From 149e155a77852b5c6ab503fe509e8fb1a221ce76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ermal=20Lu=E7i?= <eri@pfsense.org>
Date: Wed, 3 Mar 2010 00:26:38 +0000
Subject: Allow config to be exported when using only server authentication
 based only on user/pass.

---
 .../openvpn-client-export.inc                      | 136 +++++++++++++--------
 .../openvpn-client-export/vpn_openvpn_export.php   |  62 ++++++++--
 2 files changed, 135 insertions(+), 63 deletions(-)

diff --git a/config/openvpn-client-export/openvpn-client-export.inc b/config/openvpn-client-export/openvpn-client-export.inc
index a2a59fb0..576a2a6e 100755
--- a/config/openvpn-client-export/openvpn-client-export.inc
+++ b/config/openvpn-client-export/openvpn-client-export.inc
@@ -109,10 +109,12 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
 	}
 
 	// lookup user info
-	$user =& $config['system']['user'][$usrid];
-	if (!$user) {
-		$input_errors[] = "Could not find user settings.";
-		return false;
+	if ($usrid) {
+		$user =& $config['system']['user'][$usrid];
+		if (!$user) {
+			$input_errors[] = "Could not find user settings.";
+			return false;
+		}
 	}
 
 	// determine basic variables
@@ -141,7 +143,8 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
 	$conf .= "persist-key\n";
 	$conf .= "proto {$proto}\n";
 	$conf .= "cipher {$cipher}\n";
-	$conf .= "tls-client\n";
+	if ($nokeys == false)
+		$conf .= "tls-client\n";
 	$conf .= "client\n";
 	$conf .= "resolv-retry infinite\n";
 	$conf .= "remote {$server_host} {$server_port}\n";
@@ -177,7 +180,8 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
 		} else {
 			$conf .= "pkcs12 {$prefix}.p12\n";
 		}
-	}
+	} else if ($settings['mode'] == "server_user")
+		$conf .= "ca {$prefix}-ca.crt\n";
 
 	if($nokeys == false) {
 		if ($settings['tls'])
@@ -194,33 +198,48 @@ function openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoke
 }
 
 function openvpn_client_export_installer($srvid, $usrid, $crtid, $useaddr, $usetoken, $outpass, $proxy) {
-	global $config, $g;
+	global $config, $g, $input_errors;
 
 	$ovpndir = "/usr/local/share/openvpn";
 	$workdir = "{$ovpndir}/client-export";
 
 	// lookup server settings
 	$settings = $config['openvpn']['openvpn-server'][$srvid];
-	if (empty($settings))
+	if (empty($settings)) {
+		$input_errors[] = "Could not find a valid server config  for id: {$srvid}";
 		return false;
-	if ($settings['disable'])
+	}
+	if ($settings['disable']) {
+		$input_errors[] = "This server is disabled.";
 		return false;
+	}
+
+	$nokeys = false;
 
 	// lookup server certificate info
 	$server_cert =& lookup_cert($settings['certref']);
 	$server_ca =& lookup_ca($server_cert['caref']);
-	if (!$server_cert || !$server_ca)
+	if (!$server_cert || !$server_ca) {
+		$input_errors[] = "Could not find a valid certificate.";
 		return false;
+	}
 
 	// lookup user info
-	$user =& $config['system']['user'][$usrid];
-	if (!$user)
-		return false;
+	if ($usrid) {
+		$user =& $config['system']['user'][$usrid];
+		if (!$user) {
+			$input_errors[] = "Could not find the details about userid: {$usrid}";
+			return false;
+		}
+	}
 
 	// lookup user certificate info
-	$cert =& $user['cert'][$crtid];
-	if (!$cert)
-		return false;
+	if ($settings['mode'] != "server_user") {
+		$cert =& $user['cert'][$crtid];
+		if (!$cert)
+			return false;
+	} else
+		$nokeys = true;
 
 	// create template directory
 	$tempdir = $g['tmp_path'] . "/openvpn-export-".uniqid();
@@ -243,31 +262,35 @@ function openvpn_client_export_installer($srvid, $usrid, $crtid, $useaddr, $uset
 		$pwdfle .= "{$proxy['password']}\n";
 		file_put_contents("{$confdir}/{$proxy['passwdfile']}", $pwdfle);
 	}
-	$conf = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, false, $proxy);
-	if (!$conf)
+	$conf = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, $nokeys, $proxy);
+	if (!$conf) {
+		$input_errors[] = "Could not create a config to export.";
 		return false;
+	}
 
 	file_put_contents($cfgfile, $conf);
 
-	// write key files
 	$cafile = "{$tempdir}/config/{$prefix}-ca.crt";
 	file_put_contents($cafile, base64_decode($server_ca['crt']));
-	$crtfile = "{$tempdir}/config/{$prefix}-{$user['name']}.crt";
-	file_put_contents($crtfile, base64_decode($cert['crt']));
-	$keyfile = "{$tempdir}/config/{$prefix}-{$user['name']}.key";
-	file_put_contents($keyfile, base64_decode($cert['prv']));
-	if ($settings['tls']) {
-		$tlsfile = "{$tempdir}/config/{$prefix}-tls.key";
-		file_put_contents($tlsfile, base64_decode($settings['tls']));
+	// write key files
+	if ($settings['mode'] != "server_user") {
+		$crtfile = "{$tempdir}/config/{$prefix}-{$user['name']}.crt";
+		file_put_contents($crtfile, base64_decode($cert['crt']));
+		$keyfile = "{$tempdir}/config/{$prefix}-{$user['name']}.key";
+		file_put_contents($keyfile, base64_decode($cert['prv']));
+		if ($settings['tls']) {
+			$tlsfile = "{$tempdir}/config/{$prefix}-tls.key";
+			file_put_contents($tlsfile, base64_decode($settings['tls']));
+		}
+	
+		// convert to pkcs12 format
+		$p12file = "{$tempdir}/config/{$prefix}.p12";
+		if ($usetoken)
+			openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile);
+		else
+			openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile, $cafile);
 	}
 
-	// convert to pkcs12 format
-	$p12file = "{$tempdir}/config/{$prefix}.p12";
-	if ($usetoken)
-		openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile);
-	else
-		openvpn_client_pem_to_pk12($p12file, $outpass, $crtfile, $keyfile, $cafile);
-
 	// 7zip the configuration data
 	chdir($tempdir);
 	$files  = "config ";
@@ -278,6 +301,7 @@ function openvpn_client_export_installer($srvid, $usrid, $crtid, $useaddr, $uset
 		$files .= "procchain-import";
 	else
 		$files .= "procchain-standard";
+
 	exec("/usr/local/libexec/p7zip/7z -y a archive.7z {$files}");
 
 	// create the final installer
@@ -316,14 +340,18 @@ function viscosity_openvpn_client_config_exporter($srvid, $usrid, $crtid, $usead
 		return false;
 
 	// lookup user info
-	$user =& $config['system']['user'][$usrid];
-	if (!$user)
-		return false;
+	if ($usrid) {
+		$user =& $config['system']['user'][$usrid];
+		if (!$user)
+			return false;
+	}
 
 	// lookup user certificate info
-	$cert =& $user['cert'][$crtid];
-	if (!$cert)
-		return false;
+	if ($settings['mode'] != "server_user") {
+		$cert =& $user['cert'][$crtid];
+		if (!$cert)
+			return false;
+	}
 
 	// create template directory
 	mkdir($tempdir, 0700, true);
@@ -357,12 +385,15 @@ function viscosity_openvpn_client_config_exporter($srvid, $usrid, $crtid, $usead
 EOF;
 
 	$configfile = "{$tempdir}/config.conf";
-	$conf .= <<<EOF
+	$conf .= "ca ca.crt\n";
+	if ($settings['mode'] != "server_user") {
+		$conf .= <<<EOF
 cert cert.crt
 tls-auth ta.key 1
-ca ca.crt
 key key.key	
 EOF;
+	}
+
 	file_put_contents($configfile, $visc_settings . "\n" . $conf);
 
 	//	ca.crt		cert.crt	config.conf	key.key		ta.key
@@ -371,18 +402,21 @@ EOF;
 	$cafile = "{$tempdir}/ca.crt";
 	file_put_contents($cafile, base64_decode($server_ca['crt']));
 
-	// write user .crt
-	$crtfile = "{$tempdir}/cert.crt";
-	file_put_contents($crtfile, base64_decode($cert['crt']));
+	if ($settings['mode'] != "server_user") {
 
-	// write user .key
-	$keyfile = "{$tempdir}/key.key";
-	file_put_contents($keyfile, base64_decode($cert['prv']));
+		// write user .crt
+		$crtfile = "{$tempdir}/cert.crt";
+		file_put_contents($crtfile, base64_decode($cert['crt']));
 
-	// TLS support?
-	if ($settings['tls']) {
-		$tlsfile = "{$tempdir}/ta.key";
-		file_put_contents($tlsfile, base64_decode($settings['tls']));
+		// write user .key
+		$keyfile = "{$tempdir}/key.key";
+		file_put_contents($keyfile, base64_decode($cert['prv']));
+
+		// TLS support?
+		if ($settings['tls']) {
+			$tlsfile = "{$tempdir}/ta.key";
+			file_put_contents($tlsfile, base64_decode($settings['tls']));
+		}
 	}
 
 	// Zip Viscosity file
diff --git a/config/openvpn-client-export/vpn_openvpn_export.php b/config/openvpn-client-export/vpn_openvpn_export.php
index 042b2a9f..05d108a6 100755
--- a/config/openvpn-client-export/vpn_openvpn_export.php
+++ b/config/openvpn-client-export/vpn_openvpn_export.php
@@ -77,6 +77,7 @@ foreach($a_server as $sindex => & $server) {
 	$ras_serverent['index'] = $sindex;
 	$ras_serverent['name'] = $name;
 	$ras_serverent['users'] = $ras_user;
+	$ras_serverent['mode'] = $server['mode'];
 	$ras_server[] = $ras_serverent;
 }
 
@@ -93,10 +94,20 @@ if($act == "conf") {
 	$srvid = $_GET['srvid'];
 	$usrid = $_GET['usrid'];
 	$crtid = $_GET['crtid'];
-	if (($srvid === false) || ($usrid === false) || ($crtid === false)) {
+	if ($srvid === false) {
+		pfSenseHeader("vpn_openvpn_export.php");
+		exit;
+	} else if (($config['openvpn']['openvpn-server'][$srvid]['mode'] != "server_user") &&
+	    (($usrid === false) || ($crtid === false))) {
 		pfSenseHeader("vpn_openvpn_export.php");
 		exit;
 	}
+
+	if ($config['openvpn']['openvpn-server'][$srvid]['mode'] == "server_user")
+		$nokeys = true;
+	else
+		$nokeys = false;
+
 	if (empty($_GET['useaddr'])) {
 		$error = true;
 		$input_errors[] = "You need to specify an IP or hostname.";
@@ -134,7 +145,7 @@ if($act == "conf") {
 	}
 
 	$exp_name = openvpn_client_export_prefix($srvid);
-	$exp_data = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, false, $proxy);
+	$exp_data = openvpn_client_export_config($srvid, $usrid, $crtid, $useaddr, $usetoken, $nokeys, $proxy);
 	if (!$exp_data) {
 		$input_errors[] = "Failed to export config files!";
 		$error = true;
@@ -156,10 +167,14 @@ if($act == "visc") {
 	$srvid = $_GET['srvid'];
 	$usrid = $_GET['usrid'];
 	$crtid = $_GET['crtid'];
-	if (($srvid === false) || ($usrid === false) || ($crtid === false)) {
-		pfSenseHeader("vpn_openvpn_export.php");
-		exit;
-	}
+	if ($srvid === false) {
+                pfSenseHeader("vpn_openvpn_export.php");
+                exit;
+        } else if (($config['openvpn']['openvpn-server'][$srvid]['mode'] != "server_user") &&
+            (($usrid === false) || ($crtid === false))) {
+                pfSenseHeader("vpn_openvpn_export.php");
+                exit;
+        }
 	if (empty($_GET['useaddr'])) {
 		$error = true;
 		$input_errors[] = "You need to specify an IP or hostname.";
@@ -222,10 +237,14 @@ if($act == "inst") {
 	$srvid = $_GET['srvid'];
 	$usrid = $_GET['usrid'];
 	$crtid = $_GET['crtid'];
-	if (($srvid === false) || ($usrid === false) || ($crtid === false)) {
-		pfSenseHeader("vpn_openvpn_export.php");
-		exit;
-	}
+	if ($srvid === false) {
+                pfSenseHeader("vpn_openvpn_export.php");
+                exit;
+        } else if (($config['openvpn']['openvpn-server'][$srvid]['mode'] != "server_user") &&
+            (($usrid === false) || ($crtid === false))) {
+                pfSenseHeader("vpn_openvpn_export.php");
+                exit;
+        }
 	if (empty($_GET['useaddr'])) {
 		$error = true;
 		$input_errors[] = "You need to specify an IP or hostname.";
@@ -299,6 +318,7 @@ var servers = new Array();
 servers[<?=$sindex;?>] = new Array();
 servers[<?=$sindex;?>][0] = '<?=$server['index'];?>';
 servers[<?=$sindex;?>][1] = new Array();
+servers[<?=$sindex;?>][2] = '<?=$server['mode'];?>';;
 <?php 	foreach ($server['users'] as $uindex => & $user): ?>
 servers[<?=$sindex;?>][1][<?=$uindex;?>] = new Array();
 servers[<?=$sindex;?>][1][<?=$uindex;?>][0] = '<?=$user['uindex'];?>';
@@ -382,8 +402,10 @@ function download_begin(act, i) {
 	var dlurl;
 	dlurl  = "/vpn_openvpn_export.php?act=" + act;
 	dlurl += "&srvid=" + servers[index][0];
-	dlurl += "&usrid=" + users[i][0];
-	dlurl += "&crtid=" + users[i][1];
+	if (users[i]) {
+		dlurl += "&usrid=" + users[i][0];
+		dlurl += "&crtid=" + users[i][1];
+	}
 	dlurl += "&useaddr=" + useaddr;
 	dlurl += "&usetoken=" + usetoken;
 	if (usepass)
@@ -425,6 +447,22 @@ function server_changed() {
 		cell2.innerHTML += "&nbsp;/&nbsp;";
 		cell2.innerHTML += "<a href='javascript:download_begin(\"visc\"," + i + ")'>Viscosity Bundle</a>";
 	}
+	if (servers[index][2] == 'server_user') {
+		var row = table.insertRow(table.rows.length);
+                var cell0 = row.insertCell(0);
+                var cell1 = row.insertCell(1);
+                var cell2 = row.insertCell(2);
+                cell0.className = "listlr";
+                cell0.innerHTML = "External authentication users";
+                cell1.className = "listr";
+                cell1.innerHTML = "none";
+                cell2.className = "listr";
+                cell2.innerHTML  = "<a href='javascript:download_begin(\"conf\"," + i + ")'>Configuration</a>";
+                cell2.innerHTML += "&nbsp;/&nbsp;";
+                cell2.innerHTML += "<a href='javascript:download_begin(\"inst\"," + i + ")'>Windows Installer</a>";
+                cell2.innerHTML += "&nbsp;/&nbsp;";
+                cell2.innerHTML += "<a href='javascript:download_begin(\"visc\"," + i + ")'>Viscosity Bundle</a>";
+	}
 }
 
 function useaddr_changed(obj) {
-- 
cgit v1.2.3