Project

General

Profile

Download (15.4 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
	vpn_ipsec.php
4
	part of m0n0wall (http://m0n0.ch/wall)
5

    
6
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
7
	Copyright (C) 2008 Shrew Soft Inc
8
	All rights reserved.
9

    
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12

    
13
	1. Redistributions of source code must retain the above copyright notice,
14
	   this list of conditions and the following disclaimer.
15

    
16
	2. Redistributions in binary form must reproduce the above copyright
17
	   notice, this list of conditions and the following disclaimer in the
18
	   documentation and/or other materials provided with the distribution.
19

    
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
*/
31

    
32
##|+PRIV
33
##|*IDENT=page-vpn-ipsec
34
##|*NAME=VPN: IPsec page
35
##|*DESCR=Allow access to the 'VPN: IPsec' page.
36
##|*MATCH=vpn_ipsec.php*
37
##|-PRIV
38

    
39
require("guiconfig.inc");
40
require_once("functions.inc");
41
require_once("filter.inc");
42
require_once("shaper.inc");
43
require_once("ipsec.inc");
44
require_once("vpn.inc");
45

    
46
if (!is_array($config['ipsec']['phase1']))
47
	$config['ipsec']['phase1'] = array();
48

    
49
if (!is_array($config['ipsec']['phase2']))
50
	$config['ipsec']['phase2'] = array();
51

    
52
$a_phase1 = &$config['ipsec']['phase1'];
53
$a_phase2 = &$config['ipsec']['phase2'];
54

    
55
$pconfig['enable'] = isset($config['ipsec']['enable']);
56

    
57
if ($_POST) {
58

    
59
	if ($_POST['apply']) {
60
		$retval = 0;
61
		$retval = vpn_ipsec_refresh_policies();
62
		$retval = vpn_ipsec_configure();
63
		/* reload the filter in the background */
64
		filter_configure();
65
		$savemsg = get_std_save_message($retval);
66
		if ($retval == 0) {
67
			if (is_subsystem_dirty('ipsec'))
68
				clear_subsystem_dirty('ipsec');
69
		}
70
	} else if ($_POST['submit']) {
71
		$pconfig = $_POST;
72

    
73
		$config['ipsec']['enable'] = $_POST['enable'] ? true : false;
74

    
75
		write_config();
76

    
77
		$retval = vpn_ipsec_configure();
78
	}
79
}
80

    
81
if ($_GET['act'] == "delph1")
82
{
83
	if ($a_phase1[$_GET['p1index']]) {
84
		/* remove static route if interface is not WAN */
85
		if ($a_phase1[$_GET['p1index']]['interface'] <> "wan")
86
			mwexec("/sbin/route delete -host {$a_phase1[$_GET['p1index']]['remote-gateway']}");
87

    
88
		/* remove all phase2 entries that match the ikeid */
89
		$ikeid = $a_phase1[$_GET['p1index']]['ikeid'];
90
		foreach ($a_phase2 as $p2index => $ph2tmp)
91
			if ($ph2tmp['ikeid'] == $ikeid)
92
				unset($a_phase2[$p2index]);
93

    
94
		/* remove the phase1 entry */
95
		unset($a_phase1[$_GET['p1index']]);
96
		vpn_ipsec_refresh_policies();
97
		vpn_ipsec_configure();
98
		write_config();
99
		filter_configure();
100
		header("Location: vpn_ipsec.php");
101
		exit;
102
	}
103
}
104

    
105
if ($_GET['act'] == "delph2")
106
{
107
	if ($a_phase2[$_GET['p2index']]) {
108
		/* remove the phase2 entry */
109
		unset($a_phase2[$_GET['p2index']]);
110
		vpn_ipsec_refresh_policies();
111
		vpn_ipsec_configure();
112
		filter_configure();
113
		write_config();
114
		header("Location: vpn_ipsec.php");
115
		exit;
116
	}
117
}
118

    
119
$pgtitle = array(gettext("VPN"),gettext("IPsec"));
120
$statusurl = "diag_ipsec.php";
121
$logurl = "diag_logs_ipsec.php";
122

    
123
include("head.inc");
124

    
125
?>
126

    
127
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
128
<?php include("fbegin.inc"); ?>
129
<form action="vpn_ipsec.php" method="post">
130
<?php
131
	if ($savemsg)
132
		print_info_box($savemsg);
133
	if ($pconfig['enable'] && is_subsystem_dirty('ipsec'))
134
		print_info_box_np(gettext("The IPsec tunnel configuration has been changed") . ".<br>" . gettext("You must apply the changes in order for them to take effect."));
135
?>
136
<table width="100%" border="0" cellpadding="0" cellspacing="0">
137
	<tr>
138
		<td class="tabnavtbl">
139
			<?php
140
				$tab_array = array();
141
				$tab_array[0] = array(gettext("Tunnels"), true, "vpn_ipsec.php");
142
				$tab_array[1] = array(gettext("Mobile clients"), false, "vpn_ipsec_mobile.php");
143
				$tab_array[2] = array(gettext("Pre-shared keys"), false, "vpn_ipsec_keys.php");
144
				display_top_tabs($tab_array);
145
			?>
146
		</td>
147
	</tr>
148
	<tr>
149
		<td>
150
			<div id="mainarea">
151
				<table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
152
					<tr>
153
						<td class="vtable">
154
							<table border="0" cellspacing="2" cellpadding="0">
155
								<tr>
156
									<td>
157
										<input name="enable" type="checkbox" id="enable" value="yes" <?php if ($pconfig['enable']) echo "checked";?>>
158
									</td>
159
									<td>
160
										<strong><?=gettext("Enable IPsec"); ?></strong>
161
									</td>
162
								</tr>
163
							</table>
164
						</td>
165
					</tr>
166
					<tr>
167
						<td>
168
							<input name="submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">
169
						</td>
170
					</tr>
171
				</table>
172
				<table class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">
173
					<?php
174
						$i = 0;
175
						foreach ($a_phase1 as $ph1ent) {
176
							if (isset( $ph1ent['disabled'])) {
177
								$spans = "<span class=\"gray\">";
178
								$spane = "</span>";
179
							}
180
							else
181
								$spans = $spane = "";
182
						
183
						show_ipsec_header($ph1ent);
184
						$counter++; // used to determine if we need to output header manually (no records exist)
185
					?>					
186
					<tr valign="top" ondblclick="document.location='vpn_ipsec_phase1.php?p1index=<?=$i;?>'">
187
						<td class="listlr">
188
							<?=$spans;?>
189
							<?php
190
								if ($ph1ent['interface']) {
191
									$iflabels = get_configured_interface_with_descr();
192

    
193
									$carplist = get_configured_carp_interface_list();
194
									foreach ($carplist as $cif => $carpip)
195
										$iflabels[$cif] = $carpip." (".get_vip_descr($carpip).")";
196

    
197
									$aliaslist = get_configured_ip_aliases_list();
198
									foreach ($aliaslist as $aliasip => $aliasif)
199
										$iflabels[$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
200

    
201
									$grouplist = return_gateway_groups_array();
202
									foreach ($grouplist as $name => $group) {
203
										if($group[0]['vip'] <> "")
204
											$vipif = $group[0]['vip'];
205
										else
206
											$vipif = $group[0]['int'];
207
										$iflabels[$name] = "GW Group {$name}";
208
									}
209
									$if = htmlspecialchars($iflabels[$ph1ent['interface']]);
210
								}
211
								else
212
									$if = "WAN";
213

    
214
								if (!isset($ph1ent['mobile']))
215
									echo $if."<br>".$ph1ent['remote-gateway'];
216
								else
217
									echo $if."<br><strong>" . gettext("Mobile Client") . "</strong>";
218
							?>
219
							<?=$spane;?>
220
						</td>
221
						<td class="listr">
222
							<?=$spans;?>
223
							<?=$ph1ent['mode'];?>
224
							<?=$spane;?>
225
						</td>
226
						<td class="listr">
227
							<?=$spans;?>
228
							<?=$p1_ealgos[$ph1ent['encryption-algorithm']['name']]['name'];?>
229
							<?php
230
								if ($ph1ent['encryption-algorithm']['keylen']) {
231
									if ($ph1ent['encryption-algorithm']['keylen']=="auto")
232
										echo " (" . gettext("auto") . ")";
233
									else
234
										echo " ({$ph1ent['encryption-algorithm']['keylen']} " . gettext("bits") . ")";
235
								}
236
							?>
237
							<?=$spane;?>
238
						</td>
239
						<td class="listr">
240
							<?=$spans;?>
241
							<?=$p1_halgos[$ph1ent['hash-algorithm']];?>
242
							<?=$spane;?>
243
						</td>
244
						<td class="listbg">
245
							<?=$spans;?>
246
							<?=htmlspecialchars($ph1ent['descr']);?>&nbsp;
247
							<?=$spane;?>
248
						</td>
249
						<td valign="middle" nowrap class="list">
250
							<table border="0" cellspacing="0" cellpadding="1">
251
								<tr>
252
									<td>
253
										<a href="vpn_ipsec_phase1.php?p1index=<?=$i;?>">
254
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase1 entry"); ?>" width="17" height="17" border="0">
255
										</a>
256
									</td>
257
									<td>
258
										<a href="vpn_ipsec.php?act=delph1&p1index=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase1 and all associated phase2 entries?"); ?>')">
259
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase1 entry"); ?>" width="17" height="17" border="0">
260
										</a>
261
									</td>
262
								</tr>
263
								<?php if (!isset($ph1ent['mobile'])): ?>
264
								<tr>
265
									<td>
266
									</td>
267
									<td>
268
										<a href="vpn_ipsec_phase1.php?dup=<?=$i;?>">
269
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("copy phase1 entry"); ?>" width="17" height="17" border="0">
270
										</a>
271
									</td>
272
								</tr>
273
								<?php endif; ?>
274
							</table>
275
						</td>
276
					</tr>
277
					<tr>
278
						<td class="listrborder" colspan="5">
279
							<div id="shph2but-<?=$i?>">
280
								<?php
281
									$phase2count=0;
282
									foreach ($a_phase2 as $ph2ent) {
283
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) 
284
											continue;
285
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) 
286
											continue;
287
										$phase2count++;
288
									}
289
								?>								
290
								<input  type="button" onClick="show_phase2('tdph2-<?=$i?>','shph2but-<?=$i?>')" value="+"></input> - <?php printf(gettext("Show %s Phase-2 entries"), $phase2count); ?></a>
291
							</div>
292
							<table class="tabcont" width="100%" height="100%" border="0" cellspacing="0" cellpadding="0" id="tdph2-<?=$i?>" style="display:none">
293
								<tr>
294
									<td class="listhdrr"><?=gettext("Mode"); ?></td>
295
									<?php if(($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6")): ?>
296
									<td class="listhdrr"><?=gettext("Local Subnet"); ?></td>
297
									<td class="listhdrr"><?=gettext("Remote Subnet"); ?></td>
298
									<?php endif; ?>
299
									<td class="listhdrr"><?=gettext("P2 Protocol"); ?></td>
300
									<td class="listhdrr"><?=gettext("P2 Transforms"); ?></td>
301
									<td class="listhdrr"><?=gettext("P2 Auth Methods"); ?></td>
302
									<td class ="list">
303
										<a href="vpn_ipsec_phase2.php?ikeid=<?=$ph1ent['ikeid'];?><?php if (isset($ph1ent['mobile'])) echo "&mobile=true";?>">
304
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add phase2 entry"); ?>" width="17" height="17" border="0">
305
										</a>
306
									</td>
307
								</tr>
308
								<?php
309
									$j = 0;
310
									foreach ($a_phase2 as $ph2ent) {
311
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) {
312
											$j++;
313
											continue;
314
										}
315

    
316
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) {
317
											$spans = "<span class=\"gray\">";
318
											$spane = "</span>";
319
										}
320
										else
321
											$spans = $spane = "";
322
								?>
323
								<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$j;?>'">
324

    
325
									<td nowrap class="listlr">
326
										<?=$spans;?>
327
											<?=$ph2ent['mode'];?>
328
										<?=$spane;?>
329
									</td>
330
									<?php 
331
										if(($ph2ent['mode'] <> "tunnel") and ($ph2ent['mode'] <> "tunnel6")) {
332
											echo "<td nowrap class=\"listr\">&nbsp;</td><td nowrap class=\"listr\">&nbsp;</td>";
333
										} 
334
									?>
335
									<?php if(($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6")): ?>
336
									<td nowrap class="listr">
337
										<?=$spans;?>
338
											<?=ipsec_idinfo_to_text($ph2ent['localid']); ?>
339
										<?=$spane;?>
340
									</td>
341
									<td nowrap class="listr">
342
										<?=$spans;?>
343
											<?=ipsec_idinfo_to_text($ph2ent['remoteid']); ?>
344
										<?=$spane;?>
345
									</td>
346
									<?php endif; ?>
347
									<td nowrap class="listr">
348
										<?=$spans;?>
349
											<?php echo $p2_protos[$ph2ent['protocol']];	?>
350
										<?=$spane;?>
351
									</td>
352
									<td class="listr">
353
										<?=$spans;?>
354
										<?php
355
											$k = 0;
356
											foreach ($ph2ent['encryption-algorithm-option'] as $ph2ea) {
357
												if ($k++)
358
													echo ", ";
359
												echo $p2_ealgos[$ph2ea['name']]['name'];
360
												if ($ph2ea['keylen']) {
361
													if ($ph2ea['keylen']=="auto")
362
														echo " (" . gettext("auto") . ")";
363
													else
364
														echo " ({$ph2ea['keylen']} " . gettext("bits") . ")";
365
												}
366
											}
367
										?>
368
										<?=$spane;?>
369
									</td>
370
									<td nowrap class="listr">
371
										<?=$spans;?>
372
										<?php
373
											$k = 0;
374
											foreach ($ph2ent['hash-algorithm-option'] as $ph2ha) {
375
												if ($k++)
376
													echo ", ";
377
												echo $p2_halgos[$ph2ha];
378
											}
379
										?>
380
										<?=$spane;?>
381
									</td>
382
									<td nowrap class="list">
383
										<a href="vpn_ipsec_phase2.php?p2index=<?=$j;?>">
384
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase2 entry"); ?>" width="17" height="17" border="0">
385
										</a>
386
										<a href="vpn_ipsec.php?act=delph2&p2index=<?=$j;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
387
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase2 entry"); ?>" width="17" height="17" border="0">
388
										</a>
389
										<a href="vpn_ipsec_phase2.php?dup=<?=$j;?>">
390
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new Phase 2 based on this one"); ?>" width="17" height="17" border="0">
391
										</a>
392
									</td>
393
								</tr>
394

    
395
								<?php
396
										$j++;
397
									}
398
								?>
399
							</table>
400
						</td>
401
					</tr>
402
					<tr>
403
						<td>
404
							&nbsp;
405
						</td>
406
					</tr>
407
					<?php
408
							$i++;
409
						}
410
					if(!$counter)
411
						show_ipsec_header($ph1ent);
412
					?>
413
					<tr>
414
						<td class="list" colspan="5"></td>
415
						<td class="list">
416
							<table border="0" cellspacing="0" cellpadding="1">
417
								<tr>
418
									<td width="17"></td>
419
									<td>
420
										<a href="vpn_ipsec_phase1.php">
421
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add phase1 entry"); ?>" width="17" height="17" border="0">
422
										</a>
423
									</td>
424
								</tr>
425
							</table>
426
						<td>
427
					</tr>
428
					<tr>
429
						<td colspan="4">
430
							<p>
431
								<span class="vexpl">
432
									<span class="red">
433
										<strong><?=gettext("Note"); ?>:<br></strong>
434
									</span>
435
								<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.<br/>
436
									<?=gettext("IPsec Debug Mode can be enabled at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.<br/>
437
									<?=gettext("IPsec can be set to prefer older SAs at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.
438
								</span>
439
							</p>
440
						</td>
441
					</tr>
442
				</table>
443
			</div>
444
		</td>
445
	</tr>
446
</table>
447
</form>
448
<?php include("fend.inc"); ?>
449
<script type="text/javascript">
450
function show_phase2(id, buttonid) {
451
	document.getElementById(buttonid).innerHTML='';
452
	aodiv = document.getElementById(id);
453
	aodiv.style.display = "block";
454
}
455
</script>
456
</body>
457
</html>
458

    
459
<?php
460

    
461
function show_ipsec_header($ph1ent) {
462
	global $g;
463
	if (isset($ph1ent['mobile'])) 
464
		$mobile = "&mobile=true";
465
	?>
466
	<tr>
467
		<td class="listhdrr"><?=gettext("Remote Gateway"); ?></td>
468
		<td class="listhdrr"><?=gettext("Mode"); ?></td>
469
		<td class="listhdrr"><?=gettext("P1 Protocol"); ?></td>
470
		<td class="listhdrr"><?=gettext("P1 Transforms"); ?></td>
471
		<td class="listhdrr"><?=gettext("P1 Description"); ?></td>
472
		<td class ="list">
473
		</td>
474
	</tr>
475

    
476
<?php
477
	
478
}
479

    
480
?>
(231-231/249)