mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

changes for #5219 accidentally reverted unrelated changes made by other commits. Restore those & remove some dead code that was commented out.

Browse Source
This commit is contained in:
Matt Smith 2015-11-03 12:37:51 -06:00
parent dfd460ef56
commit ce0dbd729d
1 changed files with 6 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/etc/inc/vpn.inc
View File

@ -143,9 +143,8 @@ function vpn_ipsec_configure($restart = false) {
/* wait for process to die */
sleep(2);
/* disallow IPSEC, it is off */
/* IPSEC is off, shutdown enc interface.*/
mwexec("/sbin/ifconfig enc0 down");
set_single_sysctl("net.inet.ip.ipsec_in_use", "0");
return 0;
}
@ -160,7 +159,6 @@ function vpn_ipsec_configure($restart = false) {
$crlpath = "{$g['varetc_path']}/ipsec/ipsec.d/crls";
mwexec("/sbin/ifconfig enc0 up");
set_single_sysctl("net.inet.ip.ipsec_in_use", "1");
if (php_uname('m') != "amd64") {
set_single_sysctl("net.inet.ipsec.directdispatch", "0");
}
@ -207,9 +205,6 @@ function vpn_ipsec_configure($restart = false) {
echo gettext("Configuring IPsec VPN... ");
}
/* fastforwarding is not compatible with ipsec tunnels */
set_single_sysctl("net.inet.ip.fastforwarding", "0");
/* resolve all local, peer addresses and setup pings */
$ipmap = array();
$rgmap = array();
@ -480,30 +475,6 @@ EOD;
EOD;
}
/*
$a_servers = auth_get_authserver_list();
foreach ($a_servers as $id => $pconfig) {
if ($id == $config['ipsec']['client']['user_source'] && $pconfig['type'] == "radius") {
$strongswan .= <<<EOD
eap-radius {
class_group = yes
eap_start = no
servers {
primary {
address = {$pconfig['host']}
secret = {$pconfig['radius_secret']}
auth_port = {$pconfig['radius_auth_port']}
acct_port = {$pconfig['radius_acct_port']}
}
}
}
EOD;
break;
}
}
*/
if (is_array($a_client) && isset($a_client['enable'])) {
$strongswan .= "\t\tattr {\n";
@ -1032,6 +1003,7 @@ EOD;
$authentication .= "leftauth=pubkey\n\trightauth=eap-mschapv2";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
$authentication .= "\n\tleftsendcert=always";
}
}
break;
@ -1041,11 +1013,13 @@ EOD;
$authentication .= "leftauth=pubkey\n\trightauth=eap-tls";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
$authentication .= "\n\tleftsendcert=always";
}
} else {
$authentication = "leftauth=eap-tls\n\trightauth=eap-tls";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
$authentication .= "\n\tleftsendcert=always";
}
}
if (isset($casub)) {
@ -1058,11 +1032,13 @@ EOD;
$authentication .= "leftauth=pubkey\n\trightauth=eap-radius";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
$authentication .= "\n\tleftsendcert=always";
}
} else {
$authentication = "leftauth=eap-radius\n\trightauth=eap-radius";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
$authentication .= "\n\tleftsendcert=always";
}
}
break;