vpnmain.cgi: Fix typo.

[people/pmueller/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index d46a14e7916454192306afa91eb82d54b15b384a..077f5ab6c483f0dc96dc5a6da35bbeb1f77ff4ca 100644 (file)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -35,6 +35,7 @@ require '/var/ipfire/general-functions.pl';
 require "${General::swroot}/lang.pl";
 require "${General::swroot}/header.pl";
 require "${General::swroot}/countries.pl";
+require "${General::swroot}/location-functions.pl";
 
 # enable only the following on debugging purpose
 #use warnings;
@@ -46,7 +47,7 @@ undef (@dummy);
 my %color = ();
 my %mainsettings = ();
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
-&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
+&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
 
 ###
 ### Initialize variables
@@ -63,6 +64,8 @@ my %cahash=();
 my %selected=();
 my $warnmessage = '';
 my $errormessage = '';
+my $cryptoerror = '';
+my $cryptowarning = '';
 my %settings=();
 my $routes_push_file = '';
 my $confighost="${General::swroot}/fwhosts/customhosts";
@@ -92,11 +95,12 @@ $cgiparams{'ROUTES_PUSH'} = '';
 $cgiparams{'DCOMPLZO'} = 'off';
 $cgiparams{'MSSFIX'} = '';
 $cgiparams{'number'} = '';
-$cgiparams{'PMTU_DISCOVERY'} = '';
 $cgiparams{'DCIPHER'} = '';
 $cgiparams{'DAUTH'} = '';
 $cgiparams{'TLSAUTH'} = '';
 $routes_push_file = "${General::swroot}/ovpn/routes_push";
+# Perform crypto and configration test
+&pkiconfigcheck;
 
 # Add CCD files if not already presant
 unless (-e $routes_push_file) {
@@ -170,7 +174,12 @@ sub cleanssldatabase
        print FILE "";
        close FILE;
     }
+    if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
+      print FILE "";
+      close FILE;
+    }
     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
+    unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
     unlink ("${General::swroot}/ovpn/certs/serial.old");
     unlink ("${General::swroot}/ovpn/certs/01.pem");
 }
@@ -183,9 +192,13 @@ sub newcleanssldatabase
        close FILE;
     }
     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
-       system ("touch ${General::swroot}/ovpn/certs/index.txt");
+       &General::system("touch", "${General::swroot}/ovpn/certs/index.txt");
+    }
+    if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
+       &General::system("touch", "${General::swroot}/ovpn/certs/index.txt.attr");
     }
     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
+    unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
     unlink ("${General::swroot}/ovpn/certs/serial.old");
 }
 
@@ -199,6 +212,48 @@ sub deletebackupcert
        }
 }
 
+###
+### Check for PKI and configure problems
+###
+
+sub pkiconfigcheck
+{
+       # Warning if DH parameter is 1024 bit
+       if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
+               my @dhparameter = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
+
+               foreach my $line (@dhparameter) {
+                       my @dhbit = ($line =~ /(\d+)/);
+                       if ($1 < 2048) {
+                               $cryptoerror = "$Lang::tr{'ovpn error dh'}";
+                               goto CRYPTO_ERROR;
+                       }
+               }
+       }
+
+       # Warning if md5 is in usage
+       if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
+               my @signature = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+               if (grep(/md5WithRSAEncryption/, @signature) ) {
+                       $cryptoerror = "$Lang::tr{'ovpn error md5'}";
+                       goto CRYPTO_ERROR;
+               }
+       }
+
+       CRYPTO_ERROR:
+
+       # Warning if certificate is not compliant to RFC3280 TLS rules
+       if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
+               my @extendkeyusage = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+               if ( ! grep(/TLS Web Server Authentication/, @extendkeyusage)) {
+                       $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
+                       goto CRYPTO_WARNING;
+               }
+       }
+
+       CRYPTO_WARNING:
+}
+
 sub writeserverconf {
     my %sovpnsettings = ();  
     my @temp = ();  
@@ -216,7 +271,7 @@ sub writeserverconf {
     print CONF "dev tun\n";
     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
-    print CONF "script-security 3 system\n";
+    print CONF "script-security 3\n";
     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
     print CONF "tls-server\n";
@@ -228,18 +283,7 @@ sub writeserverconf {
     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 
-    # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
-    # If we doesn't use one of them, we can use the configured mtu value.
-    if ($sovpnsettings{'MSSFIX'} eq 'on') 
-       { print CONF "tun-mtu 1500\n"; }
-    elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') 
-       { print CONF "tun-mtu 1500\n"; }
-    elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
-       ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
-       ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
-       { print CONF "tun-mtu 1500\n"; } 
-    else 
-       { print CONF "tun-mtu $sovpnsettings{'DMTU'}\n"; }
+    print CONF "tun-mtu $sovpnsettings{'DMTU'}\n";
 
     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
                @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
@@ -272,29 +316,24 @@ sub writeserverconf {
     }
     if ($sovpnsettings{MSSFIX} eq 'on') {
                print CONF "mssfix\n";
+    } else {
+               print CONF "mssfix 0\n";
     }
     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
                print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
     }
 
-    # Check if a valid operating mode has been choosen and use it.
-    if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
-       ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
-       ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
-               print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
-    }
-
     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {  
        print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
     }  
     print CONF "status-version 1\n";
     print CONF "status /var/run/ovpnserver.log 30\n";
+    print CONF "ncp-disable\n";
     print CONF "cipher $sovpnsettings{DCIPHER}\n";
-    if ($sovpnsettings{'DAUTH'} eq '') {
-        print CONF "";
-    } else {
        print CONF "auth $sovpnsettings{'DAUTH'}\n";
-    }
+    # Set TLSv2 as minimum
+    print CONF "tls-version-min 1.2\n";
+
     if ($sovpnsettings{'TLSAUTH'} eq 'on') {
        print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
     }
@@ -316,10 +355,10 @@ sub writeserverconf {
         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
     }
     
-    if ($sovpnsettings{DHCP_WINS} eq '') {
+    if ($sovpnsettings{MAX_CLIENTS} eq '') {
        print CONF "max-clients 100\n";
     }
-    if ($sovpnsettings{DHCP_WINS} ne '') {
+    if ($sovpnsettings{MAX_CLIENTS} ne '') {
        print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
     }  
     print CONF "tls-verify /usr/lib/openvpn/verify\n";
@@ -333,6 +372,11 @@ sub writeserverconf {
        } else {
                print CONF "verb 3\n";
        }
+
+    print CONF "# Log clients connecting/disconnecting\n";
+    print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n";
+    print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n";
+
     # Print server.conf.local if entries exist to server.conf
     if ( !-z $local_serverconf  && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
        open (LSC, "$local_serverconf");
@@ -427,10 +471,7 @@ sub addccdnet
                $errormessage=$Lang::tr{'ccd err invalidnet'};
                return;
        }
-       
-       $errormessage=&General::checksubnets($ccdname,$ccdnet);
-       
-               
+
        if (!$errormessage) {
                my %ccdconfhash=();
                $baseaddress=&General::getnetworkip($ccdip,$subcidr);
@@ -454,6 +495,13 @@ sub modccdnet
        my $oldname=$_[1];
        my %ccdconfhash=();
        my %ccdhash=();
+
+       # Check if the new name is valid.
+       if(!&General::validhostname($newname)) {
+               $errormessage=$Lang::tr{'ccd err invalidname'};
+               return;
+       }
+
        &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
        foreach my $key (keys %ccdconfhash) {
                if ($ccdconfhash{$key}[0] eq $oldname) {
@@ -689,7 +737,7 @@ sub writecollectdconf {
        close(COLLECTDVPN);
 
        # Reload collectd afterwards
-       system("/usr/local/bin/collectdctrl restart &>/dev/null");
+       &General::system("/usr/local/bin/collectdctrl", "restart");
 }
 
 #hier die refresh page
@@ -719,11 +767,11 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
     #start openvpn server
     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
        &emptyserverlog();
-       system('/usr/local/bin/openvpnctrl', '-s');
+       &General::system("/usr/local/bin/openvpnctrl", "-s");
     }   
     #stop openvpn server
     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
-       system('/usr/local/bin/openvpnctrl', '-k');
+       &General::system("/usr/local/bin/openvpnctrl", "-k");
        &emptyserverlog();      
     }   
 #    #restart openvpn server
@@ -749,14 +797,12 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
+    $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
     $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
-    $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
-    $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
-    $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
     my @temp=();
     
     if ($cgiparams{'FRAGMENT'} eq '') {
@@ -776,16 +822,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
        $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
     }
 
-    if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
-        ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
-        ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
-
-       if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
-               $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
-               goto ADV_ERROR;
-       }
-    }
-               
     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
        unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
                $errormessage = $Lang::tr{'invalid input for dhcp domain'};
@@ -854,7 +890,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
        undef $vpnsettings{'ROUTES_PUSH'};
        &write_routepushfile;
     }
-    if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
+    if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
         $errormessage = $Lang::tr{'invalid input for max clients'};
         goto ADV_ERROR;
     }
@@ -874,17 +910,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
         goto ADV_ERROR;        
     }
-    # Create ta.key for tls-auth if not presant
-    if ($cgiparams{'TLSAUTH'} eq 'on') {
-       if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
-               system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
-               if ($?) {
-               $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
-        goto ADV_ERROR;
-               }
-       }
-    }
-    
     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
     &writeserverconf();#hier ok
 }
@@ -948,19 +973,9 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
   print SERVERCONF "tun-mtu $tunmtu\n";
   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";} 
-  if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; }; 
+  if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; } else { print SERVERCONF "mssfix 0\n" };
   }
 
-  # Check if a valid operating mode has been choosen and use it.
-  if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
-      ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
-      ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
-       if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
-               if($cgiparams{'MTU'} eq '1500') {
-                       print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
-               }
-       }
-  }
   print SERVERCONF "# Auth. Server\n"; 
   print SERVERCONF "tls-server\n"; 
   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n"; 
@@ -969,12 +984,21 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
   print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
   print SERVERCONF "# Cipher\n"; 
   print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
-  if ($cgiparams{'DAUTH'} eq '') {
-       print SERVERCONF "auth SHA1\n";
+
+  # If GCM cipher is used, do not use --auth
+  if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
+      ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
+      ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
+    print SERVERCONF unless "# HMAC algorithm\n";
+    print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n";
   } else {
-       print SERVERCONF "# HMAC algorithm\n";
-       print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
+    print SERVERCONF "# HMAC algorithm\n";
+    print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
   }
+
+  # Set TLSv1.2 as minimum
+  print SERVERCONF "tls-version-min 1.2\n";
+
   if ($cgiparams{'COMPLZO'} eq 'on') {
    print SERVERCONF "# Enable Compression\n";
    print SERVERCONF "comp-lzo\n";
@@ -1048,32 +1072,38 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
   print CLIENTCONF "tun-mtu $tunmtu\n";
   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
-  if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; }; 
+  if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; } else { print CLIENTCONF "mssfix 0\n" };
   }
 
-  # Check if a valid operating mode has been choosen and use it.
-  if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
-      ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
-      ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
-        if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
-               if ($cgiparams{'MTU'} eq '1500') {
-                       print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
-               }
-        }
+  # Check host certificate if X509 is RFC3280 compliant.
+  # If not, old --ns-cert-type directive will be used.
+  # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
+  my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+  if ( ! grep(/TLS Web Server Authentication/, @hostcert)) {
+       print CLIENTCONF "ns-cert-type server\n";
+  } else {
+       print CLIENTCONF "remote-cert-tls server\n";
   }
- 
-  print CLIENTCONF "ns-cert-type server\n";   
   print CLIENTCONF "# Auth. Client\n"; 
   print CLIENTCONF "tls-client\n"; 
   print CLIENTCONF "# Cipher\n"; 
   print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
-  if ($cgiparams{'DAUTH'} eq '') {
-       print CLIENTCONF "auth SHA1\n";
+
+  # If GCM cipher is used, do not use --auth
+  if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
+      ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
+      ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
+    print CLIENTCONF unless "# HMAC algorithm\n";
+    print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n";
   } else {
-       print CLIENTCONF "# HMAC algorithm\n";
-       print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
+    print CLIENTCONF "# HMAC algorithm\n";
+    print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
   }
+
+  # Set TLSv1.2 as minimum
+  print CLIENTCONF "tls-version-min 1.2\n";
+
   if ($cgiparams{'COMPLZO'} eq 'on') {
    print CLIENTCONF "# Enable Compression\n";
    print CLIENTCONF "comp-lzo\n";
@@ -1091,7 +1121,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
   close(CLIENTCONF);
 
 }
-  
+
 ###
 ### Save main settings
 ###
@@ -1166,6 +1196,18 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg
        goto SETTINGS_ERROR;
     }
 
+       # Create ta.key for tls-auth if not presant
+       if ($cgiparams{'TLSAUTH'} eq 'on') {
+               if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
+                       # This system call is safe, because all arguements are passed as an array.
+                       system("/usr/sbin/openvpn", "--genkey", "--secret", "${General::swroot}/ovpn/certs/ta.key");
+                       if ($?) {
+                               $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
+                               goto SETTINGS_ERROR;
+                       }
+               }
+       }
+
     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
@@ -1177,11 +1219,28 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg
     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
+    $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
+    $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
 #wrtie enable
 
-  if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
-  if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
-  if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
+  if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {
+         &General::system("touch", "${General::swroot}/ovpn/enable_blue");
+  } else {
+         unlink(${General::swroot}/ovpn/enable_blue);
+  }
+
+  if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {
+         &General::system("touch", "${General::swroot}/ovpn/enable_orange");
+  } else {
+         unlink("${General::swroot}/ovpn/enable_orange");
+  }
+
+  if ( $vpnsettings{'ENABLED'} eq 'on' ) {
+         &General::system("touch", "${General::swroot}/ovpn/enable");
+  } else {
+         unlink("${General::swroot}/ovpn/enable");
+  }
+
 #new settings for daemon    
     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
     &writeserverconf();#hier ok
@@ -1194,7 +1253,7 @@ SETTINGS_ERROR:
     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 
     # Kill all N2N connections
-    system("/usr/local/bin/openvpnctrl -kn2n &>/dev/null");
+    &General::system("/usr/local/bin/openvpnctrl", "-kn2n");
 
     foreach my $key (keys %confighash) {
        my $name = $confighash{$cgiparams{'$key'}}[1];
@@ -1203,7 +1262,7 @@ SETTINGS_ERROR:
            delete $confighash{$cgiparams{'$key'}};
        }
 
-       system ("/usr/local/bin/openvpnctrl -drrd $name");
+       &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$name");
     }
     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
        unlink $file;
@@ -1242,7 +1301,7 @@ SETTINGS_ERROR:
        close FILE;
     }
     while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
-       system ("rm -rf $file");
+       unlink($file);
     }
 
     # Remove everything from the collectd configuration
@@ -1288,7 +1347,8 @@ END
         unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
        }
        # Create Diffie Hellmann Parameter
-       system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
+       # The system call is safe, because all arguments are passed as an array.
+       system("/usr/bin/openssl", "dhparam", "-out", "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
        if ($?) {
                $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
                unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
@@ -1313,7 +1373,6 @@ END
                <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
                <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
                        <select name='DHLENGHT'>
-                               <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
                                <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
                                <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
                                <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
@@ -1348,7 +1407,7 @@ END
 ### Upload DH key
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
-    if (ref ($cgiparams{'FH'}) ne 'Fh') {
+    unless (ref ($cgiparams{'FH'})) {
          $errormessage = $Lang::tr{'there was no file upload'};
          goto UPLOADCA_ERROR;
     }
@@ -1358,8 +1417,8 @@ END
         $errormessage = $!;
        goto UPLOADCA_ERROR;
     }
-    my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
-    if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
+    my @temp = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$filename");
+    if ( ! grep(/DH Parameters: \((2048|3072|4096) bit\)/, @temp)) {
         $errormessage = $Lang::tr{'not a valid dh key'};
         unlink ($filename);
         goto UPLOADCA_ERROR;
@@ -1405,7 +1464,7 @@ END
        }
     }
 
-    if (ref ($cgiparams{'FH'}) ne 'Fh') {
+    unless (ref ($cgiparams{'FH'})) {
        $errormessage = $Lang::tr{'there was no file upload'};
        goto UPLOADCA_ERROR;
     }
@@ -1415,8 +1474,8 @@ END
        $errormessage = $!;
        goto UPLOADCA_ERROR;
     }
-    my $temp = `/usr/bin/openssl x509 -text -in $filename`;
-    if ($temp !~ /CA:TRUE/i) {
+    my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
+    if ( ! grep(/CA:TRUE/i, @temp )) {
        $errormessage = $Lang::tr{'not a valid ca certificate'};
        unlink ($filename);
        goto UPLOADCA_ERROR;
@@ -1429,11 +1488,19 @@ END
        }
     }
 
-    my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
-    $casubject    =~ /Subject: (.*)[\n]/;
-    $casubject    = $1;
-    $casubject    =~ s+/Email+, E+;
-    $casubject    =~ s/ ST=/ S=/;
+    @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
+    my $casubject;
+
+    foreach my $line (@casubject) {
+       if ($line =~ /Subject: (.*)[\n]/) {
+               $casubject    = $1;
+               $casubject    =~ s+/Email+, E+;
+               $casubject    =~ s/ ST=/ S=/;
+
+               last;
+       }
+    }
+
     $casubject    = &Header::cleanhtml($casubject);
 
     my $key = &General::findhasharraykey (\%cahash);
@@ -1455,9 +1522,9 @@ END
        &Header::openpage($Lang::tr{'ovpn'}, 1, '');
        &Header::openbigbox('100%', 'LEFT', '', $errormessage);
        &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
-       my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
-       $output = &Header::cleanhtml($output,"y");
-       print "<pre>$output</pre>\n";
+       my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+       @output = &Header::cleanhtml(@output,"y");
+       print "<pre>@output</pre>\n";
        &Header::closebox();
        print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
        &Header::closebigbox();
@@ -1476,7 +1543,10 @@ END
     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
        print "Content-Type: application/octet-stream\r\n";
        print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
-       print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
+
+       my @tmp =  &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+       print "@tmp";
+
        exit(0);
     } else {
        $errormessage = $Lang::tr{'invalid key'};
@@ -1491,8 +1561,8 @@ END
 
     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
        foreach my $key (keys %confighash) {
-           my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
-           if ($test =~ /: OK/) {
+           my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
+           if (grep(/: OK/, @test)) {
                # Delete connection
 #              if ($vpnsettings{'ENABLED'} eq 'on' ||
 #                  $vpnsettings{'ENABLED_BLUE'} eq 'on') {
@@ -1522,8 +1592,8 @@ END
     my $assignedcerts = 0;
     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
        foreach my $key (keys %confighash) {
-           my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
-           if ($test =~ /: OK/) {
+           my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
+           if (grep(/: OK/, @test)) {
                $assignedcerts++;
            }
        }
@@ -1562,19 +1632,19 @@ END
 ###
 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
-    my $output;
+    my @output;
     &Header::showhttpheaders();
     &Header::openpage($Lang::tr{'ovpn'}, 1, '');
     &Header::openbigbox('100%', 'LEFT', '', '');
     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
        &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
-       $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
+       @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
     } else {
        &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
-       $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
+       @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
     }
-    $output = &Header::cleanhtml($output,"y");
-    print "<pre>$output</pre>\n";
+    @output = &Header::cleanhtml(@output,"y");
+    print "<pre>@output</pre>\n";
     &Header::closebox();
     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
     &Header::closebigbox();
@@ -1588,7 +1658,10 @@ END
     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
        print "Content-Type: application/octet-stream\r\n";
        print "Content-Disposition: filename=cacert.pem\r\n\r\n";
-       print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
+
+       my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
+       print "@tmp";
+
        exit(0);
     }
     
@@ -1599,7 +1672,10 @@ END
     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
        print "Content-Type: application/octet-stream\r\n";
        print "Content-Disposition: filename=servercert.pem\r\n\r\n";
-       print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
+
+       my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+       print "@tmp";
+
        exit(0);
     }
 
@@ -1610,7 +1686,13 @@ END
     if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
        print "Content-Type: application/octet-stream\r\n";
        print "Content-Disposition: filename=ta.key\r\n\r\n";
-       print `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
+
+       open(FILE, "${General::swroot}/ovpn/certs/ta.key");
+       my @tmp = <FILE>;
+       close(FILE);
+
+       print "@tmp";
+
        exit(0);
     }
 
@@ -1638,8 +1720,7 @@ END
            }
        }
     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
-
-       if (ref ($cgiparams{'FH'}) ne 'Fh') {
+       unless (ref ($cgiparams{'FH'})) {
            $errormessage = $Lang::tr{'there was no file upload'};
            goto ROOTCERT_ERROR;
        }
@@ -1888,6 +1969,7 @@ END
        }
        
        # Sign the host certificate request
+       # This system call is safe, because all argeuments are passed as an array.
        system('/usr/bin/openssl', 'ca', '-days', '999999',
                '-batch', '-notext',
                '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
@@ -1909,6 +1991,7 @@ END
        }
 
        # Create an empty CRL
+       # System call is safe, because all arguments are passed as array.
        system('/usr/bin/openssl', 'ca', '-gencrl',
                '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
                '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
@@ -1923,7 +2006,16 @@ END
 #      } else {
 #          &cleanssldatabase();
        }
+       # Create ta.key for tls-auth
+       # This system call is safe, because all arguments are passed as an array.
+       system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
+       if ($?) {
+           $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
+           &cleanssldatabase();
+           goto ROOTCERT_ERROR;
+       }
        # Create Diffie Hellmann Parameter
+       # The system call is safe, because all arguments are passed as an array.
        system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
        if ($?) {
            $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
@@ -1937,13 +2029,6 @@ END
 #      } else {
 #          &cleanssldatabase();
        }
-       # Create ta.key for tls-auth
-       system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
-       if ($?) {
-           $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
-           &cleanssldatabase();
-           goto ROOTCERT_ERROR;
-       }
        goto ROOTCERT_SUCCESS;
     }
     ROOTCERT_ERROR:
@@ -1995,7 +2080,6 @@ END
            </select></td>
        <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
                <td class='base'><select name='DHLENGHT'>
-                               <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
                                <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
                                <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
                                <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
@@ -2046,7 +2130,7 @@ END
     }
 
     ROOTCERT_SUCCESS:
-    system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
+    &General::system("chmod", "600", "${General::swroot}/ovpn/certs/serverkey.pem");
 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
 #      $vpnsettings{'ENABLE_BLUE'} eq 'on') {
 #      system('/usr/local/bin/ipsecctrl', 'S');
@@ -2064,8 +2148,12 @@ END
     
     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
-#    my $n2nactive = '';
-    my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
+    my $n2nactive = '';
+    my @ps = &General::system_output("/bin/ps", "ax");
+
+    if(grep(/$confighash{$cgiparams{'KEY'}}[1]/, @ps)) {
+       $n2nactive = "1";
+    }
     
     if ($confighash{$cgiparams{'KEY'}}) {
                if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
@@ -2073,7 +2161,7 @@ END
                        &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 
                        if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
-                               system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
+                               &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
                                &writecollectdconf();
                        }
                } else {
@@ -2083,7 +2171,7 @@ END
 
                        if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
                                if ($n2nactive ne '') {
-                                       system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
+                                       &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
                                        &writecollectdconf();
                                }
  
@@ -2162,18 +2250,17 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
    print CLIENTCONF "tun-mtu $tunmtu\n";
    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
-   if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
+   if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} else { print CLIENTCONF "mssfix 0\n"; }
    }
-   if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
-       ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
-       ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
-       if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
-               if ($tunmtu eq '1500' ) {
-                       print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
-               }
-       }
+   # Check host certificate if X509 is RFC3280 compliant.
+   # If not, old --ns-cert-type directive will be used.
+   # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
+   my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+   if (! grep(/TLS Web Server Authentication/, @hostcert)) {
+               print CLIENTCONF "ns-cert-type server\n";
+   } else {
+               print CLIENTCONF "remote-cert-tls server\n";
    }
-   print CLIENTCONF "ns-cert-type server\n";   
    print CLIENTCONF "# Auth. Client\n"; 
    print CLIENTCONF "tls-client\n"; 
    print CLIENTCONF "# Cipher\n";
@@ -2182,13 +2269,18 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
         print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
    }
-   if ($confighash{$cgiparams{'KEY'}}[39] eq '') {
-       print CLIENTCONF "# HMAC algorithm\n";
-       print CLIENTCONF "auth SHA1\n";
+
+   # If GCM cipher is used, do not use --auth
+   if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
+       ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
+       ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
+        print CLIENTCONF unless "# HMAC algorithm\n";
+        print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n";
    } else {
-   print CLIENTCONF "# HMAC algorithm\n";
-   print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
+        print CLIENTCONF "# HMAC algorithm\n";
+        print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
    }
+
    if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
    print CLIENTCONF "# Enable Compression\n";
    print CLIENTCONF "comp-lzo\n";
@@ -2239,19 +2331,7 @@ else
     print CLIENTCONF "nobind\r\n";
     print CLIENTCONF "dev tun\r\n";
     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
-
-    # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
-    # or use configured value.
-    if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
-       { print CLIENTCONF "tun-mtu 1500\r\n"; }
-    elsif ($vpnsettings{MSSFIX} eq 'on')
-       { print CLIENTCONF "tun-mtu 1500\r\n"; }
-    elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
-           ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
-           ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) 
-       { print CLIENTCONF "tun-mtu 1500\r\n"; }
-    else
-       { print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n"; }
+    print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n";
 
     if ( $vpnsettings{'ENABLED'} eq 'on'){
        print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
@@ -2286,6 +2366,7 @@ else
                $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
 
                # Extract the certificate
+               # This system call is safe, because all arguments are passed as an array.
                system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
                        '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
                if ($?) {
@@ -2296,6 +2377,7 @@ else
                print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n";
 
                # Extract the key
+               # This system call is safe, because all arguments are passed as an array.
                system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
                        '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
                if ($?) {
@@ -2316,11 +2398,8 @@ else
        $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";    
     }
     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
-    if ($vpnsettings{'DAUTH'} eq '') {
-        print CLIENTCONF "";
-    } else {
        print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
-    }
+
     if ($vpnsettings{'TLSAUTH'} eq 'on') {
        if ($cgiparams{'MODE'} eq 'insecure') {
                print CLIENTCONF ";";
@@ -2332,24 +2411,25 @@ else
         print CLIENTCONF "comp-lzo\r\n";
     }
     print CLIENTCONF "verb 3\r\n";
-    print CLIENTCONF "ns-cert-type server\r\n";
+       # Check host certificate if X509 is RFC3280 compliant.
+       # If not, old --ns-cert-type directive will be used.
+       # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
+       my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+       if (! grep(/TLS Web Server Authentication/, @hostcert)) {
+               print CLIENTCONF "ns-cert-type server\r\n";
+       } else {
+               print CLIENTCONF "remote-cert-tls server\r\n";
+       }
     print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
     if ($vpnsettings{MSSFIX} eq 'on') {
        print CLIENTCONF "mssfix\r\n";
+    } else {
+       print CLIENTCONF "mssfix 0\r\n";
     }
     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
        print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
     }
 
-    # Check if a valid operating mode has been choosen and use it.
-    if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
-        ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
-        ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
-       if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
-               print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
-       }
-    }
-
     if ($include_certs) {
        print CLIENTCONF "\r\n";
 
@@ -2437,8 +2517,8 @@ else
 
        if ($confighash{$cgiparams{'KEY'}}) {
                # Revoke certificate if certificate was deleted and rewrite the CRL
-               my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
-               my $tempA = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
+               &General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf)";
+               &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
 
 ###
 # m.a.d net2net
@@ -2446,7 +2526,7 @@ else
 
                if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
                        # Stop the N2N connection before it is removed
-                       system("/usr/local/bin/openvpnctrl -kn2n $confighash{$cgiparams{'KEY'}}[1] &>/dev/null");
+                       &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
 
                        my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
                        my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
@@ -2488,10 +2568,10 @@ else
 # CCD end
                # Update collectd configuration and delete all RRD files of the removed connection
                &writecollectdconf();
-               system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]");
+               &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]");
 
                delete $confighash{$cgiparams{'KEY'}};
-               my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
+               &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
                &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 
        } else {
@@ -2507,7 +2587,12 @@ else
 
     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
     print "Content-Type: application/octet-stream\r\n\r\n";
-    print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
+
+    open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
+    my @tmp = <FILE>;
+    close(FILE);
+
+    print "@tmp";
     exit (0);
 
 ###
@@ -2521,9 +2606,9 @@ else
        &Header::openpage($Lang::tr{'ovpn'}, 1, '');
        &Header::openbigbox('100%', 'LEFT', '', '');
        &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
-       my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
-       $output = &Header::cleanhtml($output,"y");
-       print "<pre>$output</pre>\n";
+       my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+       @output = &Header::cleanhtml(@output,"y");
+       print "<pre>@output</pre>\n";
        &Header::closebox();
        print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
        &Header::closebigbox();
@@ -2543,9 +2628,9 @@ else
                &Header::openpage($Lang::tr{'ovpn'}, 1, '');
                &Header::openbigbox('100%', 'LEFT', '', '');
                &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
-               my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
-               $output = &Header::cleanhtml($output,"y");
-               print "<pre>$output</pre>\n";
+               my @output = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
+               @output = &Header::cleanhtml(@output,"y");
+               print "<pre>@output</pre>\n";
                &Header::closebox();
                print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
                &Header::closebigbox();
@@ -2565,9 +2650,13 @@ else
                &Header::openpage($Lang::tr{'ovpn'}, 1, '');
                &Header::openbigbox('100%', 'LEFT', '', '');
                &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
-               my $output = `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
-               $output = &Header::cleanhtml($output,"y");
-               print "<pre>$output</pre>\n";
+
+               open(FILE, "${General::swroot}/ovpn/certs/ta.key");
+               my @output = <FILE>;
+               close(FILE);
+
+               @output = &Header::cleanhtml(@output,"y");
+               print "<pre>@output</pre>\n";
                &Header::closebox();
                print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
                &Header::closebigbox();
@@ -2588,9 +2677,9 @@ else
        &Header::openpage($Lang::tr{'ovpn'}, 1, '');
        &Header::openbigbox('100%', 'LEFT', '', '');
        &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
-       my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
-       $output = &Header::cleanhtml($output,"y");
-       print "<pre>$output</pre>\n";
+       my @output = &General::system_output("/usr/bin/openssl", "crl", "-text", "-noout", "-in", "${General::swroot}/ovpn/crls/cacrl.pem");
+       @output = &Header::cleanhtml(@output,"y");
+       print "<pre>@output</pre>\n";
        &Header::closebox();
        print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
        &Header::closebigbox();
@@ -2627,12 +2716,6 @@ ADV_ERROR:
     if ($cgiparams{'LOG_VERB'} eq '') {
                $cgiparams{'LOG_VERB'} =  '3';
     }
-    if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
-               $cgiparams{'PMTU_DISCOVERY'} = 'off';
-    }
-    if ($cgiparams{'DAUTH'} eq '') {
-               $cgiparams{'DAUTH'} = 'SHA512';
-    }
     if ($cgiparams{'TLSAUTH'} eq '') {
                $cgiparams{'TLSAUTH'} = 'off';
     }
@@ -2642,13 +2725,15 @@ ADV_ERROR:
     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
+    $checked{'DCOMPLZO'}{'off'} = '';
+    $checked{'DCOMPLZO'}{'on'} = '';
+    $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
     $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
     $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
     $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
     $checked{'MSSFIX'}{'off'} = '';
     $checked{'MSSFIX'}{'on'} = '';
     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
-    $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
     $selected{'LOG_VERB'}{'0'} = '';
     $selected{'LOG_VERB'}{'1'} = '';
     $selected{'LOG_VERB'}{'2'} = '';
@@ -2662,15 +2747,6 @@ ADV_ERROR:
     $selected{'LOG_VERB'}{'10'} = '';
     $selected{'LOG_VERB'}{'11'} = '';
     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
-    $selected{'DAUTH'}{'whirlpool'} = '';
-    $selected{'DAUTH'}{'SHA512'} = '';
-    $selected{'DAUTH'}{'SHA384'} = '';
-    $selected{'DAUTH'}{'SHA256'} = '';
-    $selected{'DAUTH'}{'SHA1'} = '';
-    $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
-    $checked{'TLSAUTH'}{'off'} = '';
-    $checked{'TLSAUTH'}{'on'} = '';
-    $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
    
     &Header::showhttpheaders();
     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
@@ -2730,7 +2806,7 @@ print <<END;
        </tr>
 
        <tr>
-               <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
+               <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td>
        </tr>
 
        <tr>
@@ -2743,6 +2819,11 @@ print <<END;
                <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
        </tr>
 
+    <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
+        <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
+        <td>$Lang::tr{'openvpn default'}: off <font color='red'>($Lang::tr{'attention'} exploitable via Voracle)</font></td>
+    </tr>
+
        <tr>
                <td class='base'>$Lang::tr{'ovpn add conf'}</td>
                <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
@@ -2771,14 +2852,6 @@ print <<END;
                <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
                <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
        </tr>
-
-       <tr>
-               <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
-               <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
-               <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
-               <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
-               <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
-       </tr>
 </table>
 
 <hr size='1'>
@@ -2808,36 +2881,6 @@ print <<END;
     </table>
 
 <hr size='1'>
-<table width='100%'>
-    <tr>
-               <td class'base'><b>$Lang::tr{'ovpn crypt options'}</b></td>
-       </tr>
-       <tr>
-               <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
-    </tr>      
-    <tr><td class='base'>$Lang::tr{'ovpn ha'}</td>
-               <td><select name='DAUTH'>
-                               <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
-                               <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
-                               <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
-                               <option value='SHA256'                  $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
-                               <option value='SHA1'                    $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
-                       </select>
-               </td>
-               <td>$Lang::tr{'openvpn default'}: <span class="base">SHA1 (160 $Lang::tr{'bit'})</span></td>
-    </tr>
-</table>
-
-<table width='100%'>
-    <tr>
-       <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
-    </tr>
-
-    <tr>
-       <td class='base'>HMAC tls-auth</td>
-       <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
-    </tr>
-    </table><hr>
 END
 
 if ( -e "/var/run/openvpn.pid"){
@@ -3018,6 +3061,7 @@ END
     <tr>
        <th><b>$Lang::tr{'common name'}</b></th>
        <th><b>$Lang::tr{'real address'}</b></th>
+       <th><b>$Lang::tr{'country'}</b></th>
        <th><b>$Lang::tr{'virtual address'}</b></th>
        <th><b>$Lang::tr{'loged in at'}</b></th>
        <th><b>$Lang::tr{'bytes sent'}</b></th>
@@ -3057,6 +3101,11 @@ END
                    $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
                    $users[$uid]{'Since'} = $match[5];
                    $users[$uid]{'Proto'} = $proto;
+
+                   # get country code for "RealAddress"...
+                   my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]);
+                   my $flag_icon = &Location::Functions::get_flag_icon($ccode);
+                   $users[$uid]{'Country'} = "<a href='country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a>";
                    $uid++;
                }    
            }
@@ -3083,7 +3132,8 @@ END
                                                }
                                                print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
                                                print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
-                                               print "<td align='left' $col>$users[$idx-1]{'VirtualAddress'}</td>";
+                                               print "<td align='center' $col>$users[$idx-1]{'Country'}</td>";
+                                               print "<td align='center' $col>$users[$idx-1]{'VirtualAddress'}</td>";
                                                print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
                                                print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
                                                print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
@@ -3117,7 +3167,12 @@ END
     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
        print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
        print "Content-Type: application/octet-stream\r\n\r\n";
-       print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
+
+       open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+       my @tmp = <FILE>;
+       close(FILE);
+
+       print "@tmp";
        exit (0);
     }
 
@@ -3238,9 +3293,8 @@ END
 
        &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);    
 
-# Check if a file is uploaded
-
-       if (ref ($cgiparams{'FH'}) ne 'Fh') {
+       # Check if a file is uploaded
+       unless (ref ($cgiparams{'FH'})) {
                $errormessage = $Lang::tr{'there was no file upload'};
                goto N2N_ERROR;
     }
@@ -3356,7 +3410,6 @@ my $complzoactive;
 my $mssfixactive;
 my $authactive;
 my $n2nfragment;
-my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);
 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
 my @n2nproto = split(/-/, $n2nproto2[1]);
 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
@@ -3392,7 +3445,6 @@ $n2nremsub[2] =~ s/\n|\r//g;
 $n2nlocalsub[2] =~ s/\n|\r//g;
 $n2nfragment[1] =~ s/\n|\r//g;
 $n2nmgmt[2] =~ s/\n|\r//g;
-$n2nmtudisc[1] =~ s/\n|\r//g;
 $n2ncipher[1] =~ s/\n|\r//g;
 $n2nauth[1] =~ s/\n|\r//g;
 chomp ($complzoactive);
@@ -3469,7 +3521,6 @@ foreach my $dkey (keys %confighash) {
        $confighash{$key}[29] = $n2nport[1];
        $confighash{$key}[30] = $complzoactive;
        $confighash{$key}[31] = $n2ntunmtu[1];
-       $confighash{$key}[38] = $n2nmtudisc[1];
        $confighash{$key}[39] = $n2nauth[1];
        $confighash{$key}[40] = $n2ncipher[1];
        $confighash{$key}[41] = 'disabled';
@@ -3509,9 +3560,8 @@ foreach my $dkey (keys %confighash) {
                <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td><b>$confighash{$key}[23]</b></td></tr>
                <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td><b>$confighash{$key}[24]</b></td></tr>
                <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
-               <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td><b>$confighash{$key}[38]</b></td></tr>
                <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
-               <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn hmac'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
+               <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn tls auth'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
                <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td><b>$confighash{$key}[40]</b></td></tr>
                <tr><td>&nbsp;</td><td>&nbsp;</td></tr> 
     </table>
@@ -3609,7 +3659,6 @@ if ($confighash{$cgiparams{'KEY'}}) {
                $cgiparams{'CCD_DNS1'}          = $confighash{$cgiparams{'KEY'}}[35];
                $cgiparams{'CCD_DNS2'}          = $confighash{$cgiparams{'KEY'}}[36];
                $cgiparams{'CCD_WINS'}          = $confighash{$cgiparams{'KEY'}}[37];
-               $cgiparams{'PMTU_DISCOVERY'}    = $confighash{$cgiparams{'KEY'}}[38];
                $cgiparams{'DAUTH'}             = $confighash{$cgiparams{'KEY'}}[39];
                $cgiparams{'DCIPHER'}           = $confighash{$cgiparams{'KEY'}}[40];
                $cgiparams{'TLSAUTH'}           = $confighash{$cgiparams{'KEY'}}[41];
@@ -3785,41 +3834,42 @@ if ($cgiparams{'TYPE'} eq 'host') {
 #CCD End
 
        
- if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
-           $errormessage = $Lang::tr{'connection type is invalid'};
-           if ($cgiparams{'TYPE'} eq 'net') {
-      unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-           rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-      }
-           goto VPNCONF_ERROR;
+       if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
+               $errormessage = $Lang::tr{'connection type is invalid'};
+               if ($cgiparams{'TYPE'} eq 'net') {
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                       goto VPNCONF_ERROR;
+               }
+               goto VPNCONF_ERROR;
        }
 
-
        if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
-           $errormessage = $Lang::tr{'name must only contain characters'};
-      if ($cgiparams{'TYPE'} eq 'net') {
-      unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-           rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-      }
-      goto VPNCONF_ERROR;
-  }
+               $errormessage = $Lang::tr{'name must only contain characters'};
+               if ($cgiparams{'TYPE'} eq 'net') {
+                       goto VPNCONF_ERROR;
+               }
+               goto VPNCONF_ERROR;
+       }
 
        if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
-           $errormessage = $Lang::tr{'name is invalid'};
-           if ($cgiparams{'TYPE'} eq 'net') {
-      unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-           rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-      }
-           goto VPNCONF_ERROR;
+               $errormessage = $Lang::tr{'name is invalid'};
+               if ($cgiparams{'TYPE'} eq 'net') {
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                       goto VPNCONF_ERROR;
+               }
+               goto VPNCONF_ERROR;
        }
 
        if (length($cgiparams{'NAME'}) >60) {
-           $errormessage = $Lang::tr{'name too long'};
-           if ($cgiparams{'TYPE'} eq 'net') {
-      unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-           rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-      }
-           goto VPNCONF_ERROR;
+               $errormessage = $Lang::tr{'name too long'};
+               if ($cgiparams{'TYPE'} eq 'net') {
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                       goto VPNCONF_ERROR;
+               }
+               goto VPNCONF_ERROR;
        }
 
 ###
@@ -3878,22 +3928,6 @@ if ($cgiparams{'TYPE'} eq 'net') {
            goto VPNCONF_ERROR;
     }
 
-    if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') {
-       if (($cgiparams{'FRAGMENT'} ne '') || ($cgiparams{'MSSFIX'} eq 'on')) {
-               $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
-               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-               goto VPNCONF_ERROR;
-       }
-    }
-
-    if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') && ($cgiparams{'MTU'} ne '1500')) {
-       $errormessage = $Lang::tr{'ovpn mtu-disc and mtu not 1500'};
-       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
-       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
-       goto VPNCONF_ERROR;
-    }
-
     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
                  $errormessage = $Lang::tr{'openvpn prefix local subnet'};
                  unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
@@ -4016,6 +4050,16 @@ if ($cgiparams{'TYPE'} eq 'net') {
                goto VPNCONF_ERROR;
        }
 
+       # Check for N2N that OpenSSL maximum of valid days will not be exceeded
+       if ($cgiparams{'TYPE'} eq 'net') {
+               if ($cgiparams{'DAYS_VALID'} >= '999999') {
+                       $errormessage = $Lang::tr{'invalid input for valid till days'};
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                       goto VPNCONF_ERROR;
+               }
+       }
+
        if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
            $errormessage = $Lang::tr{'invalid input'};
            goto VPNCONF_ERROR;
@@ -4040,7 +4084,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
                $errormessage = $Lang::tr{'cant change certificates'};
                goto VPNCONF_ERROR;
            }
-           if (ref ($cgiparams{'FH'}) ne 'Fh') {
+           unless (ref ($cgiparams{'FH'})) {
                $errormessage = $Lang::tr{'there was no file upload'};
                goto VPNCONF_ERROR;
            }
@@ -4054,6 +4098,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
 
            # Sign the certificate request and move it
            # Sign the host certificate request
+           # The system call is safe, because all arguments are passed as an array.
            system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
                '-batch', '-notext',
                '-in', $filename,
@@ -4070,11 +4115,19 @@ if ($cgiparams{'TYPE'} eq 'net') {
                &deletebackupcert();
            }
 
-           my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
-           $temp =~ /Subject:.*CN=(.*)[\n]/;
-           $temp = $1;
-           $temp =~ s+/Email+, E+;
-           $temp =~ s/ ST=/ S=/;
+           my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
+           my $temp;
+
+           foreach my $line (@temp) {
+               if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
+                       $temp = $1;
+                       $temp =~ s+/Email+, E+;
+                       $temp =~ s/ ST=/ S=/;
+
+                       last;
+               }
+           }
+               
            $cgiparams{'CERT_NAME'} = $temp;
            $cgiparams{'CERT_NAME'} =~ s/,//g;
            $cgiparams{'CERT_NAME'} =~ s/\'//g;
@@ -4087,7 +4140,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
                $errormessage = $Lang::tr{'cant change certificates'};
                goto VPNCONF_ERROR;
            }
-           if (ref ($cgiparams{'FH'}) ne 'Fh') {
+           unless (ref ($cgiparams{'FH'})) {
                $errormessage = $Lang::tr{'there was no file upload'};
                goto VPNCONF_ERROR;
            }
@@ -4100,13 +4153,13 @@ if ($cgiparams{'TYPE'} eq 'net') {
 
            # Verify the certificate has a valid CA and move it
            my $validca = 0;
-           my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
-           if ($test =~ /: OK/) {
+           my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/cacert.pem", "$filename");
+           if (grep(/: OK/, @test)) {
                $validca = 1;
            } else {
                foreach my $key (keys %cahash) {
-                   $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
-                   if ($test =~ /: OK/) {
+                   @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem", "$filename");
+                   if (grep(/: OK/, @test)) {
                        $validca = 1;
                    }
                }
@@ -4124,11 +4177,19 @@ if ($cgiparams{'TYPE'} eq 'net') {
                }
            }
 
-           my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
-           $temp =~ /Subject:.*CN=(.*)[\n]/;
-           $temp = $1;
-           $temp =~ s+/Email+, E+;
-           $temp =~ s/ ST=/ S=/;
+           my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
+           my $temp;
+
+           foreach my $line (@temp) {
+               if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
+                       $temp = $1;
+                       $temp =~ s+/Email+, E+;
+                       $temp =~ s/ ST=/ S=/;
+
+                       last;
+               }
+           }
+
            $cgiparams{'CERT_NAME'} = $temp;
            $cgiparams{'CERT_NAME'} =~ s/,//g;
            $cgiparams{'CERT_NAME'} =~ s/\'//g;
@@ -4193,11 +4254,29 @@ if ($cgiparams{'TYPE'} eq 'net') {
                $errormessage = $Lang::tr{'passwords do not match'};
                goto VPNCONF_ERROR;
            }
-           if ($cgiparams{'DAYS_VALID'} ne '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
+           if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
                $errormessage = $Lang::tr{'invalid input for valid till days'};
                goto VPNCONF_ERROR;
            }
 
+           # Check for RW that OpenSSL maximum of valid days will not be exceeded
+           if ($cgiparams{'TYPE'} eq 'host') {
+               if ($cgiparams{'DAYS_VALID'} >= '999999') {
+                       $errormessage = $Lang::tr{'invalid input for valid till days'};
+                       goto VPNCONF_ERROR;
+               }
+           }
+
+               # Check for RW if client name is already set
+               if ($cgiparams{'TYPE'} eq 'host') {
+                       foreach my $key (keys %confighash) {
+                               if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
+                                       $errormessage = $Lang::tr{'a connection with this name already exists'};
+                                       goto VPNCONF_ERROR;
+                               }
+                       }
+               }
+
            # Replace empty strings with a .
            (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
            (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
@@ -4237,6 +4316,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
            }
        
            # Sign the host certificate request
+           # The system call is safe, because all arguments are passed as an array.
            system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
                '-batch', '-notext',
                '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
@@ -4255,6 +4335,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
            }
 
            # Create the pkcs12 file
+           # The system call is safe, because all arguments are passed as an array.
            system('/usr/bin/openssl', 'pkcs12', '-export', 
                '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
                '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
@@ -4337,7 +4418,6 @@ if ($cgiparams{'TYPE'} eq 'net') {
        $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
        $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
        $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
-       $confighash{$key}[38]           = $cgiparams{'PMTU_DISCOVERY'};
        $confighash{$key}[39]           = $cgiparams{'DAUTH'};
        $confighash{$key}[40]           = $cgiparams{'DCIPHER'};
 
@@ -4421,21 +4501,24 @@ if ($cgiparams{'TYPE'} eq 'net') {
        
        if ($cgiparams{'TYPE'} eq 'net') {
        
-       if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
-  system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
+               if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
+                       &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
        
-  &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
-       my $key = $cgiparams{'KEY'};
-       if (! $key) {
-           $key = &General::findhasharraykey (\%confighash);
-           foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
-           }
-  $confighash{$key}[0] = 'on';
-  &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
+                       &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
+                       my $key = $cgiparams{'KEY'};
+                       if (! $key) {
+                           $key = &General::findhasharraykey (\%confighash);
+                           foreach my $i (0 .. 31) {
+                                   $confighash{$key}[$i] = "";
+                           }
+                       }
+
+                       $confighash{$key}[0] = 'on';
+                       &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
   
-  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
-        }          
-  }
+                       &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
+               }
+       }
 
 ###
 # m.a.d n2n end
@@ -4453,7 +4536,6 @@ if ($cgiparams{'TYPE'} eq 'net') {
 ###    
         $cgiparams{'MSSFIX'} = 'on';
         $cgiparams{'FRAGMENT'} = '1300';
-       $cgiparams{'PMTU_DISCOVERY'} = 'off';
        $cgiparams{'DAUTH'} = 'SHA512';
 ###
 # m.a.d n2n end
@@ -4471,7 +4553,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
        $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
        $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
        $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
-       $cgiparams{'DAYS_VALID'}        = $vpnsettings{'DAYS_VALID'};
+       $cgiparams{'DAYS_VALID'}        = $vpnsettings{'DAYS_VALID'} = '730';
     }
 
     VPNCONF_ERROR:
@@ -4515,11 +4597,9 @@ if ($cgiparams{'TYPE'} eq 'net') {
     $checked{'MSSFIX'}{'on'} = '';
     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
 
-    if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
-       $cgiparams{'PMTU_DISCOVERY'} = 'off';
-    }
-    $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
-
+    $selected{'DCIPHER'}{'AES-256-GCM'} = '';
+    $selected{'DCIPHER'}{'AES-192-GCM'} = '';
+    $selected{'DCIPHER'}{'AES-128-GCM'} = '';
     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
@@ -4544,12 +4624,10 @@ if ($cgiparams{'TYPE'} eq 'net') {
     $selected{'DAUTH'}{'SHA384'} = '';
     $selected{'DAUTH'}{'SHA256'} = '';
     $selected{'DAUTH'}{'SHA1'} = '';
-    # If no hash algorythm has been choosen yet, select
-    # the old default value (SHA1) for compatiblity reasons.
-    if ($cgiparams{'DAUTH'} eq '') {
-       $cgiparams{'DAUTH'} = 'SHA1';
-    }
     $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
+    $checked{'TLSAUTH'}{'off'} = '';
+    $checked{'TLSAUTH'}{'on'} = '';
+    $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
 
     if (1) {
        &Header::showhttpheaders();
@@ -4605,6 +4683,15 @@ if ($cgiparams{'TYPE'} eq 'net') {
            } else {
                print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
            }
+
+               # If GCM ciphers are in usage, HMAC menu is disabled
+               my $hmacdisabled;
+               if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
+                       ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
+                       ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
+                               $hmacdisabled = "disabled='disabled'";
+               };
+
            print <<END;
                    <td width='25%'>&nbsp;</td>
                    <td width='25%'>&nbsp;</td></tr>    
@@ -4668,39 +4755,33 @@ if ($cgiparams{'TYPE'} eq 'net') {
                <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
        </tr>
 
-       <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td>
-               <td colspan='3'>
-                       <input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}
-                       <input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}
-                       <input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}
-                       <input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}
-               </td>
-       </tr>
-
 <tr><td colspan=4><hr /></td></tr><tr>
        <tr>
                <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
        </tr>
 
        <tr><td class='boldbase'>$Lang::tr{'cipher'}</td>
-               <td><select name='DCIPHER'>
+               <td><select name='DCIPHER'  id="n2ncipher" required>
+                               <option value='AES-256-GCM'             $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
+                               <option value='AES-192-GCM'             $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
+                               <option value='AES-128-GCM'             $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
                                <option value='CAMELLIA-256-CBC'        $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
                                <option value='CAMELLIA-192-CBC'        $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
                                <option value='CAMELLIA-128-CBC'        $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
                                <option value='AES-256-CBC'             $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option>
                                <option value='AES-192-CBC'             $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
                                <option value='AES-128-CBC'             $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='DES-EDE3-CBC'            $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'})</option>
-                               <option value='DESX-CBC'                $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'})</option>
-                               <option value='SEED-CBC'                $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='DES-EDE-CBC'             $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='BF-CBC'                  $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='CAST5-CBC'               $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'})</option>
+                               <option value='SEED-CBC'                        $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
+                               <option value='DES-EDE3-CBC'            $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='DESX-CBC'                        $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='DES-EDE-CBC'             $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='BF-CBC'                          $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='CAST5-CBC'                       $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
                        </select>
                </td>
 
                <td class='boldbase'>$Lang::tr{'ovpn ha'}:</td>
-               <td><select name='DAUTH'>
+               <td><select name='DAUTH' id="n2nhmac" $hmacdisabled>
                                <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
                                <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
                                <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
@@ -4714,6 +4795,22 @@ if ($cgiparams{'TYPE'} eq 'net') {
 END
 ;
        }
+
+#### JAVA SCRIPT ####
+# Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange
+print<<END;
+       <script>
+               var disable_options = false;
+               document.getElementById('n2ncipher').onchange = function () {
+                       if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) {
+                               document.getElementById('n2nhmac').setAttribute('disabled', true);
+                       } else {
+                               document.getElementById('n2nhmac').removeAttribute('disabled');
+                       }
+               }
+       </script>
+END
+
 #jumper
        print "<tr><td class='boldbase'>$Lang::tr{'remark title'}</td>";
        print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
@@ -4834,7 +4931,7 @@ END
 if ($cgiparams{'TYPE'} eq 'host') {
        print <<END;
        </select></td></tr>
-               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
+               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
                <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
                <tr><td>&nbsp;</td>
                <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
@@ -4849,7 +4946,7 @@ END
 }else{
        print <<END;
        </select></td></tr>
-               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
+               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
                <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
                <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
                <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
@@ -4952,6 +5049,35 @@ END
                }
                if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
        }       
+
+       my %vpnconfig = ();
+       &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
+       foreach my $vpn (keys %vpnconfig) {
+               # Skip all disabled VPN connections
+               my $enabled = $vpnconfig{$vpn}[0];
+               next unless ($enabled eq "on");
+
+               my $name = $vpnconfig{$vpn}[1];
+
+               # Remote subnets
+               my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
+               foreach my $network (@networks) {
+                       my $selected = "";
+
+                       foreach my $key (keys %ccdroute2hash) {
+                               if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
+                                       foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
+                                               if ($ccdroute2hash{$key}[$i] eq $network) {
+                                                       $selected = "selected";
+                                               }
+                                       }
+                               }
+                       }
+
+                       print "<option value=\"$network\" $selected>$name ($network)</option>\n";
+               }
+       }
+
        #check if green,blue,orange are defined for client
        foreach my $key (keys %ccdroute2hash) {
                if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
@@ -5009,7 +5135,9 @@ END
     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 
-    my @status = `/bin/cat /var/run/ovpnserver.log`;
+    open(FILE, "/var/run/ovpnserver.log");
+    my @status = <FILE>;
+    close(FILE);
 
     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
                if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
@@ -5037,8 +5165,20 @@ END
                $cgiparams{'MSSFIX'} = 'off';
     }
        if ($cgiparams{'DAUTH'} eq '') {
-               $cgiparams{'DAUTH'} = 'SHA512';
-    }
+               if (-z "${General::swroot}/ovpn/ovpnconfig") {
+                       $cgiparams{'DAUTH'} = 'SHA512';
+               }
+               foreach my $key (keys %confighash) {
+                       if ($confighash{$key}[3] ne 'host') {
+                               $cgiparams{'DAUTH'} = 'SHA512';
+                       } else {
+                               $cgiparams{'DAUTH'} = 'SHA1';
+                       }
+               }
+       }
+       if ($cgiparams{'TLSAUTH'} eq '') {
+               $cgiparams{'TLSAUTH'} = 'off';
+       }
     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
                $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
     }
@@ -5056,6 +5196,9 @@ END
     $selected{'DPROTOCOL'}{'tcp'} = '';
     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
 
+    $selected{'DCIPHER'}{'AES-256-GCM'} = '';
+    $selected{'DCIPHER'}{'AES-192-GCM'} = '';
+    $selected{'DCIPHER'}{'AES-128-GCM'} = '';
     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
@@ -5078,6 +5221,10 @@ END
     $selected{'DAUTH'}{'SHA1'} = '';
     $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
 
+    $checked{'TLSAUTH'}{'off'} = '';
+    $checked{'TLSAUTH'}{'on'} = '';
+    $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
+
     $checked{'DCOMPLZO'}{'off'} = '';
     $checked{'DCOMPLZO'}{'on'} = '';
     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
@@ -5098,6 +5245,20 @@ END
        &Header::closebox();
     }
 
+       if ($cryptoerror) {
+               &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
+               print "<class name='base'>$cryptoerror";
+               print "&nbsp;</class>";
+               &Header::closebox();
+       }
+
+       if ($cryptowarning) {
+               &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
+               print "<class name='base'>$cryptowarning";
+               print "&nbsp;</class>";
+               &Header::closebox();
+       }
+
        if ($warnmessage) {
                &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
                print "$warnmessage<br>";
@@ -5138,8 +5299,16 @@ END
     if (&haveOrangeNet()) {    
        print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
        print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
-    }  
-    print <<END;
+    }
+
+       print <<END;
+
+       <tr><td colspan='4'><br></td></tr>
+       <tr>
+               <td class'base'><b>$Lang::tr{'net config'}:</b></td>
+       </tr>
+    <tr><td colspan='1'><br></td></tr>
+
     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
        <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
@@ -5149,26 +5318,52 @@ END
         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}' size='5' /></td>
+    </tr>
+
+       <tr><td colspan='4'><br></td></tr>
+       <tr>
+               <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
+       </tr>
+       <tr><td colspan='1'><br></td></tr>
+
+       <tr>
+               <td class='base'>$Lang::tr{'ovpn ha'}</td>
+               <td><select name='DAUTH'>
+                               <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
+                               <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
+                               <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
+                               <option value='SHA256'                  $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
+                               <option value='SHA1'                    $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                       </select>
+               </td>
 
                <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
                <td><select name='DCIPHER'>
+                               <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
+                               <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
+                               <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
                                <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
                                <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
                                <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
                                <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option>
                                <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
                                <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'})</option>
-                               <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'})</option>
                                <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'})</option>
-                               <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'})</option>
+                               <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
+                               <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
                        </select>
                </td>
-    <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
-        <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
        </tr>
+
+    <tr><td colspan='4'><br></td></tr>
+       <tr>
+               <td class='base'>$Lang::tr{'ovpn tls auth'}</td>
+               <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
+       </tr>
+
     <tr><td colspan='4'><br><br></td></tr>
 END
 ;                                 
@@ -5254,9 +5449,17 @@ END
        #} else {
            #print "<td align='left'>&nbsp;</td>";
        #}
-       my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
-       $cavalid    =~ /Not After : (.*)[\n]/;
-       $cavalid    = $1;
+       my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
+       my $cavalid;
+
+       foreach my $line (@cavalid) {
+               if ($line =~ /Not After : (.*)[\n]/) {
+                       $cavalid    = $1;
+
+                       last;
+               }
+       }
+
        print "<td align='center' $col>$confighash{$key}[25]</td>";
        $col1="bgcolor='${Header::colourred}'";
        my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
@@ -5467,11 +5670,19 @@ END
     my $col4="bgcolor='$color{'color20'}'";
 
     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
-               my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
-               $casubject    =~ /Subject: (.*)[\n]/;
-               $casubject    = $1;
-               $casubject    =~ s+/Email+, E+;
-               $casubject    =~ s/ ST=/ S=/;
+               my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
+               my $casubject;
+
+               foreach my $line (@casubject) {
+                       if ($line =~ /Subject: (.*)[\n]/) {
+                               $casubject    = $1;
+                               $casubject    =~ s+/Email+, E+;
+                               $casubject    =~ s/ ST=/ S=/;
+
+                               last;
+                       }
+               }
+
                print <<END;
                <tr>
                        <td class='base' $col1>$Lang::tr{'root certificate'}</td>
@@ -5501,11 +5712,18 @@ END
     }
 
     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
-               my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
-               $hostsubject    =~ /Subject: (.*)[\n]/;
-               $hostsubject    = $1;
-               $hostsubject    =~ s+/Email+, E+;
-               $hostsubject    =~ s/ ST=/ S=/;
+               my @hostsubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
+               my $hostsubject;
+
+               foreach my $line (@hostsubject) {
+                       if ($line =~ /Subject: (.*)[\n]/) {
+                               $hostsubject    = $1;
+                               $hostsubject    =~ s+/Email+, E+;
+                               $hostsubject    =~ s/ ST=/ S=/;
+
+                               last;
+                       }
+               }
 
                print <<END;
                <tr>
@@ -5537,10 +5755,16 @@ END
 
     # Adding DH parameter to chart
     if (-f "${General::swroot}/ovpn/ca/dh1024.pem") {
-               my $dhsubject = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
-               $dhsubject    =~ /    (.*)[\n]/;
-               $dhsubject    = $1;
+               my @dhsubject = &System_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
+               my $dhsubject;
 
+               foreach my $line (@dhsubject) {
+                       if ($line =~ /    (.*)[\n]/) {
+                               $dhsubject = $1;
+
+                               last;
+                       }
+               }
 
        print <<END;
                <tr>
@@ -5570,9 +5794,19 @@ END
 
     # Adding ta.key to chart
     if (-f "${General::swroot}/ovpn/certs/ta.key") {
-               my $tasubject = `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
-               $tasubject    =~ /# (.*)[\n]/;
-               $tasubject    = $1;
+               open(FILE, "${General::swroot}/ovpn/certs/ta.key");
+               my @tasubject = <FILE>;
+               close(FILE);
+
+               my $tasubject;
+               foreach my $line (@tasubject) {
+                       if($line =~ /# (.*)[\n]/) {
+                               $tasubject    = $1;
+
+                               last;
+                       }
+               }
+
                print <<END;
 
                <tr>