Project

General

Profile

Download (15.4 KB) Statistics
| Branch: | Tag: | Revision:
1
<?php
2
/*
3
	vpn_ipsec.php
4
	part of m0n0wall (http://m0n0.ch/wall)
5

    
6
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
7
	Copyright (C) 2008 Shrew Soft Inc
8
	All rights reserved.
9

    
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12

    
13
	1. Redistributions of source code must retain the above copyright notice,
14
	   this list of conditions and the following disclaimer.
15

    
16
	2. Redistributions in binary form must reproduce the above copyright
17
	   notice, this list of conditions and the following disclaimer in the
18
	   documentation and/or other materials provided with the distribution.
19

    
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
*/
31

    
32
##|+PRIV
33
##|*IDENT=page-vpn-ipsec
34
##|*NAME=VPN: IPsec page
35
##|*DESCR=Allow access to the 'VPN: IPsec' page.
36
##|*MATCH=vpn_ipsec.php*
37
##|-PRIV
38

    
39
require("guiconfig.inc");
40
require_once("functions.inc");
41
require_once("filter.inc");
42
require_once("shaper.inc");
43
require_once("ipsec.inc");
44
require_once("vpn.inc");
45

    
46
if (!is_array($config['ipsec']['phase1']))
47
	$config['ipsec']['phase1'] = array();
48

    
49
if (!is_array($config['ipsec']['phase2']))
50
	$config['ipsec']['phase2'] = array();
51

    
52
$a_phase1 = &$config['ipsec']['phase1'];
53
$a_phase2 = &$config['ipsec']['phase2'];
54

    
55
$pconfig['enable'] = isset($config['ipsec']['enable']);
56

    
57
if ($_POST) {
58

    
59
	if ($_POST['apply']) {
60
		$retval = 0;
61
		$retval = vpn_ipsec_configure();
62
		/* reload the filter in the background */
63
		filter_configure();
64
		$savemsg = get_std_save_message($retval);
65
		if ($retval >= 0) {
66
			if (is_subsystem_dirty('ipsec'))
67
				clear_subsystem_dirty('ipsec');
68
		}
69
	} else if ($_POST['submit']) {
70
		$pconfig = $_POST;
71

    
72
		$config['ipsec']['enable'] = $_POST['enable'] ? true : false;
73

    
74
		write_config();
75

    
76
		$retval = vpn_ipsec_configure();
77
	}
78
}
79

    
80
if ($_GET['act'] == "delph1")
81
{
82
	if ($a_phase1[$_GET['p1index']]) {
83
		/* remove static route if interface is not WAN */
84
		if ($a_phase1[$_GET['p1index']]['interface'] <> "wan")
85
			mwexec("/sbin/route delete -host {$a_phase1[$_GET['p1index']]['remote-gateway']}");
86

    
87
		/* remove all phase2 entries that match the ikeid */
88
		$ikeid = $a_phase1[$_GET['p1index']]['ikeid'];
89
		foreach ($a_phase2 as $p2index => $ph2tmp)
90
			if ($ph2tmp['ikeid'] == $ikeid) {
91
				remove_tunnel_spd_policy($a_phase1[$_GET['p1index']],$a_phase2[$p2index]);
92
				unset($a_phase2[$p2index]);
93
			}
94

    
95
		/* remove the phase1 entry */
96
		unset($a_phase1[$_GET['p1index']]);
97
		vpn_ipsec_configure();
98
		write_config();
99
		filter_configure();
100
		header("Location: vpn_ipsec.php");
101
		exit;
102
	}
103
}
104

    
105
if ($_GET['act'] == "delph2")
106
{
107
	if ($a_phase1[$_GET['p1index']] && $a_phase2[$_GET['p2index']]) {
108
		remove_tunnel_spd_policy($a_phase1[$_GET['p1index']],$a_phase2[$_GET['p2index']]);
109
		/* remove the phase2 entry */
110
		unset($a_phase2[$_GET['p2index']]);
111
		vpn_ipsec_configure();
112
		filter_configure();
113
		write_config();
114
		header("Location: vpn_ipsec.php");
115
		exit;
116
	}
117
}
118

    
119
$pgtitle = array(gettext("VPN"),gettext("IPsec"));
120
$shortcut_section = "ipsec";
121

    
122
include("head.inc");
123

    
124
?>
125

    
126
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
127
<?php include("fbegin.inc"); ?>
128
<form action="vpn_ipsec.php" method="post">
129
<?php
130
	if ($savemsg)
131
		print_info_box($savemsg);
132
	if ($pconfig['enable'] && is_subsystem_dirty('ipsec'))
133
		print_info_box_np(gettext("The IPsec tunnel configuration has been changed") . ".<br>" . gettext("You must apply the changes in order for them to take effect."));
134
?>
135
<table width="100%" border="0" cellpadding="0" cellspacing="0">
136
	<tr>
137
		<td class="tabnavtbl">
138
			<?php
139
				$tab_array = array();
140
				$tab_array[0] = array(gettext("Tunnels"), true, "vpn_ipsec.php");
141
				$tab_array[1] = array(gettext("Mobile clients"), false, "vpn_ipsec_mobile.php");
142
				$tab_array[2] = array(gettext("Pre-Shared Keys"), false, "vpn_ipsec_keys.php");
143
				display_top_tabs($tab_array);
144
			?>
145
		</td>
146
	</tr>
147
	<tr>
148
		<td>
149
			<div id="mainarea">
150
				<table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
151
					<tr>
152
						<td class="vtable">
153
							<table border="0" cellspacing="2" cellpadding="0">
154
								<tr>
155
									<td>
156
										<input name="enable" type="checkbox" id="enable" value="yes" <?php if ($pconfig['enable']) echo "checked";?>>
157
									</td>
158
									<td>
159
										<strong><?=gettext("Enable IPsec"); ?></strong>
160
									</td>
161
								</tr>
162
							</table>
163
						</td>
164
					</tr>
165
					<tr>
166
						<td>
167
							<input name="submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">
168
						</td>
169
					</tr>
170
				</table>
171
				<table class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0">
172
					<?php
173
						$i = 0;
174
						foreach ($a_phase1 as $ph1ent) {
175
							if (isset( $ph1ent['disabled'])) {
176
								$spans = "<span class=\"gray\">";
177
								$spane = "</span>";
178
							}
179
							else
180
								$spans = $spane = "";
181
						
182
						show_ipsec_header($ph1ent);
183
						$counter++; // used to determine if we need to output header manually (no records exist)
184
					?>					
185
					<tr valign="top" ondblclick="document.location='vpn_ipsec_phase1.php?p1index=<?=$i;?>'">
186
						<td class="listlr">
187
							<?=$spans;?>
188
							<?php
189
								if ($ph1ent['interface']) {
190
									$iflabels = get_configured_interface_with_descr();
191

    
192
									$carplist = get_configured_carp_interface_list();
193
									foreach ($carplist as $cif => $carpip)
194
										$iflabels[$cif] = $carpip." (".get_vip_descr($carpip).")";
195

    
196
									$aliaslist = get_configured_ip_aliases_list();
197
									foreach ($aliaslist as $aliasip => $aliasif)
198
										$iflabels[$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
199

    
200
									$grouplist = return_gateway_groups_array();
201
									foreach ($grouplist as $name => $group) {
202
										if($group[0]['vip'] <> "")
203
											$vipif = $group[0]['vip'];
204
										else
205
											$vipif = $group[0]['int'];
206
										$iflabels[$name] = "GW Group {$name}";
207
									}
208
									$if = htmlspecialchars($iflabels[$ph1ent['interface']]);
209
								}
210
								else
211
									$if = "WAN";
212

    
213
								if (!isset($ph1ent['mobile']))
214
									echo $if."<br>".$ph1ent['remote-gateway'];
215
								else
216
									echo $if."<br><strong>" . gettext("Mobile Client") . "</strong>";
217
							?>
218
							<?=$spane;?>
219
						</td>
220
						<td class="listr">
221
							<?=$spans;?>
222
							<?=$ph1ent['mode'];?>
223
							<?=$spane;?>
224
						</td>
225
						<td class="listr">
226
							<?=$spans;?>
227
							<?=$p1_ealgos[$ph1ent['encryption-algorithm']['name']]['name'];?>
228
							<?php
229
								if ($ph1ent['encryption-algorithm']['keylen']) {
230
									if ($ph1ent['encryption-algorithm']['keylen']=="auto")
231
										echo " (" . gettext("auto") . ")";
232
									else
233
										echo " ({$ph1ent['encryption-algorithm']['keylen']} " . gettext("bits") . ")";
234
								}
235
							?>
236
							<?=$spane;?>
237
						</td>
238
						<td class="listr">
239
							<?=$spans;?>
240
							<?=$p1_halgos[$ph1ent['hash-algorithm']];?>
241
							<?=$spane;?>
242
						</td>
243
						<td class="listbg">
244
							<?=$spans;?>
245
							<?=htmlspecialchars($ph1ent['descr']);?>&nbsp;
246
							<?=$spane;?>
247
						</td>
248
						<td valign="middle" nowrap class="list">
249
							<table border="0" cellspacing="0" cellpadding="1">
250
								<tr>
251
									<td>
252
										<a href="vpn_ipsec_phase1.php?p1index=<?=$i;?>">
253
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase1 entry"); ?>" width="17" height="17" border="0">
254
										</a>
255
									</td>
256
									<td>
257
										<a href="vpn_ipsec.php?act=delph1&p1index=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase1 and all associated phase2 entries?"); ?>')">
258
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase1 entry"); ?>" width="17" height="17" border="0">
259
										</a>
260
									</td>
261
								</tr>
262
								<?php if (!isset($ph1ent['mobile'])): ?>
263
								<tr>
264
									<td>
265
									</td>
266
									<td>
267
										<a href="vpn_ipsec_phase1.php?dup=<?=$i;?>">
268
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("copy phase1 entry"); ?>" width="17" height="17" border="0">
269
										</a>
270
									</td>
271
								</tr>
272
								<?php endif; ?>
273
							</table>
274
						</td>
275
					</tr>
276
					<tr>
277
						<td class="listrborder" colspan="5">
278
							<div id="shph2but-<?=$i?>">
279
								<?php
280
									$phase2count=0;
281
									foreach ($a_phase2 as $ph2ent) {
282
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) 
283
											continue;
284
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) 
285
											continue;
286
										$phase2count++;
287
									}
288
								?>								
289
								<input  type="button" onClick="show_phase2('tdph2-<?=$i?>','shph2but-<?=$i?>')" value="+"></input> - <?php printf(gettext("Show %s Phase-2 entries"), $phase2count); ?></a>
290
							</div>
291
							<table class="tabcont" width="100%" height="100%" border="0" cellspacing="0" cellpadding="0" id="tdph2-<?=$i?>" style="display:none">
292
								<tr>
293
									<td class="listhdrr"><?=gettext("Mode"); ?></td>
294
									<?php if(($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6")): ?>
295
									<td class="listhdrr"><?=gettext("Local Subnet"); ?></td>
296
									<td class="listhdrr"><?=gettext("Remote Subnet"); ?></td>
297
									<?php endif; ?>
298
									<td class="listhdrr"><?=gettext("P2 Protocol"); ?></td>
299
									<td class="listhdrr"><?=gettext("P2 Transforms"); ?></td>
300
									<td class="listhdrr"><?=gettext("P2 Auth Methods"); ?></td>
301
									<td class ="list">
302
										<a href="vpn_ipsec_phase2.php?ikeid=<?=$ph1ent['ikeid'];?><?php if (isset($ph1ent['mobile'])) echo "&mobile=true";?>">
303
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add phase2 entry"); ?>" width="17" height="17" border="0">
304
										</a>
305
									</td>
306
								</tr>
307
								<?php
308
									$j = 0;
309
									foreach ($a_phase2 as $ph2ent) {
310
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) {
311
											$j++;
312
											continue;
313
										}
314

    
315
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) {
316
											$spans = "<span class=\"gray\">";
317
											$spane = "</span>";
318
										}
319
										else
320
											$spans = $spane = "";
321
								?>
322
								<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$j;?>'">
323

    
324
									<td nowrap class="listlr">
325
										<?=$spans;?>
326
											<?=$ph2ent['mode'];?>
327
										<?=$spane;?>
328
									</td>
329
									<?php 
330
										if(($ph2ent['mode'] <> "tunnel") and ($ph2ent['mode'] <> "tunnel6")) {
331
											echo "<td nowrap class=\"listr\">&nbsp;</td><td nowrap class=\"listr\">&nbsp;</td>";
332
										} 
333
									?>
334
									<?php if(($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6")): ?>
335
									<td nowrap class="listr">
336
										<?=$spans;?>
337
											<?=ipsec_idinfo_to_text($ph2ent['localid']); ?>
338
										<?=$spane;?>
339
									</td>
340
									<td nowrap class="listr">
341
										<?=$spans;?>
342
											<?=ipsec_idinfo_to_text($ph2ent['remoteid']); ?>
343
										<?=$spane;?>
344
									</td>
345
									<?php endif; ?>
346
									<td nowrap class="listr">
347
										<?=$spans;?>
348
											<?php echo $p2_protos[$ph2ent['protocol']];	?>
349
										<?=$spane;?>
350
									</td>
351
									<td class="listr">
352
										<?=$spans;?>
353
										<?php
354
											$k = 0;
355
											foreach ($ph2ent['encryption-algorithm-option'] as $ph2ea) {
356
												if ($k++)
357
													echo ", ";
358
												echo $p2_ealgos[$ph2ea['name']]['name'];
359
												if ($ph2ea['keylen']) {
360
													if ($ph2ea['keylen']=="auto")
361
														echo " (" . gettext("auto") . ")";
362
													else
363
														echo " ({$ph2ea['keylen']} " . gettext("bits") . ")";
364
												}
365
											}
366
										?>
367
										<?=$spane;?>
368
									</td>
369
									<td nowrap class="listr">
370
										<?=$spans;?>
371
										<?php
372
											$k = 0;
373
											foreach ($ph2ent['hash-algorithm-option'] as $ph2ha) {
374
												if ($k++)
375
													echo ", ";
376
												echo $p2_halgos[$ph2ha];
377
											}
378
										?>
379
										<?=$spane;?>
380
									</td>
381
									<td nowrap class="list">
382
										<a href="vpn_ipsec_phase2.php?p2index=<?=$j;?>">
383
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase2 entry"); ?>" width="17" height="17" border="0">
384
										</a>
385
										<a href="vpn_ipsec.php?act=delph2&p1index=<?=$i;?>&p2index=<?=$j;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
386
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase2 entry"); ?>" width="17" height="17" border="0">
387
										</a>
388
										<a href="vpn_ipsec_phase2.php?dup=<?=$j;?>">
389
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new Phase 2 based on this one"); ?>" width="17" height="17" border="0">
390
										</a>
391
									</td>
392
								</tr>
393

    
394
								<?php
395
										$j++;
396
									}
397
								?>
398
							</table>
399
						</td>
400
					</tr>
401
					<tr>
402
						<td>
403
							&nbsp;
404
						</td>
405
					</tr>
406
					<?php
407
							$i++;
408
						}
409
					if(!$counter)
410
						show_ipsec_header($ph1ent);
411
					?>
412
					<tr>
413
						<td class="list" colspan="5"></td>
414
						<td class="list">
415
							<table border="0" cellspacing="0" cellpadding="1">
416
								<tr>
417
									<td width="17"></td>
418
									<td>
419
										<a href="vpn_ipsec_phase1.php">
420
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add phase1 entry"); ?>" width="17" height="17" border="0">
421
										</a>
422
									</td>
423
								</tr>
424
							</table>
425
						<td>
426
					</tr>
427
					<tr>
428
						<td colspan="4">
429
							<p>
430
								<span class="vexpl">
431
									<span class="red">
432
										<strong><?=gettext("Note"); ?>:<br></strong>
433
									</span>
434
								<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.<br/>
435
									<?=gettext("IPsec Debug Mode can be enabled at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.<br/>
436
									<?=gettext("IPsec can be set to prefer older SAs at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.
437
								</span>
438
							</p>
439
						</td>
440
					</tr>
441
				</table>
442
			</div>
443
		</td>
444
	</tr>
445
</table>
446
</form>
447
<?php include("fend.inc"); ?>
448
<script type="text/javascript">
449
function show_phase2(id, buttonid) {
450
	document.getElementById(buttonid).innerHTML='';
451
	aodiv = document.getElementById(id);
452
	aodiv.style.display = "block";
453
}
454
</script>
455
</body>
456
</html>
457

    
458
<?php
459

    
460
function show_ipsec_header($ph1ent) {
461
	global $g;
462
	if (isset($ph1ent['mobile'])) 
463
		$mobile = "&mobile=true";
464
	?>
465
	<tr>
466
		<td class="listhdrr"><?=gettext("Remote Gateway"); ?></td>
467
		<td class="listhdrr"><?=gettext("Mode"); ?></td>
468
		<td class="listhdrr"><?=gettext("P1 Protocol"); ?></td>
469
		<td class="listhdrr"><?=gettext("P1 Transforms"); ?></td>
470
		<td class="listhdrr"><?=gettext("P1 Description"); ?></td>
471
		<td class ="list">
472
		</td>
473
	</tr>
474

    
475
<?php
476
	
477
}
478

    
479
?>
(233-233/251)