mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rename IPsec "RSA" options to "Certificate". Implements #9903

Browse Source
This commit is contained in:
jim-p 2019-11-19 11:43:17 -05:00
parent b8b0c2a320
commit d1f5587d48
7 changed files with 38 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/etc/inc/certs.inc
View File

@ -1776,7 +1776,7 @@ function cert_get_all_services($refid) {
* needs a bump. */
init_config_arr(array('ipsec', 'phase1'));
foreach ($config['ipsec']['phase1'] as $ipsec) {
if (($ipsec['authentication_method'] == 'rsasig') &&
if (($ipsec['authentication_method'] == 'cert') &&
($ipsec['certref'] == $refid)) {
$services['services'][] = array('name' => 'ipsec');
/* Stop after finding one, no need to search for more. */
@ -1858,7 +1858,7 @@ function ca_get_all_services($refid) {
}
}
foreach ($config['ipsec']['phase1'] as $ipsec) {
if (($ipsec['authentication_method'] == 'rsasig') &&
if (($ipsec['authentication_method'] == 'cert') &&
($ipsec['caref'] == $refid)) {
$services['services'][] = array('name' => 'ipsec');
break;

2
src/etc/inc/globals.inc
View File

@ -71,7 +71,7 @@ $g = array(
"disablecrashreporter" => false,
"crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php",
"debug" => false,
"latest_config" => "19.8",
"latest_config" => "19.9",
"minimum_ram_warning" => "101",
"minimum_ram_warning_text" => "128 MB",
"wan_interface_name" => "wan",

6
src/etc/inc/ipsec.inc
View File

@ -185,13 +185,13 @@ $p2_halgos = array(
global $p1_authentication_methods;
$p1_authentication_methods = array(
'hybrid_rsa_server' => array('name' => gettext('Hybrid RSA + Xauth'), 'mobile' => true),
'xauth_rsa_server' => array('name' => gettext('Mutual RSA + Xauth'), 'mobile' => true),
'hybrid_cert_server' => array('name' => gettext('Hybrid Certificate + Xauth'), 'mobile' => true),
'xauth_cert_server' => array('name' => gettext('Mutual Certificate + Xauth'), 'mobile' => true),
'xauth_psk_server' => array('name' => gettext('Mutual PSK + Xauth'), 'mobile' => true),
'eap-tls' => array('name' => gettext('EAP-TLS'), 'mobile' => true),
'eap-radius' => array('name' => gettext('EAP-RADIUS'), 'mobile' => true),
'eap-mschapv2' => array('name' => gettext('EAP-MSChapv2'), 'mobile' => true),
'rsasig' => array('name' => gettext('Mutual RSA'), 'mobile' => false),
'cert' => array('name' => gettext('Mutual Certificate'), 'mobile' => false),
'pre_shared_key' => array('name' => gettext('Mutual PSK'), 'mobile' => false)
);

19
src/etc/inc/upgrade_config.inc
View File

@ -6057,6 +6057,25 @@ function upgrade_197_to_198() {
install_cron_job('/etc/rc.periodic monthly', true, "30", '5', '1', '*', '*', 'root', false);
}
/* Update IPsec authentication method names
* https://redmine.pfsense.org/issues/9903 */
function upgrade_198_to_199() {
global $config;
/* "RSA" methods changed to the more generic "cert" since they are not only RSA. */
$namechanges = array(
'hybrid_rsa_server' => 'hybrid_cert_server',
'xauth_rsa_server' => 'xauth_cert_server',
'rsasig' => 'cert',
);
init_config_arr(array('ipsec', 'phase1'));
foreach ($config['ipsec']['phase1'] as & $ph1ent) {
/* If the auth method for this P1 is in the list to change, change it */
if (array_key_exists($ph1ent['authentication_method'], $namechanges)) {
$ph1ent['authentication_method'] = $namechanges[$ph1ent['authentication_method']];
}
}
}
/*
* Special function that is called independent of current config version. It's
* a workaround to have config_upgrade running on older versions after next

10
src/etc/inc/vpn.inc
View File

@ -652,7 +652,7 @@ EOD;
continue;
}
if (strstr($ph1ent['authentication_method'], 'rsa') ||
if (strstr($ph1ent['authentication_method'], 'cert') ||
in_array($ph1ent['authentication_method'], array('eap-mschapv2', 'eap-tls', 'eap-radius'))) {
$certline = '';
@ -730,7 +730,7 @@ EOD;
* client cert CA chain to the list of CAs to write
*/
if (in_array($ph1ent['authentication_method'],
array('rsasig', 'eap-tls', 'xauth_rsa_server'))) {
array('cert', 'eap-tls', 'xauth_cert_server'))) {
if (!empty($ph1ent['caref']) && !array_key_exists($ph1ent['caref'], $vpncas)) {
$thisca = lookup_ca($ph1ent['caref']);
@ -1110,7 +1110,7 @@ EOD;
}
}
break;
case 'xauth_rsa_server':
case 'xauth_cert_server':
$authentication = "leftauth = pubkey\n\trightauth = pubkey";
$authentication .= "\n\trightauth2 = xauth-generic";
if (!empty($ph1ent['certref'])) {
@ -1128,7 +1128,7 @@ EOD;
case 'pre_shared_key':
$authentication = "leftauth = psk\n\trightauth = psk";
break;
case 'rsasig':
case 'cert':
$authentication = "leftauth = pubkey\n\trightauth = pubkey";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";
@ -1138,7 +1138,7 @@ EOD;
$authentication .= "\n\trightca=\"$casub\"";
}
break;
case 'hybrid_rsa_server':
case 'hybrid_cert_server':
$authentication = "leftauth = pubkey\n\trightauth = xauth-generic";
if (!empty($ph1ent['certref'])) {
$authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt";

14
src/usr/local/www/vpn_ipsec_phase1.php
View File

@ -205,12 +205,12 @@ if ($_POST['save']) {
unset($pconfig['certref']);
}
if ($method != "rsasig" && $method != "xauth_rsa_server" && $method != "eap-tls") {
if ($method != "cert" && $method != "xauth_cert_server" && $method != "eap-tls") {
unset($pconfig['caref']);
}
// Only require PSK here for normal PSK tunnels (not mobile) or xauth.
// For RSA methods, require the CA/Cert.
// For certificate methods, require the CA/Cert.
switch ($method) {
case 'eap-mschapv2':
if ($pconfig['iketype'] != 'ikev2') {
@ -238,8 +238,8 @@ if ($_POST['save']) {
$reqdfieldsn = array(gettext("Pre-Shared Key"));
$validate_pskey = true;
break;
case "xauth_rsa_server":
case "rsasig":
case "xauth_cert_server":
case "cert":
$reqdfields = explode(" ", "caref certref");
$reqdfieldsn = array(gettext("Certificate Authority"), gettext("Certificate"));
break;
@ -1045,7 +1045,7 @@ events.push(function() {
switch ($('#authentication_method').val()) {
case 'eap-mschapv2':
case 'eap-radius':
case 'hybrid_rsa_server':
case 'hybrid_cert_server':
hideInput('pskey', true);
hideClass('peeridgroup', false);
hideInput('certref', false);
@ -1054,8 +1054,8 @@ events.push(function() {
disableInput('caref', true);
break;
case 'eap-tls':
case 'xauth_rsa_server':
case 'rsasig':
case 'xauth_cert_server':
case 'cert':
hideInput('pskey', true);
hideClass('peeridgroup', false);
hideInput('certref', false);

2
src/usr/local/www/vpn_ipsec_settings.php
View File

@ -336,7 +336,7 @@ $section->addInput(new Form_Checkbox(
'Strict CRL Checking',
'Enable strict Certificate Revocation List checking',
$pconfig['strictcrlpolicy']
))->setHelp('Check this to require availability of a fresh CRL for peer authentication based on RSA signatures to succeed.');
))->setHelp('Check this to require availability of a fresh CRL for peer authentication based on certificate signatures to succeed.');
$section->addInput(new Form_Checkbox(
'makebeforebreak',