pfSense

<?php

/*

 * status_ipsec.php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2004-2016 Rubicon Communications, LLC (Netgate)

 * All rights reserved.

 *

 * originally based on m0n0wall (http://m0n0.ch/wall)

 * Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>.

 * All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions are met:

 *

 * 1. Redistributions of source code must retain the above copyright notice,

 *    this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this software

 *    must display the following acknowledgment:

 *    "This product includes software developed by the pfSense Project

 *    for use in the pfSense® software distribution. (http://www.pfsense.org/).

 *

 * 4. The names "pfSense" and "pfSense Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    coreteam@pfsense.org.

 *

 * 5. Products derived from this software may not be called "pfSense"

 *    nor may "pfSense" appear in their names without prior written

 *    permission of the Electric Sheep Fencing, LLC.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *

 * "This product includes software developed by the pfSense Project

 * for use in the pfSense software distribution (http://www.pfsense.org/).

 *

 * THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 */

##|+PRIV

##|*IDENT=page-status-ipsec

##|*NAME=Status: IPsec

##|*DESCR=Allow access to the 'Status: IPsec' page.

##|*MATCH=status_ipsec.php*

##|-PRIV

require_once("guiconfig.inc");

require_once("ipsec.inc");

global $g;

if (!is_array($config['ipsec']['phase1'])) {

	$config['ipsec']['phase1'] = array();

}

// If this is just an AJAX call to update the table body, just generate the body and quit

if ($_REQUEST['ajax']) {

	print_ipsec_body();

	exit;

}

if ($_GET['act'] == 'connect') {

	if (ctype_digit($_GET['ikeid'])) {

		$ph1ent = ipsec_get_phase1($_GET['ikeid']);

		if (!empty($ph1ent)) {

			if (empty($ph1ent['iketype']) || $ph1ent['iketype'] == 'ikev1' || isset($ph1ent['splitconn'])) {

				$ph2entries = ipsec_get_number_of_phase2($_GET['ikeid']);

				for ($i = 0; $i < $ph2entries; $i++) {

					$connid = escapeshellarg("con{$_GET['ikeid']}00{$i}");

					mwexec_bg("/usr/local/sbin/ipsec down {$connid}");

					mwexec_bg("/usr/local/sbin/ipsec up {$connid}");

				}

			} else {

				mwexec_bg("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']));

				mwexec_bg("/usr/local/sbin/ipsec up con" . escapeshellarg($_GET['ikeid']));

			}

		}

	}

} else if ($_GET['act'] == 'ikedisconnect') {

	if (ctype_digit($_GET['ikeid'])) {

		if (!empty($_GET['ikesaid']) && ctype_digit($_GET['ikesaid'])) {

			mwexec_bg("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']) . "[" . escapeshellarg($_GET['ikesaid']) . "]");

		} else {

			mwexec_bg("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']));

		}

	}

} else if ($_GET['act'] == 'childdisconnect') {

	if (ctype_digit($_GET['ikeid'])) {

		if (!empty($_GET['ikesaid']) && ctype_digit($_GET['ikesaid'])) {

			mwexec_bg("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']) . "{" . escapeshellarg($_GET['ikesaid']) . "}");

		}

	}

}

// Table body is composed here so that it can be more easily updated via AJAX

function print_ipsec_body() {

	global $config;

	$a_phase1 = &$config['ipsec']['phase1'];

	$status = ipsec_list_sa();

	$ipsecconnected = array();

	if (is_array($status)) {

		foreach ($status as $ikeid => $ikesa) {

			$con_id = substr($ikeid, 3);

			if ($ikesa['version'] == 1) {

				$ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00'));

				$ipsecconnected[$ph1idx] = $ph1idx;

			} else {

				if (!ipsec_ikeid_used($con_id)) {

					// probably a v2 with split connection then

					$ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00'));

					$ipsecconnected[$ph1idx] = $ph1idx;

				} else {

					$ipsecconnected[$con_id] = $ph1idx = $con_id;

				}

			}

			print("<tr>\n");

			print("<td>\n");

			print(htmlspecialchars(ipsec_get_descr($ph1idx)));

			print("</td>\n");

			print("<td>\n");

			if (!empty($ikesa['local-id'])) {

				if ($ikesa['local-id'] == '%any') {

					print(gettext('Any identifier'));

				} else {

					print(htmlspecialchars($ikesa['local-id']));

				}

			} else {

				print(gettext("Unknown"));

			}

			print("</td>\n");

			print("<td>\n");

			if (!empty($ikesa['local-host'])) {

				print(htmlspecialchars($ikesa['local-host']));

			} else {

				print(gettext("Unknown"));

			}

			/*

			 * XXX: local-nat-t was defined by pfSense

			 * When strongswan team accepted the change, they changed it to

			 * nat-local. Keep both for a while and remove local-nat-t in

			 * the future

			 */

			if (isset($ikesa['local-nat-t']) || isset($ikesa['nat-local'])) {

				print(" NAT-T");

			}

			print("</td>\n");

			print("<td>\n");

			$identity = "";

			if (!empty($ikesa['remote-id'])) {

				if ($ikesa['remote-id'] == '%any') {

					$identity = htmlspecialchars(gettext('Any identifier'));

				} else {

					$identity = htmlspecialchars($ikesa['remote-id']);

				}

			}

			if (!empty($ikesa['remote-xauth-id'])) {

				echo htmlspecialchars($ikesa['remote-xauth-id']);

				echo "<br/>{$identity}";

			} elseif (!empty($ikesa['remote-eap-id'])) {

				echo htmlspecialchars($ikesa['remote-eap-id']);

				echo "<br/>{$identity}";

			} else {

				if (empty($identity)) {

					print(gettext("Unknown"));

				} else {

					print($identity);

				}

			}

			print("</td>\n");

			print("<td>\n");

			if (!empty($ikesa['remote-host'])) {

				print(htmlspecialchars($ikesa['remote-host']));

			} else {

				print(gettext("Unknown"));

			}

			/*

			 * XXX: remote-nat-t was defined by pfSense

			 * When strongswan team accepted the change, they changed it to

			 * nat-remote. Keep both for a while and remove remote-nat-t in

			 * the future

			 */

			if (isset($ikesa['remote-nat-t']) || isset($ikesa['nat-remote'])) {

				print(" NAT-T");

			}

			print("</td>\n");

			print("<td>\n");

			print("IKEv" . htmlspecialchars($ikesa['version']));

			print("<br/>\n");

			if ($ikesa['initiator'] == 'yes') {

				print("initiator");

			} else {

				print("responder");

			}

			print("</td>\n");

			print("<td>\n");

			print(htmlspecialchars($ikesa['reauth-time']) . gettext(" seconds (") . convert_seconds_to_dhms($ikesa['reauth-time']) . ")");

			print("</td>\n");

			print("<td>\n");

			print(htmlspecialchars($ikesa['encr-alg']));

			print("<br/>");

			print(htmlspecialchars($ikesa['integ-alg']));

			print("<br/>");

			print(htmlspecialchars($ikesa['prf-alg']));

			print("<br/>\n");

			print(htmlspecialchars($ikesa['dh-group']));

			print("</td>\n");

			print("<td>\n");

			if ($ikesa['state'] == 'ESTABLISHED') {

				print('<span class="text-success">');

			} else {

				print('<span>');

			}

			print(ucfirst(htmlspecialchars($ikesa['state'])));

			if ($ikesa['state'] == 'ESTABLISHED') {

				print("<br/>" . htmlspecialchars($ikesa['established']) . gettext(" seconds (") . convert_seconds_to_dhms($ikesa['established']) . gettext(") ago"));

			}

			print("</span>");

			print("</td>\n");

			print("<td>\n");

			if ($ikesa['state'] != 'ESTABLISHED') {

				print('<a href="status_ipsec.php?act=connect&amp;ikeid=' . $con_id . '" class="btn btn-xs btn-success" data-toggle="tooltip" title="' . gettext("Connect VPN"). '" >');

				print('<i class="fa fa-sign-in icon-embed-btn"></i>');

				print(gettext("Connect VPN"));

				print("</a>\n");

			} else {

				print('<a href="status_ipsec.php?act=ikedisconnect&amp;ikeid=' . $con_id . '" class="btn btn-xs btn-danger" data-toggle="tooltip" title="' . gettext("Disconnect VPN") . '">');

				print('<i class="fa fa-trash icon-embed-btn"></i>');

				print(gettext("Disconnect"));

				print("</a><br />\n");

			}

			print("</td>\n");

			print("</tr>\n");

			print("<tr>\n");

			print("<td colspan = 10>\n");

			if (is_array($ikesa['child-sas']) && (count($ikesa['child-sas']) > 0)) {

				print('<div>');

				print('<a type="button" id="btnchildsa-' . $ikeid .  '" class="btn btn-sm btn-info">');

				print('<i class="fa fa-plus-circle icon-embed-btn"></i>');

				print(gettext('Show child SA entries'));

				print("</a>\n");

				print("	</div>\n");

				print('<table class="table table-hover table-condensed" id="childsa-' . $ikeid . '" style="display:none">');

				print("<thead>\n");

				print('<tr class="bg-info">');

				print('<th><?=gettext("Local subnets")?></th>');

				print('<th><?=gettext("Local SPI(s)")?></th>');

				print('<th><?=gettext("Remote subnets")?></th>');

				print('<th><?=gettext("Times")?></th>');

				print('<th><?=gettext("Algo")?></th>');

				print('<th><?=gettext("Stats")?></th>');

				print('<th><!-- Buttons --></th>');

				print("</tr\n");

				print("</thead>\n");

				print("<tbody>\n");

				foreach ($ikesa['child-sas'] as $childid => $childsa) {

					print("<tr>");

					print("<td>\n");

					if (is_array($childsa['local-ts'])) {

						foreach ($childsa['local-ts'] as $lnets) {

							print(htmlspecialchars(ipsec_fixup_network($lnets)) . "<br />");

						}

					} else {

						print(gettext("Unknown"));

					}

					print("</td>\n");

					print("<td>\n");

					if (isset($childsa['spi-in'])) {

						print(gettext("Local: ") . htmlspecialchars($childsa['spi-in']));

					}

					if (isset($childsa['spi-out'])) {

						print('<br/>' . gettext('Remote: ') . htmlspecialchars($childsa['spi-out']));

					}

					print("</td>\n");

					print("<td>\n");

					if (is_array($childsa['remote-ts'])) {

						foreach ($childsa['remote-ts'] as $rnets) {

							print(htmlspecialchars(ipsec_fixup_network($rnets)) . '<br />');

						}

					} else {

						print(gettext("Unknown"));

					}

					print("</td>\n");

					print("<td>\n");

					print(gettext("Rekey: ") . htmlspecialchars($childsa['rekey-time']) . gettext(" seconds (") . convert_seconds_to_dhms($childsa['rekey-time']) . ")");

					print('<br/>' . gettext('Life: ') . htmlspecialchars($childsa['life-time']) . gettext(" seconds (") . convert_seconds_to_dhms($childsa['life-time']) . ")");

					print('<br/>' . gettext('Install: ') .htmlspecialchars($childsa['install-time']) . gettext(" seconds (") . convert_seconds_to_dhms($childsa['install-time']) . ")");

					print("</td>\n");

					print("<td>\n");

					print(htmlspecialchars($childsa['encr-alg']) . '<br/>');

					print(htmlspecialchars($childsa['integ-alg']) . '<br/>');

					if (!empty($childsa['prf-alg'])) {

						print(htmlspecialchars($childsa['prf-alg']) . '<br/>');

					}

					if (!empty($childsa['dh-group'])) {

						print(htmlspecialchars($childsa['dh-group']) . '<br/>');

					}

					if (!empty($childsa['esn'])) {

						print(htmlspecialchars($childsa['esn']) . '<br/>');

					}

					print(gettext("IPComp: "));

					if (!empty($childsa['cpi-in']) || !empty($childsa['cpi-out'])) {

						print(htmlspecialchars($childsa['cpi-in']) . " " . htmlspecialchars($childsa['cpi-out']));

					} else {

						print(gettext('none'));

					}

					print("</td>\n");

					print("<td>\n");

					print(gettext("Bytes-In: ") . htmlspecialchars(number_format($childsa['bytes-in'])) . ' (' . htmlspecialchars(format_bytes($childsa['bytes-in'])) . ')<br/>');

					print(gettext("Packets-In: ") . htmlspecialchars(number_format($childsa['packets-in'])) . '<br/>');

					print(gettext("Bytes-Out: ") . htmlspecialchars(number_format($childsa['bytes-out'])) . ' (' . htmlspecialchars(format_bytes($childsa['bytes-out'])) . ')<br/>');

					print(gettext("Packets-Out: ") . htmlspecialchars(number_format($childsa['packets-out'])) . '<br/>');

					print("</td>\n");

					print("<td>\n");

					print('<a href="status_ipsec.php?act=childdisconnect&amp;ikeid=' . $con_id . '&amp;ikesaid=' . $childsa['uniqueid'] . '" class="btn btn-xs btn-warning" data-toggle="tooltip" title="' . gettext('Disconnect Child SA') . '">');

					print('<i class="fa fa-trash icon-embed-btn"></i>');

					print(gettext("Disconnect"));

					print("</a>\n");

					print("</td>\n");

					print("</tr>\n");

				}

				print("</tbody>\n");

				print("	</table>\n");

				print("</td>\n");

				print("</tr>\n");

			}

			unset($con_id);

		}

	}

	$rgmap = array();

	if (is_array($a_phase1)) {

		foreach ($a_phase1 as $ph1ent) {

			if (isset($ph1ent['disabled'])) {

				continue;

			}

			$rgmap[$ph1ent['remote-gateway']] = $ph1ent['remote-gateway'];

			if ($ipsecconnected[$ph1ent['ikeid']]) {

				continue;

			}

			print("<tr>\n");

			print("<td>\n");

			print(htmlspecialchars($ph1ent['descr']));

			print("</td>\n");

			print("<td>\n");

			list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, "local");

			if (empty($myid_data)) {

				print(gettext("Unknown"));

			} else {

				print(htmlspecialchars($myid_data));

			}

			print("</td>\n");

			print("<td>\n");

			$ph1src = ipsec_get_phase1_src($ph1ent);

			if (empty($ph1src)) {

				print(gettext("Unknown"));

			} else {

				print(htmlspecialchars($ph1src));

			}

			print("</td>\n");

			print("<td>\n");

			list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, "peer", $rgmap);

			if (empty($peerid_data)) {

				print(gettext("Unknown"));

			} else {

				print(htmlspecialchars($peerid_data));

			}

			print("			</td>\n");

			print("			<td>\n");

			$ph1src = ipsec_get_phase1_dst($ph1ent);

			if (empty($ph1src)) {

				print(gettext("Unknown"));

			} else {

				print(htmlspecialchars($ph1src));

			}

			print("</td>\n");

			print("<td>\n");

			print("</td>\n");

			print("<td>\n");

			print("</td>\n");

			print("<td>\n");

			print("</td>\n");

			if (isset($ph1ent['mobile'])) {

				print("<td>\n");

				print(gettext("Awaiting connections"));

				print("</td>\n");

				print("<td>\n");

				print("</td>\n");

				print("</td>\n");

			} else {

				print("<td>\n");

				print(gettext("Disconnected"));

				print("</td>\n");

				print("<td>\n");

				print('<a href="status_ipsec.php?act=connect&amp;ikeid=' . $ph1ent['ikeid'] . '" class="btn btn-xs btn-success">');

				print('<i class="fa fa-sign-in icon-embed-btn"></i>');

				print(gettext("Connect VPN"));

				print("</a>\n");

				print("</td>\n");

			}

			print("</tr>\n");

		}

	}

	unset($ipsecconnected, $phase1, $rgmap);

}

$pgtitle = array(gettext("Status"), gettext("IPsec"), gettext("Overview"));

$pglinks = array("", "@self", "@self");

$shortcut_section = "ipsec";

include("head.inc");

$tab_array = array();

$tab_array[] = array(gettext("Overview"), true, "status_ipsec.php");

$tab_array[] = array(gettext("Leases"), false, "status_ipsec_leases.php");

$tab_array[] = array(gettext("SADs"), false, "status_ipsec_sad.php");

$tab_array[] = array(gettext("SPDs"), false, "status_ipsec_spd.php");

display_top_tabs($tab_array);

?>

<div class="panel panel-default">

	<div class="panel-heading"><h2 class="panel-title"><?=gettext("IPsec Status");?></h2></div>

	<div class="panel-body table-responsive">

		<table class="table table-striped table-condensed table-hover sortable-theme-bootstrap" data-sortable>

			<thead>

				<tr>

					<th><?=gettext("Description")?></th>

					<th><?=gettext("Local ID")?></th>

					<th><?=gettext("Local IP")?></th>

					<th><?=gettext("Remote ID")?></th>

					<th><?=gettext("Remote IP")?></th>

					<th><?=gettext("Role")?></th>

					<th><?=gettext("Reauth")?></th>

					<th><?=gettext("Algo")?></th>

					<th><?=gettext("Status")?></th>

					<th></th>

				</tr>

			</thead>

			<tbody id="ipsec-body">

				<tr>

					<td colspan="10">

						<?=print_info_box(gettext("Collecting IPsec status information."), "warning", "")?>

					</td>

				</tr>

			</tbody>

		</table>

	</div>

</div>

<?php

unset($status);

if (ipsec_enabled()) {

	print('<div class="infoblock">');

} else {

	print('<div class="infoblock blockopen">');

}

print_info_box(sprintf(gettext('IPsec can be configured %1$shere%2$s.'), '<a href="vpn_ipsec.php">', '</a>'), 'info', false);

?>

</div>

<script type="text/javascript">

//<![CDATA[

events.push(function() {

	ajax_lock = false;		// Mutex so we don't make a call until the previous call is finished

	sa_open = new Array();	// Array in which to keep the child SA show/hide state

	// Fetch the tbody contents from the server

	function update_table() {

		if (ajax_lock) {

			return;

		}

		ajax_lock = true;

		ajaxRequest = $.ajax(

			{

				url: "/status_ipsec.php",

				type: "post",

				data: {

					ajax: 	"ajax"

				}

			}

		);

		// Deal with the results of the above ajax call

		ajaxRequest.done(function (response, textStatus, jqXHR) {

			if (!response) {

				response = '<tr><td colspan="10"><?=print_info_box(gettext("No IPsec status information available."), "warning", "")?></td></tr>';

			}

			$('#ipsec-body').html(response);

			ajax_lock = false;

			// Update "Show child SA" handlers

			$('[id^=btnchildsa-]').click(function () {

				show_childsa($(this).prop("id").replace( /^\D+/g, ''));

			});

			// Check the sa_open array for child SAs that have been opened

			$('[id^=childsa-con]').each(function(idx) {

				sa_idx = $(this).prop("id").replace( /^\D+/g, '');

				if (sa_open[sa_idx]) {

					show_childsa(sa_idx);

				}

			});

			// and do it again

			setTimeout(update_table, 5000);

		});

	}

	function show_childsa(said) {

		sa_open[said] = true;

		$('#childsa-con' + said).show();

		$('#btnchildsa-con' + said).hide();

	}

	// Populate the tbody on page load

	update_table();

});

//]]>

</script>

<?php

include("foot.inc"); ?>