mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Correct the functions for returning tunnel status to use strongswan status reports

Browse Source
This commit is contained in:
Ermal 2014-08-18 21:51:35 +02:00
parent c650b2f749
commit fe12d7ea12
2 changed files with 17 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
etc/inc/ipsec.inc
View File

@ -324,11 +324,11 @@ function ipsec_lookup_phase1(& $ph2ent,& $ph1ent) {
global $config;
if (!is_array($config['ipsec']))
return;
return false;
if (!is_array($config['ipsec']['phase1']))
return;
return false;
if (empty($config['ipsec']['phase1']))
return;
return false;
foreach ($config['ipsec']['phase1'] as $ph1tmp) {
if ($ph1tmp['ikeid'] == $ph2ent['ikeid']) {
@ -343,13 +343,15 @@ function ipsec_lookup_phase1(& $ph2ent,& $ph1ent) {
/*
* Check phase1 communications status
*/
function ipsec_phase1_status(& $ph1ent) {
function ipsec_phase1_status($ipsec_status, $ikeid) {
$loc_ip = get_ipsec_tunnel_src($ph1ent);
$rmt_ip = $ph1ent['remote-gateway'];
if (ipsec_lookup_ipsakmp_sa($loc_ip,$rmt_ip))
return true;
foreach ($ipsec_status as $ike) {
if ($ike['peerconfig'] != "con{$ikeid}")
continue;
if ($ike['status'] == "established")
return true;
break;
}
return false;
}
@ -357,23 +359,10 @@ function ipsec_phase1_status(& $ph1ent) {
/*
* Check phase2 communications status
*/
function ipsec_phase2_status(& $spd,& $sad,& $ph1ent,& $ph2ent) {
function ipsec_phase2_status($ipsec_status, &$phase2) {
$loc_ip = ipsec_get_phase1_src($ph1ent);
$rmt_ip = ipsec_get_phase1_dst($ph1ent);
$loc_id = ipsec_idinfo_to_cidr($ph2ent['localid'],true,$ph2ent['mode']);
if (!empty($ph2ent['natlocalid']))
$natloc_id = ipsec_idinfo_to_cidr($ph2ent['natlocalid'],true,$ph2ent['mode']);
$rmt_id = ipsec_idinfo_to_cidr($ph2ent['remoteid'],true,$ph2ent['mode']);
/* check for established SA in both directions */
if( ipsec_lookup_ipsec_sa($spd,$sad,"out",$loc_ip,$rmt_ip,$loc_id,$rmt_id)) {
if (empty($ph2ent['natlocalid']) && ipsec_lookup_ipsec_sa($spd,$sad,"in",$rmt_ip,$loc_ip,$rmt_id,$loc_id))
return true;
else if (!empty($ph2ent['natlocalid']) && ipsec_lookup_ipsec_sa($spd,$sad,"out",$loc_ip,$rmt_ip,$loc_id,$rmt_id))
return true;
}
if (ipsec_lookup_phase1($ph2ent,$ph1ent))
return ipsec_phase1_status($ipsec_status, $ph1ent['ikeid']);
return false;
}

7
usr/local/www/diag_ipsec_xml.php
View File

@ -50,15 +50,14 @@ $ipsec_status = array();
$a_phase2 = &$config['ipsec']['phase2'];
$spd = ipsec_dump_spd();
$sad = ipsec_dump_sad();
$status = ipsec_smp_dump_status();
if(is_array($a_phase2)) {
if (is_array($status['query']) && $status['query']['ikesalist'] && $status['query']['ikesalist']['ikesa'])) {
foreach ($a_phase2 as $ph2ent) {
ipsec_lookup_phase1($ph2ent,$ph1ent);
$tunnel = array();
if (!isset($ph2ent['disabled']) && !isset($ph1ent['disabled'])) {
if(ipsec_phase2_status($spd,$sad,$ph1ent,$ph2ent))
if(ipsec_phase1_status($status['query']['ikesalist']['ikesa'], $ph1ent['ikeid']))
$tunnel['state'] = "up";
elseif(!isset($config['ipsec']['enable']))
$tunnel['state'] = "disabled";