannot open server-mobile{$tunnelnumber}-key.pem in vpn.\n"); + return 1; + } + chmod("{$g['varetc_path']}/server-mobile{$tunnelnumber}-key.pem", 0600); + fwrite($fd1, $private_key); + fclose($fd1); + $certline = "certificate_type x509 \"server-mobile{$tunnelnumber}-signed.pem\" \"server-mobile{$tunnelnumber}-key.pem\";"; + } $racoonconf .= <<<EOD remote anonymous \{ exchange_mode {$tunnel['p1']['mode']}; my_identifier {$myidentt} "{$myident}"; + {$certline} initial_contact on; passive on; generate_policy on; @@ -289,23 +360,23 @@ remote anonymous \{ proposal \{ encryption_algorithm {$tunnel['p1']['encryption-algorithm']}; hash_algorithm {$tunnel['p1']['hash-algorithm']}; - authentication_method pre_shared_key; + authentication_method {$authmethod}; dh_group {$tunnel['p1']['dhgroup']}; EOD; if ($tunnel['p1']['lifetime']) $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; - + $racoonconf .= " }\n"; - + if ($tunnel['p1']['lifetime']) $racoonconf .= " lifetime time {$tunnel['p1']['lifetime']} secs;\n"; - + $racoonconf .= "}\n\n"; - + $p2ealgos = join(",", $tunnel['p2']['encryption-algorithm-option']); $p2halgos = join(",", $tunnel['p2']['hash-algorithm-option']); - + $racoonconf .= <<<EOD sainfo anonymous \{ encryption_algorithm {$p2ealgos}; @@ -316,25 +387,25 @@ EOD; if ($tunnel['p2']['pfsgroup']) $racoonconf .= " pfs_group {$tunnel['p2']['pfsgroup']};\n"; - + if ($tunnel['p2']['lifetime']) $racoonconf .= " lifetime time {$tunnel['p2']['lifetime']} secs;\n"; - + $racoonconf .= "}\n\n"; } - + fwrite($fd, $racoonconf); fclose($fd); - + /* generate psk.txt */ $fd = fopen("{$g['varetc_path']}/psk.txt", "w"); if (!$fd) { printf("Error: cannot open psk.txt in vpn_ipsec_configure().\n"); return 1; } - + $pskconf = ""; - + if (is_array($ipseccfg['tunnel'])) { foreach ($ipseccfg['tunnel'] as $tunnel) { if (isset($tunnel['disabled'])) @@ -342,22 +413,22 @@ EOD; $pskconf .= "{$tunnel['remote-gateway']} {$tunnel['p1']['pre-shared-key']}\n"; } } - + /* add PSKs for mobile clients */ if (is_array($ipseccfg['mobilekey'])) { foreach ($ipseccfg['mobilekey'] as $key) { $pskconf .= "{$key['ident']} {$key['pre-shared-key']}\n"; } } - + fwrite($fd, $pskconf); fclose($fd); chmod("{$g['varetc_path']}/psk.txt", 0600); - + /* start racoon */ mwexec("/usr/local/sbin/racoon -d -f {$g['varetc_path']}/racoon.conf"); - - if(is_array($ipseccfg['tunnel'])) + + if (is_array($ipseccfg['tunnel'])) { foreach ($ipseccfg['tunnel'] as $tunnel) { if (isset($tunnel['auto'])) { $remotehost = substr($tunnel['remote-subnet'],0,strpos($tunnel['remote-subnet'],"/")); @@ -366,75 +437,74 @@ EOD; mwexec_bg("/sbin/ping -c 1 -S {$srchost} {$remotehost}"); } } + } } } - + if (!$g['booting']) { /* reload the filter */ filter_configure(); } - + if ($g['booting']) - echo "done.\n"; - + echo "done\n"; + return 0; } function vpn_pptpd_configure() { global $config, $g; - + $syscfg = $config['system']; $pptpdcfg = $config['pptpd']; - + if ($g['booting']) { if (!$pptpdcfg['mode'] || ($pptpdcfg['mode'] == "off")) return 0; - - echo "Configuring PPTP VPN... "; - } else { + + echo "Configuring PPTP VPN service... "; + } else { /* kill mpd */ killbypid("{$g['varrun_path']}/mpd-vpn.pid"); - + /* wait for process to die */ sleep(2); - + /* remove mpd.conf, if it exists */ unlink_if_exists("{$g['varetc_path']}/mpd-vpn/mpd.conf"); unlink_if_exists("{$g['varetc_path']}/mpd-vpn/mpd.links"); unlink_if_exists("{$g['varetc_path']}/mpd-vpn/mpd.secret"); } - + /* make sure mpd-vpn directory exists */ - safe_mkdir("{$g['varetc_path']}/mpd-vpn"); - + if (!file_exists("{$g['varetc_path']}/mpd-vpn")) + mkdir("{$g['varetc_path']}/mpd-vpn"); + switch ($pptpdcfg['mode']) { - + case 'server': - + /* write mpd.conf */ $fd = fopen("{$g['varetc_path']}/mpd-vpn/mpd.conf", "w"); if (!$fd) { printf("Error: cannot open mpd.conf in vpn_pptpd_configure().\n"); return 1; } - + $mpdconf = <<<EOD pptpd: EOD; - $n_pptp_units = $g['n_pptp_units']; - if($config['pptp']['n_pptp_units'] <> "") - $n_pptp_units = $config['pptp']['n_pptp_units']; - for ($i = 0; $i < $n_pptp_units; $i++) { + for ($i = 0; $i < $g['n_pptp_units']; $i++) { $mpdconf .= " load pt{$i}\n"; } - - for ($i = 0; $i < $n_pptp_units; $i++) { - + + for ($i = 0; $i < $g['n_pptp_units']; $i++) { + $clientip = long2ip(ip2long($pptpdcfg['remoteip']) + $i); $ngif = "ng" . ($i+1); - + $mpdconf .= <<<EOD pt{$i}: @@ -444,7 +514,7 @@ pt{$i}: EOD; } - + $mpdconf .= <<<EOD pts: @@ -468,7 +538,7 @@ pts: set ccp yes mpp-stateless EOD; - + if (!isset($pptpdcfg['req128'])) { $mpdconf .= <<<EOD set ccp yes mpp-e40 @@ -476,8 +546,10 @@ EOD; EOD; } - - if (isset($config['dnsmasq']['enable'])) { + + if (is_array($pptpdcfg['dnsserver']) && ($pptpdcfg['dnsserver'][0])) { + $mpdconf .= " set ipcp dns " . join(" ", $pptpdcfg['dnsserver']) . "\n"; + } else if (isset($config['dnsmasq']['enable'])) { $mpdconf .= " set ipcp dns " . $config['interfaces']['lan']['ipaddr']; if ($syscfg['dnsserver'][0]) $mpdconf .= " " . $syscfg['dnsserver'][0]; @@ -485,7 +557,7 @@ EOD; } else if (is_array($syscfg['dnsserver']) && ($syscfg['dnsserver'][0])) { $mpdconf .= " set ipcp dns " . join(" ", $syscfg['dnsserver']) . "\n"; } - + if (isset($pptpdcfg['radius']['enable'])) { $mpdconf .= <<<EOD set radius server {$pptpdcfg['radius']['server']} "{$pptpdcfg['radius']['secret']}" @@ -506,20 +578,17 @@ EOD; fwrite($fd, $mpdconf); fclose($fd); - + /* write mpd.links */ $fd = fopen("{$g['varetc_path']}/mpd-vpn/mpd.links", "w"); if (!$fd) { printf("Error: cannot open mpd.links in vpn_pptpd_configure().\n"); return 1; } - + $mpdlinks = ""; - - $n_pptp_units = $g['n_pptp_units']; - if($config['pptp']['n_pptp_units'] <> "") - $n_pptp_units = $config['pptp']['n_pptp_units']; - for ($i = 0; $i < $n_pptp_units; $i++) { + + for ($i = 0; $i < $g['n_pptp_units']; $i++) { $mpdlinks .= <<<EOD pt{$i}: @@ -534,16 +603,16 @@ EOD; fwrite($fd, $mpdlinks); fclose($fd); - + /* write mpd.secret */ $fd = fopen("{$g['varetc_path']}/mpd-vpn/mpd.secret", "w"); if (!$fd) { printf("Error: cannot open mpd.secret in vpn_pptpd_configure().\n"); return 1; } - + $mpdsecret = ""; - + if (is_array($pptpdcfg['user'])) { foreach ($pptpdcfg['user'] as $user) $mpdsecret .= "{$user['name']} \"{$user['password']}\" {$user['ip']}\n"; @@ -552,21 +621,24 @@ EOD; fwrite($fd, $mpdsecret); fclose($fd); chmod("{$g['varetc_path']}/mpd-vpn/mpd.secret", 0600); - + /* fire up mpd */ mwexec("/usr/local/sbin/mpd -b -d {$g['varetc_path']}/mpd-vpn -p {$g['varrun_path']}/mpd-vpn.pid pptpd"); - + break; - + case 'redir': break; } - - if ($g['booting']) - echo "done.\n"; - else + + if (!$g['booting']) { + /* reload the filter */ filter_configure(); - + } + + if ($g['booting']) + echo "done\n"; + return 0; } @@ -574,7 +646,7 @@ function vpn_localnet_determine($adr, &$sa, &$sn) { global $config, $g; if (isset($adr)) { - if ($adr['network']) { + if ($adr['network']) { switch ($adr['network']) { case 'lan': $sn = $config['interfaces']['lan']['subnet']; @@ -593,9 +665,9 @@ function vpn_localnet_determine($adr, &$sa, &$sn) { } function vpn_endpoint_determine($tunnel, $curwanip) { - + global $g, $config; - + if ((!$tunnel['interface']) || ($tunnel['interface'] == "wan")) { if ($curwanip) return $curwanip; @@ -605,13 +677,13 @@ function vpn_endpoint_determine($tunnel, $curwanip) { return $config['interfaces']['lan']['ipaddr']; } else { $oc = $config['interfaces'][$tunnel['interface']]; - + if (isset($oc['enable']) && $oc['if']) { return $oc['ipaddr']; } } - + return null; } - + ?> |