Merge branch 'perl-system' into next

diff --combined html/cgi-bin/proxy.cgi
index b3c2d0713405df927521b18031a5d9357480e7e5,83411e4ac0b78297eaa68465fde756380ebdd846..78ad33ad249079ebeb7c38c2fd83f774930b2b61
--- 1/html/cgi-bin/proxy.cgi
--- 2/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@@ -2,7 -2,7 +2,7 @@@
  ###############################################################################
  #                                                                             #
  # IPFire.org - A linux based firewall                                         #
 -# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
 +# Copyright (C) 2007-2021  IPFire Team  <info@ipfire.org>                     #
  #                                                                             #
  # This program is free software: you can redistribute it and/or modify        #
  # it under the terms of the GNU General Public License as published by        #
@@@ -32,7 -32,7 +32,7 @@@ require "${General::swroot}/header.pl"
  
  require "${General::swroot}/ids-functions.pl";
  
- my @squidversion = `/usr/sbin/squid -v`;
+ my @squidversion = &General::system_output("/usr/sbin/squid", "-v");
  my $http_port='81';
  my $https_port='444';
  
@@@ -131,35 -131,35 +131,35 @@@ unless (-d "$raddir")   { mkdir("$raddi
  unless (-d "$identdir") { mkdir("$identdir"); }
  unless (-d "$credir")   { mkdir("$credir"); }
  
- unless (-e $cre_groups)  { system("touch $cre_groups"); }
- unless (-e $cre_svhosts) { system("touch $cre_svhosts"); }
- 
- unless (-e $userdb) { system("touch $userdb"); }
- unless (-e $stdgrp) { system("touch $stdgrp"); }
- unless (-e $extgrp) { system("touch $extgrp"); }
- unless (-e $disgrp) { system("touch $disgrp"); }
- 
- unless (-e $acl_src_subnets)    { system("touch $acl_src_subnets"); }
- unless (-e $acl_src_banned_ip)  { system("touch $acl_src_banned_ip"); }
- unless (-e $acl_src_banned_mac) { system("touch $acl_src_banned_mac"); }
- unless (-e $acl_src_unrestricted_ip)  { system("touch $acl_src_unrestricted_ip"); }
- unless (-e $acl_src_unrestricted_mac) { system("touch $acl_src_unrestricted_mac"); }
- unless (-e $acl_src_noaccess_ip)  { system("touch $acl_src_noaccess_ip"); }
- unless (-e $acl_src_noaccess_mac) { system("touch $acl_src_noaccess_mac"); }
- unless (-e $acl_dst_noauth)     { system("touch $acl_dst_noauth"); }
- unless (-e $acl_dst_noauth_dom) { system("touch $acl_dst_noauth_dom"); }
- unless (-e $acl_dst_noauth_net) { system("touch $acl_dst_noauth_net"); }
- unless (-e $acl_dst_noauth_url) { system("touch $acl_dst_noauth_url"); }
- unless (-e $acl_dst_nocache)     { system("touch $acl_dst_nocache"); }
- unless (-e $acl_dst_nocache_dom) { system("touch $acl_dst_nocache_dom"); }
- unless (-e $acl_dst_nocache_net) { system("touch $acl_dst_nocache_net"); }
- unless (-e $acl_dst_nocache_url) { system("touch $acl_dst_nocache_url"); }
- unless (-e $acl_dst_throttle)  { system("touch $acl_dst_throttle"); }
- unless (-e $acl_ports_safe) { system("touch $acl_ports_safe"); }
- unless (-e $acl_ports_ssl)  { system("touch $acl_ports_ssl"); }
- unless (-e $acl_include) { system("touch $acl_include"); }
- 
- unless (-e $mimetypes) { system("touch $mimetypes"); }
+ unless (-e $cre_groups)  { &General::system("touch", "$cre_groups"); }
+ unless (-e $cre_svhosts) { &General::system("touch $cre_svhosts"); }
+ 
+ unless (-e $userdb) { &General::system("touch", "$userdb"); }
+ unless (-e $stdgrp) { &General::system("touch", "$stdgrp"); }
+ unless (-e $extgrp) { &General::system("touch", "$extgrp"); }
+ unless (-e $disgrp) { &General::system("touch", "$disgrp"); }
+ 
+ unless (-e $acl_src_subnets)    { &General::system("touch", "$acl_src_subnets"); }
+ unless (-e $acl_src_banned_ip)  { &General::system("touch", "$acl_src_banned_ip"); }
+ unless (-e $acl_src_banned_mac) { &General::system("touch", "$acl_src_banned_mac"); }
+ unless (-e $acl_src_unrestricted_ip)  { &General::system("touch", "$acl_src_unrestricted_ip"); }
+ unless (-e $acl_src_unrestricted_mac) { &General::system("touch", "$acl_src_unrestricted_mac"); }
+ unless (-e $acl_src_noaccess_ip)  { &General::system("touch", "$acl_src_noaccess_ip"); }
+ unless (-e $acl_src_noaccess_mac) { &General::system("touch", "$acl_src_noaccess_mac"); }
+ unless (-e $acl_dst_noauth)     { &General::system("touch", "$acl_dst_noauth"); }
+ unless (-e $acl_dst_noauth_dom) { &General::system("touch", "$acl_dst_noauth_dom"); }
+ unless (-e $acl_dst_noauth_net) { &General::system("touch", "$acl_dst_noauth_net"); }
+ unless (-e $acl_dst_noauth_url) { &General::system("touch", "$acl_dst_noauth_url"); }
+ unless (-e $acl_dst_nocache)     { &General::system("touch", "$acl_dst_nocache"); }
+ unless (-e $acl_dst_nocache_dom) { &General::system("touch", "$acl_dst_nocache_dom"); }
+ unless (-e $acl_dst_nocache_net) { &General::system("touch", "$acl_dst_nocache_net"); }
+ unless (-e $acl_dst_nocache_url) { &General::system("touch", "$acl_dst_nocache_url"); }
+ unless (-e $acl_dst_throttle)  { &General::system("touch", "$acl_dst_throttle"); }
+ unless (-e $acl_ports_safe) { &General::system("touch", "$acl_ports_safe"); }
+ unless (-e $acl_ports_ssl)  { &General::system("touch", "$acl_ports_ssl"); }
+ unless (-e $acl_include) { &General::system("touch", "$acl_include"); }
+ 
+ unless (-e $mimetypes) { &General::system("touch", "$mimetypes"); }
  
  my $HAVE_NTLM_AUTH = (-e "/usr/bin/ntlm_auth");
  
@@@ -226,6 -226,8 +226,6 @@@ $proxysettings{'THROTTLING_GREEN_HOST'
  $proxysettings{'THROTTLING_BLUE_TOTAL'} = 'unlimited';
  $proxysettings{'THROTTLING_BLUE_HOST'} = 'unlimited';
  $proxysettings{'ENABLE_MIME_FILTER'} = 'off';
 -$proxysettings{'FAKE_USERAGENT'} = '';
 -$proxysettings{'FAKE_REFERER'} = '';
  $proxysettings{'AUTH_METHOD'} = 'none';
  $proxysettings{'AUTH_REALM'} = '';
  $proxysettings{'AUTH_MAX_USERIP'} = '';
@@@ -383,7 -385,7 +383,7 @@@ if (($proxysettings{'ACTION'} eq $Lang:
                $errormessage = $Lang::tr{'advproxy errmsg mem cache size'};
                goto ERROR;
        }
-       my @free = `/usr/bin/free`;
+       my @free = &General::system_output("/usr/bin/free");
        $free[1] =~ m/(\d+)/;
        $cachemem = int $1 / 2048;
        if ($proxysettings{'CACHE_MEM'} > $cachemem) {
@@@ -630,25 -632,25 +630,25 @@@ ERROR
  
                if ($proxysettings{'CACHEMGR'} eq 'on'){&writecachemgr;}
  
-               system ('/usr/local/bin/squidctrl', 'disable');
+               &General::system ('/usr/local/bin/squidctrl', 'disable');
                unlink "${General::swroot}/proxy/enable";
                unlink "${General::swroot}/proxy/transparent";
                unlink "${General::swroot}/proxy/enable_blue";
                unlink "${General::swroot}/proxy/transparent_blue";
  
                if ($proxysettings{'ENABLE'} eq 'on') {
-                       system ('/usr/bin/touch', "${General::swroot}/proxy/enable");
-                       system ('/usr/local/bin/squidctrl', 'enable'); }
+                       &General::system('/usr/bin/touch', "${General::swroot}/proxy/enable");
+                       &General::system('/usr/local/bin/squidctrl', 'enable'); }
                if ($proxysettings{'TRANSPARENT'} eq 'on' && $proxysettings{'ENABLE'} eq 'on') {
-                       system ('/usr/bin/touch', "${General::swroot}/proxy/transparent"); }
+                       &General::system('/usr/bin/touch', "${General::swroot}/proxy/transparent"); }
                if ($proxysettings{'ENABLE_BLUE'} eq 'on') {
-                       system ('/usr/bin/touch', "${General::swroot}/proxy/enable_blue");
-                       system ('/usr/local/bin/squidctrl', 'enable'); }
+                       &General::system('/usr/bin/touch', "${General::swroot}/proxy/enable_blue");
+                       &General::system('/usr/local/bin/squidctrl', 'enable'); }
                if ($proxysettings{'TRANSPARENT_BLUE'} eq 'on' && $proxysettings{'ENABLE_BLUE'} eq 'on') {
-                       system ('/usr/bin/touch', "${General::swroot}/proxy/transparent_blue"); }
+                       &General::system('/usr/bin/touch', "${General::swroot}/proxy/transparent_blue"); }
  
-               if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) { system('/usr/local/bin/squidctrl restart >/dev/null 2>&1'); }
-               if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { system('/usr/local/bin/squidctrl reconfigure >/dev/null 2>&1'); }
+               if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy save and restart'}) { &General::system('/usr/local/bin/squidctrl', 'restart'); }
+               if ($proxysettings{'ACTION'} eq $Lang::tr{'proxy reconfigure'}) { &General::system('/usr/local/bin/squidctrl', 'reconfigure'); }
  
                # Check if the suricata_proxy_ports_changed flag has been set.
                if ($suricata_proxy_ports_changed) {
@@@ -663,7 -665,7 +663,7 @@@
  
  if ($proxysettings{'ACTION'} eq $Lang::tr{'advproxy clear cache'})
  {
-       system('/usr/local/bin/squidctrl flush >/dev/null 2>&1');
+       &General::system('/usr/local/bin/squidctrl', 'flush');
  }
  
  if (!$errormessage)
@@@ -1627,6 -1629,21 +1627,6 @@@ EN
  print <<END
  </table>
  
 -<hr size='1'>
 -
 -<table width='100%'>
 -<tr>
 -      <td><b>$Lang::tr{'advproxy privacy'}</b></td>
 -</tr>
 -<tr>
 -      <td class='base'>$Lang::tr{'advproxy fake useragent'}:</td>
 -      <td class='base'>$Lang::tr{'advproxy fake referer'}:</td>
 -</tr>
 -<tr>
 -      <td><input type='text' name='FAKE_USERAGENT' value='$proxysettings{'FAKE_USERAGENT'}' size='40%' /></td>
 -      <td><input type='text' name='FAKE_REFERER' value='$proxysettings{'FAKE_REFERER'}' size='40%' /></td>
 -</tr>
 -</table>
  <hr size='1'>
  END
  ;
@@@ -3829,7 -3846,8 +3829,7 @@@ EN
  
        print FILE "http_access deny  all\n\n";
  
 -      if (($proxysettings{'FORWARD_IPADDRESS'} eq 'off') || ($proxysettings{'FORWARD_VIA'} eq 'off') ||
 -              (!($proxysettings{'FAKE_USERAGENT'} eq '')) || (!($proxysettings{'FAKE_REFERER'} eq '')))
 +      if (($proxysettings{'FORWARD_IPADDRESS'} eq 'off') || ($proxysettings{'FORWARD_VIA'} eq 'off'))
        {
                print FILE "#Strip HTTP Header\n";
  
@@@ -3843,9 -3861,31 +3843,9 @@@
                        print FILE "request_header_access Via deny all\n";
                        print FILE "reply_header_access Via deny all\n";
                }
 -              if (!($proxysettings{'FAKE_USERAGENT'} eq ''))
 -              {
 -                      print FILE "request_header_access User-Agent deny all\n";
 -                      print FILE "reply_header_access User-Agent deny all\n";
 -              }
 -              if (!($proxysettings{'FAKE_REFERER'} eq ''))
 -              {
 -                      print FILE "request_header_access Referer deny all\n";
 -                      print FILE "reply_header_access Referer deny all\n";
 -              }
  
                print FILE "\n";
  
 -              if ((!($proxysettings{'FAKE_USERAGENT'} eq '')) || (!($proxysettings{'FAKE_REFERER'} eq '')))
 -              {
 -                      if (!($proxysettings{'FAKE_USERAGENT'} eq ''))
 -                      {
 -                              print FILE "header_replace User-Agent $proxysettings{'FAKE_USERAGENT'}\n";
 -                      }
 -                      if (!($proxysettings{'FAKE_REFERER'} eq ''))
 -                      {
 -                              print FILE "header_replace Referer $proxysettings{'FAKE_REFERER'}\n";
 -                      }
 -                      print FILE "\n";
 -              }
        }
  
        if ($proxysettings{'SUPPRESS_VERSION'} eq 'on') { print FILE "httpd_suppress_version_string on\n\n" }

diff --combined html/cgi-bin/vpnmain.cgi
index 20ee6da93f0053f4224acd12e22c1e594f32735a,29b8c80705ff8194796ae5d89263be9a6384c774..79a2943d4dc732d543ac9429b4a103df2096a869
--- 1/html/cgi-bin/vpnmain.cgi
--- 2/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@@ -208,10 -208,12 +208,12 @@@ sub newcleanssldatabase 
                close FILE;
        }
        if (! -s ">${General::swroot}/certs/index.txt") {
-               system ("touch ${General::swroot}/certs/index.txt");
+               open(FILE, ">${General::swroot}/certs/index.txt");
+               close(FILE);
        }
        if (! -s ">${General::swroot}/certs/index.txt.attr") {
-               system ("touch ${General::swroot}/certs/index.txt.attr");
+               open(FILE, ">${General::swroot}/certs/index.txt.attr");
+               close(FILE);
        }
        unlink ("${General::swroot}/certs/index.txt.old");
        unlink ("${General::swroot}/certs/index.txt.attr.old");
@@@ -224,9 -226,13 +226,13 @@@
  ###
  sub callssl ($) {
        my $opt = shift;
-       my $retssl = `/usr/bin/openssl $opt 2>&1`; #redirect stderr
+ 
+       # Split the given argument string into single pieces and assign them to an array.
+       my @opts = split(/ /, $opt);
+ 
+       my @retssl = &General::system_output("/usr/bin/openssl", @opts); #redirect stderr
        my $ret = '';
-       foreach my $line (split (/\n/, $retssl)) {
+       foreach my $line (split (/\n/, @retssl)) {
                &General::log("ipsec", "$line") if (0); # 1 for verbose logging
                $ret .= '<br>'.$line if ( $line =~ /error|unknown/ );
        }
@@@ -240,13 -246,21 +246,21 @@@
  ###
  sub getCNfromcert ($) {
        #&General::log("ipsec", "Extracting name from $_[0]...");
-       my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
-       $temp =~ /Subject:.*CN = (.*)[\n]/;
-       $temp = $1;
-       $temp =~ s+/Email+, E+;
-       $temp =~ s/ ST = / S = /;
-       $temp =~ s/,//g;
-       $temp =~ s/\'//g;
+       my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$_[0]");
+       my $temp;
+ 
+       foreach my $line (@temp) {
+               if ($line =~ /Subject:.*CN = (.*)[\n]/) {
+                       $temp = $1;
+                       $temp =~ s+/Email+, E+;
+                       $temp =~ s/ ST = / S = /;
+                       $temp =~ s/,//g;
+                       $temp =~ s/\'//g;
+ 
+                       last;
+               }
+       }
+ 
        return $temp;
  }
  ###
@@@ -254,11 -268,19 +268,19 @@@
  ###
  sub getsubjectfromcert ($) {
        #&General::log("ipsec", "Extracting subject from $_[0]...");
-       my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
-       $temp =~ /Subject: (.*)[\n]/;
-       $temp = $1;
-       $temp =~ s+/Email+, E+;
-       $temp =~ s/ ST = / S = /;
+       my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$_[0]");
+       my $temp;
+ 
+       foreach my $line (@temp) {
+               if($line =~ /Subject: (.*)[\n]/) {
+                       $temp = $1;
+                       $temp =~ s+/Email+, E+;
+                       $temp =~ s/ ST = / S = /;
+ 
+                       last;
+               }
+       }
+ 
        return $temp;
  }
  ###
@@@ -568,9 -590,9 +590,9 @@@ if ($cgiparams{'ACTION'} eq $Lang::tr{'
        &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
        &writeipsecfiles();
        if (&vpnenabled) {
-               system('/usr/local/bin/ipsecctrl', 'S');
+               &General::system('/usr/local/bin/ipsecctrl', 'S');
        } else {
-               system('/usr/local/bin/ipsecctrl', 'D');
+               &General::system('/usr/local/bin/ipsecctrl', 'D');
        }
        sleep $sleepDelay;
        SAVE_ERROR:
@@@ -595,7 -617,7 +617,7 @@@
        }
        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
        &writeipsecfiles();
-       system('/usr/local/bin/ipsecctrl', 'R');
+       &General::system('/usr/local/bin/ipsecctrl', 'R');
        sleep $sleepDelay;
  
  ###
@@@ -667,8 -689,8 +689,8 @@@ EN
                $errormessage = $!;
                goto UPLOADCA_ERROR;
        }
-       my $temp = `/usr/bin/openssl x509 -text -in $filename`;
-       if ($temp !~ /CA:TRUE/i) {
+       my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
+       if (! grep(/CA:TRUE/, @temp)) {
                $errormessage = $Lang::tr{'not a valid ca certificate'};
                unlink ($filename);
                goto UPLOADCA_ERROR;
@@@ -686,7 -708,7 +708,7 @@@
        $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
        &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
  
-       system('/usr/local/bin/ipsecctrl', 'R');
+       &General::system('/usr/local/bin/ipsecctrl', 'R');
        sleep $sleepDelay;
  
        UPLOADCA_ERROR:
@@@ -702,9 -724,9 +724,9 @@@
                &Header::openpage($Lang::tr{'ipsec'}, 1, '');
                &Header::openbigbox('100%', 'left', '', '');
                &Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
-               my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
-               $output = &Header::cleanhtml($output,"y");
-               print "<pre>$output</pre>\n";
+               my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+               @output = &Header::cleanhtml(@output,"y");
+               print "<pre>@output</pre>\n";
                &Header::closebox();
                print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
                &Header::closebigbox();
@@@ -724,7 -746,9 +746,9 @@@
                print "Content-Type: application/force-download\n";
                print "Content-Type: application/octet-stream\r\n";
                print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
-               print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
+ 
+               my @cert = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
+               print "@cert";
                exit(0);
        } else {
                $errormessage = $Lang::tr{'invalid key'};
@@@ -739,21 -763,21 +763,21 @@@
  
        if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
                foreach my $key (keys %confighash) {
-                       my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
-                       if ($test =~ /: OK/) {
+                       my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/certs/$confighash{$key}[1]cert.pem");
+                       if (grep(/: OK/, @test)) {
                                # Delete connection
                                unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
                                unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
                                delete $confighash{$key};
                                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                                &writeipsecfiles();
-                               system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
+                               &General::system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
                        }
                }
                unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
                delete $cahash{$cgiparams{'KEY'}};
                &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-               system('/usr/local/bin/ipsecctrl', 'R');
+               &General::system('/usr/local/bin/ipsecctrl', 'R');
                sleep $sleepDelay;
        } else {
                $errormessage = $Lang::tr{'invalid key'};
@@@ -768,8 -792,8 +792,8 @@@
        my $assignedcerts = 0;
        if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
                foreach my $key (keys %confighash) {
-                       my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
-                       if ($test =~ /: OK/) {
+                       my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/certs/$confighash{$key}[1]cert.pem");
+                       if (grep(/: OK/, @test)) {
                                $assignedcerts++;
                        }
                }
@@@ -805,7 -829,7 +829,7 @@@ EN
                        unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
                        delete $cahash{$cgiparams{'KEY'}};
                        &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-                       system('/usr/local/bin/ipsecctrl', 'R');
+                       &General::system('/usr/local/bin/ipsecctrl', 'R');
                        sleep $sleepDelay;
                }
        } else {
@@@ -817,19 -841,19 +841,19 @@@
  ###
  } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
        $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
-       my $output;
+       my @output;
        &Header::showhttpheaders();
        &Header::openpage($Lang::tr{'ipsec'}, 1, '');
        &Header::openbigbox('100%', 'left', '', '');
        if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
                &Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
-               $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
+               @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ca/cacert.pem");
        } else {
                &Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
-               $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
+               @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/certs/hostcert.pem");
        }
-       $output = &Header::cleanhtml($output,"y");
-       print "<pre>$output</pre>\n";
+       @output = &Header::cleanhtml(@output,"y");
+       print "<pre>@output</pre>\n";
        &Header::closebox();
        print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
        &Header::closebigbox();
@@@ -843,7 -867,9 +867,9 @@@
        if ( -f "${General::swroot}/ca/cacert.pem" ) {
                print "Content-Type: application/force-download\n";
                print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
-               print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
+ 
+               my @cert = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ca/cacert.pem");
+               print "@cert";
                exit(0);
        }
  ###
@@@ -853,7 -879,9 +879,9 @@@
        if ( -f "${General::swroot}/certs/hostcert.pem" ) {
                print "Content-Type: application/force-download\n";
                print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
-               print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
+ 
+               my @cert = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/certs/hostcert.pem");
+               print "@cert";
                exit(0);
        }
  ###
@@@ -1216,7 -1244,7 +1244,7 @@@ EN
  
        ROOTCERT_SUCCESS:
        if (&vpnenabled) {
-               system('/usr/local/bin/ipsecctrl', 'S');
+               &General::system('/usr/local/bin/ipsecctrl', 'S');
                sleep $sleepDelay;
        }
        ROOTCERT_SKIP:
@@@ -1228,7 -1256,12 +1256,12 @@@
        print "Content-Type: application/force-download\n";
        print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
        print "Content-Type: application/octet-stream\r\n\r\n";
-       print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
+ 
+       open(FILE, "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
+       my @p12 = <FILE>;
+       close(FILE);
+       print "@file";
+ 
        exit (0);
  
  # Export Apple profile to browser
@@@ -1507,9 -1540,9 +1540,9 @@@
                &Header::openpage($Lang::tr{'ipsec'}, 1, '');
                &Header::openbigbox('100%', 'left', '', '');
                &Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
-               my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
-               $output = &Header::cleanhtml($output,"y");
-               print "<pre>$output</pre>\n";
+               my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+               @output = &Header::cleanhtml(@output,"y");
+               print "<pre>@output</pre>\n";
                &Header::closebox();
                print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
                &Header::closebigbox();
@@@ -1526,7 -1559,12 +1559,12 @@@
        if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
                print "Content-Type: application/force-download\n";
                print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
-               print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
+ 
+               open(FILE, "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
+               my @pem = <FILE>;
+               close(FILE);
+               print "@pem";
+ 
                exit (0);
        }
  
@@@ -1543,12 -1581,12 +1581,12 @@@
                        $confighash{$cgiparams{'KEY'}}[0] = 'on';
                        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                        &writeipsecfiles();
-                       system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
+                       &General::system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
                } else {
                        $confighash{$cgiparams{'KEY'}}[0] = 'off';
                        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                        &writeipsecfiles();
-                       system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
+                       &General::system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
                }
                sleep $sleepDelay;
        } else {
@@@ -1564,7 -1602,7 +1602,7 @@@
  
        if ($confighash{$cgiparams{'KEY'}}) {
                if (&vpnenabled) {
-                       system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
+                       &General::system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
                        sleep $sleepDelay;
                }
        } else {
@@@ -1584,7 -1622,7 +1622,7 @@@
                delete $confighash{$cgiparams{'KEY'}};
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
-               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
+               &General::system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
        } else {
                $errormessage = $Lang::tr{'invalid key'};
        }
@@@ -1952,8 -1990,8 +1990,8 @@@ EN
                                unshift (@names,$cahash{$x}[0]);
                        }
                        if ($casubject) { # a new one!
-                               my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
-                               if ($temp !~ /CA:TRUE/i) {
+                               my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "/tmp/newcacert");
+                               if (! grep(/CA:TRUE/, @temp)) {
                                        $errormessage = $Lang::tr{'not a valid ca certificate'};
                                } else {
                                        #compute a name for it
@@@ -1968,7 -2006,7 +2006,7 @@@
                                                $cahash{$key}[0] = $cgiparams{'CA_NAME'};
                                                $cahash{$key}[1] = $casubject;
                                                &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
-                                               system('/usr/local/bin/ipsecctrl', 'R');
+                                               &General::system('/usr/local/bin/ipsecctrl', 'R');
                                        }
                                }
                        }
@@@ -2008,12 -2046,12 +2046,12 @@@
                # Verify the certificate has a valid CA and move it
                &General::log("ipsec", "Validating imported cert against our known CA...");
                my $validca = 1; #assume ok
-               my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
-               if ($test !~ /: OK/) {
+               my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/cacert.pem", "$filename");
+               if (! grep(/: OK/, @test)) {
                        my $validca = 0;
                        foreach my $key (keys %cahash) {
-                               $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
-                               if ($test =~ /: OK/) {
+                               @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ca/$cahash{$key}[0]cert.pem", "$filename");
+                               if (grep(/: OK/, @test)) {
                                        $validca = 1;
                                        last;
                                }
@@@ -2276,7 -2314,7 +2314,7 @@@ EN
        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
        &writeipsecfiles();
        if (&vpnenabled) {
-               system('/usr/local/bin/ipsecctrl', 'S', $key);
+               &General::system('/usr/local/bin/ipsecctrl', 'S', $key);
                sleep $sleepDelay;
        }
        if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
@@@ -2337,11 -2375,11 +2375,11 @@@
        #use default advanced value
        $cgiparams{'IKE_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18];
        $cgiparams{'IKE_INTEGRITY'}             = 'sha2_512|sha2_256'; #[19];
 -      $cgiparams{'IKE_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[20];
 +      $cgiparams{'IKE_GROUPTYPE'}             = 'curve448|curve25519|4096|3072|2048'; #[20];
        $cgiparams{'IKE_LIFETIME'}              = '3'; #[16];
        $cgiparams{'ESP_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21];
        $cgiparams{'ESP_INTEGRITY'}             = 'sha2_512|sha2_256'; #[22];
 -      $cgiparams{'ESP_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[23];
 +      $cgiparams{'ESP_GROUPTYPE'}             = 'curve448|curve25519|4096|3072|2048'; #[23];
        $cgiparams{'ESP_KEYLIFE'}               = '1'; #[17];
        $cgiparams{'COMPRESSION'}               = 'off'; #[13];
        $cgiparams{'ONLY_PROPOSED'}             = 'on'; #[24];
@@@ -2722,7 -2760,7 +2760,7 @@@ if(($cgiparams{'ACTION'} eq $Lang::tr{'
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
 -                      if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
 +                      if ($val !~ /^(curve448|curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@@ -2763,7 -2801,7 +2801,7 @@@
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
 -                      if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
 +                      if ($val !~ /^(curve448|curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@@ -2822,7 -2860,7 +2860,7 @@@
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
                if (&vpnenabled) {
-                       system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
+                       &General::system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
                        sleep $sleepDelay;
                }
                goto ADVANCED_END;
@@@ -2903,8 -2941,8 +2941,8 @@@
        $checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
        @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
        foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
 -      $checked{'IKE_GROUPTYPE'}{'curve25519'} = '';
        $checked{'IKE_GROUPTYPE'}{'curve448'} = '';
 +      $checked{'IKE_GROUPTYPE'}{'curve25519'} = '';
        $checked{'IKE_GROUPTYPE'}{'768'} = '';
        $checked{'IKE_GROUPTYPE'}{'1024'} = '';
        $checked{'IKE_GROUPTYPE'}{'1536'} = '';
@@@ -2943,8 -2981,8 +2981,8 @@@
        $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
        @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
        foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
 -      $checked{'ESP_GROUPTYPE'}{'curve25519'} = '';
        $checked{'ESP_GROUPTYPE'}{'curve448'} = '';
 +      $checked{'ESP_GROUPTYPE'}{'curve25519'} = '';
        $checked{'ESP_GROUPTYPE'}{'768'} = '';
        $checked{'ESP_GROUPTYPE'}{'1024'} = '';
        $checked{'ESP_GROUPTYPE'}{'1536'} = '';
@@@ -3108,8 -3146,8 +3146,8 @@@
                        <td class='boldbase' width="15%">$Lang::tr{'grouptype'}</td>
                        <td class='boldbase'>
                                <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
 -                                      <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
                                        <option value='curve448' $checked{'IKE_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
 +                                      <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (128 bit)</option>
                                        <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@@ -3131,8 -3169,8 +3169,8 @@@
                        </td>
                        <td class='boldbase'>
                                <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
 -                                      <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
                                        <option value='curve448' $checked{'ESP_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
 +                                      <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (128 bit)</option>
                                        <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@@ -3271,7 -3309,7 +3309,7 @@@ EO
        &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
        $cgiparams{'CA_NAME'} = '';
  
-       my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
+       my @status = &General::system_output("/usr/local/bin/ipsecctrl", "I");
  
        $checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : '';
  
@@@ -3705,7 -3743,7 +3743,7 @@@ sub make_algos($$$$$) 
  
                                        if ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
 -                                      } elsif ($grp =~ m/curve(25519|448)/) {
 +                                      } elsif ($grp =~ m/curve(448|25519)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");
@@@ -3722,7 -3760,7 +3760,7 @@@
                                                # noop
                                        } elsif ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
 -                                      } elsif ($grp =~ m/curve(25519|448)/) {
 +                                      } elsif ($grp =~ m/curve(448|25519)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");