Project

General

Profile

« Previous | Next » 

Revision 235c051f

Added by Jim Pingle about 7 years ago

Rework how IPsec VTI interfaces and reqid specifications for same are formed. Ticket #8544

View differences:

src/etc/inc/interfaces.inc
1212 1212 
	return $gifif;
1213 1213 
}
1214 1214 

  		




  
  1215
  
    
/* Build a list of IPsec interfaces */


  		




  
  1216
  
    
function interface_ipsec_vti_list_p1($ph1ent) {


  		




  
  1217
  
    
	global $config;


  		




  
  1218
  
    
	$iface_list = array();


  		




  
  1219
  
    

  		




  
  1220
  
    
	if (empty($ph1ent) || !is_array($ph1ent) || !is_array($config['ipsec']['phase2'])) {


  		




  
  1221
  
    
		return $iface_list;


  		




  
  1222
  
    
	}


  		




  
  1223
  
    

  		




  
  1224
  
    
	$vtisubnet_spec = ipsec_vti($ph1ent, true);


  		




  
  1225
  
    
	if ((!$vtisubnet_spec || !is_array($vtisubnet_spec))) {


  		




  
  1226
  
    
		return $iface_list;


  		




  
  1227
  
    
	}


  		




  
  1228
  
    

  		




  
  1229
  
    
	/* With IKEv1 or v2+Split, each P2 gets its own conn/reqid/interface */


  		




  
  1230
  
    
	if (!isset($ph1ent['mobile']) && ($keyexchange == 'ikev1' || isset($ph1ent['splitconn']))) {


  		




  
  1231
  
    
		foreach ($vtisubnet_spec as $idx => $vtisub) {


  		




  
  1232
  
    
			$iface_list["ipsec{$ph1ent['ikeid']}00{$idx}"] = gettext("IPsec VTI") . ": ".htmlspecialchars($ph1ent['descr'] . " / " . $vtisub['descr']);


  		




  
  1233
  
    
		}


  		




  
  1234
  
    
	} else {


  		




  
  1235
  
    
		/* For IKEv2, only create one interface with additional addresses as aliases */


  		




  
  1236
  
    
		$iface_list["ipsec{$ph1ent['ikeid']}000"] = gettext("IPsec VTI") . ": ".htmlspecialchars($ph1ent['descr']);


  		




  
  1237
  
    
	}


  		




  
  1238
  
    
	return $iface_list;


  		




  
  1239
  
    
}


  		




  
  1240
  
    
function interface_ipsec_vti_list_all() {


  		




  
  1241
  
    
	global $config;


  		




  
  1242
  
    
	$iface_list = array();


  		




  
  1243
  
    
	if (is_array($config['ipsec']) && is_array($config['ipsec']['phase1']) && is_array($config['ipsec']['phase2'])) {


  		




  
  1244
  
    
		foreach ($config['ipsec']['phase1'] as $ph1ent) {


  		




  
  1245
  
    
			if ($ph1ent['disabled']) {


  		




  
  1246
  
    
				continue;


  		




  
  1247
  
    
			}


  		




  
  1248
  
    
			$iface_list = array_merge($iface_list, interface_ipsec_vti_list_p1($ph1ent));


  		




  
  1249
  
    
		}


  		




  
  1250
  
    
	}


  		




  
  1251
  
    
	return $iface_list;


  		




  
  1252
  
    
}


  		




  
  1253
  
    

  		




  1215
  1254
  
    
function interface_ipsec_vti_configure($ph1ent) {


  		




  1216
  1255
  
    
	global $config;


  		




  1217
  1256
  
    

  		




  ......




  1220
  1259
  
    
	}


  		




  1221
  1260
  
    

  		




  1222
  1261
  
    
	$vtisubnet_spec = ipsec_vti($ph1ent, true);


  		




  
  1262
  
    
	if ((!$vtisubnet_spec || !is_array($vtisubnet_spec))) {


  		




  
  1263
  
    
		return false;


  		




  
  1264
  
    
	}


  		




  1223
  1265
  
    

  		




  1224
  
  
    
	if ($vtisubnet_spec && is_array($vtisubnet_spec)) {


  		




  1225
  
  
    
		$left_spec = ipsec_get_phase1_src($ph1ent);


  		




  1226
  
  
    
		$right_spec = $ph1ent['remote-gateway'];


  		




  1227
  
  
    
		$ipsecif = "ipsec{$ph1ent['ikeid']}";


  		




  1228
  
  
    

  		




  1229
  
  
    
		if (platform_booting() || !does_interface_exist($ipsecif)) {


  		




  1230
  
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " destroy", false);


  		




  1231
  
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " create reqid " . escapeshellarg($ph1ent['ikeid']), false);


  		




  1232
  
  
    
		} else {


  		




  1233
  
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " create reqid " . escapeshellarg($ph1ent['ikeid']), false);


  		




  1234
  
  
    
		}


  		




  
  1266
  
    
	$left_spec = ipsec_get_phase1_src($ph1ent);


  		




  
  1267
  
    
	$right_spec = $ph1ent['remote-gateway'];


  		




  1235
  1268
  
    

  		




  1236
  
  
    
		$inet = is_ipaddrv6($left_spec) ? "inet6" : "inet";


  		




  1237
  
  
    
		mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " {$inet} tunnel " . escapeshellarg($left_spec) . " " . escapeshellarg($right_spec) . " up", false);


  		




  
  1269
  
    
	$iface_addrs = array();


  		




  1238
  1270
  
    

  		




  
  1271
  
    
	/* With IKEv1 or v2+Split, each P2 gets its own conn/reqid/interface */


  		




  
  1272
  
    
	if (!isset($ph1ent['mobile']) && ($keyexchange == 'ikev1' || isset($ph1ent['splitconn']))) {


  		




  
  1273
  
    
		/* Form a single interface for each P2 entry */


  		




  
  1274
  
    
		foreach ($vtisubnet_spec as $idx => $vtisub) {


  		




  
  1275
  
    
			$ipsecifnum = "{$ph1ent['ikeid']}00{$idx}";


  		




  
  1276
  
    
			if (!is_array($iface_addrs[$ipsecifnum])) {


  		




  
  1277
  
    
				$iface_addrs[$ipsecifnum] = array();


  		




  
  1278
  
    
			}


  		




  
  1279
  
    
			$vtisub['alias'] = "";


  		




  
  1280
  
    
			$iface_addrs[$ipsecifnum][] = $vtisub;


  		




  
  1281
  
    
		}


  		




  
  1282
  
    
	} else {


  		




  
  1283
  
    
		/* For IKEv2, only create one interface with additional addresses as aliases */


  		




  
  1284
  
    
		$ipsecifnum = "{$ph1ent['ikeid']}000";


  		




  
  1285
  
    
		if (!is_array($iface_addrs[$ipsecifnum])) {


  		




  
  1286
  
    
			$iface_addrs[$ipsecifnum] = array();


  		




  
  1287
  
    
		}


  		




  1239
  1288
  
    
		$have_v4 = false;


  		




  1240
  1289
  
    
		$have_v6 = false;


  		




  1241
  1290
  
    
		foreach ($vtisubnet_spec as $vtisub) {


  		




  1242
  
  
    
			$alias = "";


  		




  
  1291
  
    
			// Alias stuff


  		




  
  1292
  
    
			$vtisub['alias'] = "";


  		




  1243
  1293
  
    
			if (is_ipaddrv6($vtisub['left'])) {


  		




  1244
  1294
  
    
				if ($have_v6) {


  		




  1245
  
  
    
					$alias = " alias";


  		




  1246
  
  
    
				} else {


  		




  1247
  
  
    
					// Write out gwv6 file


  		




  1248
  
  
    
					file_put_contents("/tmp/{$ipsecif}_routerv6", $vtisub['right']);


  		




  
  1295
  
    
					$vtisub['alias'] = " alias";


  		




  1249
  1296
  
    
				}


  		




  1250
  
  
    
				$inet =  "inet6";


  		




  1251
  1297
  
    
				$have_v6 = true;


  		




  1252
  1298
  
    
			} else {


  		




  1253
  1299
  
    
				if ($have_v4) {


  		




  1254
  
  
    
					$alias = " alias";


  		




  1255
  
  
    
				} else {


  		




  1256
  
  
    
					// Write out gw file


  		




  1257
  
  
    
					file_put_contents("/tmp/{$ipsecif}_router", $vtisub['right']);


  		




  
  1300
  
    
					$vtisub['alias'] = " alias";


  		




  1258
  1301
  
    
				}


  		




  1259
  
  
    
				$inet =  "inet";


  		




  1260
  1302
  
    
				$have_v4 = true;


  		




  1261
  1303
  
    
			}


  		




  1262
  
  
    
			/* ifconfig ipsec0 inet <p2 local> <p2 remote> */


  		




  1263
  
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " {$inet} " . escapeshellarg($vtisub['left']) . " " . escapeshellarg($vtisub['right']) . $alias, false);


  		




  
  1304
  
    
			$iface_addrs[$ipsecifnum][] = $vtisub;


  		




  1264
  1305
  
    
		}


  		




  
  1306
  
    
	}


  		




  1265
  1307
  
    

  		




  1266
  
  
    
		if (!platform_booting()) {


  		




  1267
  
  
    
			system_routing_configure($ipsecif);


  		




  
  1308
  
    
	foreach ($iface_addrs as $ipsecifnum => $addrs) {


  		




  
  1309
  
    
		$ipsecif = "ipsec{$ipsecifnum}";


  		




  
  1310
  
    
		if (!is_array($addrs)) {


  		




  
  1311
  
    
			continue;


  		




  1268
  1312
  
    
		}


  		




  
  1313
  
    
		// Create IPsec interface


  		




  
  1314
  
    
		if (platform_booting() || !does_interface_exist($ipsecif)) {


  		




  
  1315
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " destroy", false);


  		




  
  1316
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " create reqid " . escapeshellarg($ipsecifnum), false);


  		




  
  1317
  
    
		} else {


  		




  
  1318
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " create reqid " . escapeshellarg($ipsecifnum), false);


  		




  
  1319
  
    
		}


  		




  
  1320
  
    

  		




  
  1321
  
    
		/* Apply the outer tunnel addresses to the interface */


  		




  
  1322
  
    
		$inet = is_ipaddrv6($left_spec) ? "inet6" : "inet";


  		




  
  1323
  
    
		mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " {$inet} tunnel " . escapeshellarg($left_spec) . " " . escapeshellarg($right_spec) . " up", false);


  		




  
  1324
  
    

  		




  
  1325
  
    
		/* Loop through all of the addresses for this interface and apply them as needed */


  		




  
  1326
  
    
		foreach ($addrs as $addr) {


  		




  
  1327
  
    
			// apply interface addresses


  		




  
  1328
  
    
			if (is_ipaddrv6($addr['left'])) {


  		




  
  1329
  
    
				$inet = "inet6";


  		




  
  1330
  
    
				$gwtype = "v6";


  		




  
  1331
  
    
			} else {


  		




  
  1332
  
    
				$inet = "inet";


  		




  
  1333
  
    
				$gwtype = "";


  		




  
  1334
  
    
			}


  		




  
  1335
  
    

  		




  
  1336
  
    
			mwexec("/sbin/ifconfig " . escapeshellarg($ipsecif) . " {$inet} " . escapeshellarg($addr['left']) . " " . escapeshellarg($addr['right']) . $addr['alias'], false);


  		




  
  1337
  
    
			/* If alias is empty, this is the first address on the interface and should be used as the gateway. */


  		




  
  1338
  
    
			if (empty($addr['alias'])) {


  		




  
  1339
  
    
				file_put_contents("/tmp/{$ipsecif}_router{$gwtype}", $addr['right']);


  		




  
  1340
  
    
			}


  		




  
  1341
  
    
		}


  		




  
  1342
  
    
	}


  		




  
  1343
  
    

  		




  
  1344
  
    
	if (!platform_booting()) {


  		




  
  1345
  
    
		system_routing_configure($ipsecif);


  		




  1269
  1346
  
    
	}


  		




  1270
  1347
  
    
}


  		




  1271
  1348
  
    

  		




  ......




  1276
  1353
  
    
	}


  		




  1277
  1354
  
    
	if (is_array($config['ipsec']) && is_array($config['ipsec']['phase1']) && is_array($config['ipsec']['phase2'])) {


  		




  1278
  1355
  
    
		foreach ($config['ipsec']['phase1'] as $ph1ent) {


  		




  
  1356
  
    
			if ($ph1ent['disabled']) {


  		




  
  1357
  
    
				continue;


  		




  
  1358
  
    
			}


  		




  1279
  1359
  
    
			interface_ipsec_vti_configure($ph1ent);


  		




  1280
  1360
  
    
		}


  		




  1281
  1361
  
    
	}


  		












  

    
      src/etc/inc/interfaces_fast.inc
    
  





  261
  261
  
    
		} elseif (substr($portname, 0, 4) == 'ovpn') {


  		




  262
  262
  
    
			$descr = $portname . " (" . $ovpn_descrs[substr($portname, 5)] . ")";


  		




  263
  263
  
    
		} elseif (substr($portname, 0, 5) == 'ipsec') {


  		




  264
  
  
    
			$descr = $portname . " (" . $ipsec_descrs[substr($portname, 5)] . ")";


  		




  
  264
  
    
			$descr = $portname . " (" . $ipsec_descrs[$portname] . ")";


  		




  265
  265
  
    
		} else {


  		




  266
  266
  
    
			$descr = $portname . " (" . $portinfo['mac'] . ")";


  		




  267
  267
  
    
		}


  		












  

    
      src/etc/inc/ipsec.inc
    
  





  888
  888
  
    
				$vtisubnet_spec[] = array(


  		




  889
  889
  
    
					'left' => ipsec_idinfo_to_cidr($ph2ent['localid'], true, $ph2ent['mode']),


  		




  890
  890
  
    
					'right' => ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']),


  		




  
  891
  
    
					'descr' => $ph2ent['descr'],


  		




  891
  892
  
    
				);


  		




  892
  893
  
    
			}


  		




  893
  894
  
    
			$is_vti = true;


  		












  

    
      src/etc/inc/vpn.inc
    
  





  1430
  1430
  
    
						//	$ipsecfin .= "\treqid = " . $reqids[$idx] . "\n";


  		




  1431
  1431
  
    
						//}


  		




  1432
  1432
  
    
						if (!empty($vtireq[$idx])) {


  		




  1433
  
  
    
							$ipsecfin .= "\treqid = " . $vtireq[$idx] . "\n";


  		




  
  1433
  
    
							$ipsecfin .= "\treqid = {$ph1ent['ikeid']}00{$idx}\n";


  		




  1434
  1434
  
    
						}


  		




  1435
  1435
  
    
						$ipsecfin .= $ipsecconnect;


  		




  1436
  1436
  
    
						$ipsecfin .= "\trightsubnet = {$rsubnet}\n";


  		




  ......




  1450
  1450
  
    
				//	$ipsecfin .= "\treqid = " . $reqids[0] . "\n";


  		




  1451
  1451
  
    
				//}


  		




  1452
  1452
  
    
				if (!empty($vtireq[$idx])) {


  		




  1453
  
  
    
					$ipsecfin .= "\treqid = " . $vtireq[0] . "\n";


  		




  
  1453
  
    
					$ipsecfin .= "\treqid = {$ph1ent['ikeid']}000\n";


  		




  1454
  1454
  
    
				}


  		




  1455
  1455
  
    
				$ipsecfin .= $ipsecconnect;


  		




  1456
  1456
  
    
				if (!isset($ph1ent['mobile']) && !empty($rightsubnet_spec)) {


  		












  

    
      src/usr/local/www/diag_packet_capture.php
    
  





  134
  134
  
    
		}


  		




  135
  135
  
    
	}


  		




  136
  136
  
    
}


  		




  137
  
  
    
if (is_array($config['ipsec']) && is_array($config['ipsec']['phase1']) && is_array($config['ipsec']['phase2'])) {


  		




  138
  
  
    
	foreach ($config['ipsec']['phase1'] as $ph1ent) {


  		




  139
  
  
    
		if ($ph1ent['disabled']) {


  		




  140
  
  
    
			continue;


  		




  141
  
  
    
		}


  		




  142
  
  
    
		if (ipsec_vti($ph1ent)) {


  		




  143
  
  
    
			$interfaces["ipsec{$ph1ent['ikeid']}"] = gettext("IPsec VTI") . ": ".htmlspecialchars($ph1ent['descr']);


  		




  144
  
  
    
		}


  		




  145
  
  
    
	}


  		




  146
  
  
    
}


  		




  
  137
  
    

  		




  
  138
  
    
$interfaces = array_merge($interfaces, interface_ipsec_vti_list_all());


  		




  147
  139
  
    

  		




  148
  140
  
    
if ($_POST) {


  		




  149
  141
  
    
	$host = $_POST['host'];


  		












  

    
      src/usr/local/www/interfaces_assign.php
    
  





  170
  170
  
    
}


  		




  171
  171
  
    

  		




  172
  172
  
    
global $ipsec_descrs;


  		




  173
  
  
    
$ipsec_descrs = array();


  		




  174
  
  
    
if (is_array($config['ipsec']) && is_array($config['ipsec']['phase1']) && is_array($config['ipsec']['phase2'])) {


  		




  175
  
  
    
	foreach ($config['ipsec']['phase1'] as $ph1ent) {


  		




  176
  
  
    
		if ($ph1ent['disabled']) {


  		




  177
  
  
    
			continue;


  		




  178
  
  
    
		}


  		




  179
  
  
    
		if (ipsec_vti($ph1ent)) {


  		




  180
  
  
    
			$portname = "ipsec{$ph1ent['ikeid']}";


  		




  181
  
  
    
			$portlist[$portname] = $ph1ent;


  		




  182
  
  
    
			$ipsec_descrs[$ph1ent['ikeid']] = $ph1ent['descr'];


  		




  183
  
  
    
		}


  		




  184
  
  
    
	}


  		




  
  173
  
    
$ipsec_descrs = interface_ipsec_vti_list_all();


  		




  
  174
  
    
foreach ($ipsec_descrs as $ifname => $ifdescr) {


  		




  
  175
  
    
	$portlist[$ifname] = array('descr' => $ifdescr);


  		




  185
  176
  
    
}


  		




  186
  177
  
    

  		




  187
  178
  
    

  		












  

    
      src/usr/local/www/status_graph.php
    
  





  51
  51
  
    
		}


  		




  52
  52
  
    
	}


  		




  53
  53
  
    
}


  		




  54
  
  
    
if (is_array($config['ipsec']) && is_array($config['ipsec']['phase1']) && is_array($config['ipsec']['phase2'])) {


  		




  55
  
  
    
	foreach ($config['ipsec']['phase1'] as $ph1ent) {


  		




  56
  
  
    
		if ($ph1ent['disabled']) {


  		




  57
  
  
    
			continue;


  		




  58
  
  
    
		}


  		




  59
  
  
    
		if (ipsec_vti($ph1ent)) {


  		




  60
  
  
    
			$ifdescrs["ipsec{$ph1ent['ikeid']}"] = gettext("IPsec VTI") . ": ".htmlspecialchars($ph1ent['descr']);


  		




  61
  
  
    
		}


  		




  62
  
  
    
	}


  		




  63
  
  
    
}


  		




  
  54
  
    

  		




  
  55
  
    
$ifdescrs = array_merge($ifdescrs, interface_ipsec_vti_list_all());


  		




  64
  56
  
    

  		




  65
  57
  
    
if ($_REQUEST['if']) {


  		




  66
  58
  
    
	$curif = $_REQUEST['if'];


  		












Also available in:  Unified diff