components/Openvpn.php - master - colexar/vpn_ks_api

components/Openvpn.php
209 строк7 KB
Alexander Kashirin
init commit
30 мар 2025, 06:10
30 мар 2025, 06:1053dd7fd
<?php

namespace app\components;

use yii\web\ServerErrorHttpException;

/**
 * Openvpn proxy class
 *
 * @author Aqua
 */
class Openvpn {

    public $server_name = 'openvpn_server';
    public $server_address = '127.0.0.1';
    public $server_port = '1194';
    public $protocol = 'udp';

    /**
     * Secure OpenVPN server installer script
     * @var string
     */
    public $setup_script = 'components/openvpn-install-master/openvpn-install.sh';
    public $network = '10.0.0.0';
    public $netmask = '255.255.255.0';

    /**
     * OpenVPN config path
     * @var string 
     */
    public $openvpn_path = '/etc/openvpn';

//    public $openvpn_path = 'D:/docker/VPN0/openvpn/';


    public function init() {
        parent::init();
        $this->server_address = self::getServerIP();
        $this->server_name = 'openvpn_' . str_replace('.', '', $this->server_address);
    }

    public function create_server($server_name = 'openvpn') {
        if (!file_exists($this->setupScript)) {
            throw new ServerErrorHttpException('Secure OpenVPN server installer script not found');
        }
        $command = <<<COM
            AUTO_INSTALL=y
            APPROVE_INSTALL=y
            APPROVE_IP=y
            IPV6_SUPPORT=n
            PORT_CHOICE=1
            PROTOCOL_CHOICE=1
            DNS=1
            COMPRESSION_ENABLED=n
            CUSTOMIZE_ENC=n
            PASS=1
COM;
        shell_exec($command);
        shell_exec($this->setup_script);
//        shell_exec('export AUTO_INSTALL=y');
    }

    public function create_client($client_name = NULL) {
        // Check if we easy-rsa folder exists
        $easy_rsa_path = realpath($this->easy_rsa_folder);
        if (!$easy_rsa_path)
            die('Please invoke setup() first.' . PHP_EOL);

        // Check client_name
        if (is_null($client_name) OR empty($client_name))
            die('Please input client name that you want to create.' . PHP_EOL);

        // Check if client_name exists in our keys database
        if (in_array($client_name, $this->existing_keys()))
            die('Client name already exists in database.' . PHP_EOL);

        shell_exec('cd ' . $easy_rsa_path . ' && . ./vars && ./pkitool ' . $client_name);
        shell_exec('mkdir ' . $easy_rsa_path . '/keys_packed/' . $client_name);
        shell_exec('cp ' . $easy_rsa_path . '/keys/ca.crt ' . $easy_rsa_path . '/keys_packed/' . $client_name . '/');
        shell_exec('cp ' . $easy_rsa_path . '/keys/' . $client_name . '.crt ' . $easy_rsa_path . '/keys_packed/' . $client_name . '/client.crt');
        shell_exec('cp ' . $easy_rsa_path . '/keys/' . $client_name . '.key ' . $easy_rsa_path . '/keys_packed/' . $client_name . '/client.key');
        shell_exec('cp ' . $easy_rsa_path . '/keys/ta.key ' . $easy_rsa_path . '/keys_packed/' . $client_name . '/');

        $client_conf = $this->generate_client_conf();

        file_put_contents($easy_rsa_path . '/keys_packed/' . $client_name . '/client.conf', $client_conf);

        shell_exec('cd ' . $easy_rsa_path . '/keys_packed && tar -czf ' . $client_name . '.tar.gz ' . $client_name);

        // Generate single file inline config
        $client_conf_inline = $this->create_client_conf_inline($client_name);
        file_put_contents($easy_rsa_path . '/keys_packed/' . $client_name . '_inline.conf', $client_conf_inline);
    }

    public function create_client_conf_inline($client_name = NULL) {
        // Check if we easy-rsa folder exists
        $easy_rsa_path = realpath($this->easy_rsa_folder);
        if (!$easy_rsa_path)
            die('Please invoke setup() first.' . PHP_EOL);

        // Check client_name
        if (is_null($client_name) OR empty($client_name))
            die('Please input client name.' . PHP_EOL);

        $client_key_folder = $easy_rsa_path . '/keys_packed/' . $client_name;
        if (!is_dir($client_key_folder))
            die('Client folder not found.' . PHP_EOL);

        $ca_crt = trim(file_get_contents($client_key_folder . '/ca.crt'));

        $client_crt = trim(file_get_contents($client_key_folder . '/client.crt'));
        preg_match('/(-----BEGIN CERTIFICATE-----)(?s)(.*?)(-----END CERTIFICATE-----)/', $client_crt, $match);
        $client_crt = $match[0];

        $client_key = trim(file_get_contents($client_key_folder . '/client.key'));

        $ta_key = trim(file_get_contents($client_key_folder . '/ta.key'));
        preg_match('/(-----BEGIN OpenVPN Static key V1-----)(?s)(.*?)(-----END OpenVPN Static key V1-----)/', $ta_key, $match);
        $ta_key = $match[0];

        return $this->generate_client_conf_inline($ca_crt, $client_crt, $client_key, $ta_key);
    }

    private function generate_client_conf() {
        return <<<EOT
client
dev tun
proto tcp
remote $this->server_address $this->server_port
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
ns-cert-type server
verb 3
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA
EOT;
    }

    private function generate_client_conf_inline($ca_crt, $client_crt, $client_key, $ta_key) {
        return <<<EOT
client
dev tun
proto tcp
remote $this->server_address $this->server_port
resolv-retry infinite
nobind
persist-key
persist-tun
<ca>
$ca_crt
</ca>
<cert>
$client_crt
</cert>
<key>
$client_key
</key>
key-direction 1
<tls-auth>
$ta_key
</tls-auth>
ns-cert-type server
verb 3
cipher AES-256-CBC
auth SHA512
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA
EOT;
    }

    /**
     * 
     * @param string $keyname
     * @return \DateTime|null Description
     */
    public function getKeyInfo($keyname) {
        $file = file($this->openvpn_path . 'pki/issued/' . $keyname);
        foreach ($file as $line) {
            if (strpos('Not After', $line) !== false) {
                $parts = trim(explode(':', $line));
                $date_str = array_pop($parts); //Sep 13 14:37:09 2023 GMT
                $dt = \DateTime::createFromFormat('M j G:i:s Y e', $date_str);
                return $dt;
            }
        }
        return null;
    }

    public static function getServerIP() {
//        inet 127.0.0.1/8 scope host lo
//    inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
        $shell_out = shell_exec('ip addr show|grep inet');
        if (preg_match('\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', $shell_out, $ips)) {
            foreach ($ips[0] as $ip) { //test
                if (substr($ip, 0, 3) != '127') {
                    return $ip;
                }
            }
        }
        return null;
    }

}