diff options
Diffstat (limited to 'etc/inc/vpn.inc')
| -rw-r--r-- | etc/inc/vpn.inc | 327 |
1 files changed, 166 insertions, 161 deletions
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc index 39e4333..2e2100b 100644 --- a/etc/inc/vpn.inc +++ b/etc/inc/vpn.inc @@ -269,6 +269,9 @@ charon { # number of worker threads in charon threads = 16 + # NOTE: Allows to send multiple subnets for IKEv1 + cisco_unity = yes + # XXX: There is not much choice here really users win their security! i_dont_care_about_security_and_use_aggressive_mode_psk=yes @@ -475,10 +478,13 @@ EOD; } /* Add user PSKs */ - foreach ($config['system']['user'] as $user) { - if (!empty($user['ipsecpsk'])) { - $pskconf .= "{$user['name']} : PSK \"{$user['ipsecpsk']}\"\n"; + if (is_array($config['system']) && is_array($config['system']['user'])) { + foreach ($config['system']['user'] as $user) { + if (!empty($user['ipsecpsk'])) { + $pskconf .= "{$user['name']} : PSK \"{$user['ipsecpsk']}\"\n"; + } } + unset($user); } /* add PSKs for mobile clients */ @@ -488,6 +494,7 @@ EOD; $key['ident'] = ''; $pskconf .= "{$key['ident']} : PSK \"{$key['pre-shared-key']}\"\n"; } + unset($key); } @file_put_contents("{$g['varetc_path']}/ipsec/ipsec.secrets", $pskconf); @@ -497,182 +504,175 @@ EOD; $natfilterrules = false; /* begin ipsec.conf */ $ipsecconf = ""; - if ((is_array($a_phase1) && count($a_phase1)) || (is_array($a_phase2) && count($a_phase2))) { + if (is_array($a_phase1) && count($a_phase1)) { $ipsecconf .= "# This file is automatically generated. Do not edit\n"; - if (is_array($a_phase2) && count($a_phase2)) { - $ipsecconf .= "config setup\n\tuniqueids = yes\n"; - $ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n"; + $ipsecconf .= "config setup\n\tuniqueids = yes\n"; + $ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n"; - foreach ($a_phase2 as $ph2ent) { - $ikeid = $ph2ent['ikeid']; + foreach ($a_phase1 as $ph1ent) { + if (isset($ph1ent['disabled'])) + continue; - $ph1ent = false; - if (!ipsec_lookup_phase1($ph2ent,$ph1ent)) - continue; + if ($ph1ent['mode'] == "aggressive") + $aggressive = "yes"; + else + $aggressive = "no"; - if (isset($ph1ent['disabled'])) - continue; + $ep = ipsec_get_phase1_src($ph1ent); + if (!$ep) + continue; - if (isset($ph2ent['disabled'])) - continue; + $keyexchange = "ikev1"; + if (!empty($ph1ent['iketype']) && $ph1ent['iketype'] != "ikev1") { + $keyexchange = "ikev2"; + $passive = "start"; + } else + $passive = "route"; + + if (isset($ph1ent['mobile'])) { + $right_spec = "%any"; + $passive = 'add'; + } else + $right_spec = $ph1ent['remote-gateway']; + + list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, "local"); + list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, "peer", $rgmap); + + /* Only specify peer ID if we are not dealing with a mobile PSK-only tunnel */ + $peerid_spec = ''; + if (!isset($ph1ent['mobile'])) + $peerid_spec = $peerid_data; + + if (is_array($ph1ent['encryption-algorithm']) && !empty($ph1ent['encryption-algorithm']['name']) && !empty($ph1ent['hash-algorithm'])) { + $ealgosp1 = ''; + $ealg_id = $ph1ent['encryption-algorithm']['name']; + $ealg_kl = $ph1ent['encryption-algorithm']['keylen']; + if ($ealg_kl) + $ealgosp1 = "ike = {$ealg_id}{$ealg_kl}-{$ph1ent['hash-algorithm']}"; + else + $ealgosp1 = "ike = {$ealg_id}-{$ph1ent['hash-algorithm']}"; - if (isset($ph2ent['mobile']) && !isset($a_client['enable'])) - continue; + $modp = vpn_ipsec_convert_to_modp($ph1ent['dhgroup']); + if (!empty($modp)) + $ealgosp1 .= "-{$modp}"; - $ikeid = $ph1ent['ikeid']; + if ($keyexchange == "ikev1") + $ealgosp1 .= "!"; + } - if ($ph1ent['mode'] == "aggressive") - $aggressive = "yes"; + if ($ph1ent['dpd_delay'] && $ph1ent['dpd_maxfail']) { + if ($passive == "start") + $dpdline = "dpdaction = restart"; else - $aggressive = "no"; + $dpdline = "dpdaction = clear"; + $dpdline .= "\n\tdpddelay = {$ph1ent['dpd_delay']}s"; + $dpdtimeout = $ph1ent['dpd_delay'] * ($ph1ent['dpd_maxfail'] + 1); + $dpdline .= "\n\tdpdtimeout = {$dpdtimeout}s"; + } else + $dpdline = "dpdaction = none"; + + $ikelifeline = ''; + if ($ph1ent['lifetime']) + $ikelifeline = "ikelifetime = {$ph1ent['lifetime']}s"; + + $authentication = ""; + switch ($ph1ent['authentication_method']) { + case 'xauth_rsa_server': + $authentication = "leftauth = pubkey\n\trightauth = pubkey"; + $authentication .= "\n\trightauth2 = xauth-generic"; + break; + case 'xauth_psk_server': + $authentication = "leftauth = psk\n\trightauth = psk"; + $authentication .= "\n\trightauth2 = xauth-generic"; + break; + case 'pre_shared_key': + $authentication = "leftauth = psk\n\trightauth = psk"; + break; + case 'rsasig': + $authentication = "leftauth = pubkey\n\trightauth = pubkey"; + break; + case 'hybrid_rsa_server': + $authentication = "leftauth = xauth-generic\n\trightauth = pubkey"; + $authentication .= "\n\trightauth2 = xauth"; + break; + } - $ep = ipsec_get_phase1_src($ph1ent); - if (!$ep) - continue; + $left_spec = $ep; - $passive = "start"; - if (isset($ph1ent['mobile'])) { - $rgip = "%any"; - $passive = 'add'; - } else - $rgip = $ph1ent['remote-gateway']; - - $keyexchange = "ikev1"; - if (!empty($ph1ent['iketype']) && $ph1ent['iketype'] != "ikev1") { - $keyexchange = "ikev2"; - $rekey = "rekey = yes"; - } else { - $rekey = "rekey = yes"; - } + $ipseclifetime = 0; + $rightsubnet_spec = array(); + $leftsubnet_spec = array(); + $ealgoAHsp2arr = array(); + $ealgoESPsp2arr = array(); + if (is_array($a_phase2) && count($a_phase2)) { + foreach ($a_phase2 as $ph2ent) { + $ikeid = $ph2ent['ikeid']; + if ($ikeid != $ph1ent['ikeid']) + continue; - list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, "local"); - list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, "peer", $rgmap); + if (isset($ph2ent['disabled'])) + continue; - /* Only specify peer ID if we are not dealing with a mobile PSK-only tunnel */ - $peerid_spec = ''; - if (!isset($ph1ent['mobile'])) - $peerid_spec = $peerid_data; - - if (is_array($ph1ent['encryption-algorithm']) && !empty($ph1ent['encryption-algorithm']['name']) && !empty($ph1ent['hash-algorithm'])) { - $ealgosp1 = ''; - $ealg_id = $ph1ent['encryption-algorithm']['name']; - $ealg_kl = $ph1ent['encryption-algorithm']['keylen']; - if ($ealg_kl) - $ealgosp1 = "ike = {$ealg_id}{$ealg_kl}-{$ph1ent['hash-algorithm']}"; - else - $ealgosp1 = "ike = {$ealg_id}-{$ph1ent['hash-algorithm']}"; - - $modp = vpn_ipsec_convert_to_modp($ph1ent['dhgroup']); - if (!empty($modp)) - $ealgosp1 .= "-{$modp}"; - - if ($keyexchange == "ikev1") - $ealgosp1 .= "!"; - } + if (isset($ph2ent['mobile']) && !isset($a_client['enable'])) + continue; - if ($ph1ent['dpd_delay'] && $ph1ent['dpd_maxfail']) { - if ($passive == "start") - $dpdline = "dpdaction = restart"; - else - $dpdline = "dpdaction = clear"; - $dpdline .= "\n\tdpddelay = {$ph1ent['dpd_delay']}s"; - $dpdtimeout = $ph1ent['dpd_delay'] * ($ph1ent['dpd_maxfail'] + 1); - $dpdline .= "\n\tdpdtimeout = {$dpdtimeout}s"; - } else - $dpdline = "dpdaction = none"; - - if (!empty($ph1ent['authentication_method']) && (strpos($ph1ent['authentication_method'], "xauth") || strpos($ph1ent['authentication_method'], "hybrid"))) - $xauth = "xauth = server"; - - $ikelifeline = ''; - if ($ph1ent['lifetime']) - $ikelifeline = "ikelifetime = {$ph1ent['lifetime']}s"; - - $remoteid_spec = ''; if (($ph2ent['mode'] == 'tunnel') or ($ph2ent['mode'] == 'tunnel6')) { $tunneltype = "type = tunnel"; $localid_type = $ph2ent['localid']['type']; - $localid_data = ipsec_idinfo_to_cidr($ph2ent['localid'], false, $ph2ent['mode']); + $leftsubnet_data = ipsec_idinfo_to_cidr($ph2ent['localid'], false, $ph2ent['mode']); /* Do not print localid in some cases, such as a pure-psk or psk/xauth single phase2 mobile tunnel */ if (($localid_type == "none" || $localid_type == "mobile") - && isset($ph1ent['mobile']) - && (ipsec_get_number_of_phase2($ikeid)==1)) - $localid_spec = "%any"; - else { + && isset($ph1ent['mobile']) && (ipsec_get_number_of_phase2($ikeid)==1)) { + $left_spec = '%any'; + } else { if ($localid_type != "address") { $localid_type = "subnet"; } // Don't let an empty subnet into config, it can cause parse errors. Ticket #2201. - if (!is_ipaddr($localid_data) && !is_subnet($localid_data) && ($localid_data != "0.0.0.0/0")) { + if (!is_ipaddr($leftsubnet_data) && !is_subnet($leftsubnet_data) && ($leftsubnet_data != "0.0.0.0/0")) { log_error("Invalid IPsec Phase 2 \"{$ph2ent['descr']}\" - {$ph2ent['localid']['type']} has no subnet."); continue; } - $localid_spec = $ep; if (!empty($ph2ent['natlocalid'])) { - $natlocalid_data = ipsec_idinfo_to_cidr($ph2ent['natlocalid'], false, $ph2ent['mode']); + $natleftsubnet_data = ipsec_idinfo_to_cidr($ph2ent['natlocalid'], false, $ph2ent['mode']); if ($ph2ent['natlocalid']['type'] != "address") { - if (is_subnet($natlocalid_data)) - $localid_data = "{$natlocalid_data}|{$localid_data}"; + if (is_subnet($natleftsubnet_data)) + $leftsubnet_data = "{$natleftsubnet_data}|{$leftsubnet_data}"; } else { - if (is_ipaddr($natlocalid_data)) - $localid_data = "{$natlocalid_data}|{$localid_data}"; + if (is_ipaddr($natleftsubnet_data)) + $leftsubnet_data = "{$natleftsubnet_data}|{$leftsubnet_data}"; } $natfilterrules = true; } } + $leftsubnet_spec[] = $leftsubnet_data; + if (!isset($ph2ent['mobile'])) { - $remoteid_data = ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']); - $remoteid_spec = "\trightsubnet = {$remoteid_data}"; + $rightsubnet_spec[] = ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']); } else if (!empty($a_client['pool_address'])) - $remoteid_spec = "\trightsourceip = {$a_client['pool_address']}/{$a_client['pool_netbits']}"; + $rightsubnet_spec[] = "{$a_client['pool_address']}/{$a_client['pool_netbits']}"; } else { $tunneltype = "type = transport"; - $rgip = $ph1ent['remote-gateway']; if ((($ph1ent['authentication_method'] == "xauth_psk_server") || - ($ph1ent['authentication_method'] == "pre_shared_key")) - && isset($ph1ent['mobile'])) - $localid_spec = "%any"; - else { - $localid_data = ipsec_get_phase1_src($ph1ent); - $localid_spec = $ep; - } - if (!isset($ph2ent['mobile'])) { - $remoteid_spec = "\trightsubnet = {$rgip}"; + ($ph1ent['authentication_method'] == "pre_shared_key")) && isset($ph1ent['mobile'])) { + $left_spec = "%any"; + } else { + $leftsubnet_spec[] = ipsec_get_phase1_src($ph1ent); } - } - $authentication = ""; - switch ($ph1ent['authentication_method']) { - case 'xauth_rsa_server': - $authentication = "leftauth = pubkey\n\trightauth = pubkey"; - $authentication .= "\n\trightauth2 = xauth-generic"; - break; - case 'xauth_psk_server': - $authentication = "leftauth = psk\n\trightauth = psk"; - $authentication .= "\n\trightauth2 = xauth-generic"; - break; - case 'pre_shared_key': - $authentication = "leftauth = psk\n\trightauth = psk"; - break; - case 'rsasig': - $authentication = "leftauth = pubkey\n\trightauth = pubkey"; - break; - case 'hybrid_rsa_server': - $authentication = "leftauth = xauth-generic\n\trightauth = pubkey"; - $authentication .= "\n\trightauth2 = xauth"; - break; + + if (!isset($ph2ent['mobile'])) + $rightsubnet_spec[] = $right_spec; } if (isset($a_client['pfs_group'])) $ph2ent['pfsgroup'] = $a_client['pfs_group']; - $ealgosp2 = ''; if ($ph2ent['protocol'] == 'esp') { if (is_array($ph2ent['encryption-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) { - $ealgosp2arr = array(); foreach ($ph2ent['encryption-algorithm-option'] as $ealg) { $ealg_id = $ealg['name']; $ealg_kl = $ealg['keylen']; @@ -694,7 +694,7 @@ EOD; $modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']); if (!empty($modp)) $tmpealgo .= "-{$modp}"; - $ealgosp2arr[] = $tmpealgo; + $ealgoESPsp2arr[] = $tmpealgo; } } } @@ -705,64 +705,69 @@ EOD; $modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']); if (!empty($modp)) $tmpealgo .= "-{$modp}"; - $ealgosp2arr[] = $tmpealgo; + $ealgoESPsp2arr[] = $tmpealgo; } } } - $ealgosp2 = "esp = " . join(",", $ealgosp2arr); - unset($ealgosp2arr); - $ealgosp2 .= "!"; } } else if ($ph2ent['protocol'] == 'ah') { if (is_array($ph2ent['hash-algorithm-option'])) { - $ealgosp2 = "ah = " . join(",", $ph2ent['hash-algorithm-option']); - $ealgosp2 = str_replace('hmac_', '', $ealgosp2); $modp = vpn_ipsec_convert_to_modp($ph2ent['pfsgroup']); - if (!empty($modp)) - $ealgosp2 .= "-{$modp}"; - $ealgosp2 .= "!"; + foreach ($ph2ent['hash-algorithm-option'] as $tmpAHalgo) { + $tmpAHalgo = str_replace('hmac_', '', $tmpAHalgo); + if (!empty($modp)) + $tmpAHalgo = "-{$modp}"; + $ealgoAHsp2arr[] = $tmpAHalgo; + } } } - $ipseclifetime = ''; - if ($ph2ent['lifetime']) - $ipseclifeline = "lifetime = {$ph2ent['lifetime']}s"; + if (!empty($ph2ent['lifetime'])) { + if ($ipseclifetime == 0 || intval($ipseclifetime) > intval($ph2ent['lifetime'])) + $ipseclifetime = intval($ph2ent['lifetime']); + } + } + } - $ipsecconf .=<<<EOD + $ipsecconf .=<<<EOD -conn con{$ph1ent['ikeid']}-{$ph2ent['uniqid']} +conn con{$ph1ent['ikeid']} aggressive = {$aggressive} fragmentation = yes keyexchange = {$keyexchange} keyingtries = %forever reauth = yes - {$rekey} + rekey = yes reqid = {$ikeid} installpolicy = yes - {$ikelifeline} - {$ipseclifeline} {$tunneltype} {$dpdline} auto = {$passive} - left = {$localid_spec} - leftsubnet = {$localid_data} - right = {$rgip} + left = {$left_spec} + right = {$right_spec} leftid = {$myid_data} EOD; - if (!empty($remoteid_spec)) - $ipsecconf .= "{$remoteid_spec}\n"; - if (!empty($ealgosp1)) - $ipsecconf .= "\t{$ealgosp1}\n"; - if (!empty($ealgosp2)) - $ipsecconf .= "\t{$ealgosp2}\n"; - if (!empty($authentication)) - $ipsecconf .= "\t{$authentication}\n"; - if (!empty($peerid_spec)) - $ipsecconf .= "\trightid = {$peerid_spec}\n"; - } + if (!empty($ikelifeline)) + $ipsecconf .= "\t{$ikelifeline}\n"; + if ($ipseclifetime > 0) + $ipsecconf .= "\tlifetime = {$ipseclifetime}s\n"; + if (!empty($rightsubnet_spec)) + $ipsecconf .= "\trightsubnet = " . join(",", $rightsubnet_spec) . "\n"; + if (!empty($leftsubnet_spec)) + $ipsecconf .= "\tleftsubnet = " . join(",", $leftsubnet_spec) . "\n"; + if (!empty($ealgosp1)) + $ipsecconf .= "\t{$ealgosp1}\n"; + if (!empty($ealgoAHsp2arr)) + $ipsecconf .= "\tah = " . join(',', $ealgoAHsp2arr) . "!\n"; + if (!empty($ealgoESPsp2arr)) + $ipsecconf .= "\tesp = " . join(',', $ealgoESPsp2arr) . "!\n"; + if (!empty($authentication)) + $ipsecconf .= "\t{$authentication}\n"; + if (!empty($peerid_spec)) + $ipsecconf .= "\trightid = {$peerid_spec}\n"; } } } |
