ipsec: change check if a ikev2 tunnel is up.

[people/pmueller/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index f336ec610aaa8f9f01d3a55c511fcba5840ef485..3785b90a5d6954003584c6f2dcff8171d356dac4 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2010  IPFire Team  info@ipfire.org                       #
+# Copyright (C) 2007-2011  IPFire Team  info@ipfire.org                       #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -395,8 +395,11 @@ sub writeipsecfiles {
            print CONF "\tpfsgroup=$lconfighash{$key}[23]\n";
        }
 
-       # IKE V1
-       print CONF "\tkeyexchange=ikev1\n";
+       # IKE V1 or V2
+       if (! $lconfighash{$key}[29]) {
+          $lconfighash{$key}[29] = "ikev1";
+       }
+       print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
 
        # Lifetimes
        print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
@@ -1288,6 +1291,7 @@ END
        $cgiparams{'REMARK'}            = $confighash{$cgiparams{'KEY'}}[25];
        $cgiparams{'INTERFACE'}         = $confighash{$cgiparams{'KEY'}}[26];
        $cgiparams{'DPD_ACTION'}        = $confighash{$cgiparams{'KEY'}}[27];
+       $cgiparams{'IKE_VERSION'}       = $confighash{$cgiparams{'KEY'}}[29];
        $cgiparams{'IKE_ENCRYPTION'}    = $confighash{$cgiparams{'KEY'}}[18];
        $cgiparams{'IKE_INTEGRITY'}     = $confighash{$cgiparams{'KEY'}}[19];
        $cgiparams{'IKE_GROUPTYPE'}     = $confighash{$cgiparams{'KEY'}}[20];
@@ -1383,15 +1387,15 @@ END
 
        # Allow nothing or a string (DN,FDQN,) beginning with @
        # with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
-       if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d\.\d\.\d\.\d)$/) ||
-           ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d\.\d\.\d\.\d)$/) ||
+       if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
+           ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
            (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
           ) {
            $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
            'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
            'FQDN: @ipfire.org<br />' .
            'USER_FQDN: info@ipfire.org<br />' .
-           'IPV4_ADDR: @123.123.123.123';
+           'IPV4_ADDR: 123.123.123.123';
            goto VPNCONF_ERROR;
        }
        # If Auth is DN, verify existance of Remote ID.
@@ -1790,6 +1794,7 @@ END
        $confighash{$key}[25] = $cgiparams{'REMARK'};
        $confighash{$key}[26] = $cgiparams{'INTERFACE'};
        $confighash{$key}[27] = $cgiparams{'DPD_ACTION'};
+       $confighash{$key}[29] = $cgiparams{'IKE_VERSION'};
 
        #dont forget advanced value
        $confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'};
@@ -1845,6 +1850,11 @@ END
            $cgiparams{'DPD_ACTION'} = 'restart';
        }
 
+       # Default IKE Version to V1
+       if (! $cgiparams{'IKE_VERSION'}) {
+           $cgiparams{'IKE_VERSION'} = 'ikev1';
+       }
+
        # Default is yes for 'pfs'
        $cgiparams{'PFS'}     = 'on';
        
@@ -1895,6 +1905,10 @@ END
     $selected{'DPD_ACTION'}{'restart'} = '';
     $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
 
+    $selected{'IKE_VERSION'}{'ikev1'} = '';
+    $selected{'IKE_VERSION'}{'ikev2'} = '';
+    $selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'";
+
     &Header::showhttpheaders();
     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
     &Header::openbigbox('100%', 'left', '', $errormessage);
@@ -1974,6 +1988,12 @@ END
            <td><input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' /></td>
        </tr><tr>
        </tr><td><br /></td><tr>
+           <td>$Lang::tr{'vpn keyexchange'}:</td>
+           <td><select name='IKE_VERSION'>
+               <option value='ikev1' $selected{'IKE_VERSION'}{'ikev1'}>IKEv1</option>
+               <option value='ikev2' $selected{'IKE_VERSION'}{'ikev2'}>IKEv2</option>
+               </select></a>
+           </td>
            <td>$Lang::tr{'dpd action'}:</td>
            <td><select name='DPD_ACTION'>
                <option value='clear' $selected{'DPD_ACTION'}{'clear'}>clear</option>
@@ -2400,7 +2420,7 @@ EOF
     &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
     $cgiparams{'CA_NAME'} = '';
 
-    my @status = `/usr/local/bin/ipsecctrl I`;
+    my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
 
     # suggest a default name for this side
     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
@@ -2519,7 +2539,9 @@ END
        # get real state
        my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
        foreach my $line (@status) {
-           if ($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) {
+           if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
+              ($line =~ / $confighash{$key}[1]\{.*INSTALLED/))
+           {
                $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
            }
        }