pfSense

$vpn_menu[] = array(gettext("Wireguard"), "/vpn_wg.php");

<?php

/*

 * vpn_ipsec.php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2004-2013 BSD Perimeter

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * Copyright (c) 2014-2020 Rubicon Communications, LLC (Netgate)

 * All rights reserved.

 *

 * originally based on m0n0wall (http://m0n0.ch/wall)

 * Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>.

 * All rights reserved.

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

##|+PRIV

##|*IDENT=page-vpn-ipsec

##|*NAME=VPN: IPsec

##|*DESCR=Allow access to the 'VPN: IPsec' page.

##|*MATCH=vpn_ipsec.php*

##|-PRIV

require_once("guiconfig.inc");

require_once("functions.inc");

require_once("filter.inc");

require_once("shaper.inc");

require_once("ipsec.inc");

require_once("vpn.inc");

init_config_arr(array('ipsec', 'phase1'));

init_config_arr(array('ipsec', 'phase2'));

$a_phase1 = &$config['ipsec']['phase1'];

$a_phase2 = &$config['ipsec']['phase2'];

if ($_POST['apply']) {

	$ipsec_dynamic_hosts = ipsec_configure();

	ipsec_reload_package_hook();

	/* reload the filter in the background */

	$retval = 0;

	$retval |= filter_configure();

	if ($ipsec_dynamic_hosts >= 0) {

		if (is_subsystem_dirty('ipsec')) {

			clear_subsystem_dirty('ipsec');

		}

	}

} else if (isset($_POST['del'])) {

	/* delete selected p1 entries */

	if (is_array($_POST['p1entry']) && count($_POST['p1entry'])) {

		foreach ($_POST['p1entry'] as $p1entrydel) {

			unset($a_phase1[$p1entrydel]);

		}

		if (write_config(gettext("Deleted selected IPsec Phase 1 entries."))) {

			mark_subsystem_dirty('ipsec');

		}

	}

} else if (isset($_POST['delp2'])) {

	/* delete selected p2 entries */

	if (is_array($_POST['p2entry']) && count($_POST['p2entry'])) {

		foreach ($_POST['p2entry'] as $p2entrydel) {

			if (is_interface_ipsec_vti_assigned($a_phase2[$p2entrydel]) && ($a_phase2[$p2entrydel]['mode'] == 'vti')) {

				$input_errors[] = gettext("Cannot delete a VTI Phase 2 while the interface is assigned. Remove the interface assignment before deleting this P2.");

			} else {

				ipsec_del_vtimap($a_phase2[$p2entrydel]);

				unset($a_phase2[$p2entrydel]);

			}

		}

		if (write_config(gettext("Deleted selected IPsec Phase 2 entries."))) {

			mark_subsystem_dirty('ipsec');

		}

	}

} else  {

	/* yuck - IE won't send value attributes for image buttons, while Mozilla does - so we use .x/.y to find move button clicks instead... */

	// TODO: this. is. nasty.

	unset($delbtn, $delbtnp2, $movebtn, $movebtnp2, $togglebtn, $togglebtnp2);

	foreach ($_POST as $pn => $pd) {

		if (preg_match("/del_(\d+)/", $pn, $matches)) {

			$delbtn = $matches[1];

		} else if (preg_match("/delp2_(\d+)/", $pn, $matches)) {

			$delbtnp2 = $matches[1];

		} else if (preg_match("/move_(\d+)/", $pn, $matches)) {

			$movebtn = $matches[1];

		} else if (preg_match("/movep2_(\d+)/", $pn, $matches)) {

			$movebtnp2 = $matches[1];

		} else if (preg_match("/toggle_(\d+)/", $pn, $matches)) {

			$togglebtn = $matches[1];

		} else if (preg_match("/togglep2_(\d+)/", $pn, $matches)) {

			$togglebtnp2 = $matches[1];

		}

	}

	$save = 1;

	/* move selected p1 entries before this */

	if (isset($movebtn) && is_array($_POST['p1entry']) && count($_POST['p1entry'])) {

		$a_phase1_new = array();

		/* copy all p1 entries < $movebtn and not selected */

		for ($i = 0; $i < $movebtn; $i++) {

			if (!in_array($i, $_POST['p1entry'])) {

				$a_phase1_new[] = $a_phase1[$i];

			}

		}

		/* copy all selected p1 entries */

		for ($i = 0; $i < count($a_phase1); $i++) {

			if ($i == $movebtn) {

				continue;

			}

			if (in_array($i, $_POST['p1entry'])) {

				$a_phase1_new[] = $a_phase1[$i];

			}

		}

		/* copy $movebtn p1 entry */

		if ($movebtn < count($a_phase1)) {

			$a_phase1_new[] = $a_phase1[$movebtn];

		}

		/* copy all p1 entries > $movebtn and not selected */

		for ($i = $movebtn+1; $i < count($a_phase1); $i++) {

			if (!in_array($i, $_POST['p1entry'])) {

				$a_phase1_new[] = $a_phase1[$i];

			}

		}

		if (count($a_phase1_new) > 0) {

			$a_phase1 = $a_phase1_new;

		}

	} else if (isset($movebtnp2) && is_array($_POST['p2entry']) && count($_POST['p2entry'])) {

		/* move selected p2 entries before this */

		$a_phase2_new = array();

		/* copy all p2 entries < $movebtnp2 and not selected */

		for ($i = 0; $i < $movebtnp2; $i++) {

			if (!in_array($i, $_POST['p2entry'])) {

				$a_phase2_new[] = $a_phase2[$i];

			}

		}

		/* copy all selected p2 entries */

		for ($i = 0; $i < count($a_phase2); $i++) {

			if ($i == $movebtnp2) {

				continue;

			}

			if (in_array($i, $_POST['p2entry'])) {

				$a_phase2_new[] = $a_phase2[$i];

			}

		}

		/* copy $movebtnp2 p2 entry */

		if ($movebtnp2 < count($a_phase2)) {

			$a_phase2_new[] = $a_phase2[$movebtnp2];

		}

		/* copy all p2 entries > $movebtnp2 and not selected */

		for ($i = $movebtnp2+1; $i < count($a_phase2); $i++) {

			if (!in_array($i, $_POST['p2entry'])) {

				$a_phase2_new[] = $a_phase2[$i];

			}

		}

		if (count($a_phase2_new) > 0) {

			$a_phase2 = $a_phase2_new;

		}

	} else if (isset($togglebtn)) {

		if (isset($a_phase1[$togglebtn]['disabled'])) {

			unset($a_phase1[$togglebtn]['disabled']);

		} else {

			if (ipsec_vti($a_phase1[$togglebtn], false, false)) {

				$input_errors[] = gettext("Cannot disable a Phase 1 with a child Phase 2 while the interface is assigned. Remove the interface assignment before disabling this P2.");

			} else {

				$a_phase1[$togglebtn]['disabled'] = true;

			}

		}

	} else if (isset($togglebtnp2)) {

		if (isset($a_phase2[$togglebtnp2]['disabled'])) {

			unset($a_phase2[$togglebtnp2]['disabled']);

		} else {

			if (is_interface_ipsec_vti_assigned($a_phase2[$togglebtnp2]) && ($a_phase2[$togglebtnp2]['mode'] == 'vti')) {

				$input_errors[] = gettext("Cannot disable a VTI Phase 2 while the interface is assigned. Remove the interface assignment before disabling this P2.");

			} else {

				$a_phase2[$togglebtnp2]['disabled'] = true;

			}

		}

	} else if (isset($delbtn)) {

		/* remove static route if interface is not WAN */

		if ($a_phase1[$delbtn]['interface'] <> "wan") {

			route_del($a_phase1[$delbtn]['remote-gateway']);

		}

		/* remove all phase2 entries that match the ikeid */

		$ikeid = $a_phase1[$delbtn]['ikeid'];

		$p1_has_vti = false;

		$delp2ids = array();

		foreach ($a_phase2 as $p2index => $ph2tmp) {

			if ($ph2tmp['ikeid'] == $ikeid) {

				if (is_interface_ipsec_vti_assigned($ph2tmp)) {

					$p1_has_vti = true;

				} else {

					$delp2ids[] = $p2index;

				}

			}

		}

		if ($p1_has_vti) {

			$input_errors[] = gettext("Cannot delete a Phase 1 which contains an active VTI Phase 2 with an interface assigned. Remove the interface assignment before deleting this P1.");

		} else {

			foreach ($delp2ids as $dp2idx) {

				ipsec_del_vtimap($a_phase2[$dp2idx]);

				unset($a_phase2[$dp2idx]);

			}

			unset($a_phase1[$delbtn]);

		}

	} else if (isset($delbtnp2)) {

		if (is_interface_ipsec_vti_assigned($a_phase2[$delbtnp2]) && ($a_phase2[$delbtnp2]['mode'] == 'vti')) {

			$input_errors[] = gettext("Cannot delete a VTI Phase 2 while the interface is assigned. Remove the interface assignment before deleting this P2.");

		} else {

			ipsec_del_vtimap($a_phase2[$delbtnp2]);

			unset($a_phase2[$delbtnp2]);

		}

	} else {

		$save = 0;

	}

	if ($save === 1) {

		if (write_config(gettext("Saved configuration changes for IPsec tunnels."))) {

			mark_subsystem_dirty('ipsec');

		}

	}

}

$pgtitle = array(gettext("VPN"), gettext("IPsec"), gettext("Tunnels"));

$pglinks = array("", "@self", "@self");

$shortcut_section = "ipsec";

include("head.inc");

if ($input_errors) {

	print_input_errors($input_errors);

}

$tab_array = array();

$tab_array[] = array(gettext("Tunnels"), true, "vpn_ipsec.php");

$tab_array[] = array(gettext("Mobile Clients"), false, "vpn_ipsec_mobile.php");

$tab_array[] = array(gettext("Pre-Shared Keys"), false, "vpn_ipsec_keys.php");

$tab_array[] = array(gettext("Advanced Settings"), false, "vpn_ipsec_settings.php");

display_top_tabs($tab_array);

if ($_POST['apply']) {

	print_apply_result_box($retval);

}

if (is_subsystem_dirty('ipsec')) {

	print_apply_box(gettext("The IPsec tunnel configuration has been changed.") . "<br />" . gettext("The changes must be applied for them to take effect."));

}

?>

<form name="mainform" method="post">

	<div class="panel panel-default">

		<div class="panel-heading"><h2 class="panel-title"><?=gettext('IPsec Tunnels')?></h2></div>

		<div class="panel-body table-responsive">

			<table class="table table-striped table-hover">

				<thead>

					<tr>

						<th>&nbsp;</th>

						<th>&nbsp;</th>

						<th><?=gettext("IKE")?></th>

						<th><?=gettext("Remote Gateway")?></th>

						<th><?=gettext("Mode")?></th>

						<th><?=gettext("P1 Protocol")?></th>

						<th><?=gettext("P1 Transforms")?></th>

						<th><?=gettext("P1 DH-Group")?></th>

						<th><?=gettext("P1 Description")?></th>

						<th><?=gettext("Actions")?></th>

					</tr>

				</thead>

				<tbody class="p1-entries">

<?php

$iflabels = get_configured_interface_with_descr(false, true);

$viplist = get_configured_vip_list();

foreach ($viplist as $vip => $address) {

	$iflabels[$vip] = $address;

	if (get_vip_descr($address)) {

		$iflabels[$vip] .= " (". get_vip_descr($address) .")";

	}

}

$grouplist = return_gateway_groups_array();

foreach ($grouplist as $name => $group) {

	if ($group[0]['vip'] != "") {

		$vipif = $group[0]['vip'];

	} else {

		$vipif = $group[0]['int'];

	}

	$iflabels[$name] = "GW Group {$name}";

}

$i = 0; foreach ($a_phase1 as $ph1ent):

	$iconfn = "pass";

	$entryStatus = (isset($ph1ent['disabled']) ? 'disabled' : 'enabled');

	if ($entryStatus == 'disabled') {

		$iconfn .= "_d";

	}

?>

					<tr id="fr<?=$i?>" onclick="fr_toggle(<?=$i?>)" id="frd<?=$i?>" ondblclick="document.location='vpn_ipsec_phase1.php?p1index=<?=$i?>'" class="<?= $entryStatus ?>">

						<td>

							<input type="checkbox" id="frc<?=$i?>" onclick="fr_toggle(<?=$i?>)" name="p1entry[]" value="<?=$i?>"  />

							<a	class="fa fa-anchor icon-pointer" id="Xmove_<?=$i?>" title="<?=gettext("Move checked entries to here")?>"></a>

						</td>

						<td>

							<button value="toggle_<?=$i?>" name="toggle_<?=$i?>" title="<?=gettext("click to toggle enabled/disabled status")?>" class="btn btn-xs btn-<?= ($entryStatus == 'disabled' ? 'success' : 'warning') ?>" type="submit"><?= ($entryStatus == 'disabled' ? 'Enable' : 'Disable') ?></button>

						</td>

						<td id="frd<?=$i?>">

<?php

			if (empty($ph1ent['iketype']) || $ph1ent['iketype'] == "ikev1") {

				echo "V1";

			} elseif ($ph1ent['iketype'] == "ikev2") {

				echo "V2";

			} elseif ($ph1ent['iketype'] == "auto") {

				echo "Auto";

			}

?>

						</td>

						<td>

<?php

			if ($ph1ent['interface']) {

				if (isset($iflabels[$ph1ent['interface']])) {

					$if = htmlspecialchars($iflabels[$ph1ent['interface']]);

				} else {

					$if = sprintf("Interface not found: '%s'", $ph1ent['interface']);

				}

			} else {

				$if = "WAN";

			}

			if (!isset($ph1ent['mobile'])) {

				echo $if."<br />".$ph1ent['remote-gateway'];

			} else {

				echo $if."<br /><strong>" . gettext("Mobile Client") . "</strong>";

			}

?>

						</td>

						<td id="frd<?=$i?>">

					<?=$spans?>

					<?php

					if (empty($ph1ent['iketype']) || $ph1ent['iketype'] == "ikev1" || $ph1ent['iketype'] == "auto") {

						echo "{$ph1ent['mode']}";

					}

					?>

					<?=$spane?>

				</td>

				<td id="frd<?=$i?>">

<?php

				$first = true;

				if (is_array($ph1ent['encryption']['item'])) {

					foreach($ph1ent['encryption']['item'] as $p1algo) {

						if (!$first) {

							echo "<br/>";

						}

						echo $p1_ealgos[$p1algo['encryption-algorithm']['name']]['name'];

						if ($p1algo['encryption-algorithm']['keylen']) {

							echo " ({$p1algo['encryption-algorithm']['keylen']} " . gettext("bits") . ")";

						}

						$first = false;

					}

				}

?>

						</td>

						<td>

<?php			$first = true;

				if (is_array($ph1ent['encryption']['item'])) {

					foreach($ph1ent['encryption']['item'] as $p1algo) {

						if (!$first) {

							echo "<br/>";

						}

						echo $p1_halgos[$p1algo['hash-algorithm']];

						if (isset($ph1ent['prfselect_enable'])) {

							echo " / PRF" . $p1_halgos[$p1algo['prf-algorithm']];

						}

						$first = false;

					}

				}

				?>

						</td>

						<td>

<?php			$first = true;

				if (is_array($ph1ent['encryption']['item'])) {

					foreach($ph1ent['encryption']['item'] as $p1algo) {

						if (!$first) {

							echo "<br/>";

						}

						echo str_replace(" "," ",$p1_dhgroups[$p1algo['dhgroup']]);

						$first = false;

					}

				}

				?>

						</td>

						<td>

							<?=htmlspecialchars($ph1ent['descr'])?>

						</td>

						<td style="cursor: pointer;">

<!--							<a	class="fa fa-anchor" id="Xmove_<?=$i?>" title="<?=gettext("Move checked entries to here")?>"></a> -->

							<button style="display: none;" class="btn btn-default btn-xs" type="submit" id="move_<?=$i?>" name="move_<?=$i?>" value="move_<?=$i?>"><?=gettext("Move checked entries to here")?></button>

							<a class="fa fa-pencil" href="vpn_ipsec_phase1.php?p1index=<?=$i?>" title="<?=gettext("Edit phase1 entry"); ?>"></a>

<?php if (!isset($ph1ent['mobile'])): ?>

							<a class="fa fa-clone" href="vpn_ipsec_phase1.php?dup=<?=$i?>" title="<?=gettext("Copy phase1 entry"); ?>"></a>

<?php endif; ?>

							<a	class="fa fa-trash no-confirm" id="Xdel_<?=$i?>" title="<?=gettext('Delete phase1 entry'); ?>"></a>

							<button style="display: none;" class="btn btn-xs btn-warning" type="submit" id="del_<?=$i?>" name="del_<?=$i?>" value="del_<?=$i?>" title="<?=gettext('Delete phase1 entry'); ?>">delete</button>

						</td>

					</tr>

					<tr class="<?= $entryStatus ?>">

						<td colspan="2"></td>

						<td colspan="7" class="contains-table">

<?php

			if (isset($_REQUEST["tdph2-{$i}-visible"])) {

				$tdph2_visible = htmlspecialchars($_REQUEST["tdph2-{$i}-visible"]);

			} else {

				$tdph2_visible = 0;

			}

?>

							<input type="hidden" name="tdph2-<?=$i?>-visible" id="tdph2-<?=$i?>-visible" value="<?=$tdph2_visible?>" />

							<div id="shph2but-<?=$i?>" <?=($tdph2_visible == '1' ? 'style="display:none"' : '')?>>

<?php

				$phase2count=0;

				foreach ($a_phase2 as $ph2ent) {

					if ($ph2ent['ikeid'] != $ph1ent['ikeid']) {

						continue;

					}

					$phase2count++;

				}

				$fr_prefix = "frp2{$i}";

				$fr_header = $fr_prefix . "header";

?>

								<button class="btn btn-info" type="button" onclick="show_phase2('tdph2-<?=$i?>','shph2but-<?=$i?>')" value="+"><i class="fa fa-plus-circle"></i> <?php printf(gettext("Show Phase 2 Entries (%s)"), $phase2count); ?></button>

							</div>

							<div id="tdph2-<?=$i?>" <?=($tdph2_visible != '1' ? 'style="display:none"' : '')?>>

								<table class="table table-striped table-hover">

									<thead>

										<tr>

											<th>&nbsp;</th>

											<th>&nbsp;</th>

											<th><?=gettext("Mode"); ?></th>

											<th><?=gettext("Local Subnet"); ?></th>

											<th><?=gettext("Remote Subnet"); ?></th>

											<th><?=gettext("P2 Protocol"); ?></th>

											<th><?=gettext("P2 Transforms"); ?></th>

											<th><?=gettext("P2 Auth Methods"); ?></th>

											<th><?=gettext("P2 actions")?></th>

										</tr>

									</thead>

									<tbody class="p2-entries">

<?php $j = 0; foreach ($a_phase2 as $ph2index => $ph2ent): ?>

<?php

						if ($ph2ent['ikeid'] != $ph1ent['ikeid']) {

							continue;

						}

						$fr_c = $fr_prefix . "c" . $j;

						$fr_d = $fr_prefix . "d" . $j;

						$iconfn = "pass";

						$entryStatus = (isset($ph2ent['disabled']) || isset($ph1ent['disabled']) ? 'disabled' : 'enabled');

						if ($entryStatus == 'disabled') {

							$iconfn .= "_d";

						}

?>

										<tr id="<?=$fr_prefix . $j?>" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid']?>'" class="<?= $entryStatus ?>">

											<td>

												<input type="checkbox" id="<?=$fr_c?>" name="p2entry[]" value="<?=$ph2index?>" onclick="fr_bgcolor('<?=$j?>', '<?=$fr_prefix?>')" />

												<button class="fa fa-anchor button-icon" type="submit" name="movep2_<?=$j?>" value="movep2_<?=$j?>" title="<?=gettext("Move checked P2s here")?>"></button>

											</td>

											<td>

												<button value="togglep2_<?=$ph2index?>" name="togglep2_<?=$ph2index?>" title="<?=gettext("click to toggle enabled/disabled status")?>" class="btn btn-xs btn-<?= ($entryStatus == 'disabled'? 'success' : 'warning') ?>" type="submit"><?= ($entryStatus == 'disabled'? 'Enable' : 'Disable') ?></button>

											</td>

											<td id="<?=$fr_d?>" onclick="fr_toggle('<?=$j?>', '<?=$fr_prefix?>')">

												<?=$ph2ent['mode']?>

											</td>

<?php if (($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6") or ($ph2ent['mode'] == "vti")): ?>

											<td id="<?=$fr_d?>" onclick="fr_toggle('<?=$j?>', '<?=$fr_prefix?>')">

												<?=ipsec_idinfo_to_text($ph2ent['localid']); ?>

											</td>

											<td id="<?=$fr_d?>" onclick="fr_toggle('<?=$j?>', '<?=$fr_prefix?>')">

												<?=ipsec_idinfo_to_text($ph2ent['remoteid']); ?>

											</td>

		<?php else: ?>

											<td colspan="2"></td>

<?php endif; ?>

											<td id="<?=$fr_d?>" onclick="fr_toggle('<?=$j?>', '<?=$fr_prefix?>')">

												<?=$p2_protos[$ph2ent['protocol']]; ?>

											</td>

											<td id="<?=$fr_d?>" onclick="fr_toggle('<?=$j?>', '<?=$fr_prefix?>')">

<?php

								foreach ($ph2ent['encryption-algorithm-option'] as $k => $ph2ea) {

									if ($k) {

										echo ", ";

									}

									echo $p2_ealgos[$ph2ea['name']]['name'];

									if ($ph2ea['keylen']) {

										if ($ph2ea['keylen'] == "auto") {

											echo " (" . gettext("auto") . ")";

										} else {

											echo " ({$ph2ea['keylen']} " . gettext("bits") . ")";

										}

									}

								}

?>

											</td>

											<td id="<?=$fr_d?>" onclick="fr_toggle('<?=$j?>', '<?=$fr_prefix?>')">

<?php

								if (!empty($ph2ent['hash-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) {

									foreach ($ph2ent['hash-algorithm-option'] as $k => $ph2ha) {

										if ($k) {

											echo ", ";

										}

										echo $p2_halgos[$ph2ha];

									}

								}

?>

											</td>

											<td style="cursor: pointer;">

<!--												<button class="fa fa-anchor button-icon" type="submit" name="movep2_<?=$j?>" value="movep2_<?=$j?>" title="<?=gettext("Move checked P2s here")?>"></button> -->

												<a class="fa fa-pencil" href="vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid']?>" title="<?=gettext("Edit phase2 entry"); ?>"></a>

												<a class="fa fa-clone" href="vpn_ipsec_phase2.php?dup=<?=$ph2ent['uniqid']?>" title="<?=gettext("Add a new Phase 2 based on this one"); ?>"></a>

												<a	class="fa fa-trash no-confirm" id="Xdelp2_<?=$ph2index?>" title="<?=gettext('Delete phase2 entry'); ?>"></a>

												<button style="display: none;" class="btn btn-xs btn-warning" type="submit" id="delp2_<?=$ph2index?>" name="delp2_<?=$ph2index?>" value="delp2_<?=$ph2index?>" title="<?=gettext('delete phase2 entry'); ?>">delete</button>

											</td>

										</tr>

<?php $j++; endforeach; ?>

										<tr>

											<td></td>

											<td>

												<a class="btn btn-xs btn-success" href="vpn_ipsec_phase2.php?ikeid=<?=$ph1ent['ikeid']?><?php if (isset($ph1ent['mobile'])) echo "&amp;mobile=true"?>">

													<i class="fa fa-plus icon-embed-btn"></i>

													<?=gettext("Add P2")?>

												</a>

											</td>

											<td colspan="7"></td>

										</tr>

									</tbody>

								</table>

							</div>

						</td>

					</tr>

<?php

					$i++;

				endforeach;	 // $a_phase1 as $ph1ent

?>

				</tbody>

			</table>

		</div>

	</div>

	<nav class="action-buttons">

<?php

/*

	if ($i !== 0): ?>

	<input type="submit" name="move_<?=$i?>" class="btn btn-default" value="<?=gettext("move selected phase1 entries to end")?>" />

<?php endif;

*/

?>

		<a href="vpn_ipsec_phase1.php" class="btn btn-success btn-sm"  usepost>

			<i class="fa fa-plus icon-embed-btn"></i>

			<?=gettext("Add P1")?>

		</a>

<?php if ($i !== 0): ?>

		<button type="submit" name="del" class="btn btn-danger btn-sm" value="<?=gettext("Delete selected P1s")?>">

			<i class="fa fa-trash icon-embed-btn"></i>

			<?=gettext("Delete P1s")?>

		</button>

<?php endif; ?>

	</nav>

</form>

<div class="infoblock">

	<?php print_info_box(sprintf(gettext('The IPsec status can be checked at %1$s%2$s%3$s.'), '<a href="status_ipsec.php">', gettext("Status:IPsec"), '</a>') . '<br />' .

	sprintf(gettext('IPsec debug mode can be enabled at %1$s%2$s%3$s.'), '<a href="vpn_ipsec_settings.php">', gettext("VPN:IPsec:Advanced Settings"), '</a>') . '<br />' .

	sprintf(gettext('IPsec can be set to prefer older SAs at %1$s%2$s%3$s.'), '<a href="vpn_ipsec_settings.php">', gettext("VPN:IPsec:Advanced Settings"), '</a>'), 'info', false); ?>

</div>

<script type="text/javascript">

//<![CDATA[

function show_phase2(id, buttonid) {

	document.getElementById(buttonid).innerHTML='';

	document.getElementById(id).style.display = "block";

	var visible = id + '-visible';

	document.getElementById(visible).value = "1";

}

events.push(function() {

	$('[id^=Xmove_]').click(function (event) {

		// ToDo: We POST shift="yes" if the user has the shift key depressed, but that is not yet used

		// by the $_POST code. It is intended to allow the user to choose to move stuff to the row before or

		// after the clicked anchor icon

		if (event.shiftKey) {

			$('form').append('<input type="hidden" id="shift" name="shift" value="yes" />');

		}

		$('#' + event.target.id.slice(1)).click();

	});

	$('[id^=Xdel_]').click(function (event) {

		if (confirm("<?=gettext('Confirmation required to delete this P1 entry.')?>")) {

			$('#' + event.target.id.slice(1)).click();

		}

	});

	$('[id^=Xdelp2_]').click(function (event) {

		if (confirm("<?=gettext('Confirmation required to delete this P2 entry.')?>")) {

			$('#' + event.target.id.slice(1)).click();

		}

	});

});

//]]>

</script>

<?php

include("foot.inc");

<?php

/*

 * vpn_ipsec_phase1.php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2004-2013 BSD Perimeter

 * Copyright (c) 2013-2016 Electric Sheep Fencing

 * Copyright (c) 2014-2020 Rubicon Communications, LLC (Netgate)

 * Copyright (c) 2008 Shrew Soft Inc

 * All rights reserved.

 *

 * originally based on m0n0wall (http://m0n0.ch/wall)

 * Copyright (c) 2003-2004 Manuel Kasper <mk@neon1.net>.

 * All rights reserved.

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

##|+PRIV

##|*IDENT=page-vpn-ipsec-editphase1

##|*NAME=VPN: IPsec: Edit Phase 1

##|*DESCR=Allow access to the 'VPN: IPsec: Edit Phase 1' page.

##|*MATCH=vpn_ipsec_phase1.php*

##|-PRIV

require_once("functions.inc");

require_once("guiconfig.inc");

require_once("ipsec.inc");

require_once("vpn.inc");

require_once("filter.inc");

if ($_REQUEST['generatekey']) {

	$keyoutput = "";

	$keystatus = "";

	exec("/bin/dd status=none if=/dev/random bs=4096 count=1 | /usr/bin/openssl sha224 | /usr/bin/cut -f2 -d' '", $keyoutput, $keystatus);

	print json_encode(['pskey' => $keyoutput[0]]);

	exit;

}

init_config_arr(array('ipsec', 'phase1'));

init_config_arr(array('ipsec', 'phase2'));

init_config_arr(array('ipsec', 'vtimaps', 'item'));

$a_phase1 = &$config['ipsec']['phase1'];

$a_phase2 = &$config['ipsec']['phase2'];

$a_vtimaps = &$config['ipsec']['vtimaps']['item'];

if (is_numericint($_REQUEST['p1index'])) {

	$p1index = $_REQUEST['p1index'];

}

if (is_numericint($_REQUEST['dup'])) {

	$p1index = $_REQUEST['dup'];

}

if (isset($p1index) && $a_phase1[$p1index]) {

	// don't copy the ikeid on dup

	if (!isset($_REQUEST['dup']) || !is_numericint($_REQUEST['dup'])) {

		$pconfig['ikeid'] = $a_phase1[$p1index]['ikeid'];

	}

	$old_ph1ent = $a_phase1[$p1index];

	$pconfig['disabled'] = isset($a_phase1[$p1index]['disabled']);

	if ($a_phase1[$p1index]['interface']) {

		$pconfig['interface'] = $a_phase1[$p1index]['interface'];

	} else {

		$pconfig['interface'] = "wan";

	}

	list($pconfig['remotenet'], $pconfig['remotebits']) = explode("/", $a_phase1[$p1index]['remote-subnet']);

	if (isset($a_phase1[$p1index]['mobile'])) {

		$pconfig['mobile'] = 'true';

	} else {

		$pconfig['remotegw'] = $a_phase1[$p1index]['remote-gateway'];

		$pconfig['ikeport'] = $a_phase1[$p1index]['ikeport'];

		$pconfig['nattport'] = $a_phase1[$p1index]['nattport'];

	}

	if (empty($a_phase1[$p1index]['iketype'])) {

		$pconfig['iketype'] = "ikev1";

	} else {

		$pconfig['iketype'] = $a_phase1[$p1index]['iketype'];

	}

	$pconfig['mode'] = $a_phase1[$p1index]['mode'];

	$pconfig['protocol'] = $a_phase1[$p1index]['protocol'];

	$pconfig['myid_type'] = $a_phase1[$p1index]['myid_type'];

	$pconfig['myid_data'] = $a_phase1[$p1index]['myid_data'];

	$pconfig['peerid_type'] = $a_phase1[$p1index]['peerid_type'];

	$pconfig['peerid_data'] = $a_phase1[$p1index]['peerid_data'];

	$pconfig['encryption'] = $a_phase1[$p1index]['encryption'];

	$pconfig['rekey_time'] = $a_phase1[$p1index]['rekey_time'];

	$pconfig['reauth_time'] = $a_phase1[$p1index]['reauth_time'];

	$pconfig['over_time'] = $a_phase1[$p1index]['over_time'];

	$pconfig['authentication_method'] = $a_phase1[$p1index]['authentication_method'];

	if (($pconfig['authentication_method'] == "pre_shared_key") ||

	    ($pconfig['authentication_method'] == "xauth_psk_server")) {

		$pconfig['pskey'] = $a_phase1[$p1index]['pre-shared-key'];

	} else {

		$pconfig['pkcs11certref'] = $a_phase1[$p1index]['pkcs11certref'];

		$pconfig['pkcs11pin'] = $a_phase1[$p1index]['pkcs11pin'];

		$pconfig['certref'] = $a_phase1[$p1index]['certref'];

		$pconfig['caref'] = $a_phase1[$p1index]['caref'];

	}

	$pconfig['descr'] = $a_phase1[$p1index]['descr'];

	$pconfig['nat_traversal'] = $a_phase1[$p1index]['nat_traversal'];

	$pconfig['mobike'] = $a_phase1[$p1index]['mobike'];

	if (isset($a_phase1[$p1index]['gw_duplicates'])) {

		$pconfig['gw_duplicates'] = true;

	}

	$pconfig['closeaction'] = $a_phase1[$p1index]['closeaction'];

	if (isset($a_phase1[$p1index]['responderonly'])) {

		$pconfig['responderonly'] = true;

	}

	if ($a_phase1[$p1index]['dpd_delay'] && $a_phase1[$p1index]['dpd_maxfail']) {

		$pconfig['dpd_enable'] = true;

		$pconfig['dpd_delay'] = $a_phase1[$p1index]['dpd_delay'];

		$pconfig['dpd_maxfail'] = $a_phase1[$p1index]['dpd_maxfail'];

	}

	if (isset($a_phase1[$p1index]['prfselect_enable'])) {

		$pconfig['prfselect_enable'] = 'yes';

	}

	if (isset($a_phase1[$p1index]['splitconn'])) {

		$pconfig['splitconn'] = true;

	}

	if (isset($a_phase1[$p1index]['tfc_enable'])) {

		$pconfig['tfc_enable'] = true;

	}

	if (isset($a_phase1[$p1index]['tfc_bytes'])) {

		$pconfig['tfc_bytes'] = $a_phase1[$p1index]['tfc_bytes'];

	}

} else {

	/* defaults */

	$pconfig['interface'] = "wan";

	if ($config['interfaces']['lan']) {

		$pconfig['localnet'] = "lan";

	}

	$pconfig['mode'] = "main";

	$pconfig['protocol'] = "inet";

	$pconfig['myid_type'] = "myaddress";

	$pconfig['peerid_type'] = "peeraddress";

	$pconfig['authentication_method'] = "pre_shared_key";

	$pconfig['reauth_time'] = "28800";

	$pconfig['nat_traversal'] = 'on';

	$pconfig['mobike'] = 'off';

	$pconfig['prfselect_enable'] = false;

	$pconfig['dpd_enable'] = true;

	$pconfig['iketype'] = "ikev1";

	/* mobile client */

	if ($_REQUEST['mobile']) {

		$pconfig['mobile'] = true;

		$pconfig['mode'] = "aggressive";

	}

}

// default value for new P1 and failsafe to always have at least 1 encryption item for the Form_ListItem

if (!is_array($pconfig['encryption']['item']) || count($pconfig['encryption']['item']) == 0) {

	$item = array();

	$item['encryption-algorithm'] = array('name' => "aes", 'keylen' => 128);

	$item['hash-algorithm'] = "sha256";

	$item['prf-algorithm'] = "sha256";

	$item['dhgroup'] = "14";

	$pconfig['encryption']['item'][] = $item;

}

if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {

	unset($p1index);

}

if ($_POST['save']) {

	unset($input_errors);

	$pconfig = $_POST;

	for($i = 0; $i < 100; $i++) {

		if (isset($_POST['ealgo_algo'.$i])) {

			$item = array();

			$item['encryption-algorithm']['name'] = $_POST['ealgo_algo'.$i];

			$item['encryption-algorithm']['keylen'] = $_POST['ealgo_keylen'.$i];

			$item['hash-algorithm'] = $_POST['halgo'.$i];

			$item['prf-algorithm'] = $_POST['prfalgo'.$i];

			$item['dhgroup'] = $_POST['dhgroup'.$i];

			$pconfig['encryption']['item'][] = $item;

		}

	}

	/* input validation */

	$method = $pconfig['authentication_method'];

	// Unset ca and cert if not required to avoid storing in config

	if ($method == "pre_shared_key" || $method == "xauth_psk_server") {

		unset($pconfig['certref']);

		unset($pconfig['pkcs11certref']);

	}

	if (!in_array($method, array('cert', 'eap-tls', 'xauth_cert_server', 'pkcs11'))) {

		unset($pconfig['caref']);

	}

	// Only require PSK here for normal PSK tunnels (not mobile) or xauth.

	// For certificate methods, require the CA/Cert.

	switch ($method) {

		case 'eap-mschapv2':

			if ($pconfig['iketype'] != 'ikev2') {

				$input_errors[] = gettext("EAP-MSChapv2 can only be used with IKEv2 type VPNs.");

			}

			break;

		case "eap-tls":

			if ($pconfig['iketype'] != 'ikev2') {

				$input_errors[] = gettext("EAP-TLS can only be used with IKEv2 type VPNs.");

			}

			break;

		case "eap-radius":

			if ($pconfig['iketype'] != 'ikev2') {

				$input_errors[] = gettext("EAP-RADIUS can only be used with IKEv2 type VPNs.");

			}

			break;

		case "pre_shared_key":

			// If this is a mobile PSK tunnel the user PSKs go on

			//	  the PSK tab, not here, so skip the check.

			if ($pconfig['mobile']) {

				break;

			}

		case "xauth_psk_server":

			$reqdfields = explode(" ", "pskey");

			$reqdfieldsn = array(gettext("Pre-Shared Key"));

			$validate_pskey = true;

			break;

		case "xauth_cert_server":

		case "cert":

			$reqdfields = explode(" ", "caref certref");

			$reqdfieldsn = array(gettext("Certificate Authority"), gettext("Certificate"));

			break;

		case "pkcs11":

			$reqdfields = explode(" ", "caref pkcs11certref pkcs11pin");

			$reqdfieldsn = array(gettext("Certificate Authority"), gettext("Token Certificate"), gettext("Token PIN"));

			break;

		default:

			/* Other types do not use this validation mechanism. */

	}

	if (!$pconfig['mobile']) {

		$reqdfields[] = "remotegw";

		$reqdfieldsn[] = gettext("Remote gateway");

	}

	do_input_validation($pconfig, $reqdfields, $reqdfieldsn, $input_errors);

	if (isset($validate_pskey) && isset($pconfig['pskey']) && !preg_match('/^[[:ascii:]]*$/', $pconfig['pskey'])) {

		unset($validate_pskey);

		$input_errors[] = gettext("Pre-Shared Key contains invalid characters.");

	}

	if (!empty($pconfig['rekey_time']) && !is_numericint($pconfig['rekey_time'])) {

		$input_errors[] = gettext("Rekey Time must be an integer.");

	}

	if (!empty($pconfig['reauth_time']) && !is_numericint($pconfig['reauth_time'])) {

		$input_errors[] = gettext("Reauth Time must be an integer.");

	}

	if (!empty($pconfig['over_time']) && !is_numericint($pconfig['over_time'])) {

		$input_errors[] = gettext("Over Time must be an integer.");

	}

	if (!empty($pconfig['closeaction']) && !array_key_exists($pconfig['closeaction'], $ipsec_closeactions)) {

		$input_errors[] = gettext("Invalid Child SA Close Action.");

	}

	if ($pconfig['remotegw']) {

		if (!is_ipaddr($pconfig['remotegw']) && !is_domain($pconfig['remotegw'])) {

			$input_errors[] = gettext("A valid remote gateway address or host name must be specified.");

		} elseif (is_ipaddrv4($pconfig['remotegw']) && ($pconfig['protocol'] == "inet6")) {

			$input_errors[] = gettext("A valid remote gateway IPv4 address must be specified or protocol needs to be changed to IPv6");

		} elseif (is_ipaddrv6($pconfig['remotegw']) && ($pconfig['protocol'] == "inet")) {

			$input_errors[] = gettext("A valid remote gateway IPv6 address must be specified or protocol needs to be changed to IPv4");

		}

	}

	if ($_POST['ikeport']) {

		if (!is_port($pconfig['ikeport'])) {

			$input_errors[] = gettext("The IKE port number is invalid.");

		}

	} else {

		unset($pconfig['ikeport']);

	}

	if ($_POST['nattport']) {

		if (!is_port($pconfig['nattport'])) {

			$input_errors[] = gettext("The NAT-T port number is invalid.");

		}

	} else {

		unset($pconfig['nattport']);

	}

	if (isset($pconfig['ikeport']) && isset($pconfig['nattport']) && $pconfig['ikeport'] == $pconfig['nattport']) {

		$input_errors[] = gettext("IKE and NAT-T port numbers must be different.");

	}

	if ($pconfig['remotegw'] && is_ipaddr($pconfig['remotegw']) && !isset($pconfig['disabled'])) {

		$t = 0;

		foreach ($a_phase1 as $ph1tmp) {

			if ($p1index != $t) {

				$tremotegw = $pconfig['remotegw'];

				if (($ph1tmp['remote-gateway'] == $tremotegw) && ($ph1tmp['remote-gateway'] != '0.0.0.0') &&

				    ($ph1tmp['remote-gateway'] != '::') && !isset($ph1tmp['disabled']) &&

				    (!isset($pconfig['gw_duplicates']) || !isset($ph1tmp['gw_duplicates']))) {

					$input_errors[] = sprintf(gettext('The remote gateway "%1$s" is already used by phase1 "%2$s".'), $tremotegw, $ph1tmp['descr']);

				}

			}

			$t++;

		}

	}

	if (($pconfig['remotegw'] == '0.0.0.0') || ($pconfig['remotegw'] == '::')) {

		if (!isset($pconfig['responderonly'])) {

			$input_errors[] = gettext('The remote gateway "0.0.0.0" or "::" address can only be used with "Responder Only".');

		}

		if ($pconfig['peerid_type'] == "peeraddress") {

			$input_errors[] = gettext('The remote gateway "0.0.0.0" or "::" address can not be used with IP address peer identifier.');

		}

	}

	if (($pconfig['iketype'] == "ikev1") && is_array($a_phase2) && (count($a_phase2))) {

		foreach ($a_phase2 as $phase2) {

			if ($phase2['ikeid'] == $pconfig['ikeid']) {

				if (($pconfig['protocol'] == "inet") && ($phase2['mode'] == "tunnel6")) {

					$input_errors[] = gettext("There is a Phase 2 using IPv6, cannot use IPv4.");

					break;

				}

				if (($pconfig['protocol'] == "inet6") && ($phase2['mode'] == "tunnel")) {

					$input_errors[] = gettext("There is a Phase 2 using IPv4, cannot use IPv6.");

					break;

				}

			}

		}

	}

	/* My identity */

	if ($pconfig['myid_type'] == "myaddress") {

		$pconfig['myid_data'] = "";

	}

	if ($pconfig['myid_type'] == "address" and $pconfig['myid_data'] == "") {

		$input_errors[] = gettext("Please enter an address for 'My Identifier'");

	}

	if ($pconfig['myid_type'] == "keyid tag" and $pconfig['myid_data'] == "") {

		$input_errors[] = gettext("Please enter a keyid tag for 'My Identifier'");

	}

	if ($pconfig['myid_type'] == "fqdn" and $pconfig['myid_data'] == "") {

		$input_errors[] = gettext("Please enter a fully qualified domain name for 'My Identifier'");

	}

	if ($pconfig['myid_type'] == "user_fqdn" and $pconfig['myid_data'] == "") {

		$input_errors[] = gettext("Please enter a user and fully qualified domain name for 'My Identifier'");

	}

	if ($pconfig['myid_type'] == "dyn_dns" and $pconfig['myid_data'] == "") {

		$input_errors[] = gettext("Please enter a dynamic domain name for 'My Identifier'");

	}

	if (($pconfig['myid_type'] == "address") && !is_ipaddr($pconfig['myid_data'])) {

		$input_errors[] = gettext("A valid IP address for 'My identifier' must be specified.");

	}

	if (($pconfig['myid_type'] == "fqdn") && !is_domain($pconfig['myid_data'])) {

		$input_errors[] = gettext("A valid domain name for 'My identifier' must be specified.");

	}

	if ($pconfig['myid_type'] == "fqdn") {

		if (is_domain($pconfig['myid_data']) == false) {

			$input_errors[] = gettext("A valid FQDN for 'My identifier' must be specified.");

		}

	}

	if ($pconfig['myid_type'] == "user_fqdn") {

		$user_fqdn = explode("@", $pconfig['myid_data']);

		if (is_domain($user_fqdn[1]) == false) {

			$input_errors[] = gettext("A valid User FQDN in the form of user@my.domain.com for 'My identifier' must be specified.");

		}

	}

	if ($pconfig['myid_type'] == "dyn_dns") {

		if (is_domain($pconfig['myid_data']) == false) {

			$input_errors[] = gettext("A valid Dynamic DNS address for 'My identifier' must be specified.");

		}

	}

	/* Peer identity */

	if ($pconfig['myid_type'] == "peeraddress") {

		$pconfig['peerid_data'] = "";

	}

	// Only enforce peer ID if we are not dealing with a pure-psk mobile config.

	if (!(($pconfig['authentication_method'] == "pre_shared_key") && ($pconfig['mobile']))) {

		if ($pconfig['peerid_type'] == "address" and $pconfig['peerid_data'] == "") {

			$input_errors[] = gettext("Please enter an address for 'Peer Identifier'");

		}

		if ($pconfig['peerid_type'] == "keyid tag" and $pconfig['peerid_data'] == "") {

			$input_errors[] = gettext("Please enter a keyid tag for 'Peer Identifier'");

		}

		if ($pconfig['peerid_type'] == "fqdn" and $pconfig['peerid_data'] == "") {

			$input_errors[] = gettext("Please enter a fully qualified domain name for 'Peer Identifier'");

		}

		if ($pconfig['peerid_type'] == "user_fqdn" and $pconfig['peerid_data'] == "") {

			$input_errors[] = gettext("Please enter a user and fully qualified domain name for 'Peer Identifier'");

		}

		if ((($pconfig['peerid_type'] == "address") && !is_ipaddr($pconfig['peerid_data']))) {

			$input_errors[] = gettext("A valid IP address for 'Peer identifier' must be specified.");

		}

		if ((($pconfig['peerid_type'] == "fqdn") && !is_domain($pconfig['peerid_data']))) {

			$input_errors[] = gettext("A valid domain name for 'Peer identifier' must be specified.");

		}

		if ($pconfig['peerid_type'] == "fqdn") {

			if (is_domain($pconfig['peerid_data']) == false) {

				$input_errors[] = gettext("A valid FQDN for 'Peer identifier' must be specified.");

			}

		}

		if ($pconfig['peerid_type'] == "user_fqdn") {

			$user_fqdn = explode("@", $pconfig['peerid_data']);

			if (is_domain($user_fqdn[1]) == false) {

				$input_errors[] = gettext("A valid User FQDN in the form of user@my.domain.com for 'Peer identifier' must be specified.");

			}

		}

	}

	if ($pconfig['dpd_enable']) {

		if (!is_numericint($pconfig['dpd_delay'])) {

			$input_errors[] = gettext("A numeric value must be specified for DPD delay.");

		}

		if (!is_numericint($pconfig['dpd_maxfail'])) {

			$input_errors[] = gettext("A numeric value must be specified for DPD retries.");

		}

	}

	if ($pconfig['tfc_bytes'] && !is_numericint($pconfig['tfc_bytes'])) {

		$input_errors[] = gettext("A numeric value must be specified for TFC bytes.");

	}

	if (!empty($pconfig['iketype']) && $pconfig['iketype'] != "ikev1" && $pconfig['iketype'] != "ikev2" && $pconfig['iketype'] != "auto") {

		$input_errors[] = gettext("Valid arguments for IKE type are v1, v2 or auto");

	}

	foreach($pconfig['encryption']['item'] as $p1algo) {

		if (preg_match("/aes\d+gcm/", $p1algo['encryption-algorithm']['name']) && $_POST['iketype'] != "ikev2") {

			$input_errors[] = gettext("Encryption Algorithm AES-GCM can only be used with IKEv2");

		}

	}

	/* auth backend for mobile eap-radius VPNs should be a RADIUS server */

	if (($pconfig['authentication_method'] == 'eap-radius') && $pconfig['mobile']) {

		if (!empty($config['ipsec']['client']['user_source'])) {

			$auth_server_list  = explode(',', $config['ipsec']['client']['user_source']);

			foreach ($auth_server_list as $auth_server_name) {

				$auth_server       = auth_get_authserver($auth_server_name);

				if (!is_array($auth_server) || ($auth_server['type'] != 'radius')) {

					$input_errors[] = gettext("A valid RADIUS server must be selected for user authentication on the Mobile Clients tab in order to set EAP-RADIUS as the authentication method.");

				}

			}

		}

	}

	if (is_array($old_ph1ent) && ipsec_vti($old_ph1ent, false, false) && $pconfig['disabled']) {

		$input_errors[] = gettext("Cannot disable a Phase 1 with a child Phase 2 while the interface is assigned. Remove the interface assignment before disabling this P2.");

	}

	if (!empty($pconfig['certref'])) {

		$errchkcert =& lookup_cert($pconfig['certref']);

		if (is_array($errchkcert) && !cert_check_pkey_compatibility($errchkcert['prv'], 'IPsec')) {

			$input_errors[] = gettext("The selected ECDSA certificate does not use a curve compatible with IKEv2");

		}

	}

	if (!$input_errors) {

		$ph1ent['ikeid'] = $pconfig['ikeid'];

		$ph1ent['iketype'] = $pconfig['iketype'];

		if ($pconfig['iketype'] == 'ikev2') {

			unset($ph1ent['mode']);

		} else {

			$ph1ent['mode'] = $pconfig['mode'];

		}

		// re-create vtimaps after IKE version switching

		$vtisubnet_spec = ipsec_vti($ph1ent, true);

		if ((($pconfig['iketype'] != $a_phase1[$p1index]['iketype']) ||

		    (isset($pconfig['splitconn']) != isset($a_phase1[$p1index]['splitconn']))) &&

		    ($vtisubnet_spec || is_array($vtisubnet_spec))) {

			foreach ($a_vtimaps as $id => $vtimap) {

				if ($vtimap['reqid'] == $ph1ent['ikeid']) {

					unset($a_vtimaps[$id]);

				}

			}

			if (($pconfig['iketype'] == 'ikev1') ||

			    isset($pconfig['splitconn'])) {

				foreach ($vtisubnet_spec as $idx => $vtisub) {

					$a_vtimaps[] = ipsec_create_vtimap(

					    $ph1ent['ikeid'], $idx);

				}

			} else {

				$a_vtimaps[] = ipsec_create_vtimap(

				    $ph1ent['ikeid'], 0);

			}

		}

		$ph1ent['disabled'] = $pconfig['disabled'] ? true : false;

		$ph1ent['interface'] = $pconfig['interface'];

		/* if the remote gateway changed and the interface is not WAN then remove route */

		/* the ipsec_configure() handles adding the route */

		if ($pconfig['interface'] <> "wan") {

			if ($old_ph1ent['remote-gateway'] <> $pconfig['remotegw']) {

				route_del($old_ph1ent['remote-gateway']);

			}

		}

		if ($pconfig['mobile']) {

			$ph1ent['mobile'] = true;

		} else {

			$ph1ent['remote-gateway'] = $pconfig['remotegw'];

			if ( !empty($pconfig['ikeport']) ) {

				$ph1ent['ikeport'] = $pconfig['ikeport'];

			} else {

				unset($ph1ent['ikeport']);

			}

			if ( !empty($pconfig['nattport']) ) {

				$ph1ent['nattport'] = $pconfig['nattport'];

			} else {

				unset($ph1ent['nattport']);

			}

		}

		$ph1ent['protocol'] = $pconfig['protocol'];

		$ph1ent['myid_type'] = $pconfig['myid_type'];

		$ph1ent['myid_data'] = $pconfig['myid_data'];

		$ph1ent['peerid_type'] = $pconfig['peerid_type'];

		$ph1ent['peerid_data'] = $pconfig['peerid_data'];

		$ph1ent['encryption'] = $pconfig['encryption'];

		$ph1ent['rekey_time'] = $pconfig['rekey_time'];

		$ph1ent['reauth_time'] = $pconfig['reauth_time'];

		$ph1ent['over_time'] = $pconfig['over_time'];

		$ph1ent['pre-shared-key'] = $pconfig['pskey'];

		$ph1ent['private-key'] = base64_encode($pconfig['privatekey']);

		$ph1ent['certref'] = $pconfig['certref'];

		$ph1ent['pkcs11certref'] = $pconfig['pkcs11certref'];

		$ph1ent['pkcs11pin'] = $pconfig['pkcs11pin'];

		$ph1ent['caref'] = $pconfig['caref'];

		$ph1ent['authentication_method'] = $pconfig['authentication_method'];

		$ph1ent['descr'] = $pconfig['descr'];

		$ph1ent['nat_traversal'] = $pconfig['nat_traversal'];

		$ph1ent['mobike'] = $pconfig['mobike'];

		if ( isset($pconfig['gw_duplicates'])) {

			$ph1ent['gw_duplicates'] = true;

		} else {

			unset($ph1ent['gw_duplicates']);

		}

		$ph1ent['closeaction'] = $pconfig['closeaction'];

		if (isset($pconfig['prfselect_enable'])) {

			$ph1ent['prfselect_enable'] = 'yes';

		} else {

			unset($ph1ent['prfselect_enable']);

		}

		if (isset($pconfig['responderonly'])) {

			$ph1ent['responderonly'] = true;

		} else {

			unset($ph1ent['responderonly']);

		}

		if (isset($pconfig['dpd_enable'])) {

			$ph1ent['dpd_delay'] = $pconfig['dpd_delay'];

			$ph1ent['dpd_maxfail'] = $pconfig['dpd_maxfail'];

		}

		if (isset($pconfig['splitconn'])) {

			$ph1ent['splitconn'] = true;

		} else {

			unset($ph1ent['splitconn']);

		}

		if (isset($pconfig['tfc_enable'])) {

			$ph1ent['tfc_enable'] = true;

		}

		if (isset($pconfig['tfc_bytes'])) {

			$ph1ent['tfc_bytes'] = $pconfig['tfc_bytes'];

		}

		/* generate unique phase1 ikeid */

		if ($ph1ent['ikeid'] == 0) {

			$ph1ent['ikeid'] = ipsec_ikeid_next();

		}

		if (isset($p1index) && $a_phase1[$p1index]) {

			$a_phase1[$p1index] = $ph1ent;

		} else {

			$a_phase1[] = $ph1ent;

		}

		write_config(gettext("Saved IPsec tunnel Phase 1 configuration."));

		mark_subsystem_dirty('ipsec');

		header("Location: vpn_ipsec.php");

		exit;

	}

}

function build_interface_list() {

	$interfaces = get_configured_interface_with_descr();

	$viplist = get_configured_vip_list();

	foreach ($viplist as $vip => $address) {

		$interfaces[$vip] = $address;

		if (get_vip_descr($address)) {

			$interfaces[$vip] .= " (". get_vip_descr($address) .")";

		}

	}

	$grouplist = return_gateway_groups_array();

	foreach ($grouplist as $name => $group) {

		if ($group[0]['vip'] != "") {

			$vipif = $group[0]['vip'];

		} else {

			$vipif = $group[0]['int'];

		}

		$interfaces[$name] = sprintf(gettext("GW Group %s"), $name);

	}

	return($interfaces);

}

function build_auth_method_list() {

	global $p1_authentication_methods, $pconfig;

	$list = array();

	foreach ($p1_authentication_methods as $method_type => $method_params) {

		if (!$pconfig['mobile'] && $method_params['mobile']) {

			continue;

		}

		$list[$method_type] = htmlspecialchars($method_params['name']);

	}

	return($list);

}

function build_myid_list() {

	global $my_identifier_list;

	$list = array();

	foreach ($my_identifier_list as $id_type => $id_params) {

		$list[$id_type] = htmlspecialchars($id_params['desc']);

	}

	return($list);

}

function build_peerid_list() {

	global $peer_identifier_list;

	$list = array();

	foreach ($peer_identifier_list as $id_type => $id_params) {

		$list[$id_type] = htmlspecialchars($id_params['desc']);

	}

	return($list);

}

function build_pkcs11cert_list() {

	global $config;

	$list = array();

	$p11_cn = array();

	$p11_id = array();

	$output = shell_exec('/usr/local/bin/pkcs15-tool -c');

	preg_match_all('/X\.509\ Certificate\ \[(.*)\]/', $output, $p11_cn);

	preg_match_all('/ID\s+: (.*)/', $output, $p11_id);

	if (is_array($p11_id)) {

		for ($i = 0; $i < count($p11_id[1]); $i++) {

			$list[$p11_id[1][$i]] = "{$p11_cn[1][$i]} " . "({$p11_id[1][$i]})";

		}

	}

	return($list);

}

function build_eal_list() {

	global $p1_ealgos;

	$list = array();

	if (is_array($p1_ealgos)) {

		foreach ($p1_ealgos as $algo => $algodata) {

			$list[$algo] = htmlspecialchars($algodata['name']);

		}

	}

	return($list);

}

if ($pconfig['mobile']) {

	$pgtitle = array(gettext("VPN"), gettext("IPsec"), gettext("Mobile Clients"), gettext("Edit Phase 1"));

	$pglinks = array("", "vpn_ipsec.php", "vpn_ipsec_mobile.php", "@self");

} else {

	$pgtitle = array(gettext("VPN"), gettext("IPsec"), gettext("Tunnels"), gettext("Edit Phase 1"));

	$pglinks = array("", "vpn_ipsec.php", "vpn_ipsec.php", "@self");

}

$shortcut_section = "ipsec";

include("head.inc");

if ($input_errors) {

	print_input_errors($input_errors);

}

$tab_array = array();

$tab_array[] = array(gettext("Tunnels"), true, "vpn_ipsec.php");

$tab_array[] = array(gettext("Mobile Clients"), false, "vpn_ipsec_mobile.php");

$tab_array[] = array(gettext("Pre-Shared Keys"), false, "vpn_ipsec_keys.php");

$tab_array[] = array(gettext("Advanced Settings"), false, "vpn_ipsec_settings.php");

display_top_tabs($tab_array);

$form = new Form();

$section = new Form_Section('General Information');

$section->addInput(new Form_Checkbox(

	'disabled',

	'Disabled',

	'Set this option to disable this phase1 without removing it from the list. ',

	$pconfig['disabled']

));

$section->addInput(new Form_Select(

	'iketype',

	'*Key Exchange version',

	$pconfig['iketype'],

	array("ikev1" => "IKEv1", "ikev2" => "IKEv2", "auto" => gettext("Auto"))

))->setHelp('Select the Internet Key Exchange protocol version to be used. Auto uses IKEv2 when initiator, and accepts either IKEv1 or IKEv2 as responder.');

$section->addInput(new Form_Select(

	'protocol',

	'*Internet Protocol',

	$pconfig['protocol'],

	array("inet" => "IPv4", "inet6" => "IPv6", "both" => "Both (Dual Stack)")

))->setHelp('Select the Internet Protocol family.');

$section->addInput(new Form_Select(

	'interface',

	'*Interface',

	$pconfig['interface'],

	build_interface_list()

))->setHelp('Select the interface for the local endpoint of this phase1 entry.');

if (!$pconfig['mobile']) {

	$group = new Form_Group('*Remote Gateway');

	$group->add(new Form_Input(

		'remotegw',

		'Remote Gateway',

		'text',

		$pconfig['remotegw']

	))->setHelp('Enter the public IP address or host name of the remote gateway.%1$s%2$s%3$s',

	    '<div class="infoblock">',

	    sprint_info_box(gettext('Use \'0.0.0.0\' to allow connections from any IPv4 address or \'::\' ' . 

	    'to allow connections from any IPv6 address.' . '<br/>' . 'Responder Only must be set and ' . 

	    'Peer IP Address cannot be used for Remote Identifier.'), 'info', false),

	    '</div>');

	$group->add(new Form_Input(

	    'ikeport',

	    'Remote IKE Port',

	    'number',

	    $pconfig['ikeport'],

	    ['min' => 1, 'max' => 65535]

	))->setHelp('UDP port for IKE on the remote gateway. Leave empty for default automatic behavior (500/4500).');

	$group->add(new Form_Input(

	    'nattport',

	    'Remote NAT-T Port',

	    'number',

	    $pconfig['nattport'],

	    ['min' => 1, 'max' => 65535]

	))->setHelp('UDP port for NAT-T on the remote gateway.%1$s%2$s%3$s',

	    '<div class="infoblock">',

	    sprint_info_box(gettext('If the IKE port is empty and NAT-T contains a value, the tunnel will use only NAT-T.'),

	    'info', false),

	    '</div>');

	$section->add($group);

}

$section->addInput(new Form_Input(