pfSense

<?php

/*

	diag_ipsec.php

*/

 *  Parts of this code originally based on vpn_ipsec_sad.php from m0n0wall,

 *  are permitted provided that the following conditions are met:

 *  1. Redistributions of source code must retain the above copyright notice,

 *      this list of conditions and the following disclaimer.

 *

 *  2. Redistributions in binary form must reproduce the above copyright

 *      notice, this list of conditions and the following disclaimer in

 *      the documentation and/or other materials provided with the

 *      "This product includes software developed by the pfSense Project

 *  4. The names "pfSense" and "pfSense Project" must not be used to

 *       endorse or promote products derived from this software without

 *       prior written permission. For written permission, please contact

 *       coreteam@pfsense.org.

 *

 *  5. Products derived from this software may not be called "pfSense"

 *      nor may "pfSense" appear in their names without prior written

 *      permission of the Electric Sheep Fencing, LLC.

 *

 *  6. Redistributions of any form whatsoever must retain the following

 *      acknowledgment:

 *

 *  "This product includes software developed by the pfSense Project

 *  for use in the pfSense software distribution (http://www.pfsense.org/).

 *  EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 *  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 *  PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 *  ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 *  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 *  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 *  LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 *  HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 *  STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 *  ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 *  OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 *  ====================================================================

 *

 */

##|*IDENT=page-status-ipsec

##|*NAME=Status: IPsec page

##|*DESCR=Allow access to the 'Status: IPsec' page.

##|*MATCH=diag_ipsec.php*

##|-PRIV

require("guiconfig.inc");

include("head.inc");

	if (ctype_digit($_GET['ikeid'])) {

		if (!empty($ph1ent)) {

				for ($i = 0; $i < $ph2entries; $i++) {

					$connid = escapeshellarg("con{$_GET['ikeid']}00{$i}");

					mwexec("/usr/local/sbin/ipsec down {$connid}");

					mwexec("/usr/local/sbin/ipsec up {$connid}");

				}

			} else {

				mwexec("/usr/local/sbin/ipsec down con" . escapeshellarg($_GET['ikeid']));

				mwexec("/usr/local/sbin/ipsec up con" . escapeshellarg($_GET['ikeid']));

			}

		}

	if (ctype_digit($_GET['ikeid'])) {

	if (ctype_digit($_GET['ikeid'])) {

}

$tab_array[] = array(gettext("Overview"), true, "diag_ipsec.php");

$tab_array[] = array(gettext("Leases"), false, "diag_ipsec_leases.php");

$tab_array[] = array(gettext("SAD"), false, "diag_ipsec_sad.php");

$tab_array[] = array(gettext("SPD"), false, "diag_ipsec_spd.php");

<div class="panel panel-default">

	<div class="panel-heading">IPSec status</div>

	<div class="panel-body table responsive">

				<tr>

					<th><?=gettext("Description")?></th>

					<th><?=gettext("Local ID")?></th>

					<th><?=gettext("Local IP")?></th>

					<th><?=gettext("Remote ID")?></th>

					<th><?=gettext("Remote IP")?></th>

					<th><?=gettext("Role")?></th>

					<th><?=gettext("Reauth")?></th>

					<th><?=gettext("Algo")?></th>

					<th><?=gettext("Status")?></th>

					<th></th>

				</tr>

			</thead>

			<tbody>

<?php

$ipsecconnected = array();

	foreach ($status as $ikeid => $ikesa) {

	$con_id = substr($ikeid, 3);

			$ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00'));

			$ipsecconnected[$ph1idx] = $ph1idx;

		} else {

			$ipsecconnected[$con_id] = $ph1idx = $con_id;

		}

?>

				<tr>

					<td>

						<?=htmlspecialchars(ipsec_get_descr($ph1idx))?>

					</td>

					<td>

<?php

			if ($ikesa['local-id'] == '%any') {

				print(gettext('Any identifier'));

			print(gettext("Unknown"));

		}

					<td>

			print(htmlspecialchars($ikesa['local-host']));

		} else {

			print(gettext("Unknown"));

		}

		 * XXX: local-nat-t was defined by pfSense

		 * When strongswan team accepted the change, they changed it to

		 * nat-local. Keep both for a while and remove local-nat-t in

		 * the future

		 */

		}

		if (!empty($ikesa['remote-id'])) {

			if ($ikesa['remote-id'] == '%any') {

				$identity = 'Any identifier';

			} else {

				$identity = htmlspecialchars($ikesa['remote']['identification']);

			}

		}

		if (!empty($ikesa['remote-xauth-id'])) {

			echo htmlspecialchars($ikesa['remote-xauth-id']);

			echo "<br/>{$identity}";

		} elseif (!empty($ikesa['remote-eap-id'])) {

			echo htmlspecialchars($ikesa['remote-eap-id']);

			echo "<br/>{$identity}";

		} else {

			if (empty($identity)) {

				print($identity);

					<td>

			print(htmlspecialchars($ikesa['remote-host']));

		} else {

			print(gettext("Unknown"));

		}

		 * XXX: remote-nat-t was defined by pfSense

		 * When strongswan team accepted the change, they changed it to

		 * nat-remote. Keep both for a while and remove remote-nat-t in

		 * the future

		 */

		if (isset($ikesa['remote-nat-t']) || isset($ikesa['nat-remote'])) {

		}

						IKEv<?=htmlspecialchars($ikesa['version'])?>

						<br/>

		if ($ikesa['initiator'] == 'yes') {

			print("initiator");

		} else {

			print("responder");

		}

?>

					<td>

					<td>

					<td>

<?php

			print('<span style="color:green">');

		} else {

			print('<span>');

		}

					</td>

					<td >

							<?=gettext("Disconnect")?>

						</a><br />

				</tr>

				<tr>

					<td colspan = 10>

							<a type="button" onclick="show_childsa('childsa-<?=$ikeid?>','btnchildsa-<?=$ikeid?>');" class="btn btn-sm btn-default" />

								<?=gettext('Show child SA entries')?>

							</a>

						</div>

							<thead>

								<tr class="info">

									<th><?=gettext("Local subnets")?></th>

									<th><?=gettext("Local SPI(s)")?></th>

									<th><?=gettext("Remote subnets")?></th>

									<th><?=gettext("Times")?></th>

									<th><?=gettext("Algo")?></th>

									<th><?=gettext("Stats")?></th>

									<th><!-- Buttons --></th>

								</tr>

							</thead>

							<tbody>

<?php

								<tr>

									<td>

<?php

					foreach ($childsa['local-ts'] as $lnets) {

				} else {

									<td>

					print(gettext("Local: ") . htmlspecialchars($childsa['spi-in']));

				}

					print('<br/>' . gettext('Remote: ') . htmlspecialchars($childsa['spi-out']));

				}

									<td>

					foreach ($childsa['remote-ts'] as $rnets) {

				} else {

									<td>

				print('<br/>' . gettext('Life: ') . htmlspecialchars($childsa['life-time']) . gettext(" seconds (") . convert_seconds_to_hms($childsa['life-time']) . ")" );

				print('<br/>' . gettext('Install: ') .htmlspecialchars($childsa['install-time']) . gettext(" seconds (") . convert_seconds_to_hms($childsa['install-time']) . ")" );

									<td>

<?php

				print(htmlspecialchars($childsa['integ-alg']) . '<br/>');

					print(htmlspecialchars($childsa['prf-alg']) . '<br/>');

				}

				if (!empty($childsa['dh-group'])) {

					print(htmlspecialchars($childsa['dh-group']) . '<br/>');

				}

				if (!empty($childsa['esn'])) {

				if (!empty($childsa['cpi-in']) || !empty($childsa['cpi-out'])) {

					print(htmlspecialchars($childsa['cpi-in']) . " " . htmlspecialchars($childsa['cpi-out']));

				} else {

					print(gettext('none'));

				}

									</td>

									<td>

<?php

				print(gettext("Packets-In: ") . htmlspecialchars(number_format($childsa['packets-in'])) . '<br/>');

				print(gettext("Bytes-Out: ") . htmlspecialchars(number_format($childsa['bytes-out'])) . ' (' . htmlspecialchars(format_bytes($childsa['bytes-out'])) . ')<br/>');

				print(gettext("Packets-Out: ") . htmlspecialchars(number_format($childsa['packets-out'])) . '<br/>');

									</td>

									<td>

										</a>

									</td>

								</tr>

<?php

							</tbody>

						</table>

					</td>

				</tr>

		unset($con_id);

$rgmap = array();

	if (isset($ph1ent['disabled'])) {

				<tr>

					<td>

<?php

	print(htmlspecialchars($ph1ent['descr']));

?>

					</td>

					<td>

<?php

	list ($myid_type, $myid_data) = ipsec_find_id($ph1ent, "local");

	if (empty($myid_data))

		print(gettext("Unknown"));

	else

		print(htmlspecialchars($myid_data));

?>

					</td>

					<td>

<?php

	$ph1src = ipsec_get_phase1_src($ph1ent);

		print(gettext("Unknown"));

	else

		print(htmlspecialchars($ph1src));

?>

					</td>

					<td>

<?php

	list ($peerid_type, $peerid_data) = ipsec_find_id($ph1ent, "peer", $rgmap);

	if (empty($peerid_data))

		print(gettext("Unknown"));

	else

		print(htmlspecialchars($peerid_data));

?>

					</td>

					<td>

<?php

	$ph1src = ipsec_get_phase1_dst($ph1ent);

	if (empty($ph1src))

		print(gettext("Unknown"));

	else

		print(htmlspecialchars($ph1src));

?>

					</td>

					<td>

					</td>

					<td>

					</td>

					<td>

					</td>

<?php

					<td>

						<?=gettext("Awaiting connections")?>

					</td>

					<td>

					</td>

<?php

					<td>

						<?=gettext("Disconnected")?>

					</td>

					<td >

						<a href="diag_ipsec.php?act=connect&amp;ikeid=<?=$ph1ent['ikeid']; ?>" class="btn btn-xs btn-success">

							<?=gettext("Connect VPN")?>

				</tr>

	</div>

	document.getElementById(buttonid).innerHTML='';

	aodiv = document.getElementById(id);

	aodiv.style.display = "block";

}

<?php

unset($status);

print_info_box(gettext("You can configure IPsec ") . '<a href="vpn_ipsec.php">Here</a>');

include("foot.inc"); ?>