. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* pfSense_BUILDER_BINARIES: /usr/bin/killall /usr/local/sbin/sasyncd /sbin/ifconfig /sbin/sysctl pfSense_BUILDER_BINARIES: /usr/local/sbin/setkey /sbin/route /bin/mkdir pfSense_BUILDER_BINARIES: /usr/local/sbin/racoonctl /usr/local/sbin/racoon pfSense_BUILDER_BINARIES: /usr/local/sbin/filterdns /usr/local/sbin/mpd4 pfSense_MODULE: vpn */ require_once("ipsec.inc"); /* include all configuration functions */ function vpn_ipsec_failover_configure() { global $config, $g; if (is_array($config['installedpackages']['sasyncd'])) { $sasyncd_text = ""; foreach ($config['installedpackages']['sasyncd']['config'] as $sasyncd) { $enabled = isset ($sasyncd['enable']); if (!$enabled) return; if ($sasyncd['peerip'] <> "") $sasyncd_text .= "peer {$sasyncd['peerip']}\n"; if ($sasyncd['interface']) $sasyncd_text .= "carp interface {$sasyncd['interface']}\n"; if ($sasyncd['sharedkey'] <> "") $sasyncd_text .= "sharedkey {$sasyncd['sharedkey']}\n"; if ($sasyncd['mode'] <> "") $sasyncd_text .= "mode {$sasyncd['mode']}\n"; if ($sasyncd['listenon'] <> "") $sasyncd_text .= "listen on {$sasyncd['listenon']}\n"; if ($sasyncd['flushmodesync'] <> "") $sasyncd_text .= "flushmode sync {$sasyncd['flushmodesync']}\n"; } file_put_contents("{$g['varetc_path']}/sasyncd.conf", $sasyncd_text); chmod("{$g['varetc_path']}/sasyncd.conf", 0600); if(is_process_running("sasyncd")) mwexec("killall sasyncd", true); /* launch sasyncd, oh wise one */ mwexec_bg("/usr/local/sbin/sasyncd -d -v -v -v"); } } function vpn_ipsec_configure($ipchg = false) { global $config, $g, $sa, $sn, $p1_ealgos, $p2_ealgos; if ($g['platform'] == 'jail') return; /* get the automatic ping_hosts.sh ready */ unlink_if_exists("{$g['vardb_path']}/ipsecpinghosts"); touch("{$g['vardb_path']}/ipsecpinghosts"); vpn_ipsec_configure_preferoldsa(); $syscfg = $config['system']; $ipseccfg = $config['ipsec']; $a_phase1 = $config['ipsec']['phase1']; $a_phase2 = $config['ipsec']['phase2']; $a_client = $config['ipsec']['client']; if (!isset($ipseccfg['enable'])) { /* try to stop racoon*/ killbypid("{$g['varrun_path']}/racoon.pid"); /* Stop dynamic monitoring */ killbypid("{$g['varrun_path']}/filterdns-ipsec.pid"); /* kill racoon forcefully */ if (is_process_running("racoon")) mwexec("/usr/bin/killall -9 racoon", true); /* wait for racoon process to die */ sleep(2); /* flush SPD and SAD */ mwexec("/usr/local/sbin/setkey -F"); mwexec("/usr/local/sbin/setkey -FP"); /* disallow IPSEC, it is off */ mwexec("/sbin/ifconfig enc0 down"); exec("/sbin/sysctl net.inet.ip.ipsec_in_use=0"); return 0; } else { mwexec("/sbin/ifconfig enc0 up"); mwexec("/sbin/sysctl net.inet.ip.ipsec_in_use=1"); /* needed for racoonctl admin socket */ if (!is_dir("/var/db/racoon")) mkdir("/var/db/racoon/"); /* needed for config files */ if (!is_dir("{$g['varetc_path']}/ipsec")) mkdir("{$g['varetc_path']}/ipsec"); if ($g['booting']) echo gettext("Configuring IPsec VPN... "); /* fastforwarding is not compatible with ipsec tunnels */ mwexec("/sbin/sysctl net.inet.ip.fastforwarding=0"); /* resolve all local, peer addresses and setup pings */ $ipmap = array(); $rgmap = array(); $filterdns_list = array(); unset($iflist); if (is_array($a_phase1) && count($a_phase1)) { $ipsecpinghosts = ""; /* step through each phase1 entry */ foreach ($a_phase1 as $ph1ent) { if (isset($ph1ent['disabled'])) continue; $ep = ipsec_get_phase1_src($ph1ent); if (!is_ipaddr($ep)) continue; if(!in_array($ep,$ipmap)) $ipmap[] = $ep; /* see if this tunnel has a hostname for the remote-gateway. If so, try to resolve it now and add it to the list for filterdns */ if (isset ($ph1ent['mobile'])) continue; $rg = $ph1ent['remote-gateway']; if (!is_ipaddr($rg)) { $filterdns_list[] = "{$rg}"; add_hostname_to_watch($rg); if(! $g['booting']) $rg = resolve_retry($rg); if (!is_ipaddr($rg)) continue; } if(array_search($rg, $rgmap)) { log_error("The remote gateway {$rg} already exists on another phase 1 entry"); continue; } $rgmap[$ph1ent['remote-gateway']] = $rg; if (is_array($a_phase2)) { /* step through each phase2 entry */ foreach ($a_phase2 as $ph2ent) { $ikeid = $ph2ent['ikeid']; if (isset($ph2ent['disabled'])) continue; if ($ikeid != $ph1ent['ikeid']) continue; /* add an ipsec pinghosts entry */ if ($ph2ent['pinghost']) { if (!is_array($iflist)) $iflist = get_configured_interface_list(); foreach ($iflist as $ifent => $ifname) { if(is_ipaddrv6($ph2ent['pinghost'])) { $interface_ip = get_interface_ipv6($ifent); if(!is_ipaddrv6($interface_ip)) continue; $local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true, $ph2ent['mode']); if (ip_in_subnet($interface_ip, $local_subnet)) { $srcip = $interface_ip; break; } } else { $interface_ip = get_interface_ip($ifent); if(!is_ipaddrv4($interface_ip)) continue; $local_subnet = ipsec_idinfo_to_cidr($ph2ent['localid'], true, $ph2ent['mode']); if ($local_subnet == "0.0.0.0/0" || ip_in_subnet($interface_ip, $local_subnet)) { $srcip = $interface_ip; break; } } } $dstip = $ph2ent['pinghost']; if(is_ipaddrv6($dstip)) { $family = "inet6"; } else { $family = "inet"; } if (is_ipaddr($srcip)) $ipsecpinghosts[] = "{$srcip}|{$dstip}|3|||||{$family}|\n"; } } } } @file_put_contents("{$g['vardb_path']}/ipsecpinghosts", $ipsecpinghosts); unset($ipsecpinghosts); } /* generate CA certificates files */ if (is_array($config['ca']) && count($config['ca'])) { foreach ($config['ca'] as $ca) { if (!isset($ca['crt'])) { log_error(sprintf(gettext("Error: Invalid certificate info for %s"), $ca['descr'])); continue; } $cert = base64_decode($ca['crt']); $x509cert = openssl_x509_parse(openssl_x509_read($cert)); if (!is_array($x509cert) || !isset($x509cert['hash'])) { log_error(sprintf(gettext("Error: Invalid certificate hash info for %s"), $ca['descr'])); continue; } $fname = "{$g['varetc_path']}/ipsec/{$x509cert['hash']}.0"; if (!@file_put_contents($fname, $cert)) { log_error(sprintf(gettext("Error: Cannot write IPsec CA file for %s"), $ca['descr'])); continue; } unset($cert); } } $pskconf = ""; if (is_array($a_phase1) && count($a_phase1)) { foreach ($a_phase1 as $ph1ent) { if (isset($ph1ent['disabled'])) continue; if (strstr($ph1ent['authentication_method'],'rsa')) continue; $peerid_type = $ph1ent['peerid_type']; switch ($peerid_type) { case "peeraddress": $peerid_type = "address"; $peerid_data = $rgmap[$ph1ent['remote-gateway']]; break; case "address"; $peerid_data = $ph1ent['peerid_data']; break; case "fqdn"; case "keyid tag"; case "user_fqdn"; $peerid_data = $ph1ent['peerid_data']; break; } if (!empty($peerid_data) && !empty($ph1ent['pre-shared-key'])) $pskconf .= trim($peerid_data) . "\t" . trim($ph1ent['pre-shared-key']) . "\n"; } } /* Add user PSKs */ foreach ($config['system']['user'] as $user) { if (!empty($user['ipsecpsk'])) { $pskconf .= "{$user['name']}\t{$user['ipsecpsk']}\n"; } } /* add PSKs for mobile clients */ if (is_array($ipseccfg['mobilekey'])) { foreach ($ipseccfg['mobilekey'] as $key) { $pskconf .= "{$key['ident']}\t{$key['pre-shared-key']}\n"; } } @file_put_contents("{$g['varetc_path']}/ipsec/psk.txt", $pskconf); chmod("{$g['varetc_path']}/ipsec/psk.txt", 0600); unset($pskconf); /* begin racoon.conf */ $racoonconf = ""; if ((is_array($a_phase1) && count($a_phase1)) || (is_array($a_phase2) && count($a_phase2))) { $racoonconf .= "# This file is automatically generated. Do not edit\n"; $racoonconf .= "path pre_shared_key \"{$g['varetc_path']}/ipsec/psk.txt\";\n\n"; $racoonconf .= "path certificate \"{$g['varetc_path']}/ipsec\";\n\n"; /* begin listen section */ if (count($ipmap)) { $racoonconf .= "\nlisten\n"; $racoonconf .= "{\n"; $racoonconf .= " adminsock \"/var/db/racoon/racoon.sock\" \"root\" \"wheel\" 0660;\n"; foreach ($ipmap as $addr) { $racoonconf .= "\tisakmp {$addr} [500];\n"; $racoonconf .= "\tisakmp_natt {$addr} [4500];\n"; } $racoonconf .= "}\n\n"; } /* begin mode_cfg section */ if (is_array($a_client) && isset($a_client['enable'])) { $racoonconf .= "\nmode_cfg\n"; $racoonconf .= "{\n"; if (!empty($a_client['user_source'])) $racoonconf .= "\tauth_source external;\n"; if (!empty($a_client['group_source']) && $a_client['group_source'] != "none") $racoonconf .= "\tgroup_source {$a_client['group_source']};\n"; if ($a_client['pool_address'] && $a_client['pool_netbits']) { $pool_address = $a_client['pool_address']; $pool_netmask = gen_subnet_mask($a_client['pool_netbits']); $pool_address = long2ip32(ip2long($pool_address)+1); $pool_size = (~ip2long($pool_netmask) & 0xFFFFFFFF) - 2; $racoonconf .= "\tpool_size {$pool_size};\n"; $racoonconf .= "\tnetwork4 {$pool_address};\n"; $racoonconf .= "\tnetmask4 {$pool_netmask};\n"; } if (isset($a_client['net_list'])) { $net_list = ''; foreach ($a_phase2 as $ph2ent) { if (isset($ph2ent['disabled'])) continue; if (!isset($ph2ent['mobile'])) continue; $localid = ipsec_idinfo_to_cidr($ph2ent['localid'], true, $ph2ent['mode']); if ($net_list) $net_list .= ", "; $net_list .= $localid; } if ($net_list) $racoonconf .= "\tsplit_network include {$net_list};\n"; } if ($a_client['dns_server1']) $racoonconf .= "\tdns4 {$a_client['dns_server1']};\n"; if ($a_client['dns_server2']) $racoonconf .= "\tdns4 {$a_client['dns_server2']};\n"; if ($a_client['dns_server3']) $racoonconf .= "\tdns4 {$a_client['dns_server3']};\n"; if ($a_client['dns_server4']) $racoonconf .= "\tdns4 {$a_client['dns_server4']};\n"; if ($a_client['wins_server1']) $racoonconf .= "\twins4 {$a_client['wins_server1']};\n"; if ($a_client['wins_server2']) $racoonconf .= "\twins4 {$a_client['wins_server2']};\n"; if ($a_client['dns_domain']) { $racoonconf .= "\tdefault_domain \"{$a_client['dns_domain']}\";\n"; if (empty($a_client['dns_split'])) $racoonconf .= "\tsplit_dns \"{$a_client['dns_domain']}\";\n"; } if ($a_client['dns_split']) { $domain_array = preg_split("/[ ,]+/",$a_client['dns_split']); $domain_string = implode('", "', $domain_array); $racoonconf .= "\tsplit_dns \"{$domain_string}\";\n"; } if ($a_client['pfs_group']) $racoonconf .= "\tpfs_group {$a_client['pfs_group']};\n"; if ($a_client['login_banner']) { @file_put_contents("{$g['varetc_path']}/ipsec/racoon.motd", $a_client['login_banner']); $racoonconf .= "\tbanner \"{$g['varetc_path']}/ipsec/racoon.motd\";\n"; } if (isset($a_client['save_passwd'])) $racoonconf .= "\tsave_passwd on;\n"; $racoonconf .= "}\n\n"; } /* end mode_cfg section */ if ($a_client['user_source'] != "none") { $authcfgs = explode(",", $a_client['user_source']); $sed = "\$authmodes=array("; $firstsed = 0; foreach ($authcfgs as $authcfg) { if ($authcfg == "system") $authcfg = "Local Database"; if ($firstsed > 0) $sed .= ","; $firstsed = 1; $sed .= "\"{$authcfg}\""; } $sed .= ");\\\n"; if ($a_client['strictusercn']) $sed .= "\$strictusercn = true;"; mwexec("/bin/cat /etc/inc/ipsec.auth-user.php | /usr/bin/sed 's/\/\/