Revision 86b2861c
Added by Matthew Smith almost 10 years ago
src/usr/local/www/diag_ipsec.php | ||
---|---|---|
5 | 5 |
*/ |
6 | 6 |
/* ==================================================================== |
7 | 7 |
* Copyright (c) 2004-2015 Electric Sheep Fencing, LLC. All rights reserved. |
8 |
* Copyright (c) 2004, 2005 Scott Ullrich |
|
8 |
* portions Copyright (C) 2008 Shrew Soft Inc <mgrooms@shrew.net>. |
|
9 |
* |
|
10 |
* Parts of this code originally based on vpn_ipsec_sad.php from m0n0wall, |
|
11 |
* Copyright (C) 2003-2004 Manuel Kasper (BSD 2 clause) |
|
9 | 12 |
* |
10 | 13 |
* Redistribution and use in source and binary forms, with or without modification, |
11 | 14 |
* are permitted provided that the following conditions are met: |
... | ... | |
115 | 118 |
|
116 | 119 |
$a_phase1 = &$config['ipsec']['phase1']; |
117 | 120 |
|
118 |
$status = ipsec_smp_dump_status();
|
|
121 |
$status = pfSense_ipsec_list_sa();
|
|
119 | 122 |
|
120 | 123 |
$tab_array = array(); |
121 | 124 |
$tab_array[] = array(gettext("Overview"), true, "diag_ipsec.php"); |
... | ... | |
148 | 151 |
<?php |
149 | 152 |
$ipsecconnected = array(); |
150 | 153 |
|
151 |
if (is_array($status['query']) && is_array($status['query']['ikesalist']) && is_array($status['query']['ikesalist']['ikesa'])):
|
|
152 |
foreach ($status['query']['ikesalist']['ikesa'] as $ikeid => $ikesa):
|
|
153 |
$con_id = substr($ikesa['peerconfig'], 3);
|
|
154 |
if (is_array($status)) {
|
|
155 |
foreach ($status as $ikeid => $ikesa) {
|
|
156 |
$con_id = substr($ikeid, 3);
|
|
154 | 157 |
|
155 | 158 |
if ($ikesa['version'] == 1) { |
156 | 159 |
$ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00')); |
... | ... | |
159 | 162 |
$ipsecconnected[$con_id] = $ph1idx = $con_id; |
160 | 163 |
} |
161 | 164 |
|
162 |
if (ipsec_phase1_status($status['query']['ikesalist']['ikesa'], $ikesa['id']))
|
|
165 |
if ($ikesa['state'] == "ESTABLISHED") {
|
|
163 | 166 |
$icon = "pass"; |
164 |
elseif (!isset($config['ipsec']['enable']))
|
|
167 |
} elseif (!isset($config['ipsec']['enable'])) {
|
|
165 | 168 |
$icon = "block"; |
166 |
else
|
|
169 |
} else {
|
|
167 | 170 |
$icon = "reject"; |
171 |
} |
|
168 | 172 |
?> |
169 | 173 |
<tr> |
170 | 174 |
<td> |
... | ... | |
172 | 176 |
</td> |
173 | 177 |
<td> |
174 | 178 |
<?php |
175 |
if (!is_array($ikesa['local'])) |
|
176 |
echo gettext("Unknown"); |
|
177 |
else { |
|
178 |
if (!empty($ikesa['local']['identification'])) { |
|
179 |
if ($ikesa['local']['identification'] == '%any') |
|
180 |
print(gettext('Any identifier')); |
|
181 |
else |
|
182 |
print(htmlspecialchars($ikesa['local']['identification'])); |
|
183 |
} else |
|
184 |
print(gettext("Unknown")); |
|
185 |
} |
|
186 |
|
|
187 |
if (ipsec_phase1_status($status['query']['ikesalist']['ikesa'], $ikesa['id'])) { |
|
188 |
$icon = "pass"; |
|
189 |
} elseif (!isset($config['ipsec']['enable'])) { |
|
190 |
$icon = "block"; |
|
179 |
if (!empty($ikesa['local-id'])) { |
|
180 |
if ($ikesa['local-id'] == '%any') { |
|
181 |
print(gettext('Any identifier')); |
|
191 | 182 |
} else { |
192 |
$icon = "reject";
|
|
183 |
print(htmlspecialchars($ikesa['local-id']));
|
|
193 | 184 |
} |
185 |
} else { |
|
186 |
print(gettext("Unknown")); |
|
187 |
} |
|
188 |
|
|
194 | 189 |
?> |
195 | 190 |
</td> |
196 | 191 |
<td> |
197 | 192 |
<?php |
198 |
if (!is_array($ikesa['local'])) |
|
199 |
print(gettext("Unknown")); |
|
200 |
else { |
|
201 |
if (!empty($ikesa['local']['address'])) |
|
202 |
print(htmlspecialchars($ikesa['local']['address']) . '<br/>' . gettext('Port: ') . htmlspecialchars($ikesa['local']['port'])); |
|
203 |
else |
|
204 |
print(gettext("Unknown")); |
|
205 |
if ($ikesa['local']['port'] == '4500') |
|
206 |
print(" NAT-T"); |
|
207 |
} |
|
193 |
if (!empty($ikesa['local-host'])) { |
|
194 |
print(htmlspecialchars($ikesa['local-host'])); |
|
195 |
} else { |
|
196 |
print(gettext("Unknown")); |
|
197 |
} |
|
198 |
if (isset($ikesa['local-nat-t'])) { |
|
199 |
print(" NAT-T"); |
|
200 |
} |
|
208 | 201 |
?> |
209 | 202 |
</td> |
210 | 203 |
<td> |
211 | 204 |
<?php |
212 |
if (!is_array($ikesa['remote'])) |
|
205 |
$identity = ""; |
|
206 |
if (!empty($ikesa['remote-id'])) { |
|
207 |
if ($ikesa['remote-id'] == '%any') { |
|
208 |
$identity = 'Any identifier'; |
|
209 |
} else { |
|
210 |
$identity = htmlspecialchars($ikesa['remote']['identification']); |
|
211 |
} |
|
212 |
} |
|
213 |
if (!empty($ikesa['remote-xauth-id'])) { |
|
214 |
echo htmlspecialchars($ikesa['remote-xauth-id']); |
|
215 |
echo "<br/>{$identity}"; |
|
216 |
} elseif (!empty($ikesa['remote-eap-id'])) { |
|
217 |
echo htmlspecialchars($ikesa['remote-eap-id']); |
|
218 |
echo "<br/>{$identity}"; |
|
219 |
} else { |
|
220 |
if (empty($identity)) { |
|
213 | 221 |
print(gettext("Unknown")); |
214 |
else { |
|
215 |
$identity = ""; |
|
216 |
if (!empty($ikesa['remote']['identification'])) { |
|
217 |
if ($ikesa['remote']['identification'] == '%any') |
|
218 |
$identity = 'Any identifier'; |
|
219 |
else |
|
220 |
$identity = htmlspecialchars($ikesa['remote']['identification']); |
|
221 |
} |
|
222 |
|
|
223 |
if (is_array($ikesa['remote']['auth']) && !empty($ikesa['remote']['auth'][0]['identity'])) { |
|
224 |
print(htmlspecialchars($ikesa['remote']['auth'][0]['identity'])); |
|
225 |
print('<br/>' . $identity); |
|
226 |
} else { |
|
227 |
if (empty($identity)) |
|
228 |
print(gettext("Unknown")); |
|
229 |
else |
|
230 |
print($identity); |
|
231 |
} |
|
222 |
} else { |
|
223 |
print($identity); |
|
232 | 224 |
} |
225 |
} |
|
233 | 226 |
?> |
234 | 227 |
</td> |
235 | 228 |
<td> |
236 | 229 |
<?php |
237 |
if (!is_array($ikesa['remote'])) |
|
238 |
print(gettext("Unknown")); |
|
239 |
else { |
|
240 |
if (!empty($ikesa['remote']['address'])) |
|
241 |
print(htmlspecialchars($ikesa['remote']['address']) . '<br/>' . gettext('Port: ') . htmlspecialchars($ikesa['remote']['port'])); |
|
242 |
else |
|
243 |
print(gettext("Unknown")); |
|
244 |
if ($ikesa['remote']['port'] == '4500') |
|
245 |
print(" NAT-T"); |
|
246 |
} |
|
230 |
if (!empty($ikesa['remote-host'])) { |
|
231 |
print(htmlspecialchars($ikesa['remote-host'])); |
|
232 |
} else { |
|
233 |
print(gettext("Unknown")); |
|
234 |
} |
|
235 |
if (isset($ikesa['remote-nat-t'])) { |
|
236 |
print(" NAT-T"); |
|
237 |
} |
|
247 | 238 |
?> |
248 | 239 |
</td> |
249 | 240 |
<td> |
250 | 241 |
IKEv<?=htmlspecialchars($ikesa['version'])?> |
251 | 242 |
<br/> |
252 |
<?=htmlspecialchars($ikesa['role'])?> |
|
243 |
<?php |
|
244 |
if ($ikesa['initiator'] == 'yes') { |
|
245 |
print("initiator"); |
|
246 |
} else { |
|
247 |
print("responder"); |
|
248 |
} |
|
249 |
?> |
|
253 | 250 |
</td> |
254 | 251 |
<td> |
255 |
<?=htmlspecialchars($ikesa['reauth']);?>
|
|
252 |
<?=htmlspecialchars($ikesa['reauth-time']) . gettext(" seconds");?>
|
|
256 | 253 |
</td> |
257 | 254 |
<td> |
258 |
<?=htmlspecialchars($ikesa['encalg'])?> |
|
255 |
<?=htmlspecialchars($ikesa['encr-alg'])?>
|
|
259 | 256 |
<br/> |
260 |
<?=htmlspecialchars($ikesa['intalg'])?> |
|
257 |
<?=htmlspecialchars($ikesa['integ-alg'])?>
|
|
261 | 258 |
<br/> |
262 |
<?=htmlspecialchars($ikesa['prfalg'])?> |
|
259 |
<?=htmlspecialchars($ikesa['prf-alg'])?>
|
|
263 | 260 |
<br/> |
264 |
<?=htmlspecialchars($ikesa['dhgroup'])?> |
|
261 |
<?=htmlspecialchars($ikesa['dh-group'])?>
|
|
265 | 262 |
</td> |
266 | 263 |
<td> |
267 | 264 |
<?php |
268 |
if ($ikesa['status'] == 'established') |
|
269 |
print('<span style="color:green">'); |
|
270 |
else |
|
271 |
print('<span>'); |
|
265 |
if ($ikesa['state'] == 'ESTABLISHED') { |
|
266 |
print('<span style="color:green">'); |
|
267 |
} else { |
|
268 |
print('<span>'); |
|
269 |
} |
|
272 | 270 |
?> |
273 |
<?=ucfirst(htmlspecialchars($ikesa['status']))?>
|
|
274 |
<br/><?=htmlspecialchars($ikesa['established'])?> |
|
271 |
<?=ucfirst(htmlspecialchars($ikesa['state']))?>
|
|
272 |
<br/><?=htmlspecialchars($ikesa['established']) . gettext(" seconds ago")?>
|
|
275 | 273 |
</span> |
276 | 274 |
</td> |
277 | 275 |
<td > |
278 | 276 |
<?php |
279 |
if ($icon != "pass"):
|
|
277 |
if ($icon != "pass") {
|
|
280 | 278 |
?> |
281 | 279 |
<a href="diag_ipsec.php?act=connect&ikeid=<?=$con_id; ?>" class="btn btn-xs btn-success" data-toggle="tooltip" title="Connect VPN" > |
282 | 280 |
<?=gettext("Connect VPN")?> |
283 | 281 |
</a> |
284 | 282 |
<?php |
285 |
else:
|
|
283 |
} else {
|
|
286 | 284 |
?> |
287 | 285 |
<a href="diag_ipsec.php?act=ikedisconnect&ikeid=<?=$con_id; ?>" class="btn btn-xs btn-danger" data-toggle="tooltip" title="Disconnect VPN"> |
288 | 286 |
<?=gettext("Disconnect")?> |
289 | 287 |
</a><br /> |
290 |
<a href="diag_ipsec.php?act=ikedisconnect&ikeid=<?=$con_id; ?>&ikesaid=<?=$ikesa['id']; ?>" class="btn btn-xs btn-warning" data-toggle="tooltip" title="Disconnect VPN connection"> |
|
288 |
<a href="diag_ipsec.php?act=ikedisconnect&ikeid=<?=$con_id; ?>&ikesaid=<?=$ikesa['uniqueid']; ?>" class="btn btn-xs btn-warning" data-toggle="tooltip" title="Disconnect VPN connection">
|
|
291 | 289 |
<?=gettext("Disconnect")?> |
292 | 290 |
</a> |
293 | 291 |
<?php |
294 |
endif;
|
|
292 |
}
|
|
295 | 293 |
?> |
296 | 294 |
</td> |
297 | 295 |
</tr> |
298 | 296 |
<tr> |
299 | 297 |
<td colspan = 10> |
300 | 298 |
<?php |
301 |
if (is_array($ikesa['childsalist'])):
|
|
299 |
if (is_array($ikesa['child-sas'])) {
|
|
302 | 300 |
?> |
303 | 301 |
<div id="btnchildsa-<?=$ikeid?>"> |
304 | 302 |
<a type="button" onclick="show_childsa('childsa-<?=$ikeid?>','btnchildsa-<?=$ikeid?>');" class="btn btn-sm btn-default" /> |
... | ... | |
320 | 318 |
</thead> |
321 | 319 |
<tbody> |
322 | 320 |
<?php |
323 |
if (is_array($ikesa['childsalist']['childsa'])): |
|
324 |
foreach ($ikesa['childsalist']['childsa'] as $childsa): |
|
321 |
foreach ($ikesa['child-sas'] as $childid => $childsa) { |
|
325 | 322 |
?> |
326 | 323 |
<tr> |
327 | 324 |
<td> |
328 | 325 |
<?php |
329 |
if (is_array($childsa['local']) && |
|
330 |
is_array($childsa['local']['networks']) && |
|
331 |
is_array($childsa['local']['networks']['network'])) |
|
332 |
foreach ($childsa['local']['networks']['network'] as $lnets) |
|
326 |
if (is_array($childsa['local-ts'])) { |
|
327 |
foreach ($childsa['local-ts'] as $lnets) { |
|
333 | 328 |
print(htmlspecialchars(ipsec_fixup_network($lnets)) . "<br />"); |
334 |
else |
|
329 |
} |
|
330 |
} else { |
|
335 | 331 |
print(gettext("Unknown")); |
332 |
} |
|
336 | 333 |
?> |
337 | 334 |
</td> |
338 | 335 |
<td> |
339 | 336 |
<?php |
340 |
if (is_array($childsa['local'])) |
|
341 |
print(gettext("Local: ") . htmlspecialchars($childsa['local']['spi'])); |
|
337 |
if (isset($childsa['spi-in'])) { |
|
338 |
print(gettext("Local: ") . htmlspecialchars($childsa['spi-in'])); |
|
339 |
} |
|
342 | 340 |
|
343 |
if (is_array($childsa['remote'])) |
|
344 |
print('<br/>' . gettext('Remote: ') . htmlspecialchars($childsa['remote']['spi'])); |
|
341 |
if (isset($childsa['spi-out'])) { |
|
342 |
print('<br/>' . gettext('Remote: ') . htmlspecialchars($childsa['spi-out'])); |
|
343 |
} |
|
345 | 344 |
?> |
346 | 345 |
</td> |
347 | 346 |
<td> |
348 | 347 |
<?php |
349 |
if (is_array($childsa['remote']) && |
|
350 |
is_array($childsa['remote']['networks']) && |
|
351 |
is_array($childsa['remote']['networks']['network'])) |
|
352 |
foreach ($childsa['remote']['networks']['network'] as $rnets) |
|
348 |
if (is_array($childsa['remote-ts'])) { |
|
349 |
foreach ($childsa['remote-ts'] as $rnets) { |
|
353 | 350 |
print(htmlspecialchars(ipsec_fixup_network($rnets)) . '<br />'); |
354 |
else |
|
351 |
} |
|
352 |
} else { |
|
355 | 353 |
print(gettext("Unknown")); |
354 |
} |
|
356 | 355 |
?> |
357 | 356 |
</td> |
358 | 357 |
<td> |
359 | 358 |
<?php |
360 |
print(gettext("Rekey: ") . htmlspecialchars($childsa['rekey']));
|
|
361 |
print('<br/>' . gettext('Life: ') . htmlspecialchars($childsa['lifetime']));
|
|
362 |
print('<br/>' . gettext('Install: ') .htmlspecialchars($childsa['installtime']));
|
|
359 |
print(gettext("Rekey: ") . htmlspecialchars($childsa['rekey-time']) . gettext(" seconds"));
|
|
360 |
print('<br/>' . gettext('Life: ') . htmlspecialchars($childsa['life-time']) . gettext(" seconds"));
|
|
361 |
print('<br/>' . gettext('Install: ') .htmlspecialchars($childsa['install-time']) . gettext(" seconds"));
|
|
363 | 362 |
|
364 | 363 |
?> |
365 | 364 |
</td> |
366 | 365 |
<td> |
367 | 366 |
<?php |
368 |
print(htmlspecialchars($childsa['encalg']) . '<br/>'); |
|
369 |
print(htmlspecialchars($childsa['intalg']) . '<br/>'); |
|
367 |
print(htmlspecialchars($childsa['encr-alg']) . '<br/>');
|
|
368 |
print(htmlspecialchars($childsa['integ-alg']) . '<br/>');
|
|
370 | 369 |
|
371 |
if (!empty($childsa['prfalg']))
|
|
372 |
print(htmlspecialchars($childsa['prfalg']) . '<br/>'); |
|
373 |
|
|
374 |
if (!empty($childsa['dhgroup']))
|
|
375 |
print(htmlspecialchars($childsa['dhgroup']) . '<br/>'); |
|
376 |
|
|
377 |
if (!empty($childsa['esn'])) |
|
370 |
if (!empty($childsa['prf-alg'])) {
|
|
371 |
print(htmlspecialchars($childsa['prf-alg']) . '<br/>');
|
|
372 |
} |
|
373 |
if (!empty($childsa['dh-group'])) {
|
|
374 |
print(htmlspecialchars($childsa['dh-group']) . '<br/>');
|
|
375 |
} |
|
376 |
if (!empty($childsa['esn'])) {
|
|
378 | 377 |
print(htmlspecialchars($childsa['esn']) . '<br/>'); |
378 |
} |
|
379 | 379 |
|
380 |
print(gettext("IPComp: ") . htmlspecialchars($childsa['ipcomp'])); |
|
380 |
print(gettext("IPComp: ")); |
|
381 |
if (!empty($childsa['cpi-in']) || !empty($childsa['cpi-out'])) { |
|
382 |
print(htmlspecialchars($childsa['cpi-in']) . " " . htmlspecialchars($childsa['cpi-out'])); |
|
383 |
} else { |
|
384 |
print(gettext('none')); |
|
385 |
} |
|
381 | 386 |
?> |
382 | 387 |
</td> |
383 | 388 |
<td> |
384 | 389 |
<?php |
385 |
print(gettext("Bytes-In: ") . htmlspecialchars($childsa['bytesin']) . '<br/>'); |
|
386 |
print(gettext("Packets-In: ") . htmlspecialchars($childsa['packetsin']) . '<br/>'); |
|
387 |
print(gettext("Bytes-Out: ") . htmlspecialchars($childsa['bytesout']) . '<br/>'); |
|
388 |
print(gettext("Packets-Out: ") . htmlspecialchars($childsa['packetsout']) . '<br/>'); |
|
390 |
print(gettext("Bytes-In: ") . htmlspecialchars($childsa['bytes-in']) . '<br/>');
|
|
391 |
print(gettext("Packets-In: ") . htmlspecialchars($childsa['packets-in']) . '<br/>');
|
|
392 |
print(gettext("Bytes-Out: ") . htmlspecialchars($childsa['bytes-out']) . '<br/>');
|
|
393 |
print(gettext("Packets-Out: ") . htmlspecialchars($childsa['packets-out']) . '<br/>');
|
|
389 | 394 |
?> |
390 | 395 |
</td> |
391 | 396 |
<td> |
... | ... | |
395 | 400 |
</td> |
396 | 401 |
</tr> |
397 | 402 |
<?php |
398 |
endforeach;
|
|
399 |
endif;
|
|
403 |
}
|
|
404 |
}
|
|
400 | 405 |
?> |
401 | 406 |
|
402 | 407 |
</tbody> |
... | ... | |
404 | 409 |
</td> |
405 | 410 |
</tr> |
406 | 411 |
<?php |
407 |
endif;
|
|
412 |
}
|
|
408 | 413 |
|
409 | 414 |
unset($con_id); |
410 |
endforeach; |
|
411 |
endif; |
|
415 |
} |
|
412 | 416 |
|
413 | 417 |
$rgmap = array(); |
414 |
foreach ($a_phase1 as $ph1ent):
|
|
415 |
if (isset($ph1ent['disabled'])) |
|
418 |
foreach ($a_phase1 as $ph1ent) {
|
|
419 |
if (isset($ph1ent['disabled'])) {
|
|
416 | 420 |
continue; |
421 |
} |
|
417 | 422 |
|
418 | 423 |
$rgmap[$ph1ent['remote-gateway']] = $ph1ent['remote-gateway']; |
419 | 424 |
|
420 |
if ($ipsecconnected[$ph1ent['ikeid']]) |
|
425 |
if ($ipsecconnected[$ph1ent['ikeid']]) {
|
|
421 | 426 |
continue; |
427 |
} |
|
422 | 428 |
?> |
423 | 429 |
<tr> |
424 | 430 |
<td> |
... | ... | |
470 | 476 |
<td> |
471 | 477 |
</td> |
472 | 478 |
<?php |
473 |
if (isset($ph1ent['mobile'])):
|
|
479 |
if (isset($ph1ent['mobile'])) {
|
|
474 | 480 |
?> |
475 | 481 |
<td> |
476 | 482 |
<?=gettext("Awaiting connections")?> |
... | ... | |
478 | 484 |
<td> |
479 | 485 |
</td> |
480 | 486 |
<?php |
481 |
else:
|
|
487 |
} else {
|
|
482 | 488 |
?> |
483 | 489 |
<td> |
484 | 490 |
<?=gettext("Disconnected")?> |
... | ... | |
489 | 495 |
</a> |
490 | 496 |
</td> |
491 | 497 |
<?php |
492 |
endif;
|
|
498 |
}
|
|
493 | 499 |
?> |
494 | 500 |
<td> |
495 | 501 |
</td> |
496 | 502 |
</tr> |
497 | 503 |
<?php |
498 |
endforeach;
|
|
504 |
}
|
|
499 | 505 |
unset($ipsecconnected, $phase1, $rgmap); |
500 | 506 |
?> |
501 | 507 |
</tbody> |
Also available in: Unified diff
Update diag_ipsec.php to use new call to get tunnel status.