From d1f5587d48af48817336fdf8644ea7d7679cf037 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 19 Nov 2019 11:43:17 -0500 Subject: [PATCH] Rename IPsec "RSA" options to "Certificate". Implements #9903 --- src/etc/inc/certs.inc | 4 ++-- src/etc/inc/globals.inc | 2 +- src/etc/inc/ipsec.inc | 6 +++--- src/etc/inc/upgrade_config.inc | 19 +++++++++++++++++++ src/etc/inc/vpn.inc | 10 +++++----- src/usr/local/www/vpn_ipsec_phase1.php | 14 +++++++------- src/usr/local/www/vpn_ipsec_settings.php | 2 +- 7 files changed, 38 insertions(+), 19 deletions(-) diff --git a/src/etc/inc/certs.inc b/src/etc/inc/certs.inc index 2f1c842f6a..6d60509a43 100644 --- a/src/etc/inc/certs.inc +++ b/src/etc/inc/certs.inc @@ -1776,7 +1776,7 @@ function cert_get_all_services($refid) { * needs a bump. */ init_config_arr(array('ipsec', 'phase1')); foreach ($config['ipsec']['phase1'] as $ipsec) { - if (($ipsec['authentication_method'] == 'rsasig') && + if (($ipsec['authentication_method'] == 'cert') && ($ipsec['certref'] == $refid)) { $services['services'][] = array('name' => 'ipsec'); /* Stop after finding one, no need to search for more. */ @@ -1858,7 +1858,7 @@ function ca_get_all_services($refid) { } } foreach ($config['ipsec']['phase1'] as $ipsec) { - if (($ipsec['authentication_method'] == 'rsasig') && + if (($ipsec['authentication_method'] == 'cert') && ($ipsec['caref'] == $refid)) { $services['services'][] = array('name' => 'ipsec'); break; diff --git a/src/etc/inc/globals.inc b/src/etc/inc/globals.inc index ebf1bd7357..2a8a50f15b 100644 --- a/src/etc/inc/globals.inc +++ b/src/etc/inc/globals.inc @@ -71,7 +71,7 @@ $g = array( "disablecrashreporter" => false, "crashreporterurl" => "https://crashreporter.pfsense.org/crash_reporter.php", "debug" => false, - "latest_config" => "19.8", + "latest_config" => "19.9", "minimum_ram_warning" => "101", "minimum_ram_warning_text" => "128 MB", "wan_interface_name" => "wan", diff --git a/src/etc/inc/ipsec.inc b/src/etc/inc/ipsec.inc index 4b9c7097fb..405ebc6cbb 100644 --- a/src/etc/inc/ipsec.inc +++ b/src/etc/inc/ipsec.inc @@ -185,13 +185,13 @@ $p2_halgos = array( global $p1_authentication_methods; $p1_authentication_methods = array( - 'hybrid_rsa_server' => array('name' => gettext('Hybrid RSA + Xauth'), 'mobile' => true), - 'xauth_rsa_server' => array('name' => gettext('Mutual RSA + Xauth'), 'mobile' => true), + 'hybrid_cert_server' => array('name' => gettext('Hybrid Certificate + Xauth'), 'mobile' => true), + 'xauth_cert_server' => array('name' => gettext('Mutual Certificate + Xauth'), 'mobile' => true), 'xauth_psk_server' => array('name' => gettext('Mutual PSK + Xauth'), 'mobile' => true), 'eap-tls' => array('name' => gettext('EAP-TLS'), 'mobile' => true), 'eap-radius' => array('name' => gettext('EAP-RADIUS'), 'mobile' => true), 'eap-mschapv2' => array('name' => gettext('EAP-MSChapv2'), 'mobile' => true), - 'rsasig' => array('name' => gettext('Mutual RSA'), 'mobile' => false), + 'cert' => array('name' => gettext('Mutual Certificate'), 'mobile' => false), 'pre_shared_key' => array('name' => gettext('Mutual PSK'), 'mobile' => false) ); diff --git a/src/etc/inc/upgrade_config.inc b/src/etc/inc/upgrade_config.inc index a54a1fd40f..aa251bee78 100644 --- a/src/etc/inc/upgrade_config.inc +++ b/src/etc/inc/upgrade_config.inc @@ -6057,6 +6057,25 @@ function upgrade_197_to_198() { install_cron_job('/etc/rc.periodic monthly', true, "30", '5', '1', '*', '*', 'root', false); } +/* Update IPsec authentication method names + * https://redmine.pfsense.org/issues/9903 */ +function upgrade_198_to_199() { + global $config; + /* "RSA" methods changed to the more generic "cert" since they are not only RSA. */ + $namechanges = array( + 'hybrid_rsa_server' => 'hybrid_cert_server', + 'xauth_rsa_server' => 'xauth_cert_server', + 'rsasig' => 'cert', + ); + init_config_arr(array('ipsec', 'phase1')); + foreach ($config['ipsec']['phase1'] as & $ph1ent) { + /* If the auth method for this P1 is in the list to change, change it */ + if (array_key_exists($ph1ent['authentication_method'], $namechanges)) { + $ph1ent['authentication_method'] = $namechanges[$ph1ent['authentication_method']]; + } + } +} + /* * Special function that is called independent of current config version. It's * a workaround to have config_upgrade running on older versions after next diff --git a/src/etc/inc/vpn.inc b/src/etc/inc/vpn.inc index 429501f91a..a04d97277f 100644 --- a/src/etc/inc/vpn.inc +++ b/src/etc/inc/vpn.inc @@ -652,7 +652,7 @@ EOD; continue; } - if (strstr($ph1ent['authentication_method'], 'rsa') || + if (strstr($ph1ent['authentication_method'], 'cert') || in_array($ph1ent['authentication_method'], array('eap-mschapv2', 'eap-tls', 'eap-radius'))) { $certline = ''; @@ -730,7 +730,7 @@ EOD; * client cert CA chain to the list of CAs to write */ if (in_array($ph1ent['authentication_method'], - array('rsasig', 'eap-tls', 'xauth_rsa_server'))) { + array('cert', 'eap-tls', 'xauth_cert_server'))) { if (!empty($ph1ent['caref']) && !array_key_exists($ph1ent['caref'], $vpncas)) { $thisca = lookup_ca($ph1ent['caref']); @@ -1110,7 +1110,7 @@ EOD; } } break; - case 'xauth_rsa_server': + case 'xauth_cert_server': $authentication = "leftauth = pubkey\n\trightauth = pubkey"; $authentication .= "\n\trightauth2 = xauth-generic"; if (!empty($ph1ent['certref'])) { @@ -1128,7 +1128,7 @@ EOD; case 'pre_shared_key': $authentication = "leftauth = psk\n\trightauth = psk"; break; - case 'rsasig': + case 'cert': $authentication = "leftauth = pubkey\n\trightauth = pubkey"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; @@ -1138,7 +1138,7 @@ EOD; $authentication .= "\n\trightca=\"$casub\""; } break; - case 'hybrid_rsa_server': + case 'hybrid_cert_server': $authentication = "leftauth = pubkey\n\trightauth = xauth-generic"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; diff --git a/src/usr/local/www/vpn_ipsec_phase1.php b/src/usr/local/www/vpn_ipsec_phase1.php index 4f7bc5220f..14e2af0506 100644 --- a/src/usr/local/www/vpn_ipsec_phase1.php +++ b/src/usr/local/www/vpn_ipsec_phase1.php @@ -205,12 +205,12 @@ if ($_POST['save']) { unset($pconfig['certref']); } - if ($method != "rsasig" && $method != "xauth_rsa_server" && $method != "eap-tls") { + if ($method != "cert" && $method != "xauth_cert_server" && $method != "eap-tls") { unset($pconfig['caref']); } // Only require PSK here for normal PSK tunnels (not mobile) or xauth. - // For RSA methods, require the CA/Cert. + // For certificate methods, require the CA/Cert. switch ($method) { case 'eap-mschapv2': if ($pconfig['iketype'] != 'ikev2') { @@ -238,8 +238,8 @@ if ($_POST['save']) { $reqdfieldsn = array(gettext("Pre-Shared Key")); $validate_pskey = true; break; - case "xauth_rsa_server": - case "rsasig": + case "xauth_cert_server": + case "cert": $reqdfields = explode(" ", "caref certref"); $reqdfieldsn = array(gettext("Certificate Authority"), gettext("Certificate")); break; @@ -1045,7 +1045,7 @@ events.push(function() { switch ($('#authentication_method').val()) { case 'eap-mschapv2': case 'eap-radius': - case 'hybrid_rsa_server': + case 'hybrid_cert_server': hideInput('pskey', true); hideClass('peeridgroup', false); hideInput('certref', false); @@ -1054,8 +1054,8 @@ events.push(function() { disableInput('caref', true); break; case 'eap-tls': - case 'xauth_rsa_server': - case 'rsasig': + case 'xauth_cert_server': + case 'cert': hideInput('pskey', true); hideClass('peeridgroup', false); hideInput('certref', false); diff --git a/src/usr/local/www/vpn_ipsec_settings.php b/src/usr/local/www/vpn_ipsec_settings.php index 2d6162d10d..ac5c98c787 100644 --- a/src/usr/local/www/vpn_ipsec_settings.php +++ b/src/usr/local/www/vpn_ipsec_settings.php @@ -336,7 +336,7 @@ $section->addInput(new Form_Checkbox( 'Strict CRL Checking', 'Enable strict Certificate Revocation List checking', $pconfig['strictcrlpolicy'] -))->setHelp('Check this to require availability of a fresh CRL for peer authentication based on RSA signatures to succeed.'); +))->setHelp('Check this to require availability of a fresh CRL for peer authentication based on certificate signatures to succeed.'); $section->addInput(new Form_Checkbox( 'makebeforebreak',