Project

General

Profile

Download (16 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/* $Id$ */
3
/*
4
	diag_ipsec.php
5
	Copyright (C) 2004-2009 Scott Ullrich
6
	Copyright (C) 2008 Shrew Soft Inc <mgrooms@shrew.net>.
7
        Copyright (C) 2013-2014 Electric Sheep Fencing, LP
8
	All rights reserved.
9

    
10
	Parts of this code was originally based on vpn_ipsec_sad.php
11
	Copyright (C) 2003-2004 Manuel Kasper
12

    
13
	Redistribution and use in source and binary forms, with or without
14
	modification, are permitted provided that the following conditions are met:
15

    
16
	1. Redistributions of source code must retain the above copyright notice,
17
	   this list of conditions and the following disclaimer.
18

    
19
	2. Redistributions in binary form must reproduce the above copyright
20
	   notice, this list of conditions and the following disclaimer in the
21
	   documentation and/or other materials provided with the distribution.
22

    
23
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
24
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
25
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
26
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
27
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32
	POSSIBILITY OF SUCH DAMAGE.
33
*/
34

    
35
/*
36
	pfSense_MODULE:	ipsec
37
*/
38

    
39
##|+PRIV
40
##|*IDENT=page-status-ipsec
41
##|*NAME=Status: IPsec page
42
##|*DESCR=Allow access to the 'Status: IPsec' page.
43
##|*MATCH=diag_ipsec.php*
44
##|-PRIV
45

    
46

    
47
global $g;
48

    
49
$pgtitle = array(gettext("Status"),gettext("IPsec"));
50
$shortcut_section = "ipsec";
51

    
52
require("guiconfig.inc");
53
include("head.inc");
54
require("ipsec.inc");
55

    
56
if ($_GET['act'] == 'connect') {
57
	if (ctype_digit($_GET['ikeid'])) {
58
		mwexec("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']));
59
		mwexec("/usr/local/sbin/ipsec up con" . escapeshellarg($_GET['ikeid']));
60
	}
61
} else if ($_GET['act'] == 'ikedisconnect') {
62
	if (ctype_digit($_GET['ikeid'])) {
63
		if (!empty($_GET['ikesaid']) && ctype_digit($_GET['ikesaid']))
64
			mwexec("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']) . "[" . escapeshellarg($_GET['ikesaid']) . "]");
65
		else
66
			mwexec("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']));
67
	}
68
} else if ($_GET['act'] == 'childdisconnect') {
69
	if (ctype_digit($_GET['ikeid'])) {
70
		if (!empty($_GET['ikesaid']) && ctype_digit($_GET['ikesaid']))
71
			mwexec("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']) . "{" . escapeshellarg($_GET['ikesaid']) . "}");
72
	}
73
}
74

    
75
if (!is_array($config['ipsec']['phase1']))
76
    $config['ipsec']['phase1'] = array();
77

    
78
$a_phase1 = &$config['ipsec']['phase1'];
79

    
80
$status = ipsec_smp_dump_status();
81

    
82
?>
83

    
84
<body link="#0000CC" vlink="#0000CC" alink="#0000CC" onload="<?php echo $jsevents["body"]["onload"]; ?>">
85
<?php include("fbegin.inc"); ?>
86
<div id="inputerrors"></div>
87
<table width="100%" border="0" cellpadding="0" cellspacing="0" summary="status ipsec">
88
	<tr>
89
		<td>
90
<?php
91
			$tab_array = array();
92
			$tab_array[0] = array(gettext("Overview"), true, "diag_ipsec.php");
93
			$tab_array[1] = array(gettext("Leases"), false, "diag_ipsec_leases.php");
94
			$tab_array[2] = array(gettext("SAD"), false, "diag_ipsec_sad.php");
95
			$tab_array[3] = array(gettext("SPD"), false, "diag_ipsec_spd.php");
96
			$tab_array[4] = array(gettext("Logs"), false, "diag_logs_ipsec.php");
97
			display_top_tabs($tab_array);
98
?>
99
		</td>
100
	</tr>
101
	<tr>
102
		<td>
103
		<div id="mainarea">
104
		<table width="100%" border="0" cellpadding="6" cellspacing="0" class="tabcont sortable" summary="status">
105
		<thead>
106
			<tr>
107
				<th class="listhdrr nowrap"><?php echo gettext("Description");?></th>
108
				<th class="listhdrr nowrap"><?php echo gettext("Local ID");?></th>
109
				<th class="listhdrr nowrap"><?php echo gettext("Local IP");?></th>
110
				<th class="listhdrr nowrap"><?php echo gettext("Remote ID");?></th>
111
				<th class="listhdrr nowrap"><?php echo gettext("Remote IP");?></th>
112
				<th class="listhdrr nowrap"><?php echo gettext("Role");?></th>
113
				<th class="listhdrr nowrap"><?php echo gettext("Reauth");?></th>
114
				<th class="listhdrr nowrap"><?php echo gettext("Algo");?></th>
115
				<th class="listhdrr nowrap"><?php echo gettext("Status");?></th>
116
				<th class="list nowrap"></th>
117
			</tr>
118
		</thead>
119
		<tbody>
120
<?php
121
	$ipsecconnected = array();
122
	if (is_array($status['query']) && is_array($status['query']['ikesalist']) && is_array($status['query']['ikesalist']['ikesa'])):
123
		foreach ($status['query']['ikesalist']['ikesa'] as $ikeid => $ikesa):
124
			$con_id = substr($ikesa['peerconfig'], 3);
125
			$ipsecconnected[$con_id] = $con_id;
126

    
127
			if (ipsec_phase1_status($status['query']['ikesalist']['ikesa'], $ikesa['id']))
128
				$icon = "pass";
129
			elseif (!isset($config['ipsec']['enable']))
130
				$icon = "block";
131
			else
132
				$icon = "reject";
133
?>
134
			<tr>
135
				<td class="listlr">
136
<?php
137
					echo htmlspecialchars(ipsec_get_descr($con_id));
138
?>
139
				</td>
140
				<td class="listr">
141
<?php
142
				if (!is_array($ikesa['local']))
143
					echo gettext("Unknown");
144
				else {
145
					if (!empty($ikesa['local']['identification'])) {
146
						if ($ikesa['local']['identification'] == '%any')
147
							echo gettext('Any identifier');
148
						else
149
							echo htmlspecialchars($ikesa['local']['identification']);
150
					} else
151
						echo gettext("Unknown");
152
				}
153
?>
154
				</td>
155
				<td class="listr">
156
<?php
157
				if (!is_array($ikesa['local']))
158
					echo gettext("Unknown");
159
				else {
160
					if (!empty($ikesa['local']['address']))
161
						echo htmlspecialchars($ikesa['local']['address']) . '<br/>' .
162
							gettext('Port: ') . htmlspecialchars($ikesa['local']['port']);
163
					else
164
						echo gettext("Unknown");
165
					if ($ikesa['local']['port'] == '4500')
166
						echo " NAT-T";
167
				}
168
?>
169
				</td>
170
				<td class="listr">
171
<?php
172
				if (!is_array($ikesa['remote']))
173
					echo gettext("Unknown");
174
				else {
175
					$identity = "";
176
					if (!empty($ikesa['remote']['identification'])) {
177
						if ($ikesa['remote']['identification'] == '%any')
178
							$identity = 'Any identifier';
179
						else
180
							$identity = htmlspecialchars($ikesa['remote']['identification']);
181
					}
182

    
183
					if (is_array($ikesa['remote']['auth']) && !empty($ikesa['remote']['auth'][0]['identity'])) {
184
						echo htmlspecialchars($ikesa['remote']['auth'][0]['identity']);
185
						echo "<br/>{$identity}";
186
					} else {
187
						if (empty($identity))
188
							echo gettext("Unknown");
189
						else
190
							echo $identity;
191
					}
192
				}
193
?>
194
				</td>
195
				<td class="listr">
196
<?php
197
				if (!is_array($ikesa['remote']))
198
					echo gettext("Unknown");
199
				else {
200
					if (!empty($ikesa['remote']['address']))
201
						echo htmlspecialchars($ikesa['remote']['address']) . '<br/>' .
202
							gettext('Port: ') . htmlspecialchars($ikesa['remote']['port']);
203
					else
204
						echo gettext("Unknown");
205
					if ($ikesa['remote']['port'] == '4500')
206
						echo " NAT-T";
207
				}
208
?>
209
				</td>
210
				<td class="listr">
211
					IKEv<?php echo htmlspecialchars($ikesa['version']);?>
212
					<br/>
213
<?php
214
					echo htmlspecialchars($ikesa['role']);
215
?>
216
				</td>
217
				<td class="listr">
218
<?php
219
					echo htmlspecialchars($ikesa['reauth']);
220
?>
221
				</td>
222
				<td class="listr">
223
<?php
224
					echo htmlspecialchars($ikesa['encalg']);
225
					echo "<br/>";
226
					echo htmlspecialchars($ikesa['intalg']);
227
					echo "<br/>";
228
					echo htmlspecialchars($ikesa['prfalg']);
229
					echo "<br/>";
230
					echo htmlspecialchars($ikesa['dhgroup']);
231
?>
232
				</td>
233
				<td class="listr">
234
					<center>
235
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_<?php echo $icon; ?>.gif" title="<?php echo $ikesa['status']; ?>" alt=""/>
236
						<br/><?php echo htmlspecialchars($ikesa['status']);?>
237
						<br/><?php echo htmlspecialchars($ikesa['established']);?>
238
					</center>
239
				</td>
240
				<td >
241
<?php
242
				if ($icon != "pass"):
243
?>
244
					<center>
245
						<a href="diag_ipsec.php?act=connect&amp;ikeid=<?php echo $con_id; ?>">
246
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_service_start.gif" alt=<?php echo gettext("Connect VPN");?> title=<?php echo gettext("Connect VPN");?> border="0"/>
247
						</a>
248
					</center>
249
<?php
250
				else:
251
?>
252
					<center>
253
						<a href="diag_ipsec.php?act=ikedisconnect&amp;ikeid=<?php echo $con_id; ?>">
254
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_service_stop.gif" alt=<?php echo gettext("Disconnect VPN");?> title=<?php echo gettext("Disconnect VPN");?> border="0"/>
255
						</a>
256
						<a href="diag_ipsec.php?act=ikedisconnect&amp;ikeid=<?php echo $con_id; ?>&amp;ikesaid=<?php echo $ikesa['id']; ?>">
257
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_x.gif" alt=<?php echo gettext("Disconnect VPN Connection");?> title=<?php echo gettext("Disconnect VPN Connection");?> border="0"/>
258
						</a>
259
					</center>
260
<?php
261
				endif;
262
?>
263
				</td>
264
				<td valign="middle" class="list nowrap">
265
					<table border="0" cellspacing="0" cellpadding="1" summary="">
266
					</table>
267
				</td>
268
			</tr>
269
<?php
270
			if (is_array($ikesa['childsalist'])):
271
?>
272
			<tr>
273
				<td class="listrborder" colspan="9">
274
				<div id="btnchildsa-<?=$ikeid;?>">
275
					<input  type="button" onclick="show_childsa('childsa-<?=$ikeid;?>','btnchildsa-<?=$ikeid;?>');" value="+" /> - Show child SA entries
276
				</div>
277
				<table class="tabcont" width="100%" height="100%" border="0" cellspacing="0" cellpadding="0" id="childsa-<?=$ikeid;?>" style="display:none" summary="">
278
					<thead>
279
						<tr>
280
							<th class="listhdrr nowrap"><?php echo gettext("Local subnets");?></th>
281
							<th class="listhdrr nowrap"><?php echo gettext("Local SPI(s)");?></th>
282
							<th class="listhdrr nowrap"><?php echo gettext("Remote subnets");?></th>
283
							<th class="listhdrr nowrap"><?php echo gettext("Times");?></th>
284
							<th class="listhdrr nowrap"><?php echo gettext("Algo");?></th>
285
							<th class="listhdrr nowrap"><?php echo gettext("Stats");?></th>
286
						</tr>
287
					</thead>
288
					<tbody>
289
<?php
290
				if (is_array($ikesa['childsalist']['childsa'])):
291
					foreach ($ikesa['childsalist']['childsa'] as $childsa):
292
?>
293
						<tr valign="top">
294
							<td class="listlr nowrap">
295
<?php
296
							if (is_array($childsa['local']) &&
297
							    is_array($childsa['local']['networks']) &&
298
							    is_array($childsa['local']['networks']['network']))
299
								foreach ($childsa['local']['networks']['network'] as $lnets)
300
									echo htmlspecialchars(ipsec_fixup_network($lnets)) . "<br />";
301
							else
302
								echo gettext("Unknown");
303
?>
304
							</td>
305
							<td class="listr nowrap">
306
<?php
307
							if (is_array($childsa['local']))
308
								echo gettext("Local: ") . htmlspecialchars($childsa['local']['spi']);
309
							if (is_array($childsa['remote']))
310
								echo "<br/>" . gettext("Remote: ") . htmlspecialchars($childsa['remote']['spi']);
311
?>
312
							</td>
313
							<td class="listr nowrap">
314
<?php
315
							if (is_array($childsa['remote']) &&
316
							    is_array($childsa['remote']['networks']) &&
317
							    is_array($childsa['remote']['networks']['network']))
318
								foreach ($childsa['remote']['networks']['network'] as $rnets)
319
									echo htmlspecialchars(ipsec_fixup_network($rnets)) . "<br />";
320
							else
321
								echo gettext("Unknown");
322
?>
323
							</td>
324
							<td class="listr nowrap">
325
<?php
326
								echo gettext("Rekey: ") . htmlspecialchars($childsa['rekey']);
327
								echo "<br/>" . gettext("Life: ") . htmlspecialchars($childsa['lifetime']);
328
								echo "<br/>" . gettext("Install: ") .htmlspecialchars($childsa['installtime']);
329

    
330
?>
331
							</td>
332
							<td class="listr nowrap">
333
<?php
334
								echo htmlspecialchars($childsa['encalg']);
335
								echo "<br/>";
336
								echo htmlspecialchars($childsa['intalg']);
337
								echo "<br/>";
338
								if (!empty($childsa['prfalg'])) {
339
									echo htmlspecialchars($childsa['prfalg']);
340
									echo "<br/>";
341
								}
342
								if (!empty($childsa['dhgroup'])) {
343
									echo htmlspecialchars($childsa['dhgroup']);
344
									echo "<br/>";
345
								}
346
								if (!empty($childsa['esn'])) {
347
									echo htmlspecialchars($childsa['esn']);
348
									echo "<br/>";
349
								}
350
								echo gettext("IPComp: ") . htmlspecialchars($childsa['ipcomp']);
351
?>
352
							</td>
353
							<td class="listr nowrap">
354
<?php
355
								echo gettext("Bytes-In: ") . htmlspecialchars($childsa['bytesin']);
356
								echo "<br/>";
357
								echo gettext("Packets-In: ") . htmlspecialchars($childsa['packetsin']);
358
								echo "<br/>";
359
								echo gettext("Bytes-Out: ") . htmlspecialchars($childsa['bytesout']);
360
								echo "<br/>";
361
								echo gettext("Packets-Out: ") . htmlspecialchars($childsa['packetsout']);
362
?>
363
							</td>
364
							<td>
365
								<center>
366
									<a href="diag_ipsec.php?act=childdisconnect&amp;ikeid=<?php echo $con_id; ?>&amp;ikesaid=<?php echo $childsa['reqid']; ?>">
367
									<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_x.gif" alt=<?php echo gettext("Disconnect Child SA");?> title=<?php echo gettext("Disconnect Child SA");?> border="0"/>
368
									</a>
369
								</center>
370
							</td>
371
							<td class="list nowrap">
372
								&nbsp;
373
							</td>
374
						</tr>
375
<?php
376
					endforeach;
377
				endif;
378
?>
379
						<tr style="display:none;"><td></td></tr>
380
					</tbody>
381
				</table>
382
				</td>
383
			</tr>
384
<?php
385
			endif;
386

    
387
			unset($con_id);
388
		endforeach;
389
	endif;
390

    
391
	$rgmap = array();
392
	foreach ($a_phase1 as $ph1ent):
393
		if (isset($ph1ent['disabled']))
394
			continue;
395
		$rgmap[$ph1ent['remote-gateway']] = $ph1ent['remote-gateway'];
396
		if ($ipsecconnected[$ph1ent['ikeid']])
397
			continue;
398
?>
399
			<tr>
400
				<td class="listlr">
401
<?php
402
					echo htmlspecialchars($ph1ent['descr']);
403
?>
404
				</td>
405
				<td class="listr">
406
<?php
407
				list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, "local");
408
				if (empty($myid_data))
409
					echo gettext("Unknown");
410
				else
411
					echo htmlspecialchars($myid_data);
412
?>
413
				</td>
414
				<td class="listr">
415
<?php
416
				$ph1src = ipsec_get_phase1_src($ph1ent);
417
				if (empty($ph1src))
418
					echo gettext("Unknown");
419
				else
420
					echo htmlspecialchars($ph1src);
421
?>
422
				</td>
423
				<td class="listr">
424
<?php
425
				list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, "peer", $rgmap);
426
				if (empty($peerid_data))
427
					echo gettext("Unknown");
428
				else
429
					echo htmlspecialchars($peerid_data);
430
?>
431
				</td>
432
				<td class="listr">
433
<?php
434
				$ph1src = ipsec_get_phase1_dst($ph1ent);
435
				if (empty($ph1src))
436
					echo gettext("Unknown");
437
				else
438
					echo htmlspecialchars($ph1src);
439
?>
440
				</td>
441
				<td class="listr" >
442
				</td>
443
				<td class="listr" >
444
				</td>
445
				<td class="listr" >
446
				</td>
447
<?php
448
			if (isset($ph1ent['mobile'])):
449
?>
450
				<td class="listr">
451
					<center>
452
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_pass.gif" title=<?php echo gettext("Awaiting connections");?> alt=""/>
453
						<br/><?php echo gettext("Awaiting connections");?>
454
					</center>
455
				</td>
456
				<td valign="middle" class="list nowrap">
457
					<table border="0" cellspacing="0" cellpadding="1" summary="">
458
					</table>
459
				</td>
460
<?php
461
			else:
462
?>
463
				<td class="listr">
464
					<center>
465
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_reject.gif" title=<?php echo gettext("Disconnected");?> alt=""/>
466
						<br/><?php echo gettext("Disconnected");?>
467
					</center>
468
				</td>
469
				<td >
470
					<center>
471
						<a href="diag_ipsec.php?act=connect&amp;ikeid=<?php echo $ph1ent['ikeid']; ?>">
472
						<img src ="/themes/<?php echo $g['theme']; ?>/images/icons/icon_service_start.gif" alt=<?php echo gettext("Connect VPN");?> title=<?php echo gettext("Connect VPN");?> border="0"/>
473
						</a>
474
					</center>
475
				</td>
476
<?php
477
			endif;
478
?>
479
				<td valign="middle" class="list nowrap">
480
					<table border="0" cellspacing="0" cellpadding="1" summary="">
481
					</table>
482
				</td>
483
			</tr>
484
<?php
485
	endforeach;
486
	unset($ipsecconnected, $phase1, $rgmap);
487
?>
488
			<tr style="display:none;"><td></td></tr>
489
		</tbody>
490
		</table>
491
	</div>
492
	</td>
493
	</tr>
494
</table>
495

    
496
<p class="vexpl">
497
	<span class="red">
498
		<strong><?php echo gettext("Note:");?><br /></strong>
499
	</span>
500
	<?php echo gettext("You can configure IPsec");?>
501
	<a href="vpn_ipsec.php">here</a>.
502
</p>
503
<?php unset($status); include("fend.inc"); ?>
504
<script type="text/javascript">
505
//<![CDATA[
506
function show_childsa(id, buttonid) {
507
	document.getElementById(buttonid).innerHTML='';
508
	aodiv = document.getElementById(id);
509
	aodiv.style.display = "block";
510
}
511
//]]>
512
</script>
513
</body>
514
</html>
(14-14/256)