mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add EAP-MSChapv2 implementation for Windows ipsec support as reported here https://forum.pfsense.org/index.php?topic=81657.15

Browse Source
This commit is contained in:
Ermal LUÇI 2015-01-14 12:27:48 +01:00
parent 5526efab3d
commit 10e2acb5f0
5 changed files with 61 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/inc/ipsec.inc
View File

@ -112,9 +112,15 @@ $p1_authentication_methods = array(
'xauth_rsa_server' => array( 'name' => 'Mutual RSA + Xauth', 'mobile' => true ),
'xauth_psk_server' => array( 'name' => 'Mutual PSK + Xauth', 'mobile' => true ),
'eap-tls' => array( 'name' => 'EAP-TLS', 'mobile' => true),
'eap-mschapv2' => array( 'name' => 'EAP-MSChapv2', 'mobile' => true),
'rsasig' => array( 'name' => 'Mutual RSA', 'mobile' => false ),
'pre_shared_key' => array( 'name' => 'Mutual PSK', 'mobile' => false ) );
$ipsec_preshared_key_type = array(
'PSK' => 'PSK',
'EAP' => 'EAP'
);
$p2_modes = array(
'tunnel' => 'Tunnel IPv4',
'tunnel6' => 'Tunnel IPv6',

12
etc/inc/vpn.inc
View File

@ -516,7 +516,9 @@ EOD;
foreach ($ipseccfg['mobilekey'] as $key) {
if ($key['ident'] == "allusers")
$key['ident'] = '%any';
$pskconf .= "%any {$key['ident']} : PSK 0s" . base64_encode($key['pre-shared-key']) . "\n";
if (empty($key['type']))
$key['type'] = 'PSK';
$pskconf .= "%any {$key['ident']} : {$key['type']} 0s" . base64_encode($key['pre-shared-key']) . "\n";
}
unset($key);
}
@ -616,6 +618,14 @@ EOD;
$authentication = "";
switch ($ph1ent['authentication_method']) {
case 'eap-mschapv2':
if (isset($ph1ent['mobile'])) {
$authentication = "eap_identity=%any\n\t";
$authentication .= "leftauth=pubkey\n\trightauth=eap-mschapv2";
if (!empty($ph1ent['certref']))
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
}
break;
case 'eap-tls':
$authentication = "leftauth=eap-tls\n\trightauth=eap-tls";
if (!empty($ph1ent['certref']))

21
usr/local/www/vpn_ipsec_keys.php
View File

@ -52,7 +52,7 @@ $a_secret = &$config['ipsec']['mobilekey'];
$userkeys = array();
foreach ($config['system']['user'] as $id => $user) {
if (!empty($user['ipsecpsk'])) {
$userkeys[] = array('ident' => $user['name'], 'pre-shared-key' => $user['ipsecpsk'], 'id' => $id);;
$userkeys[] = array('ident' => $user['name'], 'type' => 'PSK', 'pre-shared-key' => $user['ipsecpsk'], 'id' => $id);;
}
}
@ -110,6 +110,7 @@ if (is_subsystem_dirty('ipsec'))
<table class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0" summary="main area">
<tr>
<td class="listhdrr"><?=gettext("Identifier"); ?></td>
<td class="listhdrr"><?=gettext("Type"); ?></td>
<td class="listhdr"><?=gettext("Pre-Shared Key"); ?></td>
<td class="list">
<table border="0" cellspacing="0" cellpadding="1" summary="add key">
@ -130,6 +131,14 @@ if (is_subsystem_dirty('ipsec'))
echo htmlspecialchars($secretent['ident']);
?>
</td>
<td class="listlr gray">
<?php
if (empty($secretent['type']))
echo 'PSK';
else
echo htmlspecialchars($secretent['type']);
?>
</td>
<td class="listr gray">
<?=htmlspecialchars($secretent['pre-shared-key']);?>
</td>
@ -150,6 +159,14 @@ if (is_subsystem_dirty('ipsec'))
<td class="listlr">
<?=htmlspecialchars($secretent['ident']);?>
</td>
<td class="listlr">
<?php
if (empty($secretent['type']))
echo 'PSK';
else
echo htmlspecialchars($secretent['type']);
?>
</td>
<td class="listr">
<?=htmlspecialchars($secretent['pre-shared-key']);?>
</td>
@ -158,7 +175,7 @@ if (is_subsystem_dirty('ipsec'))
</tr>
<?php $i++; endforeach; ?>
<tr>
<td class="list" colspan="2"></td>
<td class="list" colspan="3"></td>
<td class="list">
<table border="0" cellspacing="0" cellpadding="1" summary="add key">
<tr>

20
usr/local/www/vpn_ipsec_keys_edit.php
View File

@ -55,6 +55,7 @@ if (isset($_POST['id']) && is_numericint($_POST['id']))
if (isset($id) && $a_secret[$id]) {
$pconfig['ident'] = $a_secret[$id]['ident'];
$pconfig['type'] = $a_secret[$id]['type'];
$pconfig['psk'] = $a_secret[$id]['pre-shared-key'];
}
@ -99,6 +100,7 @@ if ($_POST) {
$secretent = $a_secret[$id];
$secretent['ident'] = $_POST['ident'];
$secretent['type'] = $_POST['type'];
$secretent['pre-shared-key'] = $_POST['psk'];
$text = "";
@ -130,6 +132,9 @@ include("head.inc");
<?php if ($input_errors) print_input_errors($input_errors); ?>
<form action="vpn_ipsec_keys_edit.php" method="post" name="iform" id="iform">
<table width="100%" border="0" cellpadding="6" cellspacing="0" summary="vpn ipsec keys edit">
<tr>
<td colspan="2" valign="top" class="listtopic">Edit pre-shared secret</td>
</tr>
<tr>
<td valign="top" class="vncellreq"><?=gettext("Identifier"); ?></td>
<td class="vtable">
@ -138,6 +143,21 @@ include("head.inc");
<?=gettext("This can be either an IP address, fully qualified domain name or an e-mail address"); ?>.
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("Secret type"); ?></td>
<td width="78%" class="vtable">
<select name="type" class="formselect">
<?php
foreach ($ipsec_preshared_key_type as $value => $descr) {
echo "<option value='{$value}' ";
if ($pconfig['type'] == $value)
echo "selected=\"selected\"";
echo ">{$descr}</option>";
}
?>
</select>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("Pre-Shared Key"); ?></td>
<td width="78%" class="vtable">

5
usr/local/www/vpn_ipsec_phase1.php
View File

@ -162,6 +162,10 @@ if ($_POST) {
// Only require PSK here for normal PSK tunnels (not mobile) or xauth.
// For RSA methods, require the CA/Cert.
switch ($method) {
case 'eap-mschapv2':
if ($pconfig['iketype'] != 'ikev2')
$input_errors[] = gettext("EAP-MSChapv2 can only be used with IKEv2 type VPNs.");
break;
case "eap-tls":
if ($pconfig['iketype'] != 'ikev2')
$input_errors[] = gettext("EAP-TLS can only be used with IKEv2 type VPNs.");
@ -448,6 +452,7 @@ function methodsel_change() {
value = document.iform.authentication_method.options[index].value;
switch (value) {
case 'eap-mschapv2':
case 'eap-tls':
document.getElementById('opt_psk').style.display = 'none';
document.getElementById('opt_peerid').style.display = '';