-
Notifications
You must be signed in to change notification settings - Fork 787
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
VPN: IPsec: Mobile Clients - move charon attributes to "Advanced sett…
…ings" for #8349 Rename previous "advanced settings" to "mobile & advanced settings" to guide people into the right direction, strongswan.conf contains both sets of data. Keep legacy page for settings that are only relevant for the old components. Since our pam authenticator hooks into the configuration, refactor to use the model as well. Cleanup code in the model that was only used in the legacy glue.
- Loading branch information
1 parent
81ec980
commit 8c04662
Showing
10 changed files
with
418 additions
and
482 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| <?php | ||
|
|
||
| /* | ||
| * Copyright (C) 2016-2023 Deciso B.V. | ||
| * Copyright (C) 2016-2025 Deciso B.V. | ||
| * Copyright (C) 2019 Pascal Mathis <[email protected]> | ||
| * Copyright (C) 2008 Shrew Soft Inc. <[email protected]> | ||
| * Copyright (C) 2008 Ermal Luçi | ||
|
|
@@ -925,6 +925,8 @@ function ipsec_write_strongswan_conf() | |
|
|
||
| $strongswanTree = (new \OPNsense\IPsec\IPsec())->strongswanTree(); | ||
|
|
||
| /* legacy overwrites for strongswan.conf */ | ||
|
|
||
| foreach ($a_phase1 as $ph1ent) { | ||
| if (isset($ph1ent['disabled'])) { | ||
| continue; | ||
|
|
@@ -936,18 +938,10 @@ function ipsec_write_strongswan_conf() | |
| } | ||
| } | ||
|
|
||
| $strongswanTree['charon']['install_routes'] = 'no'; | ||
| if (isset($a_client['enable']) && isset($a_client['net_list'])) { | ||
| $strongswanTree['charon']['cisco_unity'] = 'yes'; | ||
| } | ||
|
|
||
| $strongswanTree['charon']['plugins'] = []; | ||
|
|
||
| $radius_auth_servers = null; | ||
| $disable_xauth = false; | ||
| if (isset($a_client['enable'])) { | ||
| if (isset($a_client['enable']) && empty($strongswanTree['charon']['plugins']['attr']['subnet'])) { | ||
| /* legacy subnet collection, can only be used when not offered manually */ | ||
| $net_list = []; | ||
| if (isset($a_client['net_list'])) { | ||
| if ($strongswanTree['charon']['cisco_unity'] == 'yes') { | ||
| foreach ($a_phase1 as $ph1ent) { | ||
| if (isset($ph1ent['disabled']) || !isset($ph1ent['mobile'])) { | ||
| continue; | ||
|
|
@@ -960,123 +954,21 @@ function ipsec_write_strongswan_conf() | |
| } | ||
| } | ||
|
|
||
| $strongswanTree['charon']['plugins']['attr'] = []; | ||
| if (!isset($strongswanTree['charon']['plugins']['attr'])) { | ||
| $strongswanTree['charon']['plugins']['attr'] = []; | ||
| } | ||
| if (!empty($net_list)) { | ||
| $net_list_str = implode(",", $net_list); | ||
| $strongswanTree['charon']['plugins']['attr']['subnet'] = $net_list_str; | ||
| $strongswanTree['charon']['plugins']['attr']['split-include'] = $net_list_str; | ||
| } | ||
| $cfgservers = []; | ||
| foreach (array('dns_server1', 'dns_server2', 'dns_server3', 'dns_server4') as $dns_server) { | ||
| if (!empty($a_client[$dns_server])) { | ||
| $cfgservers[] = $a_client[$dns_server]; | ||
| } | ||
| } | ||
| if (!empty($cfgservers)) { | ||
| $strongswanTree['charon']['plugins']['attr']['dns'] = implode(",", $cfgservers); | ||
| } | ||
| $cfgservers = []; | ||
| if (!empty($a_client['wins_server1'])) { | ||
| $cfgservers[] = $a_client['wins_server1']; | ||
| } | ||
| if (!empty($a_client['wins_server2'])) { | ||
| $cfgservers[] = $a_client['wins_server2']; | ||
| } | ||
| if (!empty($cfgservers)) { | ||
| $strongswanTree['charon']['plugins']['attr']['nbns'] = implode(",", $cfgservers); | ||
| } | ||
|
|
||
| if (!empty($a_client['dns_domain'])) { | ||
| $strongswanTree['charon']['plugins']['attr']['# Search domain and default domain'] = ''; | ||
| $strongswanTree['charon']['plugins']['attr']['28674'] = $a_client['dns_domain']; | ||
| } | ||
|
|
||
| /* | ||
| * 28675 --> UNITY_SPLITDNS_NAME | ||
| * 25 --> INTERNAL_DNS_DOMAIN | ||
| */ | ||
| foreach (array("28675", "25") as $attr) { | ||
| if (!empty($a_client['dns_split'])) { | ||
| $strongswanTree['charon']['plugins']['attr'][$attr] = $a_client['dns_split']; | ||
| } elseif (!empty($a_client['dns_domain'])) { | ||
| $strongswanTree['charon']['plugins']['attr'][$attr] = $a_client['dns_domain']; | ||
| } | ||
| } | ||
|
|
||
| if (!empty($a_client['dns_split'])) { | ||
| $strongswanTree['charon']['plugins']['attr']['28675'] = $a_client['dns_split']; | ||
| } | ||
|
|
||
| if (!empty($a_client['login_banner'])) { | ||
| /* defang login banner, it may be multiple lines and we should not let it escape */ | ||
| $strongswanTree['charon']['plugins']['attr']['28672'] = '"' . str_replace(['\\', '"'], '', $a_client['login_banner']) . '"'; | ||
| } | ||
|
|
||
| if (isset($a_client['save_passwd'])) { | ||
| $strongswanTree['charon']['plugins']['attr']['28673'] = 1; | ||
| } | ||
|
|
||
| if (!empty($a_client['pfs_group'])) { | ||
| $strongswanTree['charon']['plugins']['attr']['28679'] = $a_client['pfs_group']; | ||
| } | ||
|
|
||
| foreach ($a_phase1 as $ph1ent) { | ||
| if (!isset($ph1ent['disabled']) && isset($ph1ent['mobile'])) { | ||
| if ($ph1ent['authentication_method'] == "eap-radius") { | ||
| $radius_auth_servers = $ph1ent['authservers']; | ||
| break; // there can only be one mobile phase1, exit loop | ||
| } | ||
| } | ||
| } | ||
| } | ||
| if (empty($radius_auth_servers) && !empty($a_client['radius_source'])) { | ||
| $radius_auth_servers = $a_client['radius_source']; | ||
| } | ||
| $mdl = new \OPNsense\IPsec\Swanctl(); | ||
| if ((isset($a_client['enable']) || $mdl->isEnabled()) && !empty($radius_auth_servers)) { | ||
| $disable_xauth = true; // disable Xauth when radius is used. | ||
| $strongswanTree['charon']['plugins']['eap-radius'] = []; | ||
| $strongswanTree['charon']['plugins']['eap-radius']['servers'] = []; | ||
| $radius_server_num = 1; | ||
| $radius_accounting_enabled = false; | ||
|
|
||
| foreach (auth_get_authserver_list() as $auth_server) { | ||
| if (in_array($auth_server['name'], explode(',', $radius_auth_servers))) { | ||
| $server = [ | ||
| 'address' => $auth_server['host'], | ||
| 'secret' => '"' . $auth_server['radius_secret'] . '"', | ||
| 'auth_port' => $auth_server['radius_auth_port'], | ||
| ]; | ||
|
|
||
| if (!empty($auth_server['radius_acct_port'])) { | ||
| $server['acct_port'] = $auth_server['radius_acct_port']; | ||
| } | ||
| $strongswanTree['charon']['plugins']['eap-radius']['servers']['server' . $radius_server_num] = $server; | ||
|
|
||
| if (!empty($auth_server['radius_acct_port'])) { | ||
| $radius_accounting_enabled = true; | ||
| } | ||
| $radius_server_num += 1; | ||
| } | ||
| } | ||
| if ($radius_accounting_enabled) { | ||
| $strongswanTree['charon']['plugins']['eap-radius']['accounting'] = 'yes'; | ||
| } | ||
| if ($mdl->radiusUsesGroups()) { | ||
| $strongswanTree['charon']['plugins']['eap-radius']['class_group'] = 'yes'; | ||
| } | ||
| } | ||
| if ((isset($a_client['enable']) && !$disable_xauth) || (new \OPNsense\IPsec\Swanctl())->isEnabled()) { | ||
| $strongswanTree['charon']['plugins']['xauth-pam'] = [ | ||
| 'pam_service' => 'ipsec', | ||
| 'session' => 'no', | ||
| 'trim_email' => 'yes' | ||
| ]; | ||
| } | ||
|
|
||
| $strongswan = generate_strongswan_conf($strongswanTree); | ||
| $strongswan .= "\ninclude strongswan.opnsense.d/*.conf\n"; | ||
| @file_put_contents("/usr/local/etc/strongswan.conf", $strongswan); | ||
| /* flush to disk */ | ||
| @file_put_contents( | ||
| "/usr/local/etc/strongswan.conf", | ||
| sprintf("%s\ninclude strongswan.opnsense.d/*.conf\n", generate_strongswan_conf($strongswanTree)) | ||
| ); | ||
| } | ||
|
|
||
| /** | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.