summaryrefslogtreecommitdiffstats
path: root/bin/drakvpn
diff options
context:
space:
mode:
Diffstat (limited to 'bin/drakvpn')
-rw-r--r--bin/drakvpn1139
1 files changed, 10 insertions, 1129 deletions
diff --git a/bin/drakvpn b/bin/drakvpn
index 09ddae8..fbf10a6 100644
--- a/bin/drakvpn
+++ b/bin/drakvpn
@@ -1,1136 +1,17 @@
#!/usr/bin/perl
-#
-# author Florin Grad (florin@mandrakesoft.com)
-#
-# Copyright 2005 Mandriva
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2, as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-#
-
+# drakvpn: VPN configuration GUI
+# Olivier Blin, 2006 <oblin@mandriva.com>
+# Licensed under the GPL
+use strict;
use lib qw(/usr/lib/libDrakX);
-use standalone; #- warning, standalone must be loaded very first, for 'explanations'
-
-use common;
-use detect_devices;
+# i18n: IMPORTANT: to get correct namespace (drakx-net instead of libDrakX)
+BEGIN { unshift @::textdomains, 'drakx-net' }
+use standalone;
use interactive;
-use network::network;
-use log;
-use c;
-use network::netconnect;
-use network::shorewall;
-use network::ipsec;
-use Data::Dumper;
-
-$::isInstall and die "Not supported during install.\n";
-
-
-local $_ = join '', @ARGV;
-
-$::Wizard_pix_up = "drakvpn.png";
-$ugtk2::wm_icon = "drakvpn";
-
-my $direct = /-direct/;
-
-my ($kernel_version) = c::kernel_version() =~ /(...)/;
-log::l("[drakvpn] kernel_version $kernel_version");
-
-$kernel_version >= 2.4 or fatal_quit(N("Sorry, we support only 2.4 and above kernels."));
-
-my $tunnels_file = "/etc/shorewall/tunnels";
-my $ipsec_conf = "";
-my $racoon_conf = "/etc/racoon/racoon.conf";
-my $proc_version = "";
-my $ipsec_package = "";
-
-my $in = interactive->vnew('su');
-my $shorewall = network::shorewall::read($in);
-my @section_names;
-
-if ($kernel_version > 2.5) {
- $ipsec_conf = "/etc/ipsec.conf";
-} else {
- $ipsec_conf = "/etc/freeswan/ipsec.conf";
-}
-my $ipsec = network::ipsec::read_ipsec_conf($ipsec_conf,$kernel_version);
-my $racoon = network::ipsec::read_racoon_conf($racoon_conf);
-
-#print network::ipsec::display_ipsec_conf($ipsec_conf,$ipsec,$kernel_version);
-
-$::Wizard_title = N("DrakVPN");
-
-$in->isa('interactive::gtk') and $::isWizard = 1;
-
-my $wait_configuring;
-
-sub fatal_quit ($) {
- log::l("[drakvpn] FATAL: $_[0]");
- undef $wait_configuring;
- $in->ask_warn('', $_[0]);
- quit_global($in, -1);
-}
-
-begin:
-
-#- **********************************
-#- * 0th step: verify if we are already set up
-
-if ($shorewall && any { !/^\s*(?:#|\n)/ } cat_($tunnels_file)) {
- $::Wizard_no_previous = 1;
-
- if (!$shorewall->{disabled}) {
- my $r = $in->ask_from_list_(N("The VPN connection is enabled."),
-N("The setup of a VPN connection has already been done.
-
-It's currently enabled.
-
-What would you like to do?"),
- [ N_("disable"), N_("reconfigure"), N_("dismiss") ]) or quit_global($in, 0);
- # FIXME: reconfigure is not handled
- if ($r eq "disable") {
- if (!$::testing) {
- my $_wait_disabl = $in->wait_message('', N("Disabling VPN..."));
- network::ipsec::stop_daemons();
- }
- foreach ($ipsec_conf, $tunnels_file) {
- if (-f $_) { rename($_, "$_.drakvpndisable") or die "Could not rename $_ to $_.drakvpndisable" }
- }
- network::ipsec::sys("/etc/init.d/shorewall restart >/dev/null");
- log::l("[drakvpn] Disabled");
- $::Wizard_finished = 1;
- $in->ask_okcancel('', N("The VPN connection is now disabled."));
- quit_global($in, 0);
- }
- if ($r eq "dismiss") {
- quit_global($in, 0);
- }
- } else {
- my $r = $in->ask_from_list_(N("VPN connection currently disabled"),
-N("The setup of a VPN connection has already been done.
-
-It's currently disabled.
-
-What would you like to do?"),
- [ N_("enable"), N_("reconfigure"), N_("dismiss") ]);
- # FIXME: reconfigure is not handled
- if ($r eq "enable") {
- foreach ($ipsec_conf, $tunnels_file) {
- rename($_, "$_.old") if -f $_;
- rename("$_.drakvpndisable", $_) or die "Could not find configuration. Please reconfigure.";
- }
- {
- my $_wait_enabl = $in->wait_message('', N("Enabling VPN..."));
- network::ipsec::start_daemons();
- }
- log::l("[drakvpn] Enabled");
- }
- $::Wizard_finished = 1;
- $in->ask_okcancel('', N("The VPN connection is now enabled."));
- quit_global($in, 0);
- if ($r eq "dismiss") {
- quit_global($in, 0);
- }
- }
- }
-
-#- **********************************
-#- * 1st step: detect/setup
-step_ask_confirm:
-
-$::Wizard_no_previous = 1;
-
-$direct or $in->ask_okcancel(N("Simple VPN setup."),
-N("You are about to configure your computer to use a VPN connection.
-
-With this feature, computers on your local private network and computers
-on some other remote private networks, can share resources, through
-their respective firewalls, over the Internet, in a secure manner.
-
-The communication over the Internet is encrypted. The local and remote
-computers look as if they were on the same network.
-
-Make sure you have configured your Network/Internet access using
-drakconnect before going any further."), 1) or goto begin;
-
-undef $::Wizard_no_previous;
-
-if ($kernel_version < 2.5) {
- system("/sbin/modprobe ipsec") if -e "/sbin/modprobe";
- $proc_version = cat_("/proc/net/ipsec_version") if -e "/proc/net/ipsec_version";
- if ($proc_version =~ /super/i) {
- $ipsec_package = "super-freeswan";
- } else {
- $ipsec_package = "freeswan";
- }
-} else {
- $ipsec_package = "ipsec-tools";
- $proc_version = "ipsec native";
-}
-
-$direct or $in->ask_okcancel(N("Simple VPN setup."),
-N("VPN connection.
-
-This program is based on the following projects:
- - FreeSwan: \t\t\thttp://www.freeswan.org/
- - Super-FreeSwan: \t\thttp://www.freeswan.ca/
- - ipsec-tools: \t\t\thttp://ipsec-tools.sourceforge.net/
- - ipsec-howto: \t\thttp://www.ipsec-howto.org
- - the docs and man pages coming with the %s package
-
-Please read AT LEAST the ipsec-howto docs
-before going any further.",$ipsec_package)) or goto begin;
-
-$direct or $in->ask_okcancel(N("Kernel module."),
-N("The kernel needs to have ipsec support.
-
-You're running a %s kernel version.
-
-This kernel has '%s' support.", $kernel_version, $proc_version)) or goto begin;
-
-step_detectsetup:
-
-#my @configured_devices = map { /ifcfg-(\S+)/ } glob('/etc/sysconfig/network-scripts/ifcfg*');
-
-my %aliased_devices;
-/^\s*alias\s+(eth[0-9])\s+(\S+)/ and $aliased_devices{$1} = $2 foreach cat_("/etc/modules.conf");
-
-#- **********************************
-#- * 2nd step: configure
-
-#$wait_configuring = $in->wait_message(N("Configuring..."),
-# N("Configuring scripts, installing software, starting servers..."));
-
-#- if the kernel has super-freeswan support, remove the freeswan package
-#- and vice-versa
-#- if you're using e kernel 2.5 and above with native ipsec support, remove
-#- both freeswan and super-freeswan packages
-
-if (!$::testing && $ipsec_package =~ /super/i && $kernel_version < 2.5) {
- log::l("[drakvpn] removing the freeswan package");
- $in->do_pkgs->remove("freeswan") if -e "/etc/freeswan/ipsec.d/policies/clear";
- log::l("[drakvpn] removing the ipsec-tools package");
- $in->do_pkgs->remove("ipsec-tools") if -e "/sbin/setkey";
- $in->do_pkgs->remove("libipsec-tools0") if -e "/lib/libipsec.so.0";
-} elsif (!$::testing && $kernel_version < 2.5) {
- log::l("[drakvpn] removing the $ipsec_package package");
- $in->do_pkgs->remove("super-freeswan") if -e "/usr/lib/ipsec/auto.advroute";
- log::l("[drakvpn] removing the ipsec-tools package");
- $in->do_pkgs->remove("ipsec-tools") if -e "/sbin/setkey";
- $in->do_pkgs->remove("libipsec-tools0") if -e "/sbin/setkey";
-} else {
- log::l("[drakvpn] removing the freeswan AND the super-freeswan packages");
- $in->do_pkgs->remove("freeswan") if -e "/etc/freeswan/ipsec.d/policies/clear";
- $in->do_pkgs->remove("super-freeswan-doc") if -e "/usr/sbin/ipsec";
- $in->do_pkgs->remove("super-freeswan") if -e "/usr/lib/ipsec/auto.advroute";
-}
-
-
-#- install and setup the RPM packages, if needed
-
-my %rpm2file;
-log::l("[drakvpn] install the $ipsec_package and the shorewall rpm packages");
-if (!$::testing && $ipsec_package =~ /ipsec-tools/i) {
- %rpm2file = ($ipsec_package => '/sbin/setkey',
- shorewall => '/sbin/shorewall');
-} else {
- %rpm2file = ($ipsec_package => '/usr/sbin/ipsec',
- shorewall => '/sbin/shorewall');
-}
-
-#- first: try to install all in one step, if needed
-if (! ($ipsec_package =~ /super/i && -e "/usr/lib/ipsec/auto.advroute" ||
- $ipsec_package =~ /^freeswan/i && -e "/etc/freeswan/ipsec.d/policies/clear" ||
- $ipsec_package =~ /ipsec-tools/i && -e "/sbin/setkey")) {
-
- my @needed_to_install = grep { !-e $rpm2file{$_} } keys %rpm2file;
- @needed_to_install and $in->do_pkgs->install(@needed_to_install) if !$::testing;
- #- second: try one by one if failure detected
- if (!$::testing && any { !-e $rpm2file{$_} } keys %rpm2file) {
- foreach (keys %rpm2file) {
- -e $rpm2file{$_} or $in->do_pkgs->install($_);
- -e $rpm2file{$_} or fatal_quit(N("Problems installing package %s", $_));
- }
- }
-}
-
-undef $wait_configuring;
-
-#- configure the $ipsec_conf file
-#- Add, Remove config|conn entries
-
-step_configuration:
-
-my $c;
-
-my %messages = (ipsec => N("Security Policies"), racoon => N("IKE daemon racoon"));
-
-if ($kernel_version > 2.5) {
- $in->ask_from(N("Configuration file"),
-N("Configuration step!
-
-You need to define the Security Policies and then to
-configure the automatic key exchange (IKE) daemon.
-The KAME IKE daemon we're using is called 'racoon'.
-
-What would you like to configure?\n"),
- [ { val => \$c, type => "list", list => [ keys %messages ], format => sub { $messages{$_[0]} } } ]) or goto step_detectsetup;
-
-} else {
-$in->ask_okcancel(N("Configuration file"),
-N("Next, we will configure the %s file.\n
-
-Simply click on Next.\n", $ipsec_conf)) or goto step_detectsetup;
-
- $c = "configure";
-}
-
-#-------------------------------------------------------------------
-#---------------------- configure ipsec_conf -----------------------
-#-------------------------------------------------------------------
-
-if ($c eq "ipsec" || $c eq "configure") {
-
-step_configure_ipsec_conf:
-
-@section_names = network::ipsec::get_section_names_ipsec_conf($ipsec,$kernel_version) if $ipsec;
-
-my $choice = $section_names[0];
-my $d = $in->ask_from_list_(N("%s entries", $ipsec_conf),
-N("The %s file contents
-is divided into sections.\n
-You can now:\n
- - display, add, edit, or remove sections, then
- - commit the changes
-
-What would you like to do?\n", $ipsec_conf),
- [ N_("_:display here is a verb\nDisplay"), N_("Add"), N_("Edit"), N_("Remove"), N_("Commit") ]) or goto step_configuration;
-
-my $existing_section = "";
-
-#- display $ipsec_conf -------------------------
-
-step_display_ipsec_conf:
-
-if ($d eq "display $ipsec_conf" || $d eq "_:display here is a verb\nDisplay") {
- my $ipsec_exists = 0;
- foreach my $key (keys %$ipsec) {
- $ipsec_exists = 1 if $ipsec->{$key};
- }
- if ($ipsec_exists) {
- $in->ask_okcancel(N("_:display here is a verb\nDisplay configuration"),
- network::ipsec::display_ipsec_conf($ipsec,$kernel_version));
- goto step_configure_ipsec_conf;
- } else {
-$in->ask_okcancel(N("_:display here is a verb\nDisplay configuration"),
-N("The %s file does not exist.\n
-This must be a new configuration.\n
-You'll have to go back and choose 'add'.\n", $ipsec_conf));
- goto step_configure_ipsec_conf;
- }
-
-#- add ---------------------
-
-} elsif ($d eq "Add") {
-
-step_add_section:
-
-if ($kernel_version < 2.5) {
-
-#- add ---- kernel 2.4 part -------------------------------
-
-my $e = $in->ask_from_list_(N("ipsec.conf entries"),
-N("The %s file contains different sections.\n
-Here is its skeleton: 'config setup'
- 'conn default'
- 'normal1'
- 'normal2' \n
-You can now add one of these sections.\n
-Choose the section you would like to add.\n", $ipsec_conf),
- [ N_("config setup"), N_("conn %default"), N_("normal conn"), N_("dismiss") ]) or goto step_configure_ipsec_conf;
- if ($e eq "config setup") {
-
- $existing_section = network::ipsec::already_existing_section_ipsec_conf("config setup", $ipsec, $kernel_version);
-
- if ($existing_section eq "already existing") {
-$in->ask_okcancel(N("Exists!"),
-N("A section with this name already exists.
-The section names have to be unique.\n
-You'll have to go back and add another section
-or change its name.\n"));
- goto step_add_section;
-}
-
- my $config_setup = {
- 1 => [ "config", "setup" ],
- 2 => [ "interfaces", "%defaultroute" ],
- 3 => [ "klipsdebug", "none" ],
- 4 => [ "plutodebug", "none" ],
- 5 => [ "plutoload", "%search" ],
- 6 => [ "plutostart", "%search" ],
- 7 => [ "uniqueids", "yes" ],
- };
- $in->ask_from('',
-N("This section has to be on top of your
-%s file.\n
-Make sure all other sections follow this config
-setup section.\n
-Choose continue or previous when you are done.\n", $ipsec_conf),
- [ { label => N("interfaces"), val => \$config_setup->{2}[1], type => 'entry' },
- { label => N("klipsdebug"), val => \$config_setup->{3}[1], type => 'entry' },
- { label => N("plutodebug"), val => \$config_setup->{4}[1], type => 'entry' },
- { label => N("plutoload"), val => \$config_setup->{5}[1], type => 'entry' },
- { label => N("plutostart"), val => \$config_setup->{6}[1], type => 'entry' },
- { label => N("uniqueids"), val => \$config_setup->{7}[1], type => 'entry' },
- ]
-) or goto step_configure_ipsec_conf;
-
- network::ipsec::add_section_ipsec_conf($config_setup, $ipsec);
-
- goto step_configure_ipsec_conf;
-
- } elsif ($e eq "conn %default") {
-
- $existing_section = network::ipsec::already_existing_section_ipsec_conf("conn %default", $ipsec, $kernel_version);
-
- if ($existing_section eq "already existing") {
-$in->ask_okcancel(N("Exists!"),
-N("A section with this name already exists.
-The section names have to be unique.\n
-You'll have to go back and add another section
-or change its name.\n"));
- goto step_add_section;
-}
-
- my $conn_default = {
- 1 => [ "conn", "%default" ],
- 2 => [ "pfs", "yes" ],
- 3 => [ "keyingtries", "1" ],
- 4 => [ "compress", "yes" ],
- 5 => [ "disablearrivalcheck", "no" ],
- 6 => [ "left", "" ],
- 7 => [ "leftcert", "" ],
- 8 => [ "leftrsasigkey", "%cert" ],
- 9 => [ "leftsubnet", "" ],
- 10 => [ "leftnexthop", "" ],
- };
- $in->ask_from('',
-N("This is the first section after the config
-setup one.\n
-Here you define the default settings.
-All the other sections will follow this one.
-The left settings are optional. If do not define
-them here, globally, you can define them in each
-section.\n",),
- [ { label => N("PFS"), val => \$conn_default->{2}[1], type => 'entry' },
- { label => N("keyingtries"), val => \$conn_default->{3}[1], type => 'entry' },
- { label => N("compress"), val => \$conn_default->{4}[1], type => 'entry' },
- { label => N("disablearrivalcheck"), val => \$conn_default->{5}[1], type => 'entry' },
- { label => N("left"), val => \$conn_default->{6}[1], type => 'entry' },
- { label => N("leftcert"), val => \$conn_default->{7}[1], type => 'entry' },
- { label => N("leftrsasigkey"), val => \$conn_default->{8}[1], type => 'entry' },
- { label => N("leftsubnet"), val => \$conn_default->{9}[1], type => 'entry' },
- { label => N("leftnexthop"), val => \$conn_default->{10}[1], type => 'entry' },
- ]
-) or goto step_configure_ipsec_conf;
-
- network::ipsec::add_section_ipsec_conf($conn_default, $ipsec);
-
- goto step_configure_ipsec_conf;
-
- } elsif ($e eq "normal conn") {
-
-
- my $normal_conn = {
- 1 => [ "conn", "my-connection" ],
- 2 => [ "authby", "rsasig" ],
- 3 => [ "auto", "start" ],
- 4 => [ "left", "" ],
- 5 => [ "leftcert", "" ],
- 6 => [ "leftrsasigkey", "%cert" ],
- 7 => [ "leftsubnet", "" ],
- 8 => [ "leftnexthop", "" ],
- 9 => [ "right", "" ],
- 10 => [ "rightcert", "" ],
- 11 => [ "rightrsasigkey", "%cert" ],
- 12 => [ "rightsubnet", "" ],
- 13 => [ "rightnexthop", "" ],
- };
-
-step_add_normal_conn:
- $in->ask_from('',
-N("Your %s file has several sections, or connections.\n
-You can now add a new section.
-Choose continue when you are done to write the data.\n", $ipsec_conf),
- [ { label => N("section name"), val => \$normal_conn->{1}[1], type => 'entry' },
- { label => N("authby"), val => \$normal_conn->{2}[1], type => 'entry' },
- { label => N("auto"), val => \$normal_conn->{3}[1], type => 'entry' },
- { label => N("left"), val => \$normal_conn->{4}[1], type => 'entry' },
- { label => N("leftcert"), val => \$normal_conn->{5}[1], type => 'entry' },
- { label => N("leftrsasigkey"), val => \$normal_conn->{6}[1], type => 'entry' },
- { label => N("leftsubnet"), val => \$normal_conn->{7}[1], type => 'entry' },
- { label => N("leftnexthop"), val => \$normal_conn->{8}[1], type => 'entry' },
- { label => N("right"), val => \$normal_conn->{9}[1], type => 'entry' },
- { label => N("rightcert"), val => \$normal_conn->{10}[1], type => 'entry' },
- { label => N("rightrsasigkey"), val => \$normal_conn->{11}[1], type => 'entry' },
- { label => N("rightsubnet"), val => \$normal_conn->{12}[1], type => 'entry' },
- { label => N("rightnexthop"), val => \$normal_conn->{13}[1], type => 'entry' },
- ]
-) or goto step_configure_ipsec_conf;
-
- $existing_section = network::ipsec::already_existing_section_ipsec_conf($normal_conn->{1}[0] . " " . $normal_conn->{1}[1], $ipsec, $kernel_version);
-
- if ($existing_section eq "already existing") {
-$in->ask_okcancel(N("Exists!"),
-N("A section with this name already exists.
-The section names have to be unique.\n
-You'll have to go back and add another section
-or change the name of the section.\n"));
- goto step_add_normal_conn;
-}
-
- network::ipsec::add_section_ipsec_conf($normal_conn, $ipsec);
-
- goto step_configure_ipsec_conf;
-
- }
-
-} else {
-
-#- add ---- kernel 2.6 part -------------------------------
-
- my $section = { command => 'spdadd',
- src_range => 'src_network_address',
- dst_range => 'dest_network_address',
- upperspec => 'any',
- flag => '-P',
- direction => 'in or out',
- ipsec => 'ipsec',
- protocol => 'esp',
- mode => 'tunnel',
- src_dest => 'source-destination',
- level => 'require' };
-
-step_add_section_ipsec_conf_k26:
-
- ask_info3('',
-N("Add a Security Policy.\n
-You can now add a Security Policy.\n
-Choose continue when you are done to write the data.\n"), $section) or goto step_configure_ipsec_conf;
-
-# $existing_section = network::ipsec::already_existing_section_ipsec_conf($section->{src_dest}, $ipsec, $kernel_version);
-#
-# if ($existing_section eq "already existing") {
-#$in->ask_okcancel(N("Exists!"),
-#N("A section with this name already exists.
-#The section names have to be unique.\n
-#You'll have to go back and add another section
-#or change the name of the section.\n"));
-# goto step_add_section_ipsec_conf_k26;
-#};
-
- if (!$ipsec->{1}) {
- put_in_hash($ipsec, { max(keys %$ipsec) + 1 => "#!/sbin/setkey -f" });
- put_in_hash($ipsec, { max(keys %$ipsec) + 1 => "flush;" });
- put_in_hash($ipsec, { max(keys %$ipsec) + 1 => "spdflush;" });
- }
-
- network::ipsec::add_section_ipsec_conf($section, $ipsec);
-
- @section_names = network::ipsec::get_section_names_ipsec_conf($ipsec,$kernel_version);
-
- goto step_configure_ipsec_conf;
-}
-
-#- edit ---------------------
-
-} elsif ($d eq "Edit") {
-
-step_edit_ipsec_conf:
-$in->ask_from(N("Edit section"),
-N("Your %s file has several sections or connections.\n
-You can choose here below the one you want to edit
-and then click on next.\n", $ipsec_conf),
- [ { val => \$choice, list => \@section_names, label => N("Section names"), sort => 0, not_edit => 0 } ])
- or goto step_configure_ipsec_conf;
-
-my $number = network::ipsec::matched_section_key_number_ipsec_conf($choice,$ipsec,$kernel_version);
-
-#- edit ---- kernel 2.4 part -------------------------------
-
-if ($kernel_version < 2.5) {
-if ($choice =~ /^version|block|private|clear|packet/) {
-
-$in->ask_okcancel(N("Can not edit!"),
-N("You cannot edit this section.\n
-This section is mandatory for Freeswan 2.X.
-One has to specify version 2.0 on the top
-of the %s file, and eventually, disable or
-enable the opportunistic encryption.\n",$ipsec_conf));
- goto step_edit_ipsec_conf;
-
-} elsif ($choice =~ /^config setup/) {
- $in->ask_from('',
-N("Your %s file has several sections.\n
-You can now edit the config setup section entries.
-Choose continue when you are done to write the data.\n", $ipsec_conf),
-
-[ network::ipsec::dynamic_list($number, $ipsec) ]
-
-) or goto step_configure_ipsec_conf;
-
- goto step_configure_ipsec_conf;
-} elsif ($choice =~ /^conn %default/) {
- $in->ask_from('',
-N("Your %s file has several sections or connections.\n
-You can now edit the default section entries.
-Choose continue when you are done to write the data.\n", $ipsec_conf),
-
-[ network::ipsec::dynamic_list($number, $ipsec) ]
-
-) or goto step_configure_ipsec_conf;
-
- goto step_configure_ipsec_conf;
-
-} elsif ($choice =~ /^conn/) {
-
- $in->ask_from('',
-N("Your %s file has several sections or connections.\n
-You can now edit the normal section entries.\n
-Choose continue when you are done to write the data.\n", $ipsec_conf),
-
-[ network::ipsec::dynamic_list($number, $ipsec) ]
-
-) or goto step_configure_ipsec_conf;
-
- goto step_configure_ipsec_conf;
-
-} else {
-
- goto step_configure_ipsec_conf;
-
-}
-
-#- edit ---- kernel 2.6 part -------------------------------
-
-} else {
-
- ask_info3('',
-N("Edit a Security Policy.\n
-You can now edit a Security Policy.\n
-Choose continue when you are done to write the data.\n"), $ipsec->{$number}) or goto step_configure_ipsec_conf;
-
-goto step_configure_ipsec_conf;
-
-}
-
-#- remove ---------------------
-
-} elsif ($d eq "Remove") {
-$in->ask_from(N("Remove section"),
-N("Your %s file has several sections or connections.\n
-You can choose here below the one you want to remove
-and then click on next.\n", $ipsec_conf),
- [ { val => \$choice, list => \@section_names, label => N("Section names"), sort => 0, not_edit => 0 } ]);
-
- network::ipsec::remove_section_ipsec_conf($choice,$ipsec,$kernel_version);
-
- @section_names = network::ipsec::get_section_names_ipsec_conf($ipsec,$kernel_version) if $ipsec;
-
- goto step_configure_ipsec_conf;
-
-#- continue and write ---------------------
-
-} elsif ($d eq "Commit") {
- log::l("[drakvpn] Modify the $ipsec_conf file");
- network::ipsec::write_ipsec_conf($ipsec_conf, $ipsec,$kernel_version);
- }
-#-------------------------------------------------------------------
-#---------------------- configure racoon_conf -----------------------
-#-------------------------------------------------------------------
-
-} elsif ($c eq "racoon") {
-
-step_configure_racoon_conf:
-
-@section_names = network::ipsec::get_section_names_racoon_conf($racoon) if $racoon;
-
-my $choice = $section_names[0];
-my $d = $in->ask_from_list_(N("%s entries", $racoon_conf),
-N("The racoon.conf file configuration.\n
-The contents of this file is divided into sections.
-You can now:
- - display \t\t (display the file contents)
- - add \t\t (add one section)
- - edit \t\t\t (modify parameters of an existing section)
- - remove \t\t (remove an existing section)
- - commit \t\t (writes the changes to the real file)"),
- [ N_("_:display here is a verb\nDisplay"), N_("Add"), N_("Edit"), N_("Remove"), N_("Commit") ]) or goto step_configuration;
-
-
-#- display $racoon_conf -------------------------
-
-step_display_racoon_conf:
-
-if ($d eq "_:display here is a verb\nDisplay") {
-
- my $racoon_exists = 0;
- foreach my $key (keys %$racoon) {
- $racoon_exists = 1 if $racoon->{$key};
- }
-
- if ($racoon_exists) {
- $in->ask_okcancel(N("_:display here is a verb\nDisplay configuration"),
- network::ipsec::display_racoon_conf($racoon));
- goto step_configure_racoon_conf;
- } else {
-$in->ask_okcancel(N("_:display here is a verb\nDisplay configuration"),
-N("The %s file does not exist\n
-This must be a new configuration.\n
-You'll have to go back and choose configure.\n", $racoon_conf));
- goto step_configure_racoon_conf;
- }
-
-#- add $racoon_conf ------------------------------
-
-} elsif ($d eq "Add") {
-
-step_add_section_racoon:
-
-#my $existing_section = "";
-
-my $e = $in->ask_from_list_(N("racoonf.conf entries"),
-N("The 'add' sections step.\n
-Here below is the racoon.conf file skeleton:
-\t'path'
-\t'remote'
-\t'sainfo' \n
-Choose the section you would like to add.\n"),
- [ N_("path"), N_("remote"), N_("sainfo"), N_("dismiss") ]) or goto step_configure_racoon_conf;
-if ($e eq "path") {
-
- my $path_section = {
- 1 => [ 'path', 'path_type', '"/etc/racoon/certs"' ],
- };
-
- $in->ask_from('',
-N("The 'add path' section step.\n
-The path sections have to be on top of your racoon.conf file.\n
-Put your mouse over the certificate entry to obtain online help."),
- [ { label => N("path type"),
- val => \$path_section->{1}[1],
- list => [ 'certificate', 'pre_shared_key', 'include' ],
- help =>
-N("path include path: specifies a path to include
-a file. See File Inclusion.
- Example: path include '/etc/racoon'
-
-path pre_shared_key file: specifies a file containing
-pre-shared key(s) for various ID(s). See Pre-shared key File.
- Example: path pre_shared_key '/etc/racoon/psk.txt' ;
-
-path certificate path: racoon(8) will search this directory
-if a certificate or certificate request is received.
- Example: path certificate '/etc/cert' ;
-
-File Inclusion: include file
-other configuration files can be included.
- Example: include \"remote.conf\" ;
-
-Pre-shared key File: Pre-shared key file defines a pair
-of the identifier and the shared secret key which are used at
-Pre-shared key authentication method in phase 1."),
-},
- { label => N("real file"), val => \$path_section->{1}[2], type => 'entry' },
- ]
-) or goto step_configure_racoon_conf;
-
-network::ipsec::add_section_racoon_conf($path_section, $racoon);
-} elsif ($e eq "remote") {
- my $main_remote_section = { 1 => [ 'remote', 'address' ],
- 2 => [ 'exchange_mode', 'aggressive,main' ],
- 3 => [ 'generate_policy', 'on' ],
- 4 => [ 'passive', 'on' ],
- 5 => [ 'certificate_type', 'x509', '"my_certificate.pem"', '"my_private_key.pem"' ],
- 6 => [ 'peers_certfile', '"remote.public"' ],
- 7 => [ 'verify_cert', 'on' ],
- 8 => [ 'my_identifier', 'asn1dn' ],
- 9 => [ 'peers_identifier', 'asn1dn' ]
- };
- my $proposal_remote_section = { 1 => [ 'proposal' ],
- 2 => [ 'encryption_algorithm', '3des' ],
- 3 => [ 'hash_algorithm', 'md5' ],
- 4 => [ 'authentication_method', 'rsasig' ],
- 5 => [ 'dh_group', 'modp1024' ]
- };
- ask_info2('',
-N("Make sure you already have the path sections
-on the top of your racoon.conf file.
-
-You can now choose the remote settings.
-Choose continue or previous when you are done.\n"), $main_remote_section, $proposal_remote_section) or goto step_configure_racoon_conf;
-
-network::ipsec::add_section_racoon_conf($main_remote_section, $racoon);
-network::ipsec::add_section_racoon_conf($proposal_remote_section, $racoon);
-} elsif ($e eq "sainfo") {
- my $sainfo_section = { 1 => [ 'sainfo', 'address', '192.168.100.2', 'any', 'address', '10.0.0.2', 'any' ],
- 2 => [ 'pfs_group', '1' ],
- 3 => [ 'lifetime', 'time', '30', 'sec' ],
- 4 => [ 'encryption_algorithm', '3des' ],
- 5 => [ 'authentication_algorithm', 'hmac_sha1' ],
- 6 => [ 'compression_algorithm', 'deflate' ],
- };
- ask_info('',
-N("Make sure you already have the path sections
-on the top of your %s file.
-
-You can now choose the sainfo settings.
-Choose continue or previous when you are done.\n", $racoon_conf), $sainfo_section) or goto step_configure_racoon_conf;
-
-network::ipsec::add_section_racoon_conf($sainfo_section, $racoon);
-}
-
-@section_names = network::ipsec::get_section_names_racoon_conf($racoon) if $racoon;
-
-goto step_configure_racoon_conf;
-
-#- edit $racoon_conf -----------------------------
-
-} elsif ($d eq "Edit") {
-$in->ask_from(N("Edit section"),
-N("Your %s file has several sections or connections.
-
-You can choose here in the list below the one you want
-to edit and then click on next.\n", $racoon_conf),
- [ { val => \$choice, list => \@section_names, label => N("Section names"), sort => 0, not_edit => 0 } ])
- or goto step_configure_racoon_conf;
-
-my $number = network::ipsec::matched_section_key_number_racoon_conf($choice,$racoon);
-
-if ($choice =~ /^remote/) {
- ask_info2('',
-N("Your %s file has several sections.\n
-
-You can now edit the remote section entries.
-
-Choose continue when you are done to write the data.\n", $racoon_conf), $racoon->{$number}, $racoon->{$number+2})
- or goto step_configure_racoon_conf;
-
-} elsif ($choice =~ /^sainfo/) {
- ask_info('',
-N("Your %s file has several sections.
-
-You can now edit the sainfo section entries.
-
-Choose continue when you are done to write the data.", $racoon_conf), $racoon->{$number}) or goto step_configure_racoon_conf;
-
-} elsif ($choice =~ /^path/) {
- $in->ask_from('',
-N("This section has to be on top of your
-%s file.\n
-Make sure all other sections follow these path
-sections.\n
-You can now edit the path entries.
-
-Choose continue or previous when you are done.\n", $racoon_conf),
- [ { label => N("path_type"), val => \$racoon->{$number}{1}[1], list => [ 'certificate', 'pre_shared_key', 'include' ] },
- { label => N("real file"), val => \$racoon->{$number}{1}[2], type => 'entry' },
- ]
-) or goto step_configure_racoon_conf;
-}
-
-goto step_configure_racoon_conf;
-
-#- remove $racoon_conf ---------------------------
-
-} elsif ($d eq "Remove") {
-$in->ask_from(N("Remove section"),
-N("Your %s file has several sections or connections.\n
-You can choose here below the one you want to remove
-and then click on next.\n", $racoon_conf),
- [ { val => \$choice, list => \@section_names, label => N("Section names"), sort => 0, not_edit => 0 } ]);
-
-my $number = network::ipsec::matched_section_key_number_racoon_conf($choice,$racoon);
-network::ipsec::remove_section_racoon_conf($choice,$racoon,$number);
- @section_names = network::ipsec::get_section_names_racoon_conf($racoon) if $racoon;
-
- goto step_configure_racoon_conf;
-
-#- write $racoon_conf and continue ---------------
-} elsif ($d eq "Commit") {
- log::l("[drakvpn] Modify the $racoon_conf file");
- network::ipsec::write_racoon_conf($racoon_conf, $racoon);
-}
-}
-
-#- start the daemons
-network::ipsec::start_daemons();
-
-#- bye-bye message
-
-undef $wait_configuring;
-
-$::Wizard_no_previous = 1;
-$::Wizard_finished = 1;
-
-$in->ask_okcancel(N("Congratulations!"),
-N("Everything has been configured.\n
-You may now share resources through the Internet,
-in a secure way, using a VPN connection.
-
-You should make sure that that the tunnels shorewall
-section is configured."));
-
-log::l("[drakvpn] Installation complete, exiting");
-quit_global($in, 0);
-
-sub quit_global {
- my ($in, $exitcode) = @_;
- $in->exit($exitcode);
- goto begin;
-}
-
-
-sub ask_info {
- my ($title, $text, $data) = @_;
- $in->ask_from($title, $text,
- [ { label => N("Sainfo source address"), val => \$data->{1}[2], type => 'entry',
- help => N("sainfo (source_id destination_id | anonymous) { statements }
-defines the parameters of the IKE phase 2
-(IPsec-SA establishment).
-
-source_id and destination_id are constructed like:
-
- address address [/ prefix] [[port]] ul_proto
-
-Examples: \n
-sainfo anonymous (accepts connections from anywhere)
- leave blank this entry if you want anonymous
-
-sainfo address 203.178.141.209 any address 203.178.141.218 any
- 203.178.141.209 is the source address
-
-sainfo address 172.16.1.0/24 any address 172.16.2.0/24 any
- 172.16.1.0/24 is the source address") },
- { label => N("Sainfo source protocol"), val => \$data->{1}[3], type => 'entry',
- help => N("sainfo (source_id destination_id | anonymous) { statements }
-defines the parameters of the IKE phase 2
-(IPsec-SA establishment).
-
-source_id and destination_id are constructed like:
-
- address address [/ prefix] [[port]] ul_proto
-
-Examples: \n
-sainfo anonymous (accepts connections from anywhere)
- leave blank this entry if you want anonymous
-
-sainfo address 203.178.141.209 any address 203.178.141.218 any
- the first 'any' allows any protocol for the source") },
- { label => N("Sainfo destination address"), val => \$data->{1}[5], type => 'entry',
- help => N("sainfo (source_id destination_id | anonymous) { statements }
-defines the parameters of the IKE phase 2
-(IPsec-SA establishment).
-
-source_id and destination_id are constructed like:
-
- address address [/ prefix] [[port]] ul_proto
-
-Examples: \n
-sainfo anonymous (accepts connections from anywhere)
- leave blank this entry if you want anonymous
-
-sainfo address 203.178.141.209 any address 203.178.141.218 any
- 203.178.141.218 is the destination address
-
-sainfo address 172.16.1.0/24 any address 172.16.2.0/24 any
- 172.16.2.0/24 is the destination address") },
- { label => N("Sainfo destination protocol"), val => \$data->{1}[6], type => 'entry',
- help => N("sainfo (source_id destination_id | anonymous) { statements }
-defines the parameters of the IKE phase 2
-(IPsec-SA establishment).
-
-source_id and destination_id are constructed like:
-
- address address [/ prefix] [[port]] ul_proto
-
-Examples: \n
-sainfo anonymous (accepts connections from anywhere)
- leave blank this entry if you want anonymous
-
-sainfo address 203.178.141.209 any address 203.178.141.218 any
- the last 'any' allows any protocol for the destination") },
- { label => N("PFS group"), val => \$data->{2}[1],
- list => [ qw(modp768 modp1024 modp1536 1 2 5) ],
- help => N("define the group of Diffie-Hellman exponentiations.
-If you do not require PFS then you can omit this directive.
-Any proposal will be accepted if you do not specify one.
-group is one of the following: modp768, modp1024, modp1536.
-Or you can define 1, 2, or 5 as the DH group number.") },
- { label => N("Lifetime number"), val => \$data->{3}[2], type => 'entry',
- help => N("define a lifetime of a certain time which will be pro-
-posed in the phase 1 negotiations. Any proposal will be
-accepted, and the attribute(s) will not be proposed to
-the peer if you do not specify it(them). They can be
-individually specified in each proposal.
-
-Examples: \n
- lifetime time 1 min; # sec,min,hour
- lifetime time 1 min; # sec,min,hour
- lifetime time 30 sec;
- lifetime time 30 sec;
- lifetime time 60 sec;
- lifetime time 12 hour;
-
-So, here, the lifetime numbers are 1, 1, 30, 30, 60 and 12.
-") },
- { label => N("Lifetime unit"), val => \$data->{3}[3],
- list => [ qw(sec min hour) ],
- help => N("define a lifetime of a certain time which will be pro-
-posed in the phase 1 negotiations. Any proposal will be
-accepted, and the attribute(s) will not be proposed to
-the peer if you do not specify it(them). They can be
-individually specified in each proposal.
-
-Examples: \n
- lifetime time 1 min; # sec,min,hour
- lifetime time 1 min; # sec,min,hour
- lifetime time 30 sec;
- lifetime time 30 sec;
- lifetime time 60 sec;
- lifetime time 12 hour;
-
-So, here, the lifetime units are 'min', 'min', 'sec', 'sec', 'sec' and 'hour'.
-") },
- { label => N("Encryption algorithm"), val => \$data->{4}[1],
- list => [ qw(des 3des des_iv64 des_iv32 rc5 rc4 idea 3idea cast128 blowfish null_enc twofish rijndae) ] },
- { label => N("Authentication algorithm"), val => \$data->{5}[1],
- list => [ qw(des 3des des_iv64 des_iv32 hmac_md5 hmac_sha1 non_auth) ] },
- { label => N("Compression algorithm"), val => \$data->{6}[1],
- list => [ N_("deflate") ], format => \&translate, allow_empty_list => 1 }
-
-]) }
-
-sub ask_info2 {
- my ($title, $text, $main_remote_section, $proposal_remote_section) = @_;
- $in->ask_from($title, $text,,
- [ { label => N("Remote"), val => \$main_remote_section->{1}[1], type => 'entry',
- help => N("remote (address | anonymous) [[port]] { statements }
-specifies the parameters for IKE phase 1 for each remote node.
-The default port is 500. If anonymous is specified, the state-
-ments apply to all peers which do not match any other remote
-directive.\n
-Examples: \n
-remote anonymous
-remote ::1 [8000]") },
- { label => N("Exchange mode"), val => \$main_remote_section->{2}[1],
- list => [ qw(main,agressive agressive,main) ],
- help => N("defines the exchange mode for phase 1 when racoon is the
-initiator. Also it means the acceptable exchange mode
-when racoon is responder. More than one mode can be
-specified by separating them with a comma. All of the
-modes are acceptable. The first exchange mode is what
-racoon uses when it is the initiator.\n") },
- { label => N("Generate policy"), val => \$main_remote_section->{3}[1],
- list => [ N_("off"), N_("on") ], format => \&translate,
- help => N("This directive is for the responder. Therefore you
-should set passive on in order that racoon(8) only
-becomes a responder. If the responder does not have any
-policy in SPD during phase 2 negotiation, and the direc-
-tive is set on, then racoon(8) will choice the first pro-
-posal in the SA payload from the initiator, and generate
-policy entries from the proposal. It is useful to nego-
-tiate with the client which is allocated IP address
-dynamically. Note that inappropriate policy might be
-installed into the responder's SPD by the initiator. So
-that other communication might fail if such policies
-installed due to some policy mismatches between the ini-
-tiator and the responder. This directive is ignored in
-the initiator case. The default value is off.") },
- { label => N("Passive"), val => \$main_remote_section->{4}[1],
- list => [ N_("off"), N_("on") ], format => \&translate,
- help => N("If you do not want to initiate the negotiation, set this
-to on. The default value is off. It is useful for a
-server.") },
- { label => N("Certificate type"), val => \$main_remote_section->{5}[1],
- list => [ 'x509' ], allow_empty_list => 1 },
- { label => N("My certfile"), val => \$main_remote_section->{5}[2], type => 'entry',
- help => N("Name of the certificate") },
- { label => N("My private key"), val => \$main_remote_section->{5}[3], type => 'entry',
- help => N("Name of the private key") },
- { label => N("Peers certfile"), val => \$main_remote_section->{6}[1], type => 'entry',
- help => N("Name of the peers certificate") },
- { label => N("Verify cert"), val => \$main_remote_section->{7}[1],
- list => [ N_("off"), N_("on") ], format => \&translate,
- help => N("If you do not want to verify the peer's certificate for
-some reason, set this to off. The default is on.") },
- { label => N("My identifier"), val => \$main_remote_section->{8}[1], type => 'entry',
- help => N("specifies the identifier sent to the remote host and the
-type to use in the phase 1 negotiation. address, FQDN,
-user_fqdn, keyid and asn1dn can be used as an idtype.
-they are used like:
- my_identifier address [address];
- the type is the IP address. This is the default
- type if you do not specify an identifier to use.
- my_identifier user_fqdn string;
- the type is a USER_FQDN (user fully-qualified
- domain name).
- my_identifier FQDN string;
- the type is a FQDN (fully-qualified domain name).
- my_identifier keyid file;
- the type is a KEY_ID.
- my_identifier asn1dn [string];
- the type is an ASN.1 distinguished name. If
- string is omitted, racoon(8) will get DN from
- Subject field in the certificate.\n
-Examples: \n
-my_identifier user_fqdn \"myemail\@mydomain.com\"") },
- { label => N("Peers identifier"), val => \$main_remote_section->{9}[1], type => 'entry' },
- { label => N("Proposal"), val => \$proposal_remote_section->{1}[0], list => [ 'proposal' ], allow_empty_list => 1 },
- { label => N("Encryption algorithm"), val => \$proposal_remote_section->{2}[1], list => [ qw(des 3des blowfish cast128) ],
- help => N("specify the encryption algorithm used for the
-phase 1 negotiation. This directive must be defined.
-algorithm is one of the following:
-
-DES, 3DES, blowfish, cast128 for oakley.
-
-For other transforms, this statement should not be used.") },
- { label => N("Hash algorithm"), val => \$proposal_remote_section->{3}[1], type => 'entry' },
- { label => N("Authentication method"), val => \$proposal_remote_section->{4}[1], type => 'entry' },
- { label => N("DH group"), val => \$proposal_remote_section->{5}[1], list => [ qw(modp768 modp1024 modp1536 1 2 5) ], },
- ]);
-}
-
-sub ask_info3 {
- my ($title, $text, $section) = @_;
- $in->ask_from($title, $text,,
- [ { label => N("Command"), val => \$section->{command}, list => [ 'spdadd' ], allow_empty_list => 1 },
- { label => N("Source IP range"), val => \$section->{src_range}, type => 'entry' },
- { label => N("Destination IP range"), val => \$section->{dst_range}, type => 'entry' },
- { label => N("Upper-layer protocol"), val => \$section->{upperspec}, list => [ N_("any") ],
- format => \&translate, allow_empty_list => 1 },
- { label => N("Flag"), val => \$section->{flag}, list => [ '-P' ], allow_empty_list => 1 },
- { label => N("Direction"), val => \$section->{direction}, list => [ 'in', 'out' ] },
- { label => N("IPsec policy"), val => \$section->{ipsec}, list => [ N_("ipsec"), N_("discard"), N_("none") ],
- format => \&translate },
- { label => N("Protocol"), val => \$section->{protocol}, list => [ 'esp', 'ah', 'ipcomp' ] },
- { label => N("Mode"), val => \$section->{mode}, list => [ N_("tunnel"), N_("transport"), N_("any") ],
- format => \&translate },
- { label => N("Source/destination"), val => \$section->{src_dest}, type => 'entry' },
- { label => N("Level"), val => \$section->{level}, list => [ N_("require"), N_("default"), N_("use"), N_("unique") ],
- format => \&translate },
- ]);
-}
+use network::drakvpn;
+my $in = 'interactive'->vnew('su');
+network::drakvpn::create_connection($in);