Projet

Général

Profil

Télécharger (15,6 ko) Statistiques
| Branche: | Tag: | Révision:

univnautes / usr / local / www / vpn_ipsec.php @ 391453a1

1
<?php
2
/*
3
	vpn_ipsec.php
4
	part of m0n0wall (http://m0n0.ch/wall)
5

    
6
	Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>.
7
	Copyright (C) 2008 Shrew Soft Inc
8
	All rights reserved.
9

    
10
	Redistribution and use in source and binary forms, with or without
11
	modification, are permitted provided that the following conditions are met:
12

    
13
	1. Redistributions of source code must retain the above copyright notice,
14
	   this list of conditions and the following disclaimer.
15

    
16
	2. Redistributions in binary form must reproduce the above copyright
17
	   notice, this list of conditions and the following disclaimer in the
18
	   documentation and/or other materials provided with the distribution.
19

    
20
	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
21
	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
22
	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23
	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
24
	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25
	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26
	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27
	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28
	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29
	POSSIBILITY OF SUCH DAMAGE.
30
*/
31

    
32
##|+PRIV
33
##|*IDENT=page-vpn-ipsec
34
##|*NAME=VPN: IPsec page
35
##|*DESCR=Allow access to the 'VPN: IPsec' page.
36
##|*MATCH=vpn_ipsec.php*
37
##|-PRIV
38

    
39
require("guiconfig.inc");
40
require_once("functions.inc");
41
require_once("filter.inc");
42
require_once("shaper.inc");
43
require_once("ipsec.inc");
44
require_once("vpn.inc");
45

    
46
if (!is_array($config['ipsec']['phase1']))
47
	$config['ipsec']['phase1'] = array();
48

    
49
if (!is_array($config['ipsec']['phase2']))
50
	$config['ipsec']['phase2'] = array();
51

    
52
$a_phase1 = &$config['ipsec']['phase1'];
53
$a_phase2 = &$config['ipsec']['phase2'];
54

    
55
$pconfig['enable'] = isset($config['ipsec']['enable']);
56

    
57
if ($_POST) {
58

    
59
	if ($_POST['apply']) {
60
		$retval = 0;
61
		$retval = vpn_ipsec_configure();
62
		/* reload the filter in the background */
63
		filter_configure();
64
		$savemsg = get_std_save_message($retval);
65
		if ($retval >= 0) {
66
			if (is_subsystem_dirty('ipsec'))
67
				clear_subsystem_dirty('ipsec');
68
		}
69
	} else if ($_POST['submit']) {
70
		$pconfig = $_POST;
71

    
72
		$config['ipsec']['enable'] = $_POST['enable'] ? true : false;
73

    
74
		write_config();
75

    
76
		$retval = vpn_ipsec_configure();
77
	}
78
}
79

    
80
if ($_GET['act'] == "delph1")
81
{
82
	if ($a_phase1[$_GET['p1index']]) {
83
		/* remove static route if interface is not WAN */
84
		if ($a_phase1[$_GET['p1index']]['interface'] <> "wan")
85
			mwexec("/sbin/route delete -host {$a_phase1[$_GET['p1index']]['remote-gateway']}");
86

    
87
		/* remove all phase2 entries that match the ikeid */
88
		$ikeid = $a_phase1[$_GET['p1index']]['ikeid'];
89
		foreach ($a_phase2 as $p2index => $ph2tmp)
90
			if ($ph2tmp['ikeid'] == $ikeid) {
91
				unset($a_phase2[$p2index]);
92
			}
93

    
94
		/* remove the phase1 entry */
95
		unset($a_phase1[$_GET['p1index']]);
96
		vpn_ipsec_configure();
97
		write_config();
98
		filter_configure();
99
		header("Location: vpn_ipsec.php");
100
		exit;
101
	}
102
}
103

    
104
if ($_GET['act'] == "delph2")
105
{
106
	if ($a_phase1[$_GET['p1index']] && $a_phase2[$_GET['p2index']]) {
107
		/* remove the phase2 entry */
108
		unset($a_phase2[$_GET['p2index']]);
109
		vpn_ipsec_configure();
110
		filter_configure();
111
		write_config();
112
		header("Location: vpn_ipsec.php");
113
		exit;
114
	}
115
}
116

    
117
$pgtitle = array(gettext("VPN"),gettext("IPsec"));
118
$shortcut_section = "ipsec";
119

    
120
include("head.inc");
121

    
122
?>
123

    
124
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
125
<?php include("fbegin.inc"); ?>
126
<form action="vpn_ipsec.php" method="post">
127
<?php
128
	if ($savemsg)
129
		print_info_box($savemsg);
130
	if ($pconfig['enable'] && is_subsystem_dirty('ipsec'))
131
		print_info_box_np(gettext("The IPsec tunnel configuration has been changed") . ".<br />" . gettext("You must apply the changes in order for them to take effect."));
132
?>
133
<table width="100%" border="0" cellpadding="0" cellspacing="0" summary="vpn ipsec">
134
	<tr>
135
		<td class="tabnavtbl">
136
			<?php
137
				$tab_array = array();
138
				$tab_array[0] = array(gettext("Tunnels"), true, "vpn_ipsec.php");
139
				$tab_array[1] = array(gettext("Mobile clients"), false, "vpn_ipsec_mobile.php");
140
				$tab_array[2] = array(gettext("Pre-Shared Keys"), false, "vpn_ipsec_keys.php");
141
				$tab_array[3] = array(gettext("Advanced Settings"), false, "vpn_ipsec_settings.php");
142
				display_top_tabs($tab_array);
143
			?>
144
		</td>
145
	</tr>
146
	<tr>
147
		<td>
148
			<div id="mainarea">
149
				<table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0" summary="main area">
150
					<tr>
151
						<td class="vtable">
152
							<table border="0" cellspacing="2" cellpadding="0" summary="enable">
153
								<tr>
154
									<td>
155
										<input name="enable" type="checkbox" id="enable" value="yes" <?php if ($pconfig['enable']) echo "checked=\"checked\"";?> />
156
									</td>
157
									<td>
158
										<strong><?=gettext("Enable IPsec"); ?></strong>
159
									</td>
160
								</tr>
161
							</table>
162
						</td>
163
					</tr>
164
					<tr>
165
						<td>
166
							<input name="submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" />
167
						</td>
168
					</tr>
169
				</table>
170
				<table class="tabcont" width="100%" border="0" cellpadding="0" cellspacing="0" summary="phase-1 entries">
171
					<?php
172
						$i = 0;
173
						foreach ($a_phase1 as $ph1ent) {
174
							if (isset( $ph1ent['disabled'])) {
175
								$spans = "<span class=\"gray\">";
176
								$spane = "</span>";
177
							}
178
							else
179
								$spans = $spane = "";
180
						
181
						show_ipsec_header($ph1ent);
182
						$counter++; // used to determine if we need to output header manually (no records exist)
183
					?>					
184
					<tr valign="top" ondblclick="document.location='vpn_ipsec_phase1.php?p1index=<?=$i;?>'">
185
						<td class="listlr">
186
							<?=$spans;?>
187
							<?php
188
								if ($ph1ent['interface']) {
189
									$iflabels = get_configured_interface_with_descr();
190

    
191
									$carplist = get_configured_carp_interface_list();
192
									foreach ($carplist as $cif => $carpip)
193
										$iflabels[$cif] = $carpip." (".get_vip_descr($carpip).")";
194

    
195
									$aliaslist = get_configured_ip_aliases_list();
196
									foreach ($aliaslist as $aliasip => $aliasif)
197
										$iflabels[$aliasip] = $aliasip." (".get_vip_descr($aliasip).")";
198

    
199
									$grouplist = return_gateway_groups_array();
200
									foreach ($grouplist as $name => $group) {
201
										if($group[0]['vip'] <> "")
202
											$vipif = $group[0]['vip'];
203
										else
204
											$vipif = $group[0]['int'];
205
										$iflabels[$name] = "GW Group {$name}";
206
									}
207
									$if = htmlspecialchars($iflabels[$ph1ent['interface']]);
208
								}
209
								else
210
									$if = "WAN";
211

    
212
								if (!isset($ph1ent['mobile']))
213
									echo $if."<br />".$ph1ent['remote-gateway'];
214
								else
215
									echo $if."<br /><strong>" . gettext("Mobile Client") . "</strong>";
216
							?>
217
							<?=$spane;?>
218
						</td>
219
						<td class="listr">
220
							<?=$spans;?>
221
							<?=$ph1ent['mode'];?>
222
							<?=$spane;?>
223
						</td>
224
						<td class="listr">
225
							<?=$spans;?>
226
							<?=$p1_ealgos[$ph1ent['encryption-algorithm']['name']]['name'];?>
227
							<?php
228
								if ($ph1ent['encryption-algorithm']['keylen']) {
229
									if ($ph1ent['encryption-algorithm']['keylen']=="auto")
230
										echo " (" . gettext("auto") . ")";
231
									else
232
										echo " ({$ph1ent['encryption-algorithm']['keylen']} " . gettext("bits") . ")";
233
								}
234
							?>
235
							<?=$spane;?>
236
						</td>
237
						<td class="listr">
238
							<?=$spans;?>
239
							<?=$p1_halgos[$ph1ent['hash-algorithm']];?>
240
							<?=$spane;?>
241
						</td>
242
						<td class="listbg">
243
							<?=$spans;?>
244
							<?=htmlspecialchars($ph1ent['descr']);?>&nbsp;
245
							<?=$spane;?>
246
						</td>
247
						<td valign="middle" class="list nowrap">
248
							<table border="0" cellspacing="0" cellpadding="1" summary="icons">
249
								<tr>
250
									<td>
251
										<a href="vpn_ipsec_phase1.php?p1index=<?=$i;?>">
252
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase1 entry"); ?>" width="17" height="17" border="0" alt="edit" />
253
										</a>
254
									</td>
255
									<td>
256
										<a href="vpn_ipsec.php?act=delph1&amp;p1index=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase1 and all associated phase2 entries?"); ?>')">
257
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase1 entry"); ?>" width="17" height="17" border="0" alt="delete" />
258
										</a>
259
									</td>
260
								</tr>
261
								<?php if (!isset($ph1ent['mobile'])): ?>
262
								<tr>
263
									<td>
264
									</td>
265
									<td>
266
										<a href="vpn_ipsec_phase1.php?dup=<?=$i;?>">
267
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("copy phase1 entry"); ?>" width="17" height="17" border="0" alt="add" />
268
										</a>
269
									</td>
270
								</tr>
271
								<?php endif; ?>
272
							</table>
273
						</td>
274
					</tr>
275
					<tr>
276
						<td class="listrborder" colspan="5">
277
							<div id="shph2but-<?=$i?>">
278
								<?php
279
									$phase2count=0;
280
									foreach ($a_phase2 as $ph2ent) {
281
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) 
282
											continue;
283
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) 
284
											continue;
285
										$phase2count++;
286
									}
287
								?>								
288
								<input type="button" onclick="show_phase2('tdph2-<?=$i?>','shph2but-<?=$i?>')" value="+" /> - <?php printf(gettext("Show %s Phase-2 entries"), $phase2count); ?>
289
							</div>
290
							<table class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="0" id="tdph2-<?=$i?>" style="display:none" summary="phase-2 entries">
291
								<tr>
292
									<td class="listhdrr"><?=gettext("Mode"); ?></td>
293
									<?php if(($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6")): ?>
294
									<td class="listhdrr"><?=gettext("Local Subnet"); ?></td>
295
									<td class="listhdrr"><?=gettext("Remote Subnet"); ?></td>
296
									<?php endif; ?>
297
									<td class="listhdrr"><?=gettext("P2 Protocol"); ?></td>
298
									<td class="listhdrr"><?=gettext("P2 Transforms"); ?></td>
299
									<td class="listhdrr"><?=gettext("P2 Auth Methods"); ?></td>
300
									<td class ="list">
301
										<a href="vpn_ipsec_phase2.php?ikeid=<?=$ph1ent['ikeid'];?><?php if (isset($ph1ent['mobile'])) echo "&amp;mobile=true";?>">
302
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add phase2 entry"); ?>" width="17" height="17" border="0" alt="add" />
303
										</a>
304
									</td>
305
								</tr>
306
								<?php
307
									$j = 0;
308
									foreach ($a_phase2 as $ph2ent) {
309
										if ($ph2ent['ikeid'] != $ph1ent['ikeid']) {
310
											$j++;
311
											continue;
312
										}
313

    
314
										if (isset( $ph2ent['disabled']) || isset($ph1ent['disabled'])) {
315
											$spans = "<span class=\"gray\">";
316
											$spane = "</span>";
317
										}
318
										else
319
											$spans = $spane = "";
320
								?>
321
								<tr valign="top" ondblclick="document.location='vpn_ipsec_phase2.php?p2index=<?=$j;?>'">
322

    
323
									<td class="listlr nowrap">
324
										<?=$spans;?>
325
											<?=$ph2ent['mode'];?>
326
										<?=$spane;?>
327
									</td>
328
									<?php 
329
										if(($ph2ent['mode'] <> "tunnel") and ($ph2ent['mode'] <> "tunnel6")) {
330
											echo "<td class=\"listr nowrap\">&nbsp;</td><td class=\"listr nowrap\">&nbsp;</td>";
331
										} 
332
									?>
333
									<?php if(($ph2ent['mode'] == "tunnel") or ($ph2ent['mode'] == "tunnel6")): ?>
334
									<td class="listr nowrap">
335
										<?=$spans;?>
336
											<?=ipsec_idinfo_to_text($ph2ent['localid']); ?>
337
										<?=$spane;?>
338
									</td>
339
									<td class="listr nowrap">
340
										<?=$spans;?>
341
											<?=ipsec_idinfo_to_text($ph2ent['remoteid']); ?>
342
										<?=$spane;?>
343
									</td>
344
									<?php endif; ?>
345
									<td class="listr nowrap">
346
										<?=$spans;?>
347
											<?php echo $p2_protos[$ph2ent['protocol']];	?>
348
										<?=$spane;?>
349
									</td>
350
									<td class="listr">
351
										<?=$spans;?>
352
										<?php
353
											$k = 0;
354
											foreach ($ph2ent['encryption-algorithm-option'] as $ph2ea) {
355
												if ($k++)
356
													echo ", ";
357
												echo $p2_ealgos[$ph2ea['name']]['name'];
358
												if ($ph2ea['keylen']) {
359
													if ($ph2ea['keylen']=="auto")
360
														echo " (" . gettext("auto") . ")";
361
													else
362
														echo " ({$ph2ea['keylen']} " . gettext("bits") . ")";
363
												}
364
											}
365
										?>
366
										<?=$spane;?>
367
									</td>
368
									<td class="listr nowrap">
369
										<?=$spans;?>
370
										<?php
371
											$k = 0;
372
											foreach ($ph2ent['hash-algorithm-option'] as $ph2ha) {
373
												if ($k++)
374
													echo ", ";
375
												echo $p2_halgos[$ph2ha];
376
											}
377
										?>
378
										<?=$spane;?>
379
									</td>
380
									<td class="list nowrap">
381
										<a href="vpn_ipsec_phase2.php?p2index=<?=$j;?>">
382
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit phase2 entry"); ?>" width="17" height="17" border="0" alt="edit" />
383
										</a>
384
										<a href="vpn_ipsec.php?act=delph2&amp;p1index=<?=$i;?>&amp;p2index=<?=$j;?>" onclick="return confirm('<?=gettext("Do you really want to delete this phase2 entry?"); ?>')">
385
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" title="<?=gettext("delete phase2 entry"); ?>" width="17" height="17" border="0" alt="delete" />
386
										</a>
387
										<a href="vpn_ipsec_phase2.php?dup=<?=$j;?>">
388
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new Phase 2 based on this one"); ?>" width="17" height="17" border="0" alt="add" />
389
										</a>
390
									</td>
391
								</tr>
392

    
393
								<?php
394
										$j++;
395
									}
396
								?>
397
							</table>
398
						</td>
399
					</tr>
400
					<tr>
401
						<td>
402
							&nbsp;
403
						</td>
404
					</tr>
405
					<?php
406
							$i++;
407
						}
408
					if(!$counter)
409
						show_ipsec_header($ph1ent);
410
					?>
411
					<tr>
412
						<td class="list" colspan="5"></td>
413
						<td class="list">
414
							<table border="0" cellspacing="0" cellpadding="1" summary="add">
415
								<tr>
416
									<td width="17"></td>
417
									<td>
418
										<a href="vpn_ipsec_phase1.php">
419
											<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add phase1 entry"); ?>" width="17" height="17" border="0" alt="add" />
420
										</a>
421
									</td>
422
								</tr>
423
							</table>
424
						</td>
425
					</tr>
426
					<tr>
427
						<td colspan="4">
428
							<p>
429
								<span class="vexpl">
430
									<span class="red">
431
										<strong><?=gettext("Note"); ?>:<br /></strong>
432
									</span>
433
								<?=gettext("You can check your IPsec status at"); ?> <a href="diag_ipsec.php"><?=gettext("Status:IPsec"); ?></a>.<br />
434
									<?=gettext("IPsec Debug Mode can be enabled at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.<br />
435
									<?=gettext("IPsec can be set to prefer older SAs at"); ?> <a href="system_advanced_misc.php"><?=gettext("System:Advanced:Miscellaneous"); ?></a>.
436
								</span>
437
							</p>
438
						</td>
439
					</tr>
440
				</table>
441
			</div>
442
		</td>
443
	</tr>
444
</table>
445
</form>
446
<?php include("fend.inc"); ?>
447
<script type="text/javascript">
448
//<![CDATA[
449
function show_phase2(id, buttonid) {
450
	document.getElementById(buttonid).innerHTML='';
451
	aodiv = document.getElementById(id);
452
	aodiv.style.display = "block";
453
}
454
//]]>
455
</script>
456
</body>
457
</html>
458

    
459
<?php
460

    
461
function show_ipsec_header($ph1ent) {
462
	global $g;
463
	if (isset($ph1ent['mobile'])) 
464
		$mobile = "&mobile=true";
465
	?>
466
	<tr>
467
		<td class="listhdrr"><?=gettext("Remote Gateway"); ?></td>
468
		<td class="listhdrr"><?=gettext("Mode"); ?></td>
469
		<td class="listhdrr"><?=gettext("P1 Protocol"); ?></td>
470
		<td class="listhdrr"><?=gettext("P1 Transforms"); ?></td>
471
		<td class="listhdrr"><?=gettext("P1 Description"); ?></td>
472
		<td class ="list">
473
		</td>
474
	</tr>
475

    
476
<?php
477
	
478
}
479

    
480
?>
(235-235/254)