Beispiel #1
0
function BuildTunServer(){
LoadArgvs();
   $unix=new unix();
   if(isset($GLOBALS["CLASS_SOCKETS"])){$sock=$GLOBALS["CLASS_SOCKETS"];}else{$GLOBALS["CLASS_SOCKETS"]=new sockets();$sock=$GLOBALS["CLASS_SOCKETS"];}
   $servername=$unix->hostname_g();	
   $routess=array();
   $duplicate_cn=null;
 
   
  if(preg_match("#^(.+?)\.#",$servername,$re)){$servername=$re[1];}
   $servername=strtoupper($servername);       
   echo "Starting......: OpenVPN building settings for $servername...\n";
   
   
   
   $ini=new Bs_IniHandler();
   
   $ini->loadString($sock->GET_INFO("ArticaOpenVPNSettings"));
   if(!isset($ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"])){$ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"]=0;}
   if(!isset($ini->_params["GLOBAL"]["IP_START"])){$ini->_params["GLOBAL"]["IP_START"]="10.8.0.0";}
   if(!isset($ini->_params["GLOBAL"]["NETMASK"])){$ini->_params["GLOBAL"]["NETMASK"]="255.255.255.0";}
   
   
   if($ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"]==1){
   		echo "Starting......: OpenVPN building settings mode bridge enabled...\n";
   		BuildBridgeServer();
   		return;
   }
   
   
   $IPTABLES_ETH=$GLOBALS["IPTABLES_ETH"];
   $DEV_TYPE=$ini->_params["GLOBAL"]["DEV_TYPE"];
   $port=$ini->_params["GLOBAL"]["LISTEN_PORT"];
   $IP_START=$ini->_params["GLOBAL"]["IP_START"];
   $NETMASK=$ini->_params["GLOBAL"]["NETMASK"];
   $bind_addr=$ini->_params["GLOBAL"]["LOCAL_BIND"];
   $LISTEN_PROTO=$ini->_params["GLOBAL"]["LISTEN_PROTO"];
   if($LISTEN_PROTO==null){$LISTEN_PROTO="udp";}
   if($LISTEN_PROTO=="udp"){$proto="--proto udp";}else{$proto="--proto tcp-server";}
   
    
   if(trim($port)==null){$port=1194;}
   if(trim($IP_START)==null){$IP_START="10.8.0.0";}
   if(trim($NETMASK)==null){$NETMASK="255.255.255.0";}
   
$nic=new networking();

while (list ($num, $ligne) = each ($nic->array_TCP) ){
	if($ligne==null){continue;}
		$eths[][$num]=$num;
		$ethi[$num]=$ligne;
	} 

if($IPTABLES_ETH<>null){
		echo "Starting......: OpenVPN linked to $IPTABLES_ETH ({$ethi[$IPTABLES_ETH]})...\n";
		$IPTABLES_ETH_ROUTE=IpCalcRoute($ethi[$IPTABLES_ETH]);
}else{
	echo "Starting......: OpenVPN no local NIC linked...\n";
}
	
   $ca='/etc/artica-postfix/openvpn/keys/allca.crt';
   $dh='/etc/artica-postfix/openvpn/keys/dh1024.pem';
   $key="/etc/artica-postfix/openvpn/keys/vpn-server.key";
   $crt="/etc/artica-postfix/openvpn/keys/vpn-server.crt";
   $route='';
   
   //$IPTABLES_ETH_IP=

if (is_file('/etc/artica-postfix/settings/Daemons/OpenVPNRoutes')){
   $routes=(explode("\n",@file_get_contents("/etc/artica-postfix/settings/Daemons/OpenVPNRoutes")));
   while (list ($num, $ligne) = each ($routes) ){
   	if(!preg_match("#(.+?)\s+(.+)#",$ligne,$re)){continue;}
   	$routess[]="--push \"route {$re[1]} {$re[2]}\"";
   }
}
$GetRoutes=GetRoutes();
$routess=$routess+$GetRoutes;



if(count($routess)==0){
	if($IPTABLES_ETH_ROUTE<>null){
		echo "Starting......: OpenVPN IP adding default route \"$IPTABLES_ETH_ROUTE\"\n";
		$routess[]="--push \"route $IPTABLES_ETH_ROUTE\"";
	}
  }else{
  	echo "Starting......: OpenVPN IP adding ".count($routess)." routes\n";
  }
   

	
   if(trim($bind_addr)<>null){
   	$local=" --local $bind_addr";
   	echo "Starting......: OpenVPN IP bind $bind_addr\n";
   }
   
   $IP_START=FIX_IP_START($IP_START,$local);
   $ini->set("GLOBAL","IP_START",$IP_START); 	
  
   if(preg_match("#(.+?)\.([0-9]+)$#",$IP_START,$re)){
   	$calc_ip=" {$re[1]}.0";
   	$calc_ip_end="{$re[1]}.254";
   	echo "Starting......: OpenVPN IP pool from {$re[1]}.2 to {$re[1]}.254 mask:$NETMASK\n";
   	$server_ip="{$re[1]}.1";
   	$IP_START_PREFIX=$re[1];
   }

   if($NETMASK==null){
			$ip=new IP();
			$cdir=$ip->ip2cidr($calc_ip,$calc_ip_end);
			$arr=$ip->parseCIDR($cdir);
			$rang=$arr[0];
			$netbit=$arr[1];
			$ipv=new ipv4($calc_ip,$netbit);
			$NETMASK=$ipv->netmask();	   
			if($NETMASK=="255.255.255.255"){$NETMASK="255.255.255.0";}		
   			echo "Starting......: OpenVPN Netmask is null for the range $calc_ip, assume $NETMASK\n";
   			$ini->set("GLOBAL","NETMASK",$NETMASK);
   	}
   	
	$OpenVpnPasswordCert=$sock->GET_INFO("OpenVpnPasswordCert");
	if($OpenVpnPasswordCert==null){$OpenVpnPasswordCert="MyKey";}
   
	$askpass=null;
   	if(is_file("/etc/artica-postfix/openvpn/keys/password")){
   		$askpass="******";
   	}
   	
   	$ifconfig_pool_persist=" --ifconfig-pool-persist /etc/artica-postfix/openvpn/ipp.txt ";
   	
 	if(isset($GLOBALS["OPENVPNPARAMS"]["duplicate-cn"])){
 		echo "Starting......: OpenVPN duplicate-cn is enabled\n";
 		$duplicate_cn=" --duplicate-cn ";
 		$ifconfig_pool_persist=null;
 	}
 	
 	if(isset($GLOBALS["OPENVPNPARAMS"]["script-security"])){
 		echo "Starting......: OpenVPN script-security is enabled\n";
 		$script_security=" --script-security 2";
 	} 	
 	
	if(!is_dir("/etc/openvpn/cdd")){@mkdir("/etc/openvpn/cdd");}
	$already=array();
 	echo "Starting......: OpenVPN get remote sites routes...\n";
 	$sql="SELECT sitename,IP_START,netmask,remote_site_routes,FixedIPAddr FROM vpnclient WHERE connexion_type=1";
 	$q=new mysql();
	$results=$q->QUERY_SQL($sql,"artica_backup");
	if(!$q->ok){echo2("Starting......: OpenVPN : $q->mysql_error");}
 	while($ligne=mysql_fetch_array($results,MYSQL_ASSOC)){
 		$iroute=array();
 		$sitename=$ligne["sitename"];
 		$FixedIPAddr=$ligne["FixedIPAddr"];
 		if(!is_numeric($FixedIPAddr)){$FixedIPAddr=0;}
 		
 		if($IP_START_PREFIX<>null){
 			if($FixedIPAddr>2){
 				if($FixedIPAddr<255){
 					echo "Starting......: OpenVPN $sitename $IP_START_PREFIX.$FixedIPAddr fixed IP address\n";
 					$iroute[]="ifconfig-push $IP_START_PREFIX.$FixedIPAddr $IP_START_PREFIX.2";
 				}
 			}
 		}
 		
 		if(!isset($already[$ligne["IP_START"]])){
 			echo "Starting......: OpenVPN $sitename ({$ligne["IP_START"]} {$ligne["netmask"]})\n";
 			$rou[]=" --route {$ligne["IP_START"]} {$ligne["netmask"]}";
 			$iroute[]="iroute {$ligne["IP_START"]} {$ligne["netmask"]}";
 			$already[$ligne["IP_START"]]=true;
 		}
 		
 		$remote_site_routes=unserialize(base64_decode($ligne["remote_site_routes"]));
		while (list ($num, $site_mask) = each ($remote_site_routes) ){
			if(!isset($already[$num])){
				echo "Starting......: OpenVPN $sitename ($num $site_mask)\n";
				$rou[]=" --route $num $site_mask";
				$iroute[]="iroute $num $site_mask";
				$already[$num]=true;
			}
		}
 		echo "Starting......: OpenVPN cdd $sitename\n";
 		@file_put_contents("/etc/openvpn/cdd/$sitename",@implode("\n", $iroute) );
 		
 	}
 	if(count($rou)>0){
 		$localroutes=@implode(" ", $rou);
 		$client_config_dir=" --client-config-dir /etc/openvpn/cdd";
 	}
 	
 	 
 	
 	$LDAP_AUTH=$ini->_params["GLOBAL"]["LDAP_AUTH"];
 	if($LDAP_AUTH==1){
 		if(is_file("/usr/lib/openvpn/openvpn-auth-pam.so")){
 		$plugin=" --plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth";
 		echo "Starting......: OpenVPN auth is enabled\n";
 		shell_exec("/usr/share/artica-postfix/bin/artica-install --nsswitch");
 		}
 	}
   
   @mkdir("/etc/openvpn/ccd",0666,true);
   $php5=$unix->LOCATE_PHP5_BIN();
   $me=__FILE__;
   $cmd=" --port $port --dev tun $proto --server $IP_START $NETMASK$localroutes$client_config_dir --comp-lzo $local --ca $ca --dh $dh --key $key --cert $crt";
   $cmd=$cmd. "$ifconfig_pool_persist " . implode(" ",$routess);
   $cmd=$cmd. " $askpass$duplicate_cn--client-to-client$script_security$plugin --learn-address \"$php5 $me --client-connect\" --keepalive 10 60 --persist-tun --verb 5 --daemon --writepid /var/run/openvpn/openvpn-server.pid --log \"/var/log/openvpn/openvpn.log\"";
   $cmd=$cmd. " --status /var/log/openvpn/openvpn-status.log 10";
   echo "Starting......: OpenVPN building /etc/openvpn/cmdline.conf done\n";
   @file_put_contents("/etc/openvpn/cmdline.conf",$cmd);
  
   
   $sock->SaveConfigFile($ini->toString(),"ArticaOpenVPNSettings");
   send_email_events("OpenVPN was successfully reconfigured",$cmd,"VPN");
   echo "Starting......: OpenVPN building settings done.\n";
   if($GLOBALS["VERBOSE"]){writelogs("$cmd",__FUNCTION__,__FILE__,__LINE__);}
}
Beispiel #2
0
function BuildTunServer()
{
    $unix = new unix();
    $sock = new sockets();
    $servername = $unix->hostname_g();
    if (preg_match("#^(.+?)\\.#", $servername, $re)) {
        $servername = $re[1];
    }
    $servername = strtoupper($servername);
    echo "Starting......: OpenVPN building settings for {$servername}...\n";
    $ini = new Bs_IniHandler();
    $sock = new sockets();
    $ini->loadString($sock->GET_INFO("ArticaOpenVPNSettings"));
    if ($ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"] == 1) {
        echo "Starting......: OpenVPN building settings mode bridge enabled...\n";
        BuildBridgeServer();
        return;
    }
    $IPTABLES_ETH = $GLOBALS["IPTABLES_ETH"];
    $DEV_TYPE = $ini->_params["GLOBAL"]["DEV_TYPE"];
    $port = $ini->_params["GLOBAL"]["LISTEN_PORT"];
    $IP_START = $ini->_params["GLOBAL"]["IP_START"];
    $NETMASK = $ini->_params["GLOBAL"]["NETMASK"];
    $bind_addr = $ini->_params["GLOBAL"]["LOCAL_BIND"];
    if (trim($port) == null) {
        $port = 1194;
    }
    if (trim($IP_START) == null) {
        $IP_START = "10.8.0.0";
    }
    if (trim($NETMASK) == null) {
        $IP_START = "255.255.255.0";
    }
    $nic = new networking();
    while (list($num, $ligne) = each($nic->array_TCP)) {
        if ($ligne == null) {
            continue;
        }
        $eths[][$num] = $num;
        $ethi[$num] = $ligne;
    }
    if ($IPTABLES_ETH != null) {
        echo "Starting......: OpenVPN linked to {$IPTABLES_ETH} ({$ethi[$IPTABLES_ETH]})...\n";
        $IPTABLES_ETH_ROUTE = IpCalcRoute($ethi[$IPTABLES_ETH]);
    } else {
        echo "Starting......: OpenVPN no local NIC linked...\n";
    }
    $ca = '/etc/artica-postfix/openvpn/keys/allca.crt';
    $dh = '/etc/artica-postfix/openvpn/keys/dh1024.pem';
    $key = "/etc/artica-postfix/openvpn/keys/vpn-server.key";
    $crt = "/etc/artica-postfix/openvpn/keys/vpn-server.crt";
    $route = '';
    //$IPTABLES_ETH_IP=
    if (is_file('/etc/artica-postfix/settings/Daemons/OpenVPNRoutes')) {
        $routes = explode("\n", @file_get_contents("/etc/artica-postfix/settings/Daemons/OpenVPNRoutes"));
        while (list($num, $ligne) = each($routes)) {
            if (!preg_match("#(.+?)\\s+(.+)#", $ligne, $re)) {
                continue;
            }
            $routess[] = "--push \"route {$re[1]} {$re[2]}\"";
        }
    }
    $routess[] = GetRoutes();
    if (count($routess) == 0) {
        if ($IPTABLES_ETH_ROUTE != null) {
            echo "Starting......: OpenVPN IP adding default route \"{$IPTABLES_ETH_ROUTE}\"\n";
            $routess[] = "--push \"route {$IPTABLES_ETH_ROUTE}\"";
        }
    } else {
        echo "Starting......: OpenVPN IP adding " . count($routess) . " routes\n";
    }
    if (trim($bind_addr) != null) {
        $local = " --local {$bind_addr}";
        echo "Starting......: OpenVPN IP bind {$bind_addr}\n";
    }
    $IP_START = FIX_IP_START($IP_START, $local);
    $ini->set("GLOBAL", "IP_START", $IP_START);
    if (preg_match("#(.+?)\\.([0-9]+)\$#", $IP_START, $re)) {
        $calc_ip = " {$re[1]}.0";
        $calc_ip_end = "{$re[1]}.254";
        echo "Starting......: OpenVPN IP pool from {$re[1]}.2 to {$re[1]}.254 mask:{$NETMASK}\n";
        $server_ip = "{$re[1]}.1";
    }
    if ($NETMASK == null) {
        $ip = new IP();
        $cdir = $ip->ip2cidr($calc_ip, $calc_ip_end);
        $arr = $ip->parseCIDR($cdir);
        $rang = $arr[0];
        $netbit = $arr[1];
        $ipv = new ipv4($calc_ip, $netbit);
        $NETMASK = $ipv->netmask();
        if ($NETMASK == "255.255.255.255") {
            $NETMASK = "255.255.255.0";
        }
        echo "Starting......: OpenVPN Netmask is null for the range {$calc_ip}, assume {$NETMASK}\n";
        $ini->set("GLOBAL", "NETMASK", $NETMASK);
    }
    $OpenVpnPasswordCert = $sock->GET_INFO("OpenVpnPasswordCert");
    if ($OpenVpnPasswordCert == null) {
        $OpenVpnPasswordCert = "MyKey";
    }
    if (is_file("/etc/artica-postfix/openvpn/keys/password")) {
        $askpass = "******";
    }
    $cmd = " --port {$port} --dev tun --server {$IP_START} {$NETMASK} --comp-lzo {$local} --ca {$ca} --dh {$dh} --key {$key} --cert {$crt}";
    $cmd = $cmd . " --ifconfig-pool-persist /etc/artica-postfix/openvpn/ipp.txt " . implode(" ", $routess);
    $cmd = $cmd . " {$askpass}--client-to-client --persist-tun --verb 5 --daemon --writepid /var/run/openvpn/openvpn-server.pid --log \"/var/log/openvpn/openvpn.log\"";
    $cmd = $cmd . " --status /var/log/openvpn/openvpn-status.log 10";
    @file_put_contents("/etc/openvpn/cmdline.conf", $cmd);
    $sock->SaveConfigFile($ini->toString(), "ArticaOpenVPNSettings");
    echo "Starting......: OpenVPN building settings done.\n";
    if ($GLOBALS["VERBOSE"]) {
        writelogs("{$cmd}", __FUNCTION__, __FILE__, __LINE__);
    }
}