aboutsummaryrefslogtreecommitdiffstats
path: root/config/openvpn-client-export
diff options
context:
space:
mode:
authorErmal Luçi <eri@pfsense.org>2010-03-03 00:26:38 +0000
committerErmal Luçi <eri@pfsense.org>2010-03-03 00:26:38 +0000
commit149e155a77852b5c6ab503fe509e8fb1a221ce76 (patch)
treee4521b13b3172b72dcf738d09ebe037fcf6b40f8 /config/openvpn-client-export
parent9aef7a65f6bc406c34331af2f0edbf794a4920de (diff)
downloadpfsense-packages-149e155a77852b5c6ab503fe509e8fb1a221ce76.tar.gz
pfsense-packages-149e155a77852b5c6ab503fe509e8fb1a221ce76.tar.bz2
pfsense-packages-149e155a77852b5c6ab503fe509e8fb1a221ce76.zip
Allow config to be exported when using only server authentication based only on user/pass.
Diffstat (limited to 'config/openvpn-client-export')
-rwxr-xr-xconfig/openvpn-client-export/openvpn-client-export.inc136
-rwxr-xr-xconfig/openvpn-client-export/vpn_openvpn_export.php62
2 files changed, 135 insertions, 63 deletions
diff --git a/config/openvpn-client-export/openvpn-client-export.inc b/config/openvpn-client-export/openvpn-client-export.inc
index a2a59fb0..576a2a6e 100755
--- a/config/openvpn-client-export/openvpn-client-export.inc
+++ b/config/openvpn-client-export/openvpn-client-export.inc
@@ -109,10 +109,12 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
}
// lookup user info
- $user =& $config['system']['user'][$usrid];
- if (!$user) {
- $input_errors[] = "Could not find user settings.";
- return false;
+ if ($usrid) {
+ $user =& $config['system']['user'][$usrid];
+ if (!$user) {
+ $input_errors[] = "Could not find user settings.";
+ return false;
+ }
}
// determine basic variables
@@ -141,7 +143,8 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
$conf .= "persist-key\n";
$conf .= "proto {$proto}\n";
$conf .= "cipher {$cipher}\n";
- $conf .= "tls-client\n";
+ if ($nokeys == false)
+ $conf .= "tls-client\n";
$conf .= "client\n";
$conf .= "resolv-retry infinite\n";
$conf .= "remote {$server_host} {$server_port}\n";
@@ -177,7 +180,8 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
} else {
$conf .= "pkcs12 {$prefix}.p12\n";
}
- }
+ } else if ($settings['mode'] == "server_user")
+ $conf .= "ca {$prefix}-ca.crt\n";
if($nokeys == false) {
if ($settings['tls'])
@@ -194,33 +198,48 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
}
function openvpn_client_export_installer($srvid, $usrid, $crtid, $useaddr, $usetoken, $outpass, $proxy) {
- global $config, $g;
+ global $config, $g, $input_errors;
$ovpndir = "/usr/local/share/openvpn";
$workdir = "{$ovpndir}/client-export";
// lookup server settings
$settings = $config['openvpn']['openvpn-server'][$srvid];
- if (empty($settings))
+ if (empty($settings)) {
+ $input_errors[] = "Could not find a valid server config for id: {$srvid}";
return false;
- if ($settings['disable'])
+ }
+ if ($settings['disable']) {
+ $input_errors[] = "This server is disabled.";
return false;
+ }
+
+ $nokeys = false;
// lookup server certificate info
$server_cert =& lookup_cert($settings['certref']);
$server_ca =& lookup_ca($server_cert['caref']);
- if (!$server_cert || !$server_ca)
+ if (!$server_cert || !$server_ca) {
+ $input_errors[] = "Could not find a valid certificate.";
return false;
+ }
// lookup user info
- $user =& $config['system']['user'][$usrid];
- if (!$user)
- return false;
+ if ($usrid) {
+ $user =& $config['system']['user'][$usrid];
+ if (!$user) {
+ $input_errors[] = "Could not find the details about userid: {$usrid}";
+ return false;
+ }
+ }
// lookup user certificate info
- $cert =& $user['cert'][$crtid];
- if (!$cert)
- return false;
+ if ($settings['mode'] != "server_user") {
+ $cert =& $user['cert'][$crtid];
+ if (!$cert)
+ return false;
+ } else
+ $nokeys = true;
// create template directory
$tempdir = $g['tmp_path'] . "/openvpn-export-".uniqid();
@@ -243,31 +262,35 @@ function openvpn_client_export_installer($srvid, $usrid, $crtid, $useaddr, $uset
$pwdfle .= "{$proxy['password']}\n";
file_put_contents("{$confdir}/{$proxy['passwdfile']}", $pwdfle);
}
- $conf = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, false, $proxy);
- if (!$conf)
+ $conf = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, $nokeys, $proxy);
+ if (!$conf) {
+ $input_errors[] = "Could not create a config to export.";
return false;
+ }
file_put_contents($cfgfile, $conf);
- // write key files
$cafile = "{$tempdir}/config/{$prefix}-ca.crt";
file_put_contents($cafile, base64_decode($server_ca['crt']));
- $crtfile = "{$tempdir}/config/{$prefix}-{$user['name']}.crt";
- file_put_contents($crtfile, base64_decode($cert['crt']));
- $keyfile = "{$tempdir}/config/{$prefix}-{$user['name']}.key";
- file_put_contents($keyfile, base64_decode($cert['prv']));
- if ($settings['tls']) {
- $tlsfile = "{$tempdir}/config/{$prefix}-tls.key";
- file_put_contents($tlsfile, base64_decode($settings['tls']));
+ // write key files
+ if ($settings['mode'] != "server_user") {
+ $crtfile = "{$tempdir}/config/{$prefix}-{$user['name']}.crt";
+ file_put_contents($crtfile, base64_decode($cert['crt']));
+ $keyfile = "{$tempdir}/config/{$prefix}-{$user['name']}.key";
+ file_put_contents($keyfile, base64_decode($cert['prv']));
+ if ($settings['tls']) {
+ $tlsfile = "{$tempdir}/config/{$prefix}-tls.key";
+ file_put_contents($tlsfile, base64_decode($settings['tls']));
+ }
+
+ // convert to pkcs12 format
+ $p12file = "{$tempdir}/config/{$prefix}.p12";
+ if ($usetoken)
+ openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile);
+ else
+ openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile, $cafile);
}
- // convert to pkcs12 format
- $p12file = "{$tempdir}/config/{$prefix}.p12";
- if ($usetoken)
- openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile);
- else
- openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile, $cafile);
-
// 7zip the configuration data
chdir($tempdir);
$files = "config ";
@@ -278,6 +301,7 @@ function openvpn_client_export_installer($srvid, $usrid, $crtid, $useaddr, $uset
$files .= "procchain-import";
else
$files .= "procchain-standard";
+
exec("/usr/local/libexec/p7zip/7z -y a archive.7z {$files}");
// create the final installer
@@ -316,14 +340,18 @@ function viscosity_openvpn_client_config_exporter($srvid, $usrid, $crtid, $usead
return false;
// lookup user info
- $user =& $config['system']['user'][$usrid];
- if (!$user)
- return false;
+ if ($usrid) {
+ $user =& $config['system']['user'][$usrid];
+ if (!$user)
+ return false;
+ }
// lookup user certificate info
- $cert =& $user['cert'][$crtid];
- if (!$cert)
- return false;
+ if ($settings['mode'] != "server_user") {
+ $cert =& $user['cert'][$crtid];
+ if (!$cert)
+ return false;
+ }
// create template directory
mkdir($tempdir, 0700, true);
@@ -357,12 +385,15 @@ function viscosity_openvpn_client_config_exporter($srvid, $usrid, $crtid, $usead
EOF;
$configfile = "{$tempdir}/config.conf";
- $conf .= <<<EOF
+ $conf .= "ca ca.crt\n";
+ if ($settings['mode'] != "server_user") {
+ $conf .= <<<EOF
cert cert.crt
tls-auth ta.key 1
-ca ca.crt
key key.key
EOF;
+ }
+
file_put_contents($configfile, $visc_settings . "\n" . $conf);
// ca.crt cert.crt config.conf key.key ta.key
@@ -371,18 +402,21 @@ EOF;
$cafile = "{$tempdir}/ca.crt";
file_put_contents($cafile, base64_decode($server_ca['crt']));
- // write user .crt
- $crtfile = "{$tempdir}/cert.crt";
- file_put_contents($crtfile, base64_decode($cert['crt']));
+ if ($settings['mode'] != "server_user") {
- // write user .key
- $keyfile = "{$tempdir}/key.key";
- file_put_contents($keyfile, base64_decode($cert['prv']));
+ // write user .crt
+ $crtfile = "{$tempdir}/cert.crt";
+ file_put_contents($crtfile, base64_decode($cert['crt']));
- // TLS support?
- if ($settings['tls']) {
- $tlsfile = "{$tempdir}/ta.key";
- file_put_contents($tlsfile, base64_decode($settings['tls']));
+ // write user .key
+ $keyfile = "{$tempdir}/key.key";
+ file_put_contents($keyfile, base64_decode($cert['prv']));
+
+ // TLS support?
+ if ($settings['tls']) {
+ $tlsfile = "{$tempdir}/ta.key";
+ file_put_contents($tlsfile, base64_decode($settings['tls']));
+ }
}
// Zip Viscosity file
diff --git a/config/openvpn-client-export/vpn_openvpn_export.php b/config/openvpn-client-export/vpn_openvpn_export.php
index 042b2a9f..05d108a6 100755
--- a/config/openvpn-client-export/vpn_openvpn_export.php
+++ b/config/openvpn-client-export/vpn_openvpn_export.php
@@ -77,6 +77,7 @@ foreach($a_server as $sindex => & $server) {
$ras_serverent['index'] = $sindex;
$ras_serverent['name'] = $name;
$ras_serverent['users'] = $ras_user;
+ $ras_serverent['mode'] = $server['mode'];
$ras_server[] = $ras_serverent;
}
@@ -93,10 +94,20 @@ if($act == "conf") {
$srvid = $_GET['srvid'];
$usrid = $_GET['usrid'];
$crtid = $_GET['crtid'];
- if (($srvid === false) || ($usrid === false) || ($crtid === false)) {
+ if ($srvid === false) {
+ pfSenseHeader("vpn_openvpn_export.php");
+ exit;
+ } else if (($config['openvpn']['openvpn-server'][$srvid]['mode'] != "server_user") &&
+ (($usrid === false) || ($crtid === false))) {
pfSenseHeader("vpn_openvpn_export.php");
exit;
}
+
+ if ($config['openvpn']['openvpn-server'][$srvid]['mode'] == "server_user")
+ $nokeys = true;
+ else
+ $nokeys = false;
+
if (empty($_GET['useaddr'])) {
$error = true;
$input_errors[] = "You need to specify an IP or hostname.";
@@ -134,7 +145,7 @@ if($act == "conf") {
}
$exp_name = openvpn_client_export_prefix($srvid);
- $exp_data = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, false, $proxy);
+ $exp_data = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, $nokeys, $proxy);
if (!$exp_data) {
$input_errors[] = "Failed to export config files!";
$error = true;
@@ -156,10 +167,14 @@ if($act == "visc") {
$srvid = $_GET['srvid'];
$usrid = $_GET['usrid'];
$crtid = $_GET['crtid'];
- if (($srvid === false) || ($usrid === false) || ($crtid === false)) {
- pfSenseHeader("vpn_openvpn_export.php");
- exit;
- }
+ if ($srvid === false) {
+ pfSenseHeader("vpn_openvpn_export.php");
+ exit;
+ } else if (($config['openvpn']['openvpn-server'][$srvid]['mode'] != "server_user") &&
+ (($usrid === false) || ($crtid === false))) {
+ pfSenseHeader("vpn_openvpn_export.php");
+ exit;
+ }
if (empty($_GET['useaddr'])) {
$error = true;
$input_errors[] = "You need to specify an IP or hostname.";
@@ -222,10 +237,14 @@ if($act == "inst") {
$srvid = $_GET['srvid'];
$usrid = $_GET['usrid'];
$crtid = $_GET['crtid'];
- if (($srvid === false) || ($usrid === false) || ($crtid === false)) {
- pfSenseHeader("vpn_openvpn_export.php");
- exit;
- }
+ if ($srvid === false) {
+ pfSenseHeader("vpn_openvpn_export.php");
+ exit;
+ } else if (($config['openvpn']['openvpn-server'][$srvid]['mode'] != "server_user") &&
+ (($usrid === false) || ($crtid === false))) {
+ pfSenseHeader("vpn_openvpn_export.php");
+ exit;
+ }
if (empty($_GET['useaddr'])) {
$error = true;
$input_errors[] = "You need to specify an IP or hostname.";
@@ -299,6 +318,7 @@ var servers = new Array();
servers[<?=$sindex;?>] = new Array();
servers[<?=$sindex;?>][0] = '<?=$server['index'];?>';
servers[<?=$sindex;?>][1] = new Array();
+servers[<?=$sindex;?>][2] = '<?=$server['mode'];?>';;
<?php foreach ($server['users'] as $uindex => & $user): ?>
servers[<?=$sindex;?>][1][<?=$uindex;?>] = new Array();
servers[<?=$sindex;?>][1][<?=$uindex;?>][0] = '<?=$user['uindex'];?>';
@@ -382,8 +402,10 @@ function download_begin(act, i) {
var dlurl;
dlurl = "/vpn_openvpn_export.php?act=" + act;
dlurl += "&srvid=" + servers[index][0];
- dlurl += "&usrid=" + users[i][0];
- dlurl += "&crtid=" + users[i][1];
+ if (users[i]) {
+ dlurl += "&usrid=" + users[i][0];
+ dlurl += "&crtid=" + users[i][1];
+ }
dlurl += "&useaddr=" + useaddr;
dlurl += "&usetoken=" + usetoken;
if (usepass)
@@ -425,6 +447,22 @@ function server_changed() {
cell2.innerHTML += "&nbsp;/&nbsp;";
cell2.innerHTML += "<a href='javascript:download_begin(\"visc\"," + i + ")'>Viscosity Bundle</a>";
}
+ if (servers[index][2] == 'server_user') {
+ var row = table.insertRow(table.rows.length);
+ var cell0 = row.insertCell(0);
+ var cell1 = row.insertCell(1);
+ var cell2 = row.insertCell(2);
+ cell0.className = "listlr";
+ cell0.innerHTML = "External authentication users";
+ cell1.className = "listr";
+ cell1.innerHTML = "none";
+ cell2.className = "listr";
+ cell2.innerHTML = "<a href='javascript:download_begin(\"conf\"," + i + ")'>Configuration</a>";
+ cell2.innerHTML += "&nbsp;/&nbsp;";
+ cell2.innerHTML += "<a href='javascript:download_begin(\"inst\"," + i + ")'>Windows Installer</a>";
+ cell2.innerHTML += "&nbsp;/&nbsp;";
+ cell2.innerHTML += "<a href='javascript:download_begin(\"visc\"," + i + ")'>Viscosity Bundle</a>";
+ }
}
function useaddr_changed(obj) {