mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add IPsec advanced option for strict CRL checking

Browse Source
This commit is contained in:
Chris Buechler 2015-07-22 15:03:20 -05:00
parent 0be67fe5fe
commit df4de32d34
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
etc/inc/vpn.inc
View File

@ -713,6 +713,10 @@ EOD;
$ipsecconf .= "# This file is automatically generated. Do not edit\n";
$ipsecconf .= "config setup\n\tuniqueids = {$uniqueids}\n";
$ipsecconf .= "\tcharondebug=\"" . vpn_ipsec_configure_loglevels(true) . "\"\n";
if (isset($config['ipsec']['strictcrlpolicy'])) {
$ipsecconf .= "\tstrictcrlpolicy = yes \n";
}
if (!isset($config['ipsec']['noshuntlaninterfaces'])) {
if ($config['interfaces']['lan']) {

16
usr/local/www/vpn_ipsec_settings.php
View File

@ -47,6 +47,7 @@ foreach ($ipsec_loglevels as $lkey => $ldescr) {
}
}
$pconfig['unityplugin'] = isset($config['ipsec']['unityplugin']);
$pconfig['strictcrlpolicy'] = isset($config['ipsec']['strictcrlpolicy']);
$pconfig['makebeforebreak'] = isset($config['ipsec']['makebeforebreak']);
$pconfig['noshuntlaninterfaces'] = isset($config['ipsec']['noshuntlaninterfaces']);
$pconfig['compression'] = isset($config['ipsec']['compression']);
@ -161,6 +162,12 @@ if ($_POST) {
$needsrestart = true;
unset($config['ipsec']['unityplugin']);
}
if ($_POST['strictcrlpolicy'] == "yes") {
$config['ipsec']['strictcrlpolicy'] = true;
} else {
unset($config['ipsec']['strictcrlpolicy']);
}
if ($_POST['makebeforebreak'] == "yes") {
$config['ipsec']['makebeforebreak'] = true;
@ -392,6 +399,15 @@ function maxmss_checked(obj) {
<?=gettext("Disable Unity Plugin which provides Cisco Extension support as Split-Include, Split-Exclude, Split-Dns, ..."); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Strict CRL Checking"); ?></td>
<td width="78%" class="vtable">
<input name="strictcrlpolicy" type="checkbox" id="strictcrlpolicy" value="yes" <?php if ($pconfig['strictcrlpolicy'] == true) echo "checked=\"checked\""; ?> />
<strong><?=gettext("Enable strict Certificate Revocation List checking"); ?></strong>
<br />
<?=gettext("Check this to require availability of a fresh CRL for peer authentication based on RSA signatures to succeed."); ?>
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Make before Break"); ?></td>
<td width="78%" class="vtable">