]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - html/cgi-bin/ovpnmain.cgi
projects / people / pmueller / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'perl-system' into next
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT		 2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
49abe7af 5# Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
70df8302
MT		 6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535 21###
f527e53f 22# Based on IPFireCore 77
54fd0535 23###
6e13d0a5
MT		 24use CGI;
25use CGI qw/:standard/;
26use Net::DNS;
ce9abb66 27use Net::Ping;
54fd0535 28use Net::Telnet;
6e13d0a5
MT		 29use File::Copy;
30use File::Temp qw/ tempfile tempdir /;
31use strict;
32use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
eff2dbf8 33use Sort::Naturally;
6e13d0a5 34require '/var/ipfire/general-functions.pl';
6e13d0a5
MT		 35require "${General::swroot}/lang.pl";
36require "${General::swroot}/header.pl";
37require "${General::swroot}/countries.pl";
e2e270e1 38require "${General::swroot}/location-functions.pl";
6e13d0a5
MT		 39
40# enable only the following on debugging purpose
8c877a82
AM		 41#use warnings;
42#use CGI::Carp 'fatalsToBrowser';
6e13d0a5 43#workaround to suppress a warning when a variable is used only once
8c877a82 44my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
6e13d0a5
MT		 45undef (@dummy);
46
f2fdd0c1
CS		 47my %color = ();
48my %mainsettings = ();
49&General::readhash("${General::swroot}/main/settings", \%mainsettings);
8186b372 50&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
6e13d0a5
MT		 51
52###
53### Initialize variables
54###
e81be1e1
AM		 55my %ccdconfhash=();
56my %ccdroutehash=();
57my %ccdroute2hash=();
6e13d0a5
MT		 58my %netsettings=();
59my %cgiparams=();
60my %vpnsettings=();
61my %checked=();
62my %confighash=();
63my %cahash=();
64my %selected=();
65my $warnmessage = '';
66my $errormessage = '';
400c8afd
EK		 67my $cryptoerror = '';
68my $cryptowarning = '';
6e13d0a5 69my %settings=();
54fd0535 70my $routes_push_file = '';
df9b48b7
AM		 71my $confighost="${General::swroot}/fwhosts/customhosts";
72my $configgrp="${General::swroot}/fwhosts/customgroups";
73my $customnet="${General::swroot}/fwhosts/customnetworks";
74my $name;
99bfa85c 75my $col="";
ffbe77c8
EK		 76my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local";
77my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local";
78
6e13d0a5
MT		 79&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
80$cgiparams{'ENABLED'} = 'off';
81$cgiparams{'ENABLED_BLUE'} = 'off';
82$cgiparams{'ENABLED_ORANGE'} = 'off';
83$cgiparams{'EDIT_ADVANCED'} = 'off';
84$cgiparams{'NAT'} = 'off';
85$cgiparams{'COMPRESSION'} = 'off';
86$cgiparams{'ONLY_PROPOSED'} = 'off';
87$cgiparams{'ACTION'} = '';
88$cgiparams{'CA_NAME'} = '';
4c962356
EK		 89$cgiparams{'DH_NAME'} = 'dh1024.pem';
90$cgiparams{'DHLENGHT'} = '';
6e13d0a5
MT		 91$cgiparams{'DHCP_DOMAIN'} = '';
92$cgiparams{'DHCP_DNS'} = '';
93$cgiparams{'DHCP_WINS'} = '';
54fd0535 94$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 95$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 96$cgiparams{'MSSFIX'} = '';
8c877a82 97$cgiparams{'number'} = '';
4c962356 98$cgiparams{'DCIPHER'} = '';
49abe7af
EK		 99$cgiparams{'DAUTH'} = '';
100$cgiparams{'TLSAUTH'} = '';
54fd0535 101$routes_push_file = "${General::swroot}/ovpn/routes_push";
400c8afd
EK		 102# Perform crypto and configration test
103&pkiconfigcheck;
ffbe77c8
EK		 104
105# Add CCD files if not already presant
106unless (-e $routes_push_file) {
107 open(RPF, ">$routes_push_file");
108 close(RPF);
109}
110unless (-e "${General::swroot}/ovpn/ccd.conf") {
111 open(CCDC, ">${General::swroot}/ovpn/ccd.conf");
112 close (CCDC);
113}
114unless (-e "${General::swroot}/ovpn/ccdroute") {
115 open(CCDR, ">${General::swroot}/ovpn/ccdroute");
116 close (CCDR);
117}
118unless (-e "${General::swroot}/ovpn/ccdroute2") {
119 open(CCDRT, ">${General::swroot}/ovpn/ccdroute2");
120 close (CCDRT);
121}
122# Add additional configs if not already presant
123unless (-e "$local_serverconf") {
124 open(LSC, ">$local_serverconf");
125 close (LSC);
126}
127unless (-e "$local_clientconf") {
128 open(LCC, ">$local_clientconf");
129 close (LCC);
130}
ce9abb66 131
6e13d0a5
MT		 132&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
133
134# prepare openvpn config file
135###
136### Useful functions
137###
c6c9630e
MT		 138sub haveOrangeNet
139{
13211b21
CS		 140 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
141 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT		 142 return 0;
143}
144
145sub haveBlueNet
146{
13211b21 147 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 148 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT		 149 return 0;
150}
151
152sub sizeformat{
153 my $bytesize = shift;
154 my $i = 0;
155
156 while(abs($bytesize) >= 1024){
157 $bytesize=$bytesize/1024;
158 $i++;
159 last if($i==6);
160 }
161
162 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
163 my $newsize=(int($bytesize*100 +0.5))/100;
164 return("$newsize $units[$i]");
165}
166
c6c9630e
MT		 167sub cleanssldatabase
168{
169 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
170 print FILE "01";
171 close FILE;
172 }
173 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
174 print FILE "";
175 close FILE;
176 }
e6f7f8e7
EK		 177 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
178 print FILE "";
179 close FILE;
180 }
c6c9630e 181 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
e6f7f8e7 182 unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
c6c9630e
MT		 183 unlink ("${General::swroot}/ovpn/certs/serial.old");
184 unlink ("${General::swroot}/ovpn/certs/01.pem");
185}
186
187sub newcleanssldatabase
188{
189 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
190 open(FILE, ">${General::swroot}(ovpn/certs/serial");
191 print FILE "01";
192 close FILE;
193 }
194 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
2feacd98 195 &General::system("touch", "${General::swroot}/ovpn/certs/index.txt");
c6c9630e 196 }
e6f7f8e7 197 if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
2feacd98 198 &General::system("touch", "${General::swroot}/ovpn/certs/index.txt.attr");
e6f7f8e7 199 }
c6c9630e 200 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
e6f7f8e7 201 unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
c6c9630e
MT		 202 unlink ("${General::swroot}/ovpn/certs/serial.old");
203}
204
205sub deletebackupcert
206{
207 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
208 my $hexvalue = <FILE>;
209 chomp $hexvalue;
210 close FILE;
211 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
212 }
213}
4c962356 214
400c8afd
EK		 215###
216### Check for PKI and configure problems
217###
218
219sub pkiconfigcheck
220{
221 # Warning if DH parameter is 1024 bit
222 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
2feacd98
SS		 223 my @dhparameter = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
224
225 foreach my $line (@dhparameter) {
226 my @dhbit = ($line =~ /(\d+)/);
227 if ($1 < 2048) {
228 $cryptoerror = "$Lang::tr{'ovpn error dh'}";
229 goto CRYPTO_ERROR;
230 }
400c8afd
EK		 231 }
232 }
233
234 # Warning if md5 is in usage
235 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
2feacd98
SS		 236 my @signature = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
237 if (grep(/md5WithRSAEncryption/, @signature) ) {
400c8afd
EK		 238 $cryptoerror = "$Lang::tr{'ovpn error md5'}";
239 goto CRYPTO_ERROR;
240 }
241 }
242
243 CRYPTO_ERROR:
244
245 # Warning if certificate is not compliant to RFC3280 TLS rules
246 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
2feacd98
SS		 247 my @extendkeyusage = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
248 if ( ! grep(/TLS Web Server Authentication/, @extendkeyusage)) {
400c8afd
EK		 249 $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
250 goto CRYPTO_WARNING;
251 }
252 }
253
254 CRYPTO_WARNING:
255}
256
c6c9630e 257sub writeserverconf {
54fd0535
MT		 258 my %sovpnsettings = ();
259 my @temp = ();
c6c9630e 260 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535
MT		 261 &read_routepushfile;
262
c6c9630e
MT		 263 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
264 flock CONF, 2;
265 print CONF "#OpenVPN Server conf\n";
266 print CONF "\n";
267 print CONF "daemon openvpnserver\n";
268 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 269 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e 270 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
79e7688b 271 print CONF "dev tun\n";
c6c9630e
MT		 272 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
273 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
a4fd2325 274 print CONF "script-security 3\n";
07675dc3 275 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 276 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e 277 print CONF "tls-server\n";
4c962356
EK		 278 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
279 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
280 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 281 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
c6c9630e
MT		 282 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
283 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
8c877a82 284 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
4c962356 285
d6989b4b 286 print CONF "tun-mtu $sovpnsettings{'DMTU'}\n";
2ee746be 287
54fd0535 288 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
8c877a82
AM		 289 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
290 foreach (@temp)
291 {
292 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
293 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
294 }
54fd0535 295 }
8c877a82
AM		 296# a.marx ccd
297 my %ccdconfhash=();
298 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
299 foreach my $key (keys %ccdconfhash) {
300 my $a=$ccdconfhash{$key}[1];
301 my ($b,$c) = split (/\//, $a);
302 print CONF "route $b ".&General::cidrtosub($c)."\n";
303 }
304 my %ccdroutehash=();
305 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
306 foreach my $key (keys %ccdroutehash) {
307 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
308 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
309 print CONF "route $a $b\n";
310 }
311 }
312# ccd end
54fd0535 313
8c877a82 314 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
c6c9630e
MT		 315 print CONF "client-to-client\n";
316 }
1de5c945 317 if ($sovpnsettings{MSSFIX} eq 'on') {
4c962356 318 print CONF "mssfix\n";
d6989b4b
MT		 319 } else {
320 print CONF "mssfix 0\n";
1de5c945
EK		 321 }
322 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
4c962356 323 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 324 }
2ee746be 325
c6c9630e
MT		 326 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
327 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
328 }
329 print CONF "status-version 1\n";
87fe47e9 330 print CONF "status /var/run/ovpnserver.log 30\n";
a4fd2325 331 print CONF "ncp-disable\n";
c6c9630e 332 print CONF "cipher $sovpnsettings{DCIPHER}\n";
49abe7af 333 print CONF "auth $sovpnsettings{'DAUTH'}\n";
942446b5
EK		 334 # Set TLSv2 as minimum
335 print CONF "tls-version-min 1.2\n";
86308adb 336
49abe7af 337 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
4be45949 338 print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
49abe7af 339 }
c6c9630e
MT		 340 if ($sovpnsettings{DCOMPLZO} eq 'on') {
341 print CONF "comp-lzo\n";
342 }
343 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
344 print CONF "push \"redirect-gateway def1\"\n";
345 }
346 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
347 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
348 }
349
350 if ($sovpnsettings{DHCP_DNS} ne '') {
351 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
352 }
353
354 if ($sovpnsettings{DHCP_WINS} ne '') {
355 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
356 }
357
fa527476 358 if ($sovpnsettings{MAX_CLIENTS} eq '') {
c6c9630e 359 print CONF "max-clients 100\n";
a79fa1d6 360 }
fa527476 361 if ($sovpnsettings{MAX_CLIENTS} ne '') {
c6c9630e
MT		 362 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
363 }
1d0a260a 364 print CONF "tls-verify /usr/lib/openvpn/verify\n";
c6c9630e
MT		 365 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
366 print CONF "user nobody\n";
367 print CONF "group nobody\n";
368 print CONF "persist-key\n";
369 print CONF "persist-tun\n";
370 if ($sovpnsettings{LOG_VERB} ne '') {
371 print CONF "verb $sovpnsettings{LOG_VERB}\n";
372 } else {
373 print CONF "verb 3\n";
ffbe77c8 374 }
708f2b73
MT		 375
376 print CONF "# Log clients connecting/disconnecting\n";
377 print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n";
378 print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n";
379
ffbe77c8
EK		 380 # Print server.conf.local if entries exist to server.conf
381 if ( !-z $local_serverconf && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
382 open (LSC, "$local_serverconf");
383 print CONF "\n#---------------------------\n";
384 print CONF "# Start of custom directives\n";
385 print CONF "# from server.conf.local\n";
386 print CONF "#---------------------------\n\n";
387 while (<LSC>) {
388 print CONF $_;
389 }
390 print CONF "\n#-----------------------------\n";
391 print CONF "# End of custom directives\n";
392 print CONF "#-----------------------------\n";
393 close (LSC);
394 }
c6c9630e
MT		 395 print CONF "\n";
396
397 close(CONF);
398}
8c877a82 399
c6c9630e 400sub emptyserverlog{
87fe47e9 401 if (open(FILE, ">/var/run/ovpnserver.log")) {
c6c9630e
MT		 402 flock FILE, 2;
403 print FILE "";
404 close FILE;
405 }
406
407}
408
8c877a82
AM		 409sub delccdnet
410{
411 my %ccdconfhash = ();
412 my %ccdhash = ();
413 my $ccdnetname=$_[0];
414 if (-f "${General::swroot}/ovpn/ovpnconfig"){
415 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
416 foreach my $key (keys %ccdhash) {
417 if ($ccdhash{$key}[32] eq $ccdnetname) {
418 $errormessage=$Lang::tr{'ccd err hostinnet'};
419 return;
420 }
421 }
422 }
423 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
424 foreach my $key (keys %ccdconfhash) {
425 if ($ccdconfhash{$key}[0] eq $ccdnetname){
426 delete $ccdconfhash{$key};
427 }
428 }
429 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
430
431 &writeserverconf;
432 return 0;
433}
434
435sub addccdnet
436{
437 my %ccdconfhash=();
438 my @ccdconf=();
439 my $ccdname=$_[0];
440 my $ccdnet=$_[1];
8c877a82
AM		 441 my $subcidr;
442 my @ip2=();
443 my $checkup;
444 my $ccdip;
445 my $baseaddress;
290007b3
AM		 446
447
448 #check name
449 if ($ccdname eq '')
450 {
451 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
452 return
453 }
454
455 if(!&General::validhostname($ccdname))
456 {
8c877a82
AM		 457 $errormessage=$Lang::tr{'ccd err invalidname'};
458 return;
459 }
290007b3
AM		 460
461 ($ccdip,$subcidr) = split (/\//,$ccdnet);
462 $subcidr=&General::iporsubtocidr($subcidr);
463 #check subnet
464 if ($subcidr > 30)
465 {
8c877a82
AM		 466 $errormessage=$Lang::tr{'ccd err invalidnet'};
467 return;
468 }
290007b3
AM		 469 #check ip
470 if (!&General::validipandmask($ccdnet)){
471 $errormessage=$Lang::tr{'ccd err invalidnet'};
472 return;
8c877a82 473 }
b6c60092 474
8c877a82
AM		 475 if (!$errormessage) {
476 my %ccdconfhash=();
477 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
478 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
479 my $key = &General::findhasharraykey (\%ccdconfhash);
480 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
481 $ccdconfhash{$key}[0] = $ccdname;
482 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
483 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
484 &writeserverconf;
485 $cgiparams{'ccdname'}='';
486 $cgiparams{'ccdsubnet'}='';
487 return 1;
488 }
489}
490
491sub modccdnet
492{
493
494 my $newname=$_[0];
495 my $oldname=$_[1];
496 my %ccdconfhash=();
497 my %ccdhash=();
7ad653cc
SS		 498
499 # Check if the new name is valid.
500 if(!&General::validhostname($newname)) {
501 $errormessage=$Lang::tr{'ccd err invalidname'};
502 return;
503 }
504
8c877a82
AM		 505 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
506 foreach my $key (keys %ccdconfhash) {
507 if ($ccdconfhash{$key}[0] eq $oldname) {
508 foreach my $key1 (keys %ccdconfhash) {
509 if ($ccdconfhash{$key1}[0] eq $newname){
510 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
511 return;
512 }else{
513 $ccdconfhash{$key}[0]= $newname;
514 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
515 last;
516 }
517 }
518 }
519 }
520
521 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
522 foreach my $key (keys %ccdhash) {
523 if ($ccdhash{$key}[32] eq $oldname) {
524 $ccdhash{$key}[32]=$newname;
525 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
526 last;
527 }
528 }
529
530 return 0;
531}
532sub ccdmaxclients
533{
534 my $ccdnetwork=$_[0];
535 my @octets=();
536 my @subnet=();
537 @octets=split("\/",$ccdnetwork);
538 @subnet= split /\./, &General::cidrtosub($octets[1]);
539 my ($a,$b,$c,$d,$e);
540 $a=256-$subnet[0];
541 $b=256-$subnet[1];
542 $c=256-$subnet[2];
543 $d=256-$subnet[3];
544 $e=($a*$b*$c*$d)/4;
545 return $e-1;
546}
547
548sub getccdadresses
549{
550 my $ipin=$_[0];
551 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
552 my $cidr=$_[1];
553 chomp($cidr);
554 my $count=$_[2];
555 my $hasip=$_[3];
556 chomp($hasip);
557 my @iprange=();
558 my %ccdhash=();
559 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
d9fe5693 560 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
ac87f371 561 for (my $i=1;$i<=$count;$i++) {
8c877a82
AM		 562 my $tmpip=$iprange[$i-1];
563 my $stepper=$i*4;
564 $iprange[$i]= &General::getnextip($tmpip,4);
565 }
566 my $r=0;
567 foreach my $key (keys %ccdhash) {
568 $r=0;
569 foreach my $tmp (@iprange){
570 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
571 if ($net eq $tmp) {
572 if ( $hasip ne $ccdhash{$key}[33] ){
573 splice (@iprange,$r,1);
574 }
575 }
576 $r++;
577 }
578 }
579 return @iprange;
580}
581
582sub fillselectbox
583{
584 my $boxname=$_[1];
585 my ($ccdip,$subcidr) = split("/",$_[0]);
586 my $tz=$_[2];
587 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
588 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
589 foreach (@allccdips) {
590 my $ip=$_."/30";
591 chomp($ip);
592 print "<option value='$ip' ";
593 if ( $ip eq $cgiparams{$boxname} ){
594 print"selected";
595 }
596 print ">$ip</option>";
597 }
598 print "</select>";
599}
600
601sub hostsinnet
602{
603 my $name=$_[0];
604 my %ccdhash=();
605 my $i=0;
606 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
607 foreach my $key (keys %ccdhash) {
608 if ($ccdhash{$key}[32] eq $name){ $i++;}
609 }
610 return $i;
611}
612
613sub check_routes_push
614{
615 my $val=$_[0];
616 my ($ip,$cidr) = split (/\//, $val);
617 ##check for existing routes in routes_push
618 if (-e "${General::swroot}/ovpn/routes_push") {
619 open(FILE,"${General::swroot}/ovpn/routes_push");
620 while (<FILE>) {
621 $_=~s/\s*$//g;
622
623 my ($ip2,$cidr2) = split (/\//,"$_");
624 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
625
626 if($val eq $val2){
627 return 0;
628 }
629 #subnetcheck
630 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
631 return 0;
632 }
633 };
634 close(FILE);
635 }
636 return 1;
637}
638
639sub check_ccdroute
640{
641 my %ccdroutehash=();
642 my $val=$_[0];
643 my ($ip,$cidr) = split (/\//, $val);
644 #check for existing routes in ccdroute
645 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
646 foreach my $key (keys %ccdroutehash) {
647 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
648 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
649 return 0;
650 }
651 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
652 #subnetcheck
653 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
654 return 0;
655 }
656 }
657 }
658 return 1;
659}
660sub check_ccdconf
661{
662 my %ccdconfhash=();
663 my $val=$_[0];
664 my ($ip,$cidr) = split (/\//, $val);
665 #check for existing routes in ccdroute
666 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
667 foreach my $key (keys %ccdconfhash) {
668 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
669 return 0;
670 }
671 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
672 #subnetcheck
673 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
674 return 0;
675 }
676
677 }
678 return 1;
679}
680
7c1d9faf
AH		 681###
682# m.a.d net2net
683###
684
685sub validdotmask
686{
687 my $ipdotmask = $_[0];
688 if (&General::validip($ipdotmask)) { return 0; }
689 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
690 my $mask = $2;
691 if (($mask =~ /\./ )) { return 0; }
692 return 1;
693}
54fd0535
MT		 694
695# -------------------------------------------------------------------
696
697sub write_routepushfile
698{
699 open(FILE, ">$routes_push_file");
700 flock(FILE, 2);
701 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
702 print FILE $vpnsettings{'ROUTES_PUSH'};
703 }
704 close(FILE);
705}
706
707sub read_routepushfile
708{
709 if (-e "$routes_push_file") {
710 open(FILE,"$routes_push_file");
711 delete $vpnsettings{'ROUTES_PUSH'};
712 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
713 close(FILE);
714 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
8c877a82 715
54fd0535
MT		 716 }
717}
7c1d9faf 718
775b4494
AM		 719sub writecollectdconf {
720 my $vpncollectd;
721 my %ccdhash=();
722
723 open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!";
724 print COLLECTDVPN "Loadplugin openvpn\n";
725 print COLLECTDVPN "\n";
726 print COLLECTDVPN "<Plugin openvpn>\n";
727 print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n";
728
729 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
730 foreach my $key (keys %ccdhash) {
731 if ($ccdhash{$key}[0] eq 'on' && $ccdhash{$key}[3] eq 'net') {
732 print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ccdhash{$key}[1]-n2n\"\n";
733 }
734 }
735
736 print COLLECTDVPN "</Plugin>\n";
737 close(COLLECTDVPN);
738
739 # Reload collectd afterwards
2feacd98 740 &General::system("/usr/local/bin/collectdctrl", "restart");
775b4494 741}
7c1d9faf 742
c6c9630e
MT		 743#hier die refresh page
744if ( -e "${General::swroot}/ovpn/gencanow") {
745 my $refresh = '';
746 $refresh = "<meta http-equiv='refresh' content='15;' />";
747 &Header::showhttpheaders();
748 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
749 &Header::openbigbox('100%', 'center');
750 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
751 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
752 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
753 &Header::closebox();
754 &Header::closebigbox();
755 &Header::closepage();
756 exit (0);
757}
758##hier die refresh page
759
6e13d0a5
MT		 760
761###
762### OpenVPN Server Control
763###
764if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
765 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
766 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT		 767 #start openvpn server
768 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 769 &emptyserverlog();
2feacd98 770 &General::system("/usr/local/bin/openvpnctrl", "-s");
6e13d0a5
MT		 771 }
772 #stop openvpn server
773 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
2feacd98 774 &General::system("/usr/local/bin/openvpnctrl", "-k");
c6c9630e 775 &emptyserverlog();
6e13d0a5
MT		 776 }
777# #restart openvpn server
8c877a82 778# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
6e13d0a5 779#workarund, till SIGHUP also works when running as nobody
8c877a82
AM		 780# system('/usr/local/bin/openvpnctrl', '-r');
781# &emptyserverlog();
782# }
6e13d0a5
MT		 783}
784
785###
786### Save Advanced options
787###
788
789if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
790 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
791 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
792 #DAN this value has to leave.
793#new settings for daemon
794 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
795 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
796 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
797 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
798 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
799 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
6a9d9ff4 800 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
ffbe77c8 801 $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
6e13d0a5
MT		 802 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
803 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
804 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535
MT		 805 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
806 my @temp=();
6e13d0a5 807
a79fa1d6
JPT		 808 if ($cgiparams{'FRAGMENT'} eq '') {
809 delete $vpnsettings{'FRAGMENT'};
810 } else {
811 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
812 $errormessage = "Incorrect value, please insert only numbers.";
813 goto ADV_ERROR;
814 } else {
815 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
816 }
817 }
49abe7af 818
a79fa1d6 819 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 820 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT		 821 } else {
822 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
823 }
2ee746be 824
6e13d0a5 825 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
81da1b01 826 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
6e13d0a5
MT		 827 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
828 goto ADV_ERROR;
829 }
830 }
831 if ($cgiparams{'DHCP_DNS'} ne ''){
832 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
833 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
834 goto ADV_ERROR;
835 }
836 }
837 if ($cgiparams{'DHCP_WINS'} ne ''){
838 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
839 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT		 840 goto ADV_ERROR;
841 }
842 }
843 if ($cgiparams{'ROUTES_PUSH'} ne ''){
844 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
845 undef $vpnsettings{'ROUTES_PUSH'};
8c877a82
AM		 846
847 foreach my $tmpip (@temp)
54fd0535
MT		 848 {
849 s/^\s+//g; s/\s+$//g;
8c877a82
AM		 850
851 if ($tmpip)
54fd0535 852 {
8c877a82
AM		 853 $tmpip=~s/\s*$//g;
854 unless (&General::validipandmask($tmpip)) {
855 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
856 goto ADV_ERROR;
54fd0535 857 }
8c877a82
AM		 858 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
859
54fd0535
MT		 860 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
861 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
8c877a82
AM		 862 goto ADV_ERROR;
863 }
864# a.marx ccd
865 my %ccdroutehash=();
866 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
867 foreach my $key (keys %ccdroutehash) {
868 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
869 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
870 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
871 goto ADV_ERROR;
872 }
873 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
874 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
875 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
876 goto ADV_ERROR;
877 }
878 }
54fd0535 879 }
8c877a82
AM		 880
881# ccd end
882
883 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
54fd0535 884 }
8c877a82
AM		 885 }
886 &write_routepushfile;
54fd0535 887 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP		 888 }
889 else {
890 undef $vpnsettings{'ROUTES_PUSH'};
891 &write_routepushfile;
6e13d0a5 892 }
ba50f66d 893 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
6e13d0a5
MT		 894 $errormessage = $Lang::tr{'invalid input for max clients'};
895 goto ADV_ERROR;
896 }
897 if ($cgiparams{'KEEPALIVE_1'} ne '') {
898 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
899 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
900 goto ADV_ERROR;
901 }
902 }
903 if ($cgiparams{'KEEPALIVE_2'} ne ''){
904 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
905 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
906 goto ADV_ERROR;
907 }
908 }
909 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
910 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
911 goto ADV_ERROR;
912 }
6e13d0a5 913 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 914 &writeserverconf();#hier ok
6e13d0a5
MT		 915}
916
ce9abb66 917###
7c1d9faf 918# m.a.d net2net
ce9abb66
AH		 919###
920
921if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
922{
c6c9630e 923
ce9abb66
AH		 924my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
925my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 926my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 927my $tunmtu = '';
531f0835
AH		 928
929unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
930unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH		 931
932 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
933
934 flock SERVERCONF, 2;
7c1d9faf 935 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
ce9abb66 936 print SERVERCONF "\n";
b278daf3 937 print SERVERCONF "# User Security\n";
ce9abb66
AH		 938 print SERVERCONF "user nobody\n";
939 print SERVERCONF "group nobody\n";
940 print SERVERCONF "persist-tun\n";
941 print SERVERCONF "persist-key\n";
7c1d9faf 942 print SERVERCONF "script-security 2\n";
60f396d7 943 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
c125d8a2
SS		 944
945 if ($cgiparams{'REMOTE'} ne '') {
ce9abb66 946 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
c125d8a2
SS		 947 }
948
b278daf3 949 print SERVERCONF "float\n";
60f396d7 950 print SERVERCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 951 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
60f396d7 952 print SERVERCONF "# Client Gateway Network\n";
54fd0535 953 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
2913185a 954 print SERVERCONF "up \"/etc/init.d/static-routes start\"\n";
60f396d7 955 print SERVERCONF "# tun Device\n";
ce9abb66 956 print SERVERCONF "dev tun\n";
5795fc1b
AM		 957 print SERVERCONF "#Logfile for statistics\n";
958 print SERVERCONF "status-version 1\n";
87fe47e9 959 print SERVERCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
60f396d7 960 print SERVERCONF "# Port and Protokol\n";
ce9abb66 961 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
5795fc1b 962
60f396d7
AH		 963 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
964 print SERVERCONF "proto tcp-server\n";
965 print SERVERCONF "# Packet size\n";
d96c89eb 966 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 967 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 968 }
60f396d7
AH		 969
970 if ($cgiparams{'PROTOCOL'} eq 'udp') {
971 print SERVERCONF "proto udp\n";
972 print SERVERCONF "# Paketsize\n";
973 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
974 print SERVERCONF "tun-mtu $tunmtu\n";
54fd0535 975 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
d6989b4b 976 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; } else { print SERVERCONF "mssfix 0\n" };
d96c89eb 977 }
1647059d 978
60f396d7 979 print SERVERCONF "# Auth. Server\n";
ce9abb66
AH		 980 print SERVERCONF "tls-server\n";
981 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
982 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
983 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 984 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
b278daf3 985 print SERVERCONF "# Cipher\n";
4c962356 986 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
52f61e49
EKD		 987
988 # If GCM cipher is used, do not use --auth
989 if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
990 ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
991 ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
992 print SERVERCONF unless "# HMAC algorithm\n";
993 print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n";
49abe7af 994 } else {
52f61e49
EKD		 995 print SERVERCONF "# HMAC algorithm\n";
996 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
49abe7af 997 }
52f61e49 998
942446b5
EK		 999 # Set TLSv1.2 as minimum
1000 print SERVERCONF "tls-version-min 1.2\n";
1001
ce9abb66 1002 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1003 print SERVERCONF "# Enable Compression\n";
66298ef2 1004 print SERVERCONF "comp-lzo\n";
b278daf3 1005 }
60f396d7 1006 print SERVERCONF "# Debug Level\n";
ce9abb66 1007 print SERVERCONF "verb 3\n";
b278daf3 1008 print SERVERCONF "# Tunnel check\n";
ce9abb66 1009 print SERVERCONF "keepalive 10 60\n";
60f396d7 1010 print SERVERCONF "# Start as daemon\n";
ce9abb66
AH		 1011 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1012 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1013 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT		 1014 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1015 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH		 1016 close(SERVERCONF);
1017
1018}
1019
1020###
7c1d9faf 1021# m.a.d net2net
ce9abb66 1022###
7c1d9faf 1023
ce9abb66
AH		 1024if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1025{
4c962356 1026
ce9abb66 1027 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 1028 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1029 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 1030 my $tunmtu = '';
54fd0535 1031
531f0835
AH		 1032unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1033unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH		 1034
1035 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1036
1037 flock CLIENTCONF, 2;
7c1d9faf 1038 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 1039 print CLIENTCONF "#\n";
b278daf3 1040 print CLIENTCONF "# User Security\n";
ce9abb66
AH		 1041 print CLIENTCONF "user nobody\n";
1042 print CLIENTCONF "group nobody\n";
1043 print CLIENTCONF "persist-tun\n";
1044 print CLIENTCONF "persist-key\n";
7c1d9faf 1045 print CLIENTCONF "script-security 2\n";
60f396d7 1046 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 1047 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 1048 print CLIENTCONF "float\n";
60f396d7 1049 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1050 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
60f396d7 1051 print CLIENTCONF "# Server Gateway Network\n";
54fd0535 1052 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
ebcecb4b 1053 print CLIENTCONF "up \"/etc/init.d/static-routes start\"\n";
60f396d7 1054 print CLIENTCONF "# tun Device\n";
ce9abb66 1055 print CLIENTCONF "dev tun\n";
35a21a25
AM		 1056 print CLIENTCONF "#Logfile for statistics\n";
1057 print CLIENTCONF "status-version 1\n";
1058 print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
60f396d7 1059 print CLIENTCONF "# Port and Protokol\n";
ce9abb66 1060 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH		 1061
1062 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1063 print CLIENTCONF "proto tcp-client\n";
1064 print CLIENTCONF "# Packet size\n";
d96c89eb 1065 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 1066 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1067 }
60f396d7
AH		 1068
1069 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1070 print CLIENTCONF "proto udp\n";
1071 print CLIENTCONF "# Paketsize\n";
1072 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1073 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 1074 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
d6989b4b 1075 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; } else { print CLIENTCONF "mssfix 0\n" };
d96c89eb 1076 }
1647059d 1077
b66b02ab
EK		 1078 # Check host certificate if X509 is RFC3280 compliant.
1079 # If not, old --ns-cert-type directive will be used.
1080 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2feacd98
SS		 1081 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1082 if ( ! grep(/TLS Web Server Authentication/, @hostcert)) {
b66b02ab
EK		 1083 print CLIENTCONF "ns-cert-type server\n";
1084 } else {
1085 print CLIENTCONF "remote-cert-tls server\n";
1086 }
ce9abb66
AH		 1087 print CLIENTCONF "# Auth. Client\n";
1088 print CLIENTCONF "tls-client\n";
b278daf3 1089 print CLIENTCONF "# Cipher\n";
4c962356 1090 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
ce9abb66 1091 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
52f61e49
EKD		 1092
1093 # If GCM cipher is used, do not use --auth
1094 if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1095 ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1096 ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1097 print CLIENTCONF unless "# HMAC algorithm\n";
1098 print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n";
49abe7af 1099 } else {
52f61e49
EKD		 1100 print CLIENTCONF "# HMAC algorithm\n";
1101 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
49abe7af 1102 }
52f61e49 1103
942446b5
EK		 1104 # Set TLSv1.2 as minimum
1105 print CLIENTCONF "tls-version-min 1.2\n";
1106
ce9abb66 1107 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1108 print CLIENTCONF "# Enable Compression\n";
66298ef2 1109 print CLIENTCONF "comp-lzo\n";
4c962356 1110 }
ce9abb66
AH		 1111 print CLIENTCONF "# Debug Level\n";
1112 print CLIENTCONF "verb 3\n";
b278daf3 1113 print CLIENTCONF "# Tunnel check\n";
ce9abb66 1114 print CLIENTCONF "keepalive 10 60\n";
60f396d7 1115 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH		 1116 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1117 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1118 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT		 1119 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1120 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 1121 close(CLIENTCONF);
c6c9630e 1122
ce9abb66 1123}
400c8afd 1124
6e13d0a5
MT		 1125###
1126### Save main settings
1127###
ce9abb66 1128
6e13d0a5
MT		 1129if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1130 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT		 1131 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1132 #DAN this value has to leave.
1133 if ($cgiparams{'ENABLED'} eq 'on'){
1134 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1135 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 1136 goto SETTINGS_ERROR;
6e13d0a5
MT		 1137 }
1138 }
f7fb5bc5 1139
6e13d0a5 1140 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e 1141 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
4c962356 1142 goto SETTINGS_ERROR;
c6c9630e
MT		 1143 }
1144 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1145
1146 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1147 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1148 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1149 goto SETTINGS_ERROR;
1150 }
1151
1152 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1153 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1154 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1155 goto SETTINGS_ERROR;
1156 }
1157
1158 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1159 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1160 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1161 goto SETTINGS_ERROR;
1162 }
1163
1164 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1165 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1166 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1167 goto SETTINGS_ERROR;
1168 }
1169 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1170 while (<ALIASES>)
1171 {
1172 chomp($_);
1173 my @tempalias = split(/\,/,$_);
1174 if ($tempalias[1] eq 'on') {
1175 if (&General::IpInSubnet ($tempalias[0] ,
1176 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1177 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1178 }
1179 }
1180 }
1181 close(ALIASES);
6e13d0a5 1182 if ($errormessage ne ''){
c6c9630e 1183 goto SETTINGS_ERROR;
6e13d0a5
MT		 1184 }
1185 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1186 $errormessage = $Lang::tr{'invalid input'};
1187 goto SETTINGS_ERROR;
1188 }
1189 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1190 $errormessage = $Lang::tr{'invalid mtu input'};
1191 goto SETTINGS_ERROR;
1192 }
1193
1194 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT		 1195 $errormessage = $Lang::tr{'invalid port'};
1196 goto SETTINGS_ERROR;
6e13d0a5 1197 }
8c252e6a 1198
b21a6319
EK		 1199 # Create ta.key for tls-auth if not presant
1200 if ($cgiparams{'TLSAUTH'} eq 'on') {
1201 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
2feacd98
SS		 1202 # This system call is safe, because all arguements are passed as an array.
1203 system("/usr/sbin/openvpn", "--genkey", "--secret", "${General::swroot}/ovpn/certs/ta.key");
b21a6319
EK		 1204 if ($?) {
1205 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1206 goto SETTINGS_ERROR;
1207 }
1208 }
1209 }
1210
6e13d0a5
MT		 1211 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1212 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1213 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1214 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1215#new settings for daemon
1216 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
6e13d0a5
MT		 1217 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1218 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1219 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1220 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1221 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
86308adb 1222 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
0c4ffc69 1223 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
3ffee04b
CS		 1224#wrtie enable
1225
2feacd98
SS		 1226 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {
1227 &General::system("touch", "${General::swroot}/ovpn/enable_blue");
1228 } else {
1229 unlink(${General::swroot}/ovpn/enable_blue);
1230 }
1231
1232 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {
1233 &General::system("touch", "${General::swroot}/ovpn/enable_orange");
1234 } else {
1235 unlink("${General::swroot}/ovpn/enable_orange");
1236 }
1237
1238 if ( $vpnsettings{'ENABLED'} eq 'on' ) {
1239 &General::system("touch", "${General::swroot}/ovpn/enable");
1240 } else {
1241 unlink("${General::swroot}/ovpn/enable");
1242 }
1243
6e13d0a5
MT		 1244#new settings for daemon
1245 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 1246 &writeserverconf();#hier ok
6e13d0a5
MT		 1247SETTINGS_ERROR:
1248###
1249### Reset all step 2
1250###
4c962356 1251}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
6e13d0a5
MT		 1252 my $file = '';
1253 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1254
1e499e90 1255 # Kill all N2N connections
2feacd98 1256 &General::system("/usr/local/bin/openvpnctrl", "-kn2n");
1e499e90 1257
6e13d0a5 1258 foreach my $key (keys %confighash) {
2f36a7b4
MT		 1259 my $name = $confighash{$cgiparams{'$key'}}[1];
1260
c6c9630e
MT		 1261 if ($confighash{$key}[4] eq 'cert') {
1262 delete $confighash{$cgiparams{'$key'}};
1263 }
2f36a7b4 1264
2feacd98 1265 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$name");
6e13d0a5
MT		 1266 }
1267 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
49abe7af 1268 unlink $file;
6e13d0a5
MT		 1269 }
1270 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
49abe7af 1271 unlink $file;
6e13d0a5
MT		 1272 }
1273 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
49abe7af 1274 unlink $file;
6e13d0a5 1275 }
4c962356 1276 &cleanssldatabase();
6e13d0a5
MT		 1277 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1278 print FILE "";
1279 close FILE;
1280 }
49abe7af
EK		 1281 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1282 print FILE "";
1283 close FILE;
1284 }
1285 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1286 print FILE "";
1287 close FILE;
1288 }
1289 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1290 unlink $file
1291 }
5795fc1b
AM		 1292 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1293 unlink $file
1294 }
49abe7af
EK		 1295 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1296 print FILE "";
1297 close FILE;
1298 }
1299 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1300 print FILE "";
1301 close FILE;
1302 }
1303 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
2feacd98 1304 unlink($file);
49abe7af
EK		 1305 }
1306
2f36a7b4
MT		 1307 # Remove everything from the collectd configuration
1308 &writecollectdconf();
1309
c6c9630e 1310 #&writeserverconf();
6e13d0a5
MT		 1311###
1312### Reset all step 1
1313###
4c962356 1314}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
6e13d0a5 1315 &Header::showhttpheaders();
4c962356
EK		 1316 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1317 &Header::openbigbox('100%', 'left', '', '');
1318 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1319 print <<END;
1320 <form method='post'>
1321 <table width='100%'>
1322 <tr>
1323 <td align='center'>
1324 <input type='hidden' name='AREUSURE' value='yes' />
49abe7af 1325 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
4c962356
EK		 1326 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1327 </tr>
1328 <tr>
1329 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1330 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1331 </tr>
1332 </table>
1333 </form>
6e13d0a5
MT		 1334END
1335 ;
1336 &Header::closebox();
1337 &Header::closebigbox();
1338 &Header::closepage();
1339 exit (0);
1340
4c962356
EK		 1341###
1342### Generate DH key step 2
1343###
1344} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
49abe7af 1345 # Delete if old key exists
4c962356
EK		 1346 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1347 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1348 }
1349 # Create Diffie Hellmann Parameter
2feacd98
SS		 1350 # The system call is safe, because all arguments are passed as an array.
1351 system("/usr/bin/openssl", "dhparam", "-out", "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
4c962356
EK		 1352 if ($?) {
1353 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1354 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1355 }
1356
1357###
1358### Generate DH key step 1
1359###
1360} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1361 &Header::showhttpheaders();
1362 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1363 &Header::openbigbox('100%', 'LEFT', '', '');
1364 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1365 print <<END;
1366 <table width='100%'>
1367 <tr>
f527e53f 1368 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
49abe7af 1369 </tr>
4c962356
EK		 1370 <tr>
1371 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1372 <td align='center'>
1373 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1374 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1375 <select name='DHLENGHT'>
4c962356
EK		 1376 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1377 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1378 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1379 </select>
1380 </td>
1381 </tr>
1382 <tr><td colspan='4'><br></td></tr>
1383 </table>
1384 <table width='100%'>
1385 <tr>
49abe7af 1386 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
4c962356 1387 </tr>
49abe7af
EK		 1388 <tr>
1389 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1390 </tr>
1391 <tr><td colspan='2'><br></td></tr>
4c962356
EK		 1392 <tr>
1393 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1394 </form>
1395 </tr>
1396 </table>
1397
1398END
1399 ;
1400 &Header::closebox();
1401 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1402 &Header::closebigbox();
1403 &Header::closepage();
1404 exit (0);
1405
1406###
1407### Upload DH key
1408###
1409} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
2ad1b18b 1410 unless (ref ($cgiparams{'FH'})) {
4c962356
EK		 1411 $errormessage = $Lang::tr{'there was no file upload'};
1412 goto UPLOADCA_ERROR;
1413 }
49abe7af 1414 # Move uploaded dh key to a temporary file
4c962356
EK		 1415 (my $fh, my $filename) = tempfile( );
1416 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1417 $errormessage = $!;
49abe7af 1418 goto UPLOADCA_ERROR;
4c962356 1419 }
2feacd98
SS		 1420 my @temp = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$filename");
1421 if ( ! grep(/DH Parameters: \((2048|3072|4096) bit\)/, @temp)) {
4c962356
EK		 1422 $errormessage = $Lang::tr{'not a valid dh key'};
1423 unlink ($filename);
1424 goto UPLOADCA_ERROR;
1425 } else {
1426 # Delete if old key exists
1427 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1428 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1429 }
1430 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
49abe7af
EK		 1431 if ($? ne 0) {
1432 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1433 unlink ($filename);
1434 goto UPLOADCA_ERROR;
1435 }
4c962356
EK		 1436 }
1437
6e13d0a5
MT		 1438###
1439### Upload CA Certificate
1440###
1441} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1442 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1443
1444 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1445 $errormessage = $Lang::tr{'name must only contain characters'};
1446 goto UPLOADCA_ERROR;
1447 }
1448
1449 if (length($cgiparams{'CA_NAME'}) >60) {
1450 $errormessage = $Lang::tr{'name too long'};
1451 goto VPNCONF_ERROR;
1452 }
1453
1454 if ($cgiparams{'CA_NAME'} eq 'ca') {
1455 $errormessage = $Lang::tr{'name is invalid'};
4c962356 1456 goto UPLOADCA_ERROR;
6e13d0a5
MT		 1457 }
1458
1459 # Check if there is no other entry with this name
1460 foreach my $key (keys %cahash) {
c6c9630e
MT		 1461 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1462 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1463 goto UPLOADCA_ERROR;
1464 }
6e13d0a5
MT		 1465 }
1466
2ad1b18b 1467 unless (ref ($cgiparams{'FH'})) {
c6c9630e
MT		 1468 $errormessage = $Lang::tr{'there was no file upload'};
1469 goto UPLOADCA_ERROR;
6e13d0a5
MT		 1470 }
1471 # Move uploaded ca to a temporary file
1472 (my $fh, my $filename) = tempfile( );
1473 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT		 1474 $errormessage = $!;
1475 goto UPLOADCA_ERROR;
6e13d0a5 1476 }
2feacd98
SS		 1477 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
1478 if ( ! grep(/CA:TRUE/i, @temp )) {
c6c9630e
MT		 1479 $errormessage = $Lang::tr{'not a valid ca certificate'};
1480 unlink ($filename);
1481 goto UPLOADCA_ERROR;
6e13d0a5 1482 } else {
c6c9630e
MT		 1483 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1484 if ($? ne 0) {
1485 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1486 unlink ($filename);
1487 goto UPLOADCA_ERROR;
1488 }
6e13d0a5
MT		 1489 }
1490
2feacd98
SS		 1491 @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1492 my $casubject;
1493
1494 foreach my $line (@casubject) {
1495 if ($line =~ /Subject: (.*)[\n]/) {
1496 $casubject = $1;
1497 $casubject =~ s+/Email+, E+;
1498 $casubject =~ s/ ST=/ S=/;
1499
1500 last;
1501 }
1502 }
1503
6e13d0a5
MT		 1504 $casubject = &Header::cleanhtml($casubject);
1505
1506 my $key = &General::findhasharraykey (\%cahash);
1507 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1508 $cahash{$key}[1] = $casubject;
1509 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT		 1510# system('/usr/local/bin/ipsecctrl', 'R');
1511
6e13d0a5
MT		 1512 UPLOADCA_ERROR:
1513
1514###
1515### Display ca certificate
1516###
1517} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT		 1518 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1519
1520 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1521 &Header::showhttpheaders();
4c962356 1522 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT		 1523 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1524 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
2feacd98
SS		 1525 my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1526 @output = &Header::cleanhtml(@output,"y");
1527 print "<pre>@output</pre>\n";
c6c9630e
MT		 1528 &Header::closebox();
1529 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1530 &Header::closebigbox();
1531 &Header::closepage();
1532 exit(0);
1533 } else {
1534 $errormessage = $Lang::tr{'invalid key'};
1535 }
1536
6e13d0a5
MT		 1537###
1538### Download ca certificate
1539###
1540} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1541 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1542
1543 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1544 print "Content-Type: application/octet-stream\r\n";
1545 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
2feacd98
SS		 1546
1547 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1548 print "@tmp";
1549
6e13d0a5
MT		 1550 exit(0);
1551 } else {
1552 $errormessage = $Lang::tr{'invalid key'};
1553 }
1554
1555###
1556### Remove ca certificate (step 2)
1557###
1558} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1559 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1560 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1561
1562 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1563 foreach my $key (keys %confighash) {
2feacd98
SS		 1564 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1565 if (grep(/: OK/, @test)) {
c6c9630e
MT		 1566 # Delete connection
1567# if ($vpnsettings{'ENABLED'} eq 'on' ||
1568# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1569# system('/usr/local/bin/ipsecctrl', 'D', $key);
1570# }
6e13d0a5
MT		 1571 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1572 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1573 delete $confighash{$key};
1574 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1575# &writeipsecfiles();
6e13d0a5
MT		 1576 }
1577 }
1578 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1579 delete $cahash{$cgiparams{'KEY'}};
1580 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1581# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT		 1582 } else {
1583 $errormessage = $Lang::tr{'invalid key'};
1584 }
1585###
1586### Remove ca certificate (step 1)
1587###
1588} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1589 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1590 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1591
1592 my $assignedcerts = 0;
1593 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1594 foreach my $key (keys %confighash) {
2feacd98
SS		 1595 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1596 if (grep(/: OK/, @test)) {
6e13d0a5
MT		 1597 $assignedcerts++;
1598 }
1599 }
1600 if ($assignedcerts) {
1601 &Header::showhttpheaders();
4c962356 1602 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT		 1603 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1604 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
4c962356 1605 print <<END;
6e13d0a5
MT		 1606 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1607 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1608 <tr><td align='center'>
1609 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1610 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1611 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1612 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1613 </form></table>
1614END
1615 ;
1616 &Header::closebox();
1617 &Header::closebigbox();
1618 &Header::closepage();
1619 exit (0);
1620 } else {
1621 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1622 delete $cahash{$cgiparams{'KEY'}};
1623 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1624# system('/usr/local/bin/ipsecctrl', 'R');
1625 }
1626 } else {
1627 $errormessage = $Lang::tr{'invalid key'};
1628 }
1629
1630###
1631### Display root certificate
1632###
c6c9630e
MT		 1633}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1634 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
2feacd98 1635 my @output;
c6c9630e 1636 &Header::showhttpheaders();
4c962356 1637 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT		 1638 &Header::openbigbox('100%', 'LEFT', '', '');
1639 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1640 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
2feacd98 1641 @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
c6c9630e
MT		 1642 } else {
1643 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
2feacd98 1644 @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1645 }
2feacd98
SS		 1646 @output = &Header::cleanhtml(@output,"y");
1647 print "<pre>@output</pre>\n";
c6c9630e
MT		 1648 &Header::closebox();
1649 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1650 &Header::closebigbox();
1651 &Header::closepage();
1652 exit(0);
1653
6e13d0a5
MT		 1654###
1655### Download root certificate
1656###
1657}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1658 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1659 print "Content-Type: application/octet-stream\r\n";
1660 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
2feacd98
SS		 1661
1662 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1663 print "@tmp";
1664
6e13d0a5
MT		 1665 exit(0);
1666 }
1667
1668###
1669### Download host certificate
1670###
1671}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1672 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1673 print "Content-Type: application/octet-stream\r\n";
1674 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
2feacd98
SS		 1675
1676 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1677 print "@tmp";
1678
6e13d0a5
MT		 1679 exit(0);
1680 }
f7fb5bc5 1681
fd5ccb2d
EK		 1682###
1683### Download tls-auth key
1684###
1685}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1686 if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1687 print "Content-Type: application/octet-stream\r\n";
1688 print "Content-Disposition: filename=ta.key\r\n\r\n";
2feacd98
SS		 1689
1690 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
1691 my @tmp = <FILE>;
1692 close(FILE);
1693
1694 print "@tmp";
1695
fd5ccb2d
EK		 1696 exit(0);
1697 }
1698
6e13d0a5
MT		 1699###
1700### Form for generating a root certificate
1701###
1702}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1703 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1704
1705 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1706 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1707 $errormessage = $Lang::tr{'valid root certificate already exists'};
1708 $cgiparams{'ACTION'} = '';
1709 goto ROOTCERT_ERROR;
1710 }
1711
1712 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1713 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1714 my $ipaddr = <IPADDR>;
1715 close IPADDR;
1716 chomp ($ipaddr);
1717 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1718 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1719 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1720 }
1721 }
1722 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
2ad1b18b 1723 unless (ref ($cgiparams{'FH'})) {
6e13d0a5
MT		 1724 $errormessage = $Lang::tr{'there was no file upload'};
1725 goto ROOTCERT_ERROR;
1726 }
1727
1728 # Move uploaded certificate request to a temporary file
1729 (my $fh, my $filename) = tempfile( );
1730 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1731 $errormessage = $!;
1732 goto ROOTCERT_ERROR;
1733 }
1734
1735 # Create a temporary dirctory
1736 my $tempdir = tempdir( CLEANUP => 1 );
1737
1738 # Extract the CA certificate from the file
1739 my $pid = open(OPENSSL, "|-");
1740 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1741 if ($pid) { # parent
1742 if ($cgiparams{'P12_PASS'} ne '') {
1743 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1744 }
1745 close (OPENSSL);
1746 if ($?) {
1747 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1748 unlink ($filename);
1749 goto ROOTCERT_ERROR;
1750 }
1751 } else { # child
1752 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1753 '-in', $filename,
1754 '-out', "$tempdir/cacert.pem")) {
1755 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1756 unlink ($filename);
1757 goto ROOTCERT_ERROR;
1758 }
1759 }
1760
1761 # Extract the Host certificate from the file
1762 $pid = open(OPENSSL, "|-");
1763 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1764 if ($pid) { # parent
1765 if ($cgiparams{'P12_PASS'} ne '') {
1766 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1767 }
1768 close (OPENSSL);
1769 if ($?) {
1770 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1771 unlink ($filename);
1772 goto ROOTCERT_ERROR;
1773 }
1774 } else { # child
1775 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1776 '-in', $filename,
1777 '-out', "$tempdir/hostcert.pem")) {
1778 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1779 unlink ($filename);
1780 goto ROOTCERT_ERROR;
1781 }
1782 }
1783
1784 # Extract the Host key from the file
1785 $pid = open(OPENSSL, "|-");
1786 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1787 if ($pid) { # parent
1788 if ($cgiparams{'P12_PASS'} ne '') {
1789 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1790 }
1791 close (OPENSSL);
1792 if ($?) {
1793 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1794 unlink ($filename);
1795 goto ROOTCERT_ERROR;
1796 }
1797 } else { # child
1798 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1799 '-nodes',
1800 '-in', $filename,
1801 '-out', "$tempdir/serverkey.pem")) {
1802 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1803 unlink ($filename);
1804 goto ROOTCERT_ERROR;
1805 }
1806 }
1807
1808 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1809 if ($? ne 0) {
1810 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1811 unlink ($filename);
1812 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1813 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1814 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1815 goto ROOTCERT_ERROR;
1816 }
1817
1818 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1819 if ($? ne 0) {
1820 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1821 unlink ($filename);
1822 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1823 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1824 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1825 goto ROOTCERT_ERROR;
1826 }
1827
1828 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1829 if ($? ne 0) {
1830 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1831 unlink ($filename);
1832 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1833 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1834 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1835 goto ROOTCERT_ERROR;
1836 }
1837
1838 goto ROOTCERT_SUCCESS;
1839
1840 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1841
1842 # Validate input since the form was submitted
1843 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1844 $errormessage = $Lang::tr{'organization cant be empty'};
1845 goto ROOTCERT_ERROR;
1846 }
1847 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1848 $errormessage = $Lang::tr{'organization too long'};
1849 goto ROOTCERT_ERROR;
1850 }
1851 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1852 $errormessage = $Lang::tr{'invalid input for organization'};
1853 goto ROOTCERT_ERROR;
1854 }
1855 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1856 $errormessage = $Lang::tr{'hostname cant be empty'};
1857 goto ROOTCERT_ERROR;
1858 }
1859 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1860 $errormessage = $Lang::tr{'invalid input for hostname'};
1861 goto ROOTCERT_ERROR;
1862 }
1863 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1864 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1865 goto ROOTCERT_ERROR;
1866 }
1867 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1868 $errormessage = $Lang::tr{'e-mail address too long'};
1869 goto ROOTCERT_ERROR;
1870 }
1871 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1872 $errormessage = $Lang::tr{'invalid input for department'};
1873 goto ROOTCERT_ERROR;
1874 }
1875 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1876 $errormessage = $Lang::tr{'invalid input for city'};
1877 goto ROOTCERT_ERROR;
1878 }
1879 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1880 $errormessage = $Lang::tr{'invalid input for state or province'};
1881 goto ROOTCERT_ERROR;
1882 }
1883 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1884 $errormessage = $Lang::tr{'invalid input for country'};
1885 goto ROOTCERT_ERROR;
1886 }
1887
1888 # Copy the cgisettings to vpnsettings and save the configfile
1889 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1890 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1891 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1892 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1893 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1894 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1895 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1896 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1897
1898 # Replace empty strings with a .
1899 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1900 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1901 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1902
1903 # refresh
c6c9630e 1904 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT		 1905
1906 # Create the CA certificate
1907 my $pid = open(OPENSSL, "|-");
1908 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1909 if ($pid) { # parent
1910 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1911 print OPENSSL "$state\n";
1912 print OPENSSL "$city\n";
1913 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1914 print OPENSSL "$ou\n";
1915 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1916 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1917 close (OPENSSL);
1918 if ($?) {
1919 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1920 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1921 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1922 goto ROOTCERT_ERROR;
1923 }
1924 } else { # child
badd8c1c 1925 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
49abe7af 1926 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
6e13d0a5
MT		 1927 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1928 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1929 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1930 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1931 goto ROOTCERT_ERROR;
1932 }
1933 }
1934
1935 # Create the Host certificate request
1936 $pid = open(OPENSSL, "|-");
1937 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1938 if ($pid) { # parent
1939 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1940 print OPENSSL "$state\n";
1941 print OPENSSL "$city\n";
1942 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1943 print OPENSSL "$ou\n";
1944 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1945 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1946 print OPENSSL ".\n";
1947 print OPENSSL ".\n";
1948 close (OPENSSL);
1949 if ($?) {
1950 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1951 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1952 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1953 goto ROOTCERT_ERROR;
1954 }
1955 } else { # child
badd8c1c 1956 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4c962356 1957 '-newkey', 'rsa:2048',
6e13d0a5
MT		 1958 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1959 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1960 '-extensions', 'server',
1961 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1962 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1963 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1964 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1965 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1966 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1967 goto ROOTCERT_ERROR;
1968 }
1969 }
1970
1971 # Sign the host certificate request
2feacd98 1972 # This system call is safe, because all argeuments are passed as an array.
6e13d0a5
MT		 1973 system('/usr/bin/openssl', 'ca', '-days', '999999',
1974 '-batch', '-notext',
1975 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1976 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1977 '-extensions', 'server',
1978 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1979 if ($?) {
1980 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1981 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1982 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1983 unlink ("${General::swroot}/ovpn/serverkey.pem");
1984 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1985 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1986 &newcleanssldatabase();
6e13d0a5
MT		 1987 goto ROOTCERT_ERROR;
1988 } else {
1989 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1990 &deletebackupcert();
6e13d0a5
MT		 1991 }
1992
1993 # Create an empty CRL
2feacd98 1994 # System call is safe, because all arguments are passed as array.
6e13d0a5
MT		 1995 system('/usr/bin/openssl', 'ca', '-gencrl',
1996 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1997 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1998 if ($?) {
1999 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2000 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2001 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2002 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2003 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 2004 &cleanssldatabase();
6e13d0a5 2005 goto ROOTCERT_ERROR;
c6c9630e
MT		 2006# } else {
2007# &cleanssldatabase();
6e13d0a5 2008 }
ae04d0a3 2009 # Create ta.key for tls-auth
2feacd98 2010 # This system call is safe, because all arguments are passed as an array.
ae04d0a3
EK		 2011 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
2012 if ($?) {
2013 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2014 &cleanssldatabase();
2015 goto ROOTCERT_ERROR;
2016 }
6e13d0a5 2017 # Create Diffie Hellmann Parameter
2feacd98 2018 # The system call is safe, because all arguments are passed as an array.
badd8c1c 2019 system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
6e13d0a5
MT		 2020 if ($?) {
2021 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2022 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2023 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2024 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2025 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
2026 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 2027 &cleanssldatabase();
6e13d0a5 2028 goto ROOTCERT_ERROR;
c6c9630e
MT		 2029# } else {
2030# &cleanssldatabase();
4be45949 2031 }
6e13d0a5
MT		 2032 goto ROOTCERT_SUCCESS;
2033 }
2034 ROOTCERT_ERROR:
2035 if ($cgiparams{'ACTION'} ne '') {
2036 &Header::showhttpheaders();
4c962356 2037 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT		 2038 &Header::openbigbox('100%', 'LEFT', '', '');
2039 if ($errormessage) {
2040 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2041 print "<class name='base'>$errormessage";
2042 print "&nbsp;</class>";
2043 &Header::closebox();
2044 }
2045 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
49abe7af 2046 print <<END;
6e13d0a5
MT		 2047 <form method='post' enctype='multipart/form-data'>
2048 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
e3edceeb 2049 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
6e13d0a5
MT		 2050 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
2051 <td width='35%' colspan='2'>&nbsp;</td></tr>
e3edceeb 2052 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
6e13d0a5
MT		 2053 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
2054 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2055 <tr><td class='base'>$Lang::tr{'your e-mail'}:</td>
6e13d0a5
MT		 2056 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
2057 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2058 <tr><td class='base'>$Lang::tr{'your department'}:</td>
6e13d0a5
MT		 2059 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
2060 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2061 <tr><td class='base'>$Lang::tr{'city'}:</td>
6e13d0a5
MT		 2062 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
2063 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2064 <tr><td class='base'>$Lang::tr{'state or province'}:</td>
6e13d0a5
MT		 2065 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
2066 <td colspan='2'>&nbsp;</td></tr>
2067 <tr><td class='base'>$Lang::tr{'country'}:</td>
2068 <td class='base'><select name='ROOTCERT_COUNTRY'>
2069
2070END
2071 ;
2072 foreach my $country (sort keys %{Countries::countries}) {
2073 print "<option value='$Countries::countries{$country}'";
2074 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
2075 print " selected='selected'";
2076 }
2077 print ">$country</option>";
2078 }
49abe7af 2079 print <<END;
6e13d0a5 2080 </select></td>
4c962356
EK		 2081 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
2082 <td class='base'><select name='DHLENGHT'>
4c962356
EK		 2083 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2084 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2085 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2086 </select>
2087 </td>
2088 </tr>
2089
6e13d0a5
MT		 2090 <tr><td>&nbsp;</td>
2091 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
2092 <td>&nbsp;</td><td>&nbsp;</td></tr>
2093 <tr><td class='base' colspan='4' align='left'>
e3edceeb 2094 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
49abe7af
EK		 2095 <tr><td colspan='2'><br></td></tr>
2096 <table width='100%'>
2097 <tr>
2098 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2099 <td class='base'>$Lang::tr{'dh key warn'}</td>
4c962356 2100 </tr>
49abe7af
EK		 2101 <tr>
2102 <td class='base'>$Lang::tr{'dh key warn1'}</td>
4c962356 2103 </tr>
49abe7af
EK		 2104 <tr><td colspan='2'><br></td></tr>
2105 <tr>
2106 </table>
4c962356 2107
49abe7af 2108 <table width='100%'>
4c962356 2109 <tr><td colspan='4'><hr></td></tr>
e3edceeb 2110 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
6e13d0a5
MT		 2111 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2112 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2113 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
6e13d0a5
MT		 2114 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2115 <td colspan='2'>&nbsp;</td></tr>
2116 <tr><td>&nbsp;</td>
2117 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2118 <td colspan='2'>&nbsp;</td></tr>
2119 <tr><td class='base' colspan='4' align='left'>
e3edceeb 2120 <img src='/blob.gif' valign='top' alt='*' >&nbsp;$Lang::tr{'required field'}</td>
4c962356 2121 </tr>
6e13d0a5
MT		 2122 </form></table>
2123END
2124 ;
2125 &Header::closebox();
4c962356 2126 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT		 2127 &Header::closebigbox();
2128 &Header::closepage();
2129 exit(0)
2130 }
2131
2132 ROOTCERT_SUCCESS:
2feacd98 2133 &General::system("chmod", "600", "${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT		 2134# if ($vpnsettings{'ENABLED'} eq 'on' ||
2135# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2136# system('/usr/local/bin/ipsecctrl', 'S');
2137# }
6e13d0a5
MT		 2138
2139###
2140### Enable/Disable connection
2141###
ce9abb66
AH		 2142
2143###
7c1d9faf 2144# m.a.d net2net
ce9abb66
AH		 2145###
2146
6e13d0a5 2147}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT		 2148
2149 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 2150 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2feacd98
SS		 2151 my $n2nactive = '';
2152 my @ps = &General::system_output("/bin/ps", "ax");
2153
2154 if(grep(/$confighash{$cgiparams{'KEY'}}[1]/, @ps)) {
2155 $n2nactive = "1";
2156 }
ce9abb66 2157
6e13d0a5 2158 if ($confighash{$cgiparams{'KEY'}}) {
8c877a82
AM		 2159 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2160 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2161 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2162
8c877a82 2163 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2feacd98 2164 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
775b4494 2165 &writecollectdconf();
8c877a82
AM		 2166 }
2167 } else {
ce9abb66 2168
8c877a82
AM		 2169 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2170 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2171
8c877a82 2172 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
775b4494 2173 if ($n2nactive ne '') {
2feacd98 2174 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
775b4494
AM		 2175 &writecollectdconf();
2176 }
ce9abb66 2177
8c877a82 2178 } else {
775b4494 2179 $errormessage = $Lang::tr{'invalid key'};
8c877a82 2180 }
775b4494 2181 }
ce9abb66 2182 }
6e13d0a5
MT		 2183
2184###
2185### Download OpenVPN client package
2186###
ce9abb66
AH		 2187
2188
6e13d0a5
MT		 2189} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2190 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2191 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2192 my $file = '';
2193 my $clientovpn = '';
2194 my @fileholder;
2195 my $tempdir = tempdir( CLEANUP => 1 );
2196 my $zippath = "$tempdir/";
ce9abb66
AH		 2197
2198###
7c1d9faf
AH		 2199# m.a.d net2net
2200###
ce9abb66
AH		 2201
2202if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2203
2204 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2205 my $zippathname = "$zippath$zipname";
2206 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2207 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 2208 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 2209 my $tunmtu = '';
7c1d9faf 2210 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 2211 my $n2nfragment = '';
ce9abb66
AH		 2212
2213 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2214 flock CLIENTCONF, 2;
2215
2216 my $zip = Archive::Zip->new();
7c1d9faf 2217 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 2218 print CLIENTCONF "# \n";
b278daf3 2219 print CLIENTCONF "# User Security\n";
ce9abb66
AH		 2220 print CLIENTCONF "user nobody\n";
2221 print CLIENTCONF "group nobody\n";
2222 print CLIENTCONF "persist-tun\n";
2223 print CLIENTCONF "persist-key\n";
7c1d9faf 2224 print CLIENTCONF "script-security 2\n";
60f396d7 2225 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 2226 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 2227 print CLIENTCONF "float\n";
60f396d7 2228 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 2229 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
b278daf3 2230 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 2231 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
b278daf3 2232 print CLIENTCONF "# tun Device\n";
79e7688b 2233 print CLIENTCONF "dev tun\n";
35a21a25
AM		 2234 print CLIENTCONF "#Logfile for statistics\n";
2235 print CLIENTCONF "status-version 1\n";
2236 print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
60f396d7 2237 print CLIENTCONF "# Port and Protokoll\n";
ce9abb66 2238 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
60f396d7
AH		 2239
2240 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2241 print CLIENTCONF "proto tcp-client\n";
2242 print CLIENTCONF "# Packet size\n";
d96c89eb 2243 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 2244 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 2245 }
60f396d7
AH		 2246
2247 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2248 print CLIENTCONF "proto udp\n";
2249 print CLIENTCONF "# Paketsize\n";
2250 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2251 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 2252 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
d6989b4b 2253 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} else { print CLIENTCONF "mssfix 0\n"; }
d96c89eb 2254 }
b66b02ab
EK		 2255 # Check host certificate if X509 is RFC3280 compliant.
2256 # If not, old --ns-cert-type directive will be used.
2257 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2feacd98
SS		 2258 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2259 if (! grep(/TLS Web Server Authentication/, @hostcert)) {
b66b02ab
EK		 2260 print CLIENTCONF "ns-cert-type server\n";
2261 } else {
2262 print CLIENTCONF "remote-cert-tls server\n";
2263 }
ce9abb66
AH		 2264 print CLIENTCONF "# Auth. Client\n";
2265 print CLIENTCONF "tls-client\n";
49abe7af 2266 print CLIENTCONF "# Cipher\n";
4c962356 2267 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
ce9abb66
AH		 2268 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2269 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2270 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
49abe7af 2271 }
52f61e49
EKD		 2272
2273 # If GCM cipher is used, do not use --auth
2274 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
2275 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
2276 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
2277 print CLIENTCONF unless "# HMAC algorithm\n";
2278 print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n";
49abe7af 2279 } else {
52f61e49
EKD		 2280 print CLIENTCONF "# HMAC algorithm\n";
2281 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
49abe7af 2282 }
52f61e49 2283
4c962356 2284 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 2285 print CLIENTCONF "# Enable Compression\n";
66298ef2 2286 print CLIENTCONF "comp-lzo\n";
b278daf3 2287 }
ce9abb66
AH		 2288 print CLIENTCONF "# Debug Level\n";
2289 print CLIENTCONF "verb 3\n";
b278daf3 2290 print CLIENTCONF "# Tunnel check\n";
ce9abb66 2291 print CLIENTCONF "keepalive 10 60\n";
b278daf3 2292 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH		 2293 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2294 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
b278daf3 2295 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT		 2296 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2297 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 2298 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 2299
ce9abb66
AH		 2300
2301 close(CLIENTCONF);
2302
2303 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2304 my $status = $zip->writeToFileNamed($zippathname);
2305
2306 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2307 @fileholder = <DLFILE>;
2308 print "Content-Type:application/x-download\n";
2309 print "Content-Disposition:attachment;filename=$zipname\n\n";
2310 print @fileholder;
2311 exit (0);
2312}
2313else
2314{
2315 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2316 my $zippathname = "$zippath$zipname";
2317 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2318
2319###
7c1d9faf 2320# m.a.d net2net
ce9abb66
AH		 2321###
2322
c6c9630e 2323 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT		 2324 flock CLIENTCONF, 2;
2325
2326 my $zip = Archive::Zip->new();
2327
8c877a82 2328 print CLIENTCONF "#OpenVPN Client conf\r\n";
6e13d0a5
MT		 2329 print CLIENTCONF "tls-client\r\n";
2330 print CLIENTCONF "client\r\n";
4f6e3ae3 2331 print CLIENTCONF "nobind\r\n";
79e7688b 2332 print CLIENTCONF "dev tun\r\n";
c6c9630e 2333 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
d6989b4b 2334 print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n";
2ee746be 2335
6e13d0a5
MT		 2336 if ( $vpnsettings{'ENABLED'} eq 'on'){
2337 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT		 2338 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2339 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2340 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2341 }
2342 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2343 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2344 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2345 }
2346 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2347 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2348 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2349 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2350 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2351 }
2352 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2353 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT		 2354 }
2355
71af643c
MT		 2356 my $file_crt = new File::Temp( UNLINK => 1 );
2357 my $file_key = new File::Temp( UNLINK => 1 );
b22d8aaf 2358 my $include_certs = 0;
71af643c 2359
6e13d0a5 2360 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
71af643c 2361 if ($cgiparams{'MODE'} eq 'insecure') {
b22d8aaf
MT		 2362 $include_certs = 1;
2363
71af643c 2364 # Add the CA
b22d8aaf 2365 print CLIENTCONF ";ca cacert.pem\r\n";
71af643c
MT		 2366 $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2367
2368 # Extract the certificate
2feacd98 2369 # This system call is safe, because all arguments are passed as an array.
71af643c
MT		 2370 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2371 '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
2372 if ($?) {
2373 die "openssl error: $?";
2374 }
2375
2376 $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die;
b22d8aaf 2377 print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n";
71af643c
MT		 2378
2379 # Extract the key
2feacd98 2380 # This system call is safe, because all arguments are passed as an array.
71af643c
MT		 2381 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2382 '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
2383 if ($?) {
2384 die "openssl error: $?";
2385 }
2386
2387 $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die;
b22d8aaf 2388 print CLIENTCONF ";key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
71af643c
MT		 2389 } else {
2390 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2391 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2392 }
6e13d0a5 2393 } else {
c6c9630e
MT		 2394 print CLIENTCONF "ca cacert.pem\r\n";
2395 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2396 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2397 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2398 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT		 2399 }
2400 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
49abe7af 2401 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
86308adb 2402
49abe7af 2403 if ($vpnsettings{'TLSAUTH'} eq 'on') {
b22d8aaf
MT		 2404 if ($cgiparams{'MODE'} eq 'insecure') {
2405 print CLIENTCONF ";";
2406 }
4be45949
EK		 2407 print CLIENTCONF "tls-auth ta.key\r\n";
2408 $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n";
49abe7af 2409 }
6e13d0a5
MT		 2410 if ($vpnsettings{DCOMPLZO} eq 'on') {
2411 print CLIENTCONF "comp-lzo\r\n";
2412 }
2413 print CLIENTCONF "verb 3\r\n";
b66b02ab
EK		 2414 # Check host certificate if X509 is RFC3280 compliant.
2415 # If not, old --ns-cert-type directive will be used.
2416 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2feacd98
SS		 2417 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2418 if (! grep(/TLS Web Server Authentication/, @hostcert)) {
b66b02ab
EK		 2419 print CLIENTCONF "ns-cert-type server\r\n";
2420 } else {
2421 print CLIENTCONF "remote-cert-tls server\r\n";
2422 }
964700d4 2423 print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
a79fa1d6
JPT		 2424 if ($vpnsettings{MSSFIX} eq 'on') {
2425 print CLIENTCONF "mssfix\r\n";
d6989b4b
MT		 2426 } else {
2427 print CLIENTCONF "mssfix 0\r\n";
a79fa1d6 2428 }
74225cce 2429 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT		 2430 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2431 }
1647059d 2432
b22d8aaf
MT		 2433 if ($include_certs) {
2434 print CLIENTCONF "\r\n";
2435
2436 # CA
2437 open(FILE, "<${General::swroot}/ovpn/ca/cacert.pem");
2438 print CLIENTCONF "<ca>\r\n";
2439 while (<FILE>) {
2440 chomp($_);
2441 print CLIENTCONF "$_\r\n";
2442 }
2443 print CLIENTCONF "</ca>\r\n\r\n";
2444 close(FILE);
2445
2446 # Cert
2447 open(FILE, "<$file_crt");
2448 print CLIENTCONF "<cert>\r\n";
2449 while (<FILE>) {
2450 chomp($_);
2451 print CLIENTCONF "$_\r\n";
2452 }
2453 print CLIENTCONF "</cert>\r\n\r\n";
2454 close(FILE);
2455
2456 # Key
2457 open(FILE, "<$file_key");
2458 print CLIENTCONF "<key>\r\n";
2459 while (<FILE>) {
2460 chomp($_);
2461 print CLIENTCONF "$_\r\n";
2462 }
2463 print CLIENTCONF "</key>\r\n\r\n";
2464 close(FILE);
2465
2466 # TLS auth
2467 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2468 open(FILE, "<${General::swroot}/ovpn/certs/ta.key");
2469 print CLIENTCONF "<tls-auth>\r\n";
2470 while (<FILE>) {
2471 chomp($_);
2472 print CLIENTCONF "$_\r\n";
2473 }
2474 print CLIENTCONF "</tls-auth>\r\n\r\n";
2475 close(FILE);
2476 }
2477 }
2478
ffbe77c8
EK		 2479 # Print client.conf.local if entries exist to client.ovpn
2480 if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
2481 open (LCC, "$local_clientconf");
2482 print CLIENTCONF "\n#---------------------------\n";
2483 print CLIENTCONF "# Start of custom directives\n";
2484 print CLIENTCONF "# from client.conf.local\n";
2485 print CLIENTCONF "#---------------------------\n\n";
2486 while (<LCC>) {
2487 print CLIENTCONF $_;
2488 }
2489 print CLIENTCONF "\n#---------------------------\n";
2490 print CLIENTCONF "# End of custom directives\n";
2491 print CLIENTCONF "#---------------------------\n\n";
2492 close (LCC);
2493 }
6e13d0a5 2494 close(CLIENTCONF);
ce9abb66 2495
6e13d0a5
MT		 2496 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2497 my $status = $zip->writeToFileNamed($zippathname);
2498
2499 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2500 @fileholder = <DLFILE>;
2501 print "Content-Type:application/x-download\n";
2502 print "Content-Disposition:attachment;filename=$zipname\n\n";
2503 print @fileholder;
2504 exit (0);
ce9abb66
AH		 2505 }
2506
2507
2508
6e13d0a5
MT		 2509###
2510### Remove connection
2511###
ce9abb66
AH		 2512
2513
6e13d0a5 2514} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
323be7c4
AM		 2515 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2516 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2517
323be7c4 2518 if ($confighash{$cgiparams{'KEY'}}) {
fde9c9dd 2519 # Revoke certificate if certificate was deleted and rewrite the CRL
2feacd98
SS		 2520 &General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf)";
2521 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
ce9abb66
AH		 2522
2523###
7c1d9faf 2524# m.a.d net2net
ce9abb66 2525###
7c1d9faf 2526
323be7c4 2527 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1e499e90 2528 # Stop the N2N connection before it is removed
2feacd98 2529 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
1e499e90 2530
323be7c4
AM		 2531 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2532 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2533 unlink ($certfile);
2534 unlink ($conffile);
8e6a8fd5 2535
323be7c4
AM		 2536 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2537 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2538 }
323be7c4 2539 }
ce9abb66 2540
323be7c4
AM		 2541 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2542 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
8c877a82
AM		 2543
2544# A.Marx CCD delete ccd files and routes
2545
323be7c4
AM		 2546 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2547 {
2548 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
8c877a82 2549 }
e81be1e1 2550
323be7c4
AM		 2551 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2552 foreach my $key (keys %ccdroutehash) {
2553 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2554 delete $ccdroutehash{$key};
2555 }
8c877a82 2556 }
323be7c4 2557 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
8c877a82 2558
323be7c4
AM		 2559 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2560 foreach my $key (keys %ccdroute2hash) {
2561 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2562 delete $ccdroute2hash{$key};
2563 }
2564 }
2565 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2566 &writeserverconf;
8c877a82 2567
323be7c4
AM		 2568# CCD end
2569 # Update collectd configuration and delete all RRD files of the removed connection
2570 &writecollectdconf();
2feacd98 2571 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]");
8c877a82 2572
323be7c4 2573 delete $confighash{$cgiparams{'KEY'}};
2feacd98 2574 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
323be7c4
AM		 2575 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2576
2577 } else {
2578 $errormessage = $Lang::tr{'invalid key'};
2579 }
b2e75449 2580 &General::firewall_reload();
ce9abb66 2581
6e13d0a5
MT		 2582###
2583### Download PKCS12 file
2584###
2585} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2586 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2587
2588 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2589 print "Content-Type: application/octet-stream\r\n\r\n";
2feacd98
SS		 2590
2591 open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2592 my @tmp = <FILE>;
2593 close(FILE);
2594
2595 print "@tmp";
6e13d0a5
MT		 2596 exit (0);
2597
2598###
2599### Display certificate
2600###
2601} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2602 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2603
2604 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e 2605 &Header::showhttpheaders();
4c962356 2606 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT		 2607 &Header::openbigbox('100%', 'LEFT', '', '');
2608 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2feacd98
SS		 2609 my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2610 @output = &Header::cleanhtml(@output,"y");
2611 print "<pre>@output</pre>\n";
c6c9630e
MT		 2612 &Header::closebox();
2613 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2614 &Header::closebigbox();
2615 &Header::closepage();
2616 exit(0);
6e13d0a5 2617 }
4c962356
EK		 2618
2619###
2620### Display Diffie-Hellman key
2621###
2622} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2623
2624 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
49abe7af 2625 $errormessage = $Lang::tr{'not present'};
4c962356
EK		 2626 } else {
2627 &Header::showhttpheaders();
2628 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2629 &Header::openbigbox('100%', 'LEFT', '', '');
2630 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2feacd98
SS		 2631 my @output = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
2632 @output = &Header::cleanhtml(@output,"y");
2633 print "<pre>@output</pre>\n";
4c962356
EK		 2634 &Header::closebox();
2635 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2636 &Header::closebigbox();
2637 &Header::closepage();
2638 exit(0);
2639 }
2640
fd5ccb2d
EK		 2641###
2642### Display tls-auth key
2643###
2644} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2645
2646 if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2647 $errormessage = $Lang::tr{'not present'};
2648 } else {
2649 &Header::showhttpheaders();
2650 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2651 &Header::openbigbox('100%', 'LEFT', '', '');
2652 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2feacd98
SS		 2653
2654 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
2655 my @output = <FILE>;
2656 close(FILE);
2657
2658 @output = &Header::cleanhtml(@output,"y");
2659 print "<pre>@output</pre>\n";
fd5ccb2d
EK		 2660 &Header::closebox();
2661 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2662 &Header::closebigbox();
2663 &Header::closepage();
2664 exit(0);
2665 }
2666
6e13d0a5
MT		 2667###
2668### Display Certificate Revoke List
2669###
2670} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT		 2671# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2672
49abe7af
EK		 2673 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2674 $errormessage = $Lang::tr{'not present'};
2675 } else {
b2e75449
MT		 2676 &Header::showhttpheaders();
2677 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2678 &Header::openbigbox('100%', 'LEFT', '', '');
2679 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2feacd98
SS		 2680 my @output = &General::system_output("/usr/bin/openssl", "crl", "-text", "-noout", "-in", "${General::swroot}/ovpn/crls/cacrl.pem");
2681 @output = &Header::cleanhtml(@output,"y");
2682 print "<pre>@output</pre>\n";
b2e75449
MT		 2683 &Header::closebox();
2684 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2685 &Header::closebigbox();
2686 &Header::closepage();
2687 exit(0);
6e13d0a5
MT		 2688 }
2689
2690###
2691### Advanced Server Settings
2692###
2693
2694} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2695 %cgiparams = ();
2696 %cahash = ();
2697 %confighash = ();
8c877a82 2698 my $disabled;
6e13d0a5 2699 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 2700 read_routepushfile;
8c877a82
AM		 2701
2702
c6c9630e
MT		 2703# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2704# $cgiparams{'CLIENT2CLIENT'} = 'on';
2705# }
6e13d0a5
MT		 2706ADV_ERROR:
2707 if ($cgiparams{'MAX_CLIENTS'} eq '') {
4c962356 2708 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 2709 }
6e13d0a5 2710 if ($cgiparams{'KEEPALIVE_1'} eq '') {
4c962356 2711 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT		 2712 }
2713 if ($cgiparams{'KEEPALIVE_2'} eq '') {
4c962356 2714 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT		 2715 }
2716 if ($cgiparams{'LOG_VERB'} eq '') {
4c962356 2717 $cgiparams{'LOG_VERB'} = '3';
ae9f6139 2718 }
f527e53f 2719 if ($cgiparams{'TLSAUTH'} eq '') {
754066e6 2720 $cgiparams{'TLSAUTH'} = 'off';
f527e53f 2721 }
6e13d0a5
MT		 2722 $checked{'CLIENT2CLIENT'}{'off'} = '';
2723 $checked{'CLIENT2CLIENT'}{'on'} = '';
2724 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2725 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2726 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2727 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
13389777
EK		 2728 $checked{'DCOMPLZO'}{'off'} = '';
2729 $checked{'DCOMPLZO'}{'on'} = '';
2730 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
ffbe77c8
EK		 2731 $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
2732 $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
2733 $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
a79fa1d6
JPT		 2734 $checked{'MSSFIX'}{'off'} = '';
2735 $checked{'MSSFIX'}{'on'} = '';
2736 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
49abe7af 2737 $selected{'LOG_VERB'}{'0'} = '';
6e13d0a5
MT		 2738 $selected{'LOG_VERB'}{'1'} = '';
2739 $selected{'LOG_VERB'}{'2'} = '';
2740 $selected{'LOG_VERB'}{'3'} = '';
2741 $selected{'LOG_VERB'}{'4'} = '';
2742 $selected{'LOG_VERB'}{'5'} = '';
2743 $selected{'LOG_VERB'}{'6'} = '';
2744 $selected{'LOG_VERB'}{'7'} = '';
2745 $selected{'LOG_VERB'}{'8'} = '';
2746 $selected{'LOG_VERB'}{'9'} = '';
2747 $selected{'LOG_VERB'}{'10'} = '';
2748 $selected{'LOG_VERB'}{'11'} = '';
6e13d0a5 2749 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
f527e53f 2750
6e13d0a5
MT		 2751 &Header::showhttpheaders();
2752 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2753 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2754 if ($errormessage) {
c6c9630e
MT		 2755 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2756 print "<class name='base'>$errormessage\n";
2757 print "&nbsp;</class>\n";
2758 &Header::closebox();
6e13d0a5
MT		 2759 }
2760 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
4c962356 2761 print <<END;
b376fae4 2762 <form method='post' enctype='multipart/form-data'>
b2e75449 2763<table width='100%' border=0>
4c962356
EK		 2764 <tr>
2765 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
6e13d0a5
MT		 2766 </tr>
2767 <tr>
4c962356 2768 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT		 2769 </tr>
2770 <tr>
4c962356 2771 <td class='base'>Domain</td>
8c877a82 2772 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
6e13d0a5
MT		 2773 </tr>
2774 <tr>
4c962356
EK		 2775 <td class='base'>DNS</td>
2776 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
6e13d0a5
MT		 2777 </tr>
2778 <tr>
4c962356
EK		 2779 <td class='base'>WINS</td>
2780 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2781 </tr>
54fd0535 2782 <tr>
4c962356 2783 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
54fd0535
MT		 2784 </tr>
2785 <tr>
4c962356
EK		 2786 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2787 <td colspan='2'>
2788 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
54fd0535
MT		 2789END
2790;
2791
2792if ($cgiparams{'ROUTES_PUSH'} ne '')
2793{
2794 print $cgiparams{'ROUTES_PUSH'};
2795}
2796
8c877a82 2797print <<END;
54fd0535
MT		 2798</textarea></td>
2799</tr>
6e13d0a5
MT		 2800 </tr>
2801</table>
2802<hr size='1'>
4c962356 2803<table width='100%'>
ffbe77c8 2804 <tr>
4c962356 2805 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
ffbe77c8
EK		 2806 </tr>
2807
2808 <tr>
d2de0a00 2809 <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td>
ffbe77c8
EK		 2810 </tr>
2811
2812 <tr>
4c962356
EK		 2813 <td class='base'>Client-To-Client</td>
2814 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
ffbe77c8
EK		 2815 </tr>
2816
2817 <tr>
4c962356
EK		 2818 <td class='base'>Redirect-Gateway def1</td>
2819 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
ffbe77c8
EK		 2820 </tr>
2821
13389777
EK		 2822 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
2823 <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
2824 <td>$Lang::tr{'openvpn default'}: off <font color='red'>($Lang::tr{'attention'} exploitable via Voracle)</font></td>
2825 </tr>
2826
4c962356 2827 <tr>
ffbe77c8
EK		 2828 <td class='base'>$Lang::tr{'ovpn add conf'}</td>
2829 <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
2830 <td>$Lang::tr{'openvpn default'}: off</td>
2831 </tr>
2832
2833 <tr>
2834 <td class='base'>mssfix</td>
2835 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2836 <td>$Lang::tr{'openvpn default'}: off</td>
2837 </tr>
2838
4c962356 2839 <tr>
ffbe77c8
EK		 2840 <td class='base'>fragment <br></td>
2841 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2842 </tr>
2843
2844
2845 <tr>
2846 <td class='base'>Max-Clients</td>
2847 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2848 </tr>
2849 <tr>
2850 <td class='base'>Keepalive <br />
2851 (ping/ping-restart)</td>
2852 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2853 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2854 </tr>
a79fa1d6
JPT		 2855</table>
2856
a79fa1d6 2857<hr size='1'>
4c962356 2858<table width='100%'>
a79fa1d6 2859 <tr>
49abe7af 2860 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
a79fa1d6
JPT		 2861 </tr>
2862 <tr>
49abe7af 2863 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
4c962356
EK		 2864 </tr>
2865
2866 <tr><td class='base'>VERB</td>
2867 <td><select name='LOG_VERB'>
49abe7af
EK		 2868 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option>
2869 <option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2870 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2871 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2872 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2873 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2874 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2875 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2876 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2877 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2878 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2879 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2880 </td></select>
2881 </table>
4c962356 2882
6e13d0a5 2883<hr size='1'>
8c877a82
AM		 2884END
2885
2886if ( -e "/var/run/openvpn.pid"){
2887print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2888 $Lang::tr{'server restart'}<br><br>
2889 <hr>";
49abe7af 2890 print<<END;
52d08bcb
AM		 2891<table width='100%'>
2892<tr>
2893 <td>&nbsp;</td>
2894 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2895 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2896 <td>&nbsp;</td>
2897</tr>
2898</table>
2899</form>
2900END
2901;
2902
2903
2904}else{
8c877a82 2905
49abe7af 2906 print<<END;
6e13d0a5
MT		 2907<table width='100%'>
2908<tr>
2909 <td>&nbsp;</td>
2910 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2911 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2912 <td>&nbsp;</td>
2913</tr>
2914</table>
2915</form>
2916END
2917;
52d08bcb 2918}
6e13d0a5 2919 &Header::closebox();
c6c9630e 2920# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT		 2921 &Header::closebigbox();
2922 &Header::closepage();
2923 exit(0);
2924
8c877a82
AM		 2925
2926# A.Marx CCD Add,delete or edit CCD net
2927
2928} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2929 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2930 $cgiparams{'ACTION'} eq "kill" ||
2931 $cgiparams{'ACTION'} eq "edit" ||
2932 $cgiparams{'ACTION'} eq 'editsave'){
2933 &Header::showhttpheaders();
2934 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2935 &Header::openbigbox('100%', 'LEFT', '', '');
2936
2937 if ($cgiparams{'ACTION'} eq "kill"){
2938 &delccdnet($cgiparams{'net'});
2939 }
2940
2941 if ($cgiparams{'ACTION'} eq 'editsave'){
2942 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2943 if ( $a ne $b){ &modccdnet($a,$b);}
5068ac38
AM		 2944 $cgiparams{'ccdname'}='';
2945 $cgiparams{'ccdsubnet'}='';
8c877a82
AM		 2946 }
2947
2948 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
e2429e8d 2949 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
8c877a82
AM		 2950 }
2951 if ($errormessage) {
2952 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2953 print "<class name='base'>$errormessage";
2954 print "&nbsp;</class>";
2955 &Header::closebox();
2956 }
2957if ($cgiparams{'ACTION'} eq "edit"){
2958
2959 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2960
49abe7af 2961 print <<END;
631b67b7 2962 <table width='100%' border='0'>
8c877a82
AM		 2963 <tr><form method='post'>
2964 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
a9fb14d0 2965 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly='readonly' /></td></tr>
8c877a82
AM		 2966 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2967 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2968 </td></tr>
2969 </table></form>
2970END
2971;
2972 &Header::closebox();
2973
2974 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
49abe7af 2975 print <<END;
8c877a82
AM		 2976 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2977 <tr>
2978 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2979END
2980;
2981}
2982else{
2983 if (! -e "/var/run/openvpn.pid"){
2984 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
49abe7af 2985 print <<END;
8c877a82
AM		 2986 <table width='100%' border='0'>
2987 <tr><form method='post'>
2988 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2989 <tr>
2990 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2991 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2992 <tr><td colspan=4><hr /></td></tr><tr>
2993 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2994 </table></form>
2995END
2996
2997 &Header::closebox();
2998}
2999 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
5068ac38
AM		 3000 if ( -e "/var/run/openvpn.pid"){
3001 print "<b>$Lang::tr{'attention'}:</b><br>";
3002 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
3003 }
3004
4c962356 3005 print <<END;
99bfa85c 3006 <table width='100%' cellpadding='0' cellspacing='1'>
8c877a82
AM		 3007 <tr>
3008 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
3009END
3010;
3011}
3012 my %ccdconfhash=();
3013 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
3014 my @ccdconf=();
3015 my $count=0;
df9b48b7 3016 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM		 3017 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
3018 $count++;
3019 my $ccdhosts = &hostsinnet($ccdconf[0]);
3020 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
3021 else{ print" <tr bgcolor='$color{'color20'}'>";}
3022 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
4c962356 3023 print <<END;
8c877a82 3024 <form method='post' />
1638682b 3025 <input type='image' src='/images/edit.gif' align='middle' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
8c877a82
AM		 3026 <input type='hidden' name='ACTION' value='edit'/>
3027 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
3028 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
3029 </form></td>
3030 <form method='post' />
3031 <td><input type='hidden' name='ACTION' value='kill'/>
3032 <input type='hidden' name='number' value='$count' />
3033 <input type='hidden' name='net' value='$ccdconf[0]' />
1638682b 3034 <input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /></form></td></tr>
8c877a82
AM		 3035END
3036;
3037 }
3038 print "</table></form>";
3039 &Header::closebox();
3040 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3041 &Header::closebigbox();
3042 &Header::closepage();
3043 exit(0);
3044
3045#END CCD
3046
6e13d0a5
MT		 3047###
3048### Openvpn Connections Statistics
3049###
3050} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
3051 &Header::showhttpheaders();
3052 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
3053 &Header::openbigbox('100%', 'LEFT', '', '');
3054 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
3055
3056#
3057# <td><b>$Lang::tr{'protocol'}</b></td>
3058# protocol temp removed
4c962356 3059 print <<END;
99bfa85c 3060 <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
6e13d0a5 3061 <tr>
99bfa85c
AM		 3062 <th><b>$Lang::tr{'common name'}</b></th>
3063 <th><b>$Lang::tr{'real address'}</b></th>
d8ef6a95 3064 <th><b>$Lang::tr{'country'}</b></th>
99bfa85c
AM		 3065 <th><b>$Lang::tr{'virtual address'}</b></th>
3066 <th><b>$Lang::tr{'loged in at'}</b></th>
3067 <th><b>$Lang::tr{'bytes sent'}</b></th>
3068 <th><b>$Lang::tr{'bytes received'}</b></th>
3069 <th><b>$Lang::tr{'last activity'}</b></th>
6e13d0a5
MT		 3070 </tr>
3071END
3072;
87fe47e9 3073 my $filename = "/var/run/ovpnserver.log";
6e13d0a5
MT		 3074 open(FILE, $filename) or die 'Unable to open config file.';
3075 my @current = <FILE>;
3076 close(FILE);
3077 my @users =();
3078 my $status;
3079 my $uid = 0;
3080 my $cn;
3081 my @match = ();
3082 my $proto = "udp";
3083 my $address;
3084 my %userlookup = ();
3085 foreach my $line (@current)
3086 {
3087 chomp($line);
3088 if ( $line =~ /^Updated,(.+)/){
3089 @match = split( /^Updated,(.+)/, $line);
3090 $status = $match[1];
3091 }
c6c9630e 3092#gian
6e13d0a5
MT		 3093 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3094 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3095 if ($match[1] ne "Common Name") {
3096 $cn = $match[1];
3097 $userlookup{$match[2]} = $uid;
3098 $users[$uid]{'CommonName'} = $match[1];
3099 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT		 3100 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
3101 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT		 3102 $users[$uid]{'Since'} = $match[5];
3103 $users[$uid]{'Proto'} = $proto;
d8ef6a95
PM		 3104
3105 # get country code for "RealAddress"...
07e42be9 3106 my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]);
e2e270e1 3107 my $flag_icon = &Location::Functions::get_flag_icon($ccode);
d8ef6a95 3108 $users[$uid]{'Country'} = "<a href='country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a>";
6e13d0a5
MT		 3109 $uid++;
3110 }
3111 }
3112 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
3113 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
3114 if ($match[1] ne "Virtual Address") {
3115 $address = $match[3];
3116 #find the uid in the lookup table
3117 $uid = $userlookup{$address};
3118 $users[$uid]{'VirtualAddress'} = $match[1];
3119 $users[$uid]{'LastRef'} = $match[4];
3120 }
3121 }
3122 }
3123 my $user2 = @users;
3124 if ($user2 >= 1){
99bfa85c 3125 for (my $idx = 1; $idx <= $user2; $idx++){
6e13d0a5 3126 if ($idx % 2) {
99bfa85c
AM		 3127 print "<tr>";
3128 $col="bgcolor='$color{'color22'}'";
3129 } else {
3130 print "<tr>";
3131 $col="bgcolor='$color{'color20'}'";
6e13d0a5 3132 }
99bfa85c
AM		 3133 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
3134 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
d8ef6a95
PM		 3135 print "<td align='center' $col>$users[$idx-1]{'Country'}</td>";
3136 print "<td align='center' $col>$users[$idx-1]{'VirtualAddress'}</td>";
99bfa85c
AM		 3137 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
3138 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
3139 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
3140 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
3141 }
3142 }
6e13d0a5
MT		 3143
3144 print "</table>";
49abe7af 3145 print <<END;
6e13d0a5
MT		 3146 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
3147 <tr><td></td></tr>
3148 <tr><td></td></tr>
3149 <tr><td></td></tr>
3150 <tr><td></td></tr>
3151 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
3152 </table>
3153END
3154;
3155 &Header::closebox();
3156 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3157 &Header::closebigbox();
3158 &Header::closepage();
3159 exit(0);
3160
3161###
3162### Download Certificate
3163###
3164} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
3165 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 3166
6e13d0a5 3167 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT		 3168 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
3169 print "Content-Type: application/octet-stream\r\n\r\n";
2feacd98
SS		 3170
3171 open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3172 my @tmp = <FILE>;
3173 close(FILE);
3174
3175 print "@tmp";
c6c9630e
MT		 3176 exit (0);
3177 }
3178
3179###
3180### Enable/Disable connection
3181###
ce9abb66 3182
c6c9630e
MT		 3183} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
3184
3185 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3186 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3187
3188 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 3189 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT		 3190 $confighash{$cgiparams{'KEY'}}[0] = 'on';
3191 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3192 #&writeserverconf();
3193# if ($vpnsettings{'ENABLED'} eq 'on' ||
3194# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3195# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3196# }
3197 } else {
3198 $confighash{$cgiparams{'KEY'}}[0] = 'off';
3199# if ($vpnsettings{'ENABLED'} eq 'on' ||
3200# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3201# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3202# }
3203 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3204 #&writeserverconf();
3205 }
3206 } else {
3207 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT		 3208 }
3209
3210###
3211### Restart connection
3212###
3213} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3214 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3215 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3216
3217 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT		 3218# if ($vpnsettings{'ENABLED'} eq 'on' ||
3219# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3220# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3221# }
6e13d0a5 3222 } else {
c6c9630e 3223 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT		 3224 }
3225
ce9abb66 3226###
7c1d9faf 3227# m.a.d net2net
ce9abb66
AH		 3228###
3229
3230} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3231 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3232 &Header::showhttpheaders();
4c962356 3233 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
ce9abb66
AH		 3234 &Header::openbigbox('100%', 'LEFT', '', '');
3235 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH		 3236
3237if ( -s "${General::swroot}/ovpn/settings") {
3238
49abe7af 3239 print <<END;
ce9abb66 3240 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3241 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
ce9abb66
AH		 3242 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3243 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3244 <tr><td><input type='radio' name='TYPE' value='net' /></td>
3245 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3246 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
3247 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3248 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
e3edceeb 3249 <tr><td>&nbsp;</td><td>Import Connection Name</td></tr>
040b8b0c 3250 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>$Lang::tr{'openvpn default'}: Client Packagename</td></tr>
54fd0535 3251 <tr><td colspan='3'><hr /></td></tr>
8c877a82 3252 <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
ce9abb66
AH		 3253 </form></table>
3254END
3255 ;
8c877a82 3256
ce9abb66 3257
b278daf3 3258} else {
49abe7af 3259 print <<END;
b278daf3 3260 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3261 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
b278daf3 3262 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
8c877a82 3263 <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
b278daf3
AH		 3264 </form></table>
3265END
3266 ;
3267
3268}
3269
ce9abb66 3270 &Header::closebox();
4c962356 3271 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
ce9abb66
AH		 3272 &Header::closebigbox();
3273 &Header::closepage();
3274 exit (0);
3275
3276###
7c1d9faf 3277# m.a.d net2net
ce9abb66
AH		 3278###
3279
3280} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3281
3282 my @firen2nconf;
3283 my @confdetails;
3284 my $uplconffilename ='';
54fd0535 3285 my $uplconffilename2 ='';
ce9abb66 3286 my $uplp12name = '';
54fd0535 3287 my $uplp12name2 = '';
ce9abb66
AH		 3288 my @rem_subnet;
3289 my @rem_subnet2;
3290 my @tmposupnet3;
3291 my $key;
54fd0535 3292 my @n2nname;
ce9abb66
AH		 3293
3294 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3295
2ad1b18b
MT		 3296 # Check if a file is uploaded
3297 unless (ref ($cgiparams{'FH'})) {
ce9abb66
AH		 3298 $errormessage = $Lang::tr{'there was no file upload'};
3299 goto N2N_ERROR;
3300 }
3301
3302# Move uploaded IPfire n2n package to temporary file
3303
3304 (my $fh, my $filename) = tempfile( );
3305 if (copy ($cgiparams{'FH'}, $fh) != 1) {
3306 $errormessage = $!;
3307 goto N2N_ERROR;
3308 }
3309
3310 my $zip = Archive::Zip->new();
3311 my $zipName = $filename;
3312 my $status = $zip->read( $zipName );
3313 if ($status != AZ_OK) {
3314 $errormessage = "Read of $zipName failed\n";
3315 goto N2N_ERROR;
3316 }
3317
3318 my $tempdir = tempdir( CLEANUP => 1 );
3319 my @files = $zip->memberNames();
3320 for(@files) {
3321 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3322 }
3323 my $countfiles = @files;
3324
3325# Check if we have not more then 2 files
3326
3327 if ( $countfiles == 2){
3328 foreach (@files){
3329 if ( $_ =~ /.conf$/){
3330 $uplconffilename = $_;
3331 }
3332 if ( $_ =~ /.p12$/){
3333 $uplp12name = $_;
3334 }
3335 }
3336 if (($uplconffilename eq '') || ($uplp12name eq '')){
3337 $errormessage = "Either no *.conf or no *.p12 file found\n";
3338 goto N2N_ERROR;
3339 }
3340
3341 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3342 @firen2nconf = <FILE>;
3343 close (FILE);
3344 chomp(@firen2nconf);
ce9abb66
AH		 3345 } else {
3346
3347 $errormessage = "Filecount does not match only 2 files are allowed\n";
3348 goto N2N_ERROR;
3349 }
3350
7c1d9faf
AH		 3351###
3352# m.a.d net2net
ce9abb66 3353###
54fd0535
MT		 3354
3355 if ($cgiparams{'n2nname'} ne ''){
3356
3357 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3358 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
3359 $n2nname[0] = $cgiparams{'n2nname'};
3360 my @n2nname2 = split(/\./,$uplconffilename);
3361 $n2nname2[0] =~ s/\n|\r//g;
3362 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3363 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3364 my $input2 = "$n2nname2[0]n2n";
3365 my $output2 = "$n2nname[0]n2n";
3366 my $filename = "$tempdir/$uplconffilename";
3367 open(FILE, "< $filename") or die 'Unable to open config file.';
3368 my @current = <FILE>;
3369 close(FILE);
3370 foreach (@current) {s/$input1/$output1/g;}
3371 foreach (@current) {s/$input2/$output2/g;}
3372 open (OUT, "> $filename") || die 'Unable to open config file.';
3373 print OUT @current;
3374 close OUT;
ce9abb66 3375
54fd0535
MT		 3376 }else{
3377 $uplconffilename2 = $uplconffilename;
3378 $uplp12name2 = $uplp12name;
3379 @n2nname = split(/\./,$uplconffilename);
ce9abb66 3380 $n2nname[0] =~ s/\n|\r//g;
54fd0535 3381 }
7c1d9faf
AH		 3382 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3383 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
ce9abb66 3384
7dfcaef0
AM		 3385 #Add collectd settings to configfile
3386 open(FILE, ">> $tempdir/$uplconffilename") or die 'Unable to open config file.';
3387 print FILE "# Logfile\n";
3388 print FILE "status-version 1\n";
3389 print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
3390 close FILE;
3391
54fd0535 3392 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
ce9abb66
AH		 3393
3394 if ($? ne 0) {
3395 $errormessage = "*.conf move failed: $!";
3396 unlink ($filename);
3397 goto N2N_ERROR;
3398 }
3399
54fd0535 3400 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
b278daf3
AH		 3401 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3402
ce9abb66
AH		 3403 if ($? ne 0) {
3404 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3405 unlink ($filename);
3406 goto N2N_ERROR;
3407 }
3408
3409my $complzoactive;
d96c89eb 3410my $mssfixactive;
4c962356 3411my $authactive;
d96c89eb 3412my $n2nfragment;
60f396d7 3413my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
54fd0535 3414my @n2nproto = split(/-/, $n2nproto2[1]);
ce9abb66
AH		 3415my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3416my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3417my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3418if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH		 3419my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
3420if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
54fd0535 3421#my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
d96c89eb 3422my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH		 3423my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3424my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3425my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
3426my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
54fd0535 3427my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
ce9abb66 3428my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
4c962356 3429my @n2ncipher = split(/ /, (grep { /^cipher/ } @firen2nconf)[0]);
f527e53f 3430my @n2nauth = split(/ /, (grep { /^auth/ } @firen2nconf)[0]);;
60f396d7 3431
ce9abb66
AH		 3432###
3433# m.a.d delete CR and LF from arrays for this chomp doesnt work
3434###
3435
ce9abb66 3436$n2nremote[1] =~ s/\n|\r//g;
ce9abb66
AH		 3437$n2novpnsub[0] =~ s/\n|\r//g;
3438$n2novpnsub[1] =~ s/\n|\r//g;
3439$n2novpnsub[2] =~ s/\n|\r//g;
60f396d7 3440$n2nproto[0] =~ s/\n|\r//g;
ce9abb66
AH		 3441$n2nport[1] =~ s/\n|\r//g;
3442$n2ntunmtu[1] =~ s/\n|\r//g;
3443$n2nremsub[1] =~ s/\n|\r//g;
b278daf3 3444$n2nremsub[2] =~ s/\n|\r//g;
ce9abb66 3445$n2nlocalsub[2] =~ s/\n|\r//g;
d96c89eb 3446$n2nfragment[1] =~ s/\n|\r//g;
54fd0535 3447$n2nmgmt[2] =~ s/\n|\r//g;
4c962356
EK		 3448$n2ncipher[1] =~ s/\n|\r//g;
3449$n2nauth[1] =~ s/\n|\r//g;
ce9abb66 3450chomp ($complzoactive);
d96c89eb 3451chomp ($mssfixactive);
ce9abb66
AH		 3452
3453###
7c1d9faf 3454# m.a.d net2net
ce9abb66
AH		 3455###
3456
3457###
3458# Check if there is no other entry with this name
3459###
3460
3461 foreach my $dkey (keys %confighash) {
3462 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3463 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH		 3464 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3465 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3466 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
ce9abb66
AH		 3467 goto N2N_ERROR;
3468 }
3469 }
3470
d96c89eb
AH		 3471###
3472# Check if OpenVPN Subnet is valid
3473###
3474
3475foreach my $dkey (keys %confighash) {
3476 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3477 $errormessage = 'The OpenVPN Subnet is already in use';
b278daf3
AH		 3478 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3479 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3480 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH		 3481 goto N2N_ERROR;
3482 }
3483 }
3484
3485###
4c962356 3486# Check if Dest Port is vaild
d96c89eb
AH		 3487###
3488
3489foreach my $dkey (keys %confighash) {
3490 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3491 $errormessage = 'The OpenVPN Port is already in use';
b278daf3
AH		 3492 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3493 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3494 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH		 3495 goto N2N_ERROR;
3496 }
3497 }
3498
3499
3500
ce9abb66
AH		 3501 $key = &General::findhasharraykey (\%confighash);
3502
49abe7af 3503 foreach my $i (0 .. 42) { $confighash{$key}[$i] = "";}
350f2980 3504
ce9abb66
AH		 3505 $confighash{$key}[0] = 'off';
3506 $confighash{$key}[1] = $n2nname[0];
350f2980 3507 $confighash{$key}[2] = $n2nname[0];
ce9abb66
AH		 3508 $confighash{$key}[3] = 'net';
3509 $confighash{$key}[4] = 'cert';
3510 $confighash{$key}[6] = 'client';
3511 $confighash{$key}[8] = $n2nlocalsub[2];
350f2980
SS		 3512 $confighash{$key}[10] = $n2nremote[1];
3513 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
54fd0535 3514 $confighash{$key}[22] = $n2nmgmt[2];
350f2980 3515 $confighash{$key}[23] = $mssfixactive;
d96c89eb 3516 $confighash{$key}[24] = $n2nfragment[1];
350f2980 3517 $confighash{$key}[25] = 'IPFire n2n Client';
ce9abb66 3518 $confighash{$key}[26] = 'red';
350f2980
SS		 3519 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3520 $confighash{$key}[28] = $n2nproto[0];
3521 $confighash{$key}[29] = $n2nport[1];
3522 $confighash{$key}[30] = $complzoactive;
3523 $confighash{$key}[31] = $n2ntunmtu[1];
4c962356
EK		 3524 $confighash{$key}[39] = $n2nauth[1];
3525 $confighash{$key}[40] = $n2ncipher[1];
49abe7af 3526 $confighash{$key}[41] = 'disabled';
ce9abb66
AH		 3527
3528 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
d96c89eb 3529
ce9abb66
AH		 3530 N2N_ERROR:
3531
3532 &Header::showhttpheaders();
3533 &Header::openpage('Validate imported configuration', 1, '');
3534 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3535 if ($errormessage) {
3536 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3537 print "<class name='base'>$errormessage";
3538 print "&nbsp;</class>";
3539 &Header::closebox();
3540
3541 } else
3542 {
3543 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3544 }
3545 if ($errormessage eq ''){
49abe7af 3546 print <<END;
ce9abb66
AH		 3547 <!-- ipfire net2net config gui -->
3548 <table width='100%'>
3549 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3550 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3551 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3552 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3553 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3554 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
4c962356 3555 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}:</td><td><b>$confighash{$key}[11]</b></td></tr>
ce9abb66
AH		 3556 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3557 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3558 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3559 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
4c962356
EK		 3560 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td><b>$confighash{$key}[23]</b></td></tr>
3561 <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td><b>$confighash{$key}[24]</b></td></tr>
ce9abb66 3562 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
54fd0535 3563 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
0c4ffc69 3564 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn tls auth'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
4c962356 3565 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td><b>$confighash{$key}[40]</b></td></tr>
ce9abb66
AH		 3566 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3567 </table>
3568END
3569;
3570 &Header::closebox();
3571 }
3572
3573 if ($errormessage) {
3574 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3575 } else {
3576 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3577 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3578 print "<input type='hidden' name='KEY' value='$key' />";
3579 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3580 }
3581 &Header::closebigbox();
3582 &Header::closepage();
4c962356 3583 exit(0);
ce9abb66
AH		 3584
3585
3586##
3587### Accept IPFire n2n Package Settings
3588###
3589
3590 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3591
3592###
3593### Discard and Rollback IPFire n2n Package Settings
3594###
3595
3596 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3597
3598 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3599
3600if ($confighash{$cgiparams{'KEY'}}) {
3601
3602 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3603 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3604 unlink ($certfile) or die "Removing $certfile fail: $!";
3605 unlink ($conffile) or die "Removing $conffile fail: $!";
3606 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3607 delete $confighash{$cgiparams{'KEY'}};
3608 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3609
3610 } else {
3611 $errormessage = $Lang::tr{'invalid key'};
3612 }
3613
3614
3615###
7c1d9faf 3616# m.a.d net2net
ce9abb66
AH		 3617###
3618
3619
3620###
3621### Adding a new connection
3622###
6e13d0a5
MT		 3623} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3624 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3625 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
8c877a82 3626
6e13d0a5
MT		 3627 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3628 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3629 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3630
3631 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
8c877a82
AM		 3632 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3633 $errormessage = $Lang::tr{'invalid key'};
3634 goto VPNCONF_END;
3635 }
4c962356
EK		 3636 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
3637 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
3638 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
3639 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
3640 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
3641 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
3642 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
3643 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
8c877a82 3644 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
4c962356
EK		 3645 $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
3646 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
3647 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
3648 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
3649 $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
3650 $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
3651 $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28];
3652 $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29];
3653 $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30];
3654 $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31];
3655 $cgiparams{'CHECK1'} = $confighash{$cgiparams{'KEY'}}[32];
df9b48b7 3656 $name=$cgiparams{'CHECK1'} ;
4c962356
EK		 3657 $cgiparams{$name} = $confighash{$cgiparams{'KEY'}}[33];
3658 $cgiparams{'RG'} = $confighash{$cgiparams{'KEY'}}[34];
3659 $cgiparams{'CCD_DNS1'} = $confighash{$cgiparams{'KEY'}}[35];
3660 $cgiparams{'CCD_DNS2'} = $confighash{$cgiparams{'KEY'}}[36];
3661 $cgiparams{'CCD_WINS'} = $confighash{$cgiparams{'KEY'}}[37];
4c962356
EK		 3662 $cgiparams{'DAUTH'} = $confighash{$cgiparams{'KEY'}}[39];
3663 $cgiparams{'DCIPHER'} = $confighash{$cgiparams{'KEY'}}[40];
49abe7af 3664 $cgiparams{'TLSAUTH'} = $confighash{$cgiparams{'KEY'}}[41];
8c877a82 3665 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
c6c9630e 3666 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
18837a6a 3667
8c877a82 3668#A.Marx CCD check iroute field and convert it to decimal
52d08bcb 3669if ($cgiparams{'TYPE'} eq 'host') {
8c877a82
AM		 3670 my @temp=();
3671 my %ccdroutehash=();
3672 my $keypoint=0;
5068ac38
AM		 3673 my $ip;
3674 my $cidr;
8c877a82
AM		 3675 if ($cgiparams{'IR'} ne ''){
3676 @temp = split("\n",$cgiparams{'IR'});
3677 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3678 #find key to use
3679 foreach my $key (keys %ccdroutehash) {
3680 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3681 $keypoint=$key;
3682 delete $ccdroutehash{$key};
3683 }else{
3684 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3685 }
3686 }
3687 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3688 my $i=1;
3689 my $val=0;
3690 foreach $val (@temp){
3691 chomp($val);
3692 $val=~s/\s*$//g;
5068ac38 3693 #check if iroute exists in ccdroute or if new iroute is part of an existing one
8c877a82
AM		 3694 foreach my $key (keys %ccdroutehash) {
3695 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
5068ac38
AM		 3696 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3697 $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3698 goto VPNCONF_ERROR;
3699 }
3700 my ($ip1,$cidr1) = split (/\//, $val);
82c809c7 3701 $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1));
5068ac38
AM		 3702 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3703 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3704 $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3705 goto VPNCONF_ERROR;
3706 }
3707
8c877a82
AM		 3708 }
3709 }
5068ac38
AM		 3710 if (!&General::validipandmask($val)){
3711 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3712 goto VPNCONF_ERROR;
3713 }else{
3714 ($ip,$cidr) = split(/\//,$val);
3715 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3716 $cidr=&General::iporsubtodec($cidr);
3717 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3718
3719 }
8c877a82
AM		 3720
3721 #check for existing network IP's
52d08bcb
AM		 3722 if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3723 {
3724 $errormessage=$Lang::tr{'ccd err green'};
3725 goto VPNCONF_ERROR;
3726 }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3727 {
3728 $errormessage=$Lang::tr{'ccd err red'};
3729 goto VPNCONF_ERROR;
3730 }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3731 {
3732 $errormessage=$Lang::tr{'ccd err blue'};
3733 goto VPNCONF_ERROR;
3734 }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3735 {
3736 $errormessage=$Lang::tr{'ccd err orange'};
8c877a82
AM		 3737 goto VPNCONF_ERROR;
3738 }
52d08bcb 3739
8c877a82
AM		 3740 if (&General::validipandmask($val)){
3741 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3742 }else{
3743 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3744 goto VPNCONF_ERROR;
3745 }
3746 $i++;
3747 }
3748 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3749 &writeserverconf;
3750 }else{
3751 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3752 foreach my $key (keys %ccdroutehash) {
3753 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3754 delete $ccdroutehash{$key};
3755 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3756 &writeserverconf;
3757 }
3758 }
3759 }
3760 undef @temp;
3761 #check route field and convert it to decimal
8c877a82
AM		 3762 my $val=0;
3763 my $i=1;
8c877a82 3764 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
52d08bcb
AM		 3765 #find key to use
3766 foreach my $key (keys %ccdroute2hash) {
3767 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3768 $keypoint=$key;
3769 delete $ccdroute2hash{$key};
3770 }else{
3771 $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3772 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3773 &writeserverconf;
8c877a82 3774 }
52d08bcb
AM		 3775 }
3776 $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3777 if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3778 @temp = split(/\|/,$cgiparams{'IFROUTE'});
3779 my %ownnet=();
3780 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3781 foreach $val (@temp){
3782 chomp($val);
3783 $val=~s/\s*$//g;
3784 if ($val eq $Lang::tr{'green'})
3785 {
3786 $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3787 }
3788 if ($val eq $Lang::tr{'blue'})
3789 {
3790 $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3791 }
3792 if ($val eq $Lang::tr{'orange'})
3793 {
3794 $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3795 }
3796 my ($ip,$cidr) = split (/\//, $val);
3797
3798 if ($val ne $Lang::tr{'ccd none'})
3799 {
8c877a82
AM		 3800 if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3801 if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3802 if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3803 if (&General::validipandmask($val)){
3804 $val=$ip."/".&General::iporsubtodec($cidr);
3805 $ccdroute2hash{$keypoint}[$i] = $val;
3806 }else{
3807 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3808 goto VPNCONF_ERROR;
3809 }
52d08bcb
AM		 3810 }else{
3811 $ccdroute2hash{$keypoint}[$i]='';
3812 }
3813 $i++;
3814 }
3815 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3816
8c877a82
AM		 3817 #check dns1 ip
3818 if ($cgiparams{'CCD_DNS1'} ne '' && ! &General::validip($cgiparams{'CCD_DNS1'})) {
3819 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3820 goto VPNCONF_ERROR;
3821 }
3822 #check dns2 ip
3823 if ($cgiparams{'CCD_DNS2'} ne '' && ! &General::validip($cgiparams{'CCD_DNS2'})) {
3824 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3825 goto VPNCONF_ERROR;
3826 }
3827 #check wins ip
3828 if ($cgiparams{'CCD_WINS'} ne '' && ! &General::validip($cgiparams{'CCD_WINS'})) {
3829 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3830 goto VPNCONF_ERROR;
3831 }
52d08bcb 3832}
8c877a82
AM		 3833
3834#CCD End
52d08bcb 3835
8c877a82 3836
73735ad9
EK		 3837 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3838 $errormessage = $Lang::tr{'connection type is invalid'};
3839 if ($cgiparams{'TYPE'} eq 'net') {
3840 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3841 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3842 goto VPNCONF_ERROR;
3843 }
3844 goto VPNCONF_ERROR;
c6c9630e
MT		 3845 }
3846
c6c9630e 3847 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
73735ad9
EK		 3848 $errormessage = $Lang::tr{'name must only contain characters'};
3849 if ($cgiparams{'TYPE'} eq 'net') {
3850 goto VPNCONF_ERROR;
3851 }
3852 goto VPNCONF_ERROR;
3853 }
c6c9630e
MT		 3854
3855 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
73735ad9
EK		 3856 $errormessage = $Lang::tr{'name is invalid'};
3857 if ($cgiparams{'TYPE'} eq 'net') {
3858 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3859 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3860 goto VPNCONF_ERROR;
3861 }
3862 goto VPNCONF_ERROR;
c6c9630e
MT		 3863 }
3864
3865 if (length($cgiparams{'NAME'}) >60) {
73735ad9
EK		 3866 $errormessage = $Lang::tr{'name too long'};
3867 if ($cgiparams{'TYPE'} eq 'net') {
3868 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3869 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3870 goto VPNCONF_ERROR;
3871 }
3872 goto VPNCONF_ERROR;
c6c9630e
MT		 3873 }
3874
d96c89eb 3875###
7c1d9faf 3876# m.a.d net2net
d96c89eb
AH		 3877###
3878
7c1d9faf 3879if ($cgiparams{'TYPE'} eq 'net') {
ab4cf06c 3880 if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) {
cd0c0a0d 3881 $errormessage = $Lang::tr{'openvpn destination port used'};
b278daf3
AH		 3882 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3883 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3884 goto VPNCONF_ERROR;
d96c89eb 3885 }
ab4cf06c
AM		 3886 #Bugfix 10357
3887 foreach my $key (sort keys %confighash){
3888 if ( ($confighash{$key}[22] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1]) || ($confighash{$key}[29] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1])){
54fd0535
MT		 3889 $errormessage = $Lang::tr{'openvpn destination port used'};
3890 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3891 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
ab4cf06c
AM		 3892 goto VPNCONF_ERROR;
3893 }
3894 }
3895 if ($cgiparams{'DEST_PORT'} eq '') {
3896 $errormessage = $Lang::tr{'invalid port'};
3897 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3898 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
54fd0535
MT		 3899 goto VPNCONF_ERROR;
3900 }
d96c89eb 3901
f48074ba
SS		 3902 # Check if the input for the transfer net is valid.
3903 if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
3904 $errormessage = $Lang::tr{'ccd err invalidnet'};
3905 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3906 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3907 goto VPNCONF_ERROR;
3908 }
3909
d96c89eb 3910 if ($cgiparams{'OVPN_SUBNET'} eq $vpnsettings{'DOVPN_SUBNET'}) {
cd0c0a0d 3911 $errormessage = $Lang::tr{'openvpn subnet is used'};
b278daf3
AH		 3912 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3913 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH		 3914 goto VPNCONF_ERROR;
3915 }
3916
3917 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
cd0c0a0d 3918 $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
b278daf3
AH		 3919 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3920 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH		 3921 goto VPNCONF_ERROR;
3922 }
3923
3924 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
cd0c0a0d 3925 $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
b278daf3
AH		 3926 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3927 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH		 3928 goto VPNCONF_ERROR;
3929 }
d96c89eb 3930
7c1d9faf 3931 if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) {
cd0c0a0d 3932 $errormessage = $Lang::tr{'openvpn prefix local subnet'};
b278daf3
AH		 3933 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3934 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3935 goto VPNCONF_ERROR;
7c1d9faf
AH		 3936 }
3937
3938 if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) {
cd0c0a0d 3939 $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
b278daf3
AH		 3940 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3941 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3942 goto VPNCONF_ERROR;
7c1d9faf
AH		 3943 }
3944
3945 if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) {
cd0c0a0d 3946 $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
b278daf3
AH		 3947 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3948 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3949 goto VPNCONF_ERROR;
8c252e6a
EK		 3950 }
3951
3952 if ($cgiparams{'DEST_PORT'} <= 1023) {
3953 $errormessage = $Lang::tr{'ovpn port in root range'};
3954 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3955 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3956 goto VPNCONF_ERROR;
3957 }
54fd0535 3958
4c962356 3959 if ($cgiparams{'OVPN_MGMT'} eq '') {
8c252e6a
EK		 3960 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
3961 }
3962
3963 if ($cgiparams{'OVPN_MGMT'} <= 1023) {
3964 $errormessage = $Lang::tr{'ovpn mgmt in root range'};
3965 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3966 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3967 goto VPNCONF_ERROR;
b2e75449
MT		 3968 }
3969 #Check if remote subnet is used elsewhere
3970 my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'});
3971 $warnmessage=&General::checksubnets('',$n2nip,'ovpn');
3972 if ($warnmessage){
3973 $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
3974 }
7c1d9faf 3975}
d96c89eb 3976
ce9abb66
AH		 3977# if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
3978# $errormessage = $Lang::tr{'ipfire side is invalid'};
3979# goto VPNCONF_ERROR;
3980# }
3981
c6c9630e
MT		 3982 # Check if there is no other entry with this name
3983 if (! $cgiparams{'KEY'}) {
3984 foreach my $key (keys %confighash) {
3985 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
3986 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH		 3987 if ($cgiparams{'TYPE'} eq 'net') {
3988 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3989 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3990 }
c6c9630e 3991 goto VPNCONF_ERROR;
6e13d0a5 3992 }
c6c9630e
MT		 3993 }
3994 }
3995
c125d8a2 3996 # Check if a remote host/IP has been set for the client.
86228a56
MT		 3997 if ($cgiparams{'TYPE'} eq 'net') {
3998 if ($cgiparams{'SIDE'} ne 'server' && $cgiparams{'REMOTE'} eq '') {
3999 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
c125d8a2 4000
86228a56
MT		 4001 # Check if this is a N2N connection and drop temporary config.
4002 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4003 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
ce9abb66 4004
86228a56
MT		 4005 goto VPNCONF_ERROR;
4006 }
c125d8a2 4007
86228a56
MT		 4008 # Check if a remote host/IP has been configured - the field can be empty on the server side.
4009 if ($cgiparams{'REMOTE'} ne '') {
4010 # Check if the given IP is valid - otherwise check if it is a valid domain.
4011 if (! &General::validip($cgiparams{'REMOTE'})) {
4012 # Check for a valid domain.
4013 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
4014 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
c125d8a2 4015
86228a56
MT		 4016 # Check if this is a N2N connection and drop temporary config.
4017 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4018 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
c125d8a2 4019
86228a56
MT		 4020 goto VPNCONF_ERROR;
4021 }
4022 }
6e13d0a5 4023 }
c6c9630e 4024 }
c125d8a2 4025
c6c9630e
MT		 4026 if ($cgiparams{'TYPE'} ne 'host') {
4027 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
4028 $errormessage = $Lang::tr{'local subnet is invalid'};
b278daf3
AH		 4029 if ($cgiparams{'TYPE'} eq 'net') {
4030 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4031 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4032 }
c6c9630e
MT		 4033 goto VPNCONF_ERROR;}
4034 }
4035 # Check if there is no other entry without IP-address and PSK
4036 if ($cgiparams{'REMOTE'} eq '') {
4037 foreach my $key (keys %confighash) {
4038 if(($cgiparams{'KEY'} ne $key) &&
4039 ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
4040 $confighash{$key}[10] eq '') {
4041 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
4042 goto VPNCONF_ERROR;
6e13d0a5 4043 }
c6c9630e
MT		 4044 }
4045 }
ce9abb66
AH		 4046 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
4047 $errormessage = $Lang::tr{'remote subnet is invalid'};
b278daf3
AH		 4048 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4049 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4050 goto VPNCONF_ERROR;
ce9abb66 4051 }
c6c9630e 4052
425465ed
EK		 4053 # Check for N2N that OpenSSL maximum of valid days will not be exceeded
4054 if ($cgiparams{'TYPE'} eq 'net') {
4055 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4056 $errormessage = $Lang::tr{'invalid input for valid till days'};
4057 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4058 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4059 goto VPNCONF_ERROR;
4060 }
4061 }
4062
c6c9630e
MT		 4063 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
4064 $errormessage = $Lang::tr{'invalid input'};
4065 goto VPNCONF_ERROR;
4066 }
4067 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
4068 $errormessage = $Lang::tr{'invalid input'};
4069 goto VPNCONF_ERROR;
4070 }
4071
4072#fixplausi
4073 if ($cgiparams{'AUTH'} eq 'psk') {
4074# if (! length($cgiparams{'PSK'}) ) {
4075# $errormessage = $Lang::tr{'pre-shared key is too short'};
4076# goto VPNCONF_ERROR;
4077# }
4078# if ($cgiparams{'PSK'} =~ /['",&]/) {
4079# $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
4080# goto VPNCONF_ERROR;
4081# }
4082 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
4083 if ($cgiparams{'KEY'}) {
4084 $errormessage = $Lang::tr{'cant change certificates'};
4085 goto VPNCONF_ERROR;
4086 }
2ad1b18b 4087 unless (ref ($cgiparams{'FH'})) {
c6c9630e
MT		 4088 $errormessage = $Lang::tr{'there was no file upload'};
4089 goto VPNCONF_ERROR;
4090 }
4091
4092 # Move uploaded certificate request to a temporary file
4093 (my $fh, my $filename) = tempfile( );
4094 if (copy ($cgiparams{'FH'}, $fh) != 1) {
4095 $errormessage = $!;
4096 goto VPNCONF_ERROR;
4097 }
6e13d0a5 4098
c6c9630e
MT		 4099 # Sign the certificate request and move it
4100 # Sign the host certificate request
2feacd98 4101 # The system call is safe, because all arguments are passed as an array.
f6e12093 4102 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
c6c9630e
MT		 4103 '-batch', '-notext',
4104 '-in', $filename,
4105 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4106 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4107 if ($?) {
4108 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4109 unlink ($filename);
4110 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4111 &newcleanssldatabase();
4112 goto VPNCONF_ERROR;
4113 } else {
4114 unlink ($filename);
4115 &deletebackupcert();
4116 }
4117
2feacd98
SS		 4118 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4119 my $temp;
4120
4121 foreach my $line (@temp) {
4122 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4123 $temp = $1;
4124 $temp =~ s+/Email+, E+;
4125 $temp =~ s/ ST=/ S=/;
4126
4127 last;
4128 }
4129 }
4130
c6c9630e
MT		 4131 $cgiparams{'CERT_NAME'} = $temp;
4132 $cgiparams{'CERT_NAME'} =~ s/,//g;
4133 $cgiparams{'CERT_NAME'} =~ s/\'//g;
4134 if ($cgiparams{'CERT_NAME'} eq '') {
4135 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4136 goto VPNCONF_ERROR;
4137 }
4138 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
4139 if ($cgiparams{'KEY'}) {
4140 $errormessage = $Lang::tr{'cant change certificates'};
4141 goto VPNCONF_ERROR;
4142 }
2ad1b18b 4143 unless (ref ($cgiparams{'FH'})) {
c6c9630e
MT		 4144 $errormessage = $Lang::tr{'there was no file upload'};
4145 goto VPNCONF_ERROR;
4146 }
4147 # Move uploaded certificate to a temporary file
4148 (my $fh, my $filename) = tempfile( );
4149 if (copy ($cgiparams{'FH'}, $fh) != 1) {
4150 $errormessage = $!;
4151 goto VPNCONF_ERROR;
4152 }
4153
4154 # Verify the certificate has a valid CA and move it
4155 my $validca = 0;
2feacd98
SS		 4156 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/cacert.pem", "$filename");
4157 if (grep(/: OK/, @test)) {
c6c9630e
MT		 4158 $validca = 1;
4159 } else {
4160 foreach my $key (keys %cahash) {
2feacd98
SS		 4161 @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem", "$filename");
4162 if (grep(/: OK/, @test)) {
c6c9630e
MT		 4163 $validca = 1;
4164 }
6e13d0a5 4165 }
c6c9630e
MT		 4166 }
4167 if (! $validca) {
4168 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
4169 unlink ($filename);
4170 goto VPNCONF_ERROR;
4171 } else {
4172 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4173 if ($? ne 0) {
4174 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
4175 unlink ($filename);
4176 goto VPNCONF_ERROR;
6e13d0a5 4177 }
c6c9630e
MT		 4178 }
4179
2feacd98
SS		 4180 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4181 my $temp;
4182
4183 foreach my $line (@temp) {
4184 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4185 $temp = $1;
4186 $temp =~ s+/Email+, E+;
4187 $temp =~ s/ ST=/ S=/;
4188
4189 last;
4190 }
4191 }
4192
c6c9630e
MT		 4193 $cgiparams{'CERT_NAME'} = $temp;
4194 $cgiparams{'CERT_NAME'} =~ s/,//g;
4195 $cgiparams{'CERT_NAME'} =~ s/\'//g;
4196 if ($cgiparams{'CERT_NAME'} eq '') {
4197 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4198 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4199 goto VPNCONF_ERROR;
4200 }
4201 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
4202 if ($cgiparams{'KEY'}) {
4203 $errormessage = $Lang::tr{'cant change certificates'};
4204 goto VPNCONF_ERROR;
4205 }
4206 # Validate input since the form was submitted
4207 if (length($cgiparams{'CERT_NAME'}) >60) {
4208 $errormessage = $Lang::tr{'name too long'};
4209 goto VPNCONF_ERROR;
4210 }
194314b2 4211 if ($cgiparams{'CERT_NAME'} eq '' || $cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
c6c9630e
MT		 4212 $errormessage = $Lang::tr{'invalid input for name'};
4213 goto VPNCONF_ERROR;
4214 }
4215 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
4216 $errormessage = $Lang::tr{'invalid input for e-mail address'};
4217 goto VPNCONF_ERROR;
4218 }
4219 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
4220 $errormessage = $Lang::tr{'e-mail address too long'};
4221 goto VPNCONF_ERROR;
4222 }
4223 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4224 $errormessage = $Lang::tr{'invalid input for department'};
4225 goto VPNCONF_ERROR;
4226 }
4227 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
4228 $errormessage = $Lang::tr{'organization too long'};
4229 goto VPNCONF_ERROR;
4230 }
4231 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4232 $errormessage = $Lang::tr{'invalid input for organization'};
4233 goto VPNCONF_ERROR;
4234 }
4235 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4236 $errormessage = $Lang::tr{'invalid input for city'};
4237 goto VPNCONF_ERROR;
4238 }
4239 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4240 $errormessage = $Lang::tr{'invalid input for state or province'};
4241 goto VPNCONF_ERROR;
4242 }
4243 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
4244 $errormessage = $Lang::tr{'invalid input for country'};
4245 goto VPNCONF_ERROR;
4246 }
4247 if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
4248 if (length($cgiparams{'CERT_PASS1'}) < 5) {
4249 $errormessage = $Lang::tr{'password too short'};
4250 goto VPNCONF_ERROR;
6e13d0a5 4251 }
c6c9630e
MT		 4252 }
4253 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
4254 $errormessage = $Lang::tr{'passwords do not match'};
4255 goto VPNCONF_ERROR;
4256 }
425465ed 4257 if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
f4fbb935
EK		 4258 $errormessage = $Lang::tr{'invalid input for valid till days'};
4259 goto VPNCONF_ERROR;
4260 }
c6c9630e 4261
425465ed
EK		 4262 # Check for RW that OpenSSL maximum of valid days will not be exceeded
4263 if ($cgiparams{'TYPE'} eq 'host') {
4264 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4265 $errormessage = $Lang::tr{'invalid input for valid till days'};
4266 goto VPNCONF_ERROR;
4267 }
4268 }
4269
beac479f
EK		 4270 # Check for RW if client name is already set
4271 if ($cgiparams{'TYPE'} eq 'host') {
4272 foreach my $key (keys %confighash) {
4273 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4274 $errormessage = $Lang::tr{'a connection with this name already exists'};
4275 goto VPNCONF_ERROR;
4276 }
4277 }
4278 }
4279
c6c9630e
MT		 4280 # Replace empty strings with a .
4281 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
4282 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
4283 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
4284
4285 # Create the Host certificate request client
4286 my $pid = open(OPENSSL, "|-");
4287 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
4288 if ($pid) { # parent
4289 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
4290 print OPENSSL "$state\n";
4291 print OPENSSL "$city\n";
4292 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
4293 print OPENSSL "$ou\n";
4294 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
4295 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
4296 print OPENSSL ".\n";
4297 print OPENSSL ".\n";
4298 close (OPENSSL);
4299 if ($?) {
4300 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4301 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
4302 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
4303 goto VPNCONF_ERROR;
6e13d0a5 4304 }
c6c9630e 4305 } else { # child
badd8c1c 4306 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4c962356 4307 '-newkey', 'rsa:2048',
c6c9630e
MT		 4308 '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4309 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4310 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
4311 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
4312 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4313 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4314 goto VPNCONF_ERROR;
6e13d0a5 4315 }
c6c9630e
MT		 4316 }
4317
4318 # Sign the host certificate request
2feacd98 4319 # The system call is safe, because all arguments are passed as an array.
f6e12093 4320 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
c6c9630e
MT		 4321 '-batch', '-notext',
4322 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4323 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4324 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4325 if ($?) {
4326 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4327 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4328 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4329 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4330 &newcleanssldatabase();
4331 goto VPNCONF_ERROR;
4332 } else {
4333 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4334 &deletebackupcert();
4335 }
4336
4337 # Create the pkcs12 file
2feacd98 4338 # The system call is safe, because all arguments are passed as an array.
c6c9630e
MT		 4339 system('/usr/bin/openssl', 'pkcs12', '-export',
4340 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4341 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4342 '-name', $cgiparams{'NAME'},
4343 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
4344 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
4345 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
4346 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4347 if ($?) {
4348 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4349 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4350 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4351 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4352 goto VPNCONF_ERROR;
4353 } else {
4354 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4355 }
4356 } elsif ($cgiparams{'AUTH'} eq 'cert') {
4357 ;# Nothing, just editing
4358 } else {
4359 $errormessage = $Lang::tr{'invalid input for authentication method'};
4360 goto VPNCONF_ERROR;
4361 }
4362
4363 # Check if there is no other entry with this common name
4364 if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
4365 foreach my $key (keys %confighash) {
4366 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
4367 $errormessage = $Lang::tr{'a connection with this common name already exists'};
4368 goto VPNCONF_ERROR;
6e13d0a5 4369 }
c6c9630e
MT		 4370 }
4371 }
4372
ab4cf06c 4373 # Save the config
c6c9630e 4374 my $key = $cgiparams{'KEY'};
8c877a82 4375
c6c9630e
MT		 4376 if (! $key) {
4377 $key = &General::findhasharraykey (\%confighash);
49abe7af 4378 foreach my $i (0 .. 43) { $confighash{$key}[$i] = "";}
c6c9630e 4379 }
8c877a82
AM		 4380 $confighash{$key}[0] = $cgiparams{'ENABLED'};
4381 $confighash{$key}[1] = $cgiparams{'NAME'};
c6c9630e 4382 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
8c877a82 4383 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
c6c9630e 4384 }
8c877a82
AM		 4385
4386 $confighash{$key}[3] = $cgiparams{'TYPE'};
c6c9630e 4387 if ($cgiparams{'AUTH'} eq 'psk') {
8c877a82
AM		 4388 $confighash{$key}[4] = 'psk';
4389 $confighash{$key}[5] = $cgiparams{'PSK'};
c6c9630e 4390 } else {
8c877a82 4391 $confighash{$key}[4] = 'cert';
c6c9630e 4392 }
ce9abb66 4393 if ($cgiparams{'TYPE'} eq 'net') {
8c877a82
AM		 4394 $confighash{$key}[6] = $cgiparams{'SIDE'};
4395 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
ce9abb66 4396 }
4c962356 4397 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
8c877a82 4398 $confighash{$key}[10] = $cgiparams{'REMOTE'};
4c962356 4399 if ($cgiparams{'OVPN_MGMT'} eq '') {
8c877a82 4400 $confighash{$key}[22] = $confighash{$key}[29];
4c962356 4401 } else {
8c877a82 4402 $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
4c962356 4403 }
8c877a82
AM		 4404 $confighash{$key}[23] = $cgiparams{'MSSFIX'};
4405 $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
4406 $confighash{$key}[25] = $cgiparams{'REMARK'};
4407 $confighash{$key}[26] = $cgiparams{'INTERFACE'};
c6c9630e 4408# new fields
8c877a82
AM		 4409 $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
4410 $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
4411 $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
4412 $confighash{$key}[30] = $cgiparams{'COMPLZO'};
4413 $confighash{$key}[31] = $cgiparams{'MTU'};
4414 $confighash{$key}[32] = $cgiparams{'CHECK1'};
df9b48b7 4415 $name=$cgiparams{'CHECK1'};
8c877a82
AM		 4416 $confighash{$key}[33] = $cgiparams{$name};
4417 $confighash{$key}[34] = $cgiparams{'RG'};
4418 $confighash{$key}[35] = $cgiparams{'CCD_DNS1'};
4419 $confighash{$key}[36] = $cgiparams{'CCD_DNS2'};
4420 $confighash{$key}[37] = $cgiparams{'CCD_WINS'};
4c962356
EK		 4421 $confighash{$key}[39] = $cgiparams{'DAUTH'};
4422 $confighash{$key}[40] = $cgiparams{'DCIPHER'};
350f2980 4423
71af643c
MT		 4424 if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) {
4425 $confighash{$key}[41] = "no-pass";
4426 }
4427
c6c9630e 4428 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
8c877a82
AM		 4429
4430 if ($cgiparams{'CHECK1'} ){
4431
4432 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
4433 my ($a,$b,$c,$d) = split (/\./,$ccdip);
df9b48b7
AM		 4434 if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
4435 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
4436 }
8c877a82 4437 open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
82c809c7 4438 print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n";
8c877a82
AM		 4439 if($cgiparams{'CHECK1'} eq 'dynamic'){
4440 print CCDRWCONF "#This client uses the dynamic pool\n";
4441 }else{
82c809c7 4442 print CCDRWCONF "#Ip address client and server\n";
8c877a82
AM		 4443 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
4444 }
4445 if ($confighash{$key}[34] eq 'on'){
4446 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
4447 print CCDRWCONF "push redirect-gateway\n";
4448 }
52d08bcb 4449 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
8c877a82 4450 if ($cgiparams{'IR'} ne ''){
82c809c7 4451 print CCDRWCONF "\n#Client routes these networks (behind Client)\n";
8c877a82
AM		 4452 foreach my $key (keys %ccdroutehash){
4453 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
4454 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
4455 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
4456 print CCDRWCONF "iroute $a $b\n";
4457 }
4458 }
4459 }
4460 }
52d08bcb 4461 if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
8c877a82 4462 if ($cgiparams{'IFROUTE'} ne ''){
82c809c7 4463 print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n";
8c877a82
AM		 4464 foreach my $key (keys %ccdroute2hash){
4465 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4466 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
4467 if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
4468 my %blue=();
4469 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
52d08bcb 4470 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
8c877a82
AM		 4471 }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
4472 my %orange=();
4473 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
4474 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS} $orange{ORANGE_NETMASK}\n";
4475 }else{
4476 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
4477 print CCDRWCONF "push \"route $a $b\"\n";
4478 }
4479 }
4480 }
4481 }
4482 }
4483 if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
4484 if($cgiparams{'CCD_DNS1'} ne ''){
82c809c7 4485 print CCDRWCONF "\n#Client gets these nameservers\n";
8c877a82
AM		 4486 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4487 }
4488 if($cgiparams{'CCD_DNS2'} ne ''){
4489 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4490 }
4491 if($cgiparams{'CCD_WINS'} ne ''){
4492 print CCDRWCONF "\n#Client gets this WINS server\n";
4493 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4494 }
4495 close CCDRWCONF;
4496 }
18837a6a
AH		 4497
4498###
4499# m.a.d n2n begin
4500###
4501
4502 if ($cgiparams{'TYPE'} eq 'net') {
4503
2feacd98
SS		 4504 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4505 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
18837a6a 4506
2feacd98
SS		 4507 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4508 my $key = $cgiparams{'KEY'};
4509 if (! $key) {
4510 $key = &General::findhasharraykey (\%confighash);
4511 foreach my $i (0 .. 31) {
4512 $confighash{$key}[$i] = "";
4513 }
4514 }
4515
4516 $confighash{$key}[0] = 'on';
4517 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
18837a6a 4518
2feacd98
SS		 4519 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4520 }
4521 }
18837a6a
AH		 4522
4523###
4524# m.a.d n2n end
4525###
4526
c6c9630e
MT		 4527 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4528 $cgiparams{'KEY'} = $key;
4529 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4530 }
4531 goto VPNCONF_END;
6e13d0a5 4532 } else {
c6c9630e 4533 $cgiparams{'ENABLED'} = 'on';
54fd0535
MT		 4534###
4535# m.a.d n2n begin
4536###
4537 $cgiparams{'MSSFIX'} = 'on';
4538 $cgiparams{'FRAGMENT'} = '1300';
70900745 4539 $cgiparams{'DAUTH'} = 'SHA512';
54fd0535
MT		 4540###
4541# m.a.d n2n end
4542###
4c962356 4543 $cgiparams{'SIDE'} = 'left';
c6c9630e
MT		 4544 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4545 $cgiparams{'AUTH'} = 'psk';
4546 } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4547 $cgiparams{'AUTH'} = 'certfile';
4548 } else {
6e13d0a5 4549 $cgiparams{'AUTH'} = 'certgen';
c6c9630e
MT		 4550 }
4551 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4552 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4553 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
4554 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
4555 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
c0a7c9b2 4556 $cgiparams{'DAYS_VALID'} = $vpnsettings{'DAYS_VALID'} = '730';
6e13d0a5 4557 }
c6c9630e 4558
6e13d0a5 4559 VPNCONF_ERROR:
6e13d0a5
MT		 4560 $checked{'ENABLED'}{'off'} = '';
4561 $checked{'ENABLED'}{'on'} = '';
4562 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4563 $checked{'ENABLED_BLUE'}{'off'} = '';
4564 $checked{'ENABLED_BLUE'}{'on'} = '';
4565 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4566 $checked{'ENABLED_ORANGE'}{'off'} = '';
4567 $checked{'ENABLED_ORANGE'}{'on'} = '';
4568 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
c6c9630e
MT		 4569
4570
6e13d0a5
MT		 4571 $checked{'EDIT_ADVANCED'}{'off'} = '';
4572 $checked{'EDIT_ADVANCED'}{'on'} = '';
4573 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
c6c9630e 4574
6e13d0a5
MT		 4575 $selected{'SIDE'}{'server'} = '';
4576 $selected{'SIDE'}{'client'} = '';
4577 $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
d96c89eb
AH		 4578
4579 $selected{'PROTOCOL'}{'udp'} = '';
4580 $selected{'PROTOCOL'}{'tcp'} = '';
4581 $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4582
c6c9630e 4583
6e13d0a5
MT		 4584 $checked{'AUTH'}{'psk'} = '';
4585 $checked{'AUTH'}{'certreq'} = '';
4586 $checked{'AUTH'}{'certgen'} = '';
4587 $checked{'AUTH'}{'certfile'} = '';
4588 $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
c6c9630e 4589
6e13d0a5 4590 $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
c6c9630e 4591
6e13d0a5
MT		 4592 $checked{'COMPLZO'}{'off'} = '';
4593 $checked{'COMPLZO'}{'on'} = '';
4594 $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
c6c9630e 4595
d96c89eb
AH		 4596 $checked{'MSSFIX'}{'off'} = '';
4597 $checked{'MSSFIX'}{'on'} = '';
4598 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4599
52f61e49
EKD		 4600 $selected{'DCIPHER'}{'AES-256-GCM'} = '';
4601 $selected{'DCIPHER'}{'AES-192-GCM'} = '';
4602 $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4c962356
EK		 4603 $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
4604 $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
4605 $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
4606 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4607 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4608 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4609 $selected{'DCIPHER'}{'DESX-CBC'} = '';
4610 $selected{'DCIPHER'}{'SEED-CBC'} = '';
4611 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4612 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4613 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4614 $selected{'DCIPHER'}{'BF-CBC'} = '';
4c962356 4615 $selected{'DCIPHER'}{'DES-CBC'} = '';
49abe7af
EK		 4616 # If no cipher has been chossen yet, select
4617 # the old default (AES-256-CBC) for compatiblity reasons.
4618 if ($cgiparams{'DCIPHER'} eq '') {
4619 $cgiparams{'DCIPHER'} = 'AES-256-CBC';
4620 }
4c962356 4621 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
49abe7af
EK		 4622 $selected{'DAUTH'}{'whirlpool'} = '';
4623 $selected{'DAUTH'}{'SHA512'} = '';
4624 $selected{'DAUTH'}{'SHA384'} = '';
4625 $selected{'DAUTH'}{'SHA256'} = '';
4626 $selected{'DAUTH'}{'SHA1'} = '';
49abe7af 4627 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
0c4ffc69
EK		 4628 $checked{'TLSAUTH'}{'off'} = '';
4629 $checked{'TLSAUTH'}{'on'} = '';
4630 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
49abe7af 4631
6e13d0a5
MT		 4632 if (1) {
4633 &Header::showhttpheaders();
4c962356 4634 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT		 4635 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4636 if ($errormessage) {
4637 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4638 print "<class name='base'>$errormessage";
4639 print "&nbsp;</class>";
4640 &Header::closebox();
4641 }
c6c9630e 4642
6e13d0a5
MT		 4643 if ($warnmessage) {
4644 &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4645 print "<class name='base'>$warnmessage";
4646 print "&nbsp;</class>";
4647 &Header::closebox();
4648 }
c6c9630e 4649
6e13d0a5 4650 print "<form method='post' enctype='multipart/form-data'>";
ce9abb66 4651 print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
c6c9630e 4652
6e13d0a5
MT		 4653 if ($cgiparams{'KEY'}) {
4654 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4655 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
6e13d0a5 4656 }
c6c9630e 4657
6e13d0a5 4658 &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
8c877a82 4659 print "<table width='100%' border='0'>\n";
4c962356 4660
e3edceeb 4661 print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>";
8c877a82 4662
ce9abb66 4663 if ($cgiparams{'TYPE'} eq 'host') {
6e13d0a5 4664 if ($cgiparams{'KEY'}) {
8c877a82 4665 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
6e13d0a5
MT		 4666 } else {
4667 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4668 }
c6c9630e
MT		 4669# print "<tr><td>$Lang::tr{'interface'}</td>";
4670# print "<td><select name='INTERFACE'>";
4671# print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4c962356
EK		 4672# if ($netsettings{'BLUE_DEV'} ne '') {
4673# print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4674# }
4675# print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4676# print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4677# print "</select></td></tr>";
4678# print <<END;
ce9abb66
AH		 4679 } else {
4680 print "<input type='hidden' name='INTERFACE' value='red' />";
4681 if ($cgiparams{'KEY'}) {
4682 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4683 } else {
4684 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4685 }
52f61e49
EKD		 4686
4687 # If GCM ciphers are in usage, HMAC menu is disabled
4688 my $hmacdisabled;
4689 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
4690 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
4691 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
4692 $hmacdisabled = "disabled='disabled'";
4693 };
4694
4c962356 4695 print <<END;
ce9abb66 4696 <td width='25%'>&nbsp;</td>
f527e53f
EK		 4697 <td width='25%'>&nbsp;</td></tr>
4698 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4699 <td><select name='SIDE'>
4700 <option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4701 <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option>
4702 </select>
4703 </td>
4c962356 4704
f527e53f
EK		 4705 <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4706 <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td>
4707 </tr>
4c962356 4708
e3edceeb 4709 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f 4710 <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4c962356 4711
e3edceeb 4712 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f
EK		 4713 <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td>
4714 </tr>
4c962356 4715
e3edceeb 4716 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f 4717 <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td>
49abe7af 4718
f527e53f
EK		 4719 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4720 <td><select name='PROTOCOL'>
4721 <option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4722 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4723 </tr>
4724
4725 <tr>
e3edceeb 4726 <td class='boldbase'>$Lang::tr{'destination port'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f 4727 <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td>
4c962356 4728
e3edceeb 4729 <td class='boldbase' nowrap='nowrap'>Management Port ($Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}):</td>
f527e53f
EK		 4730 <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4731 </tr>
49abe7af 4732
f527e53f
EK		 4733 <tr><td colspan=4><hr /></td></tr><tr>
4734
4735 <tr>
4736 <td class'base'><b>$Lang::tr{'MTU settings'}</b></td>
4737 </tr>
49abe7af 4738
e3edceeb 4739 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td>
f527e53f
EK		 4740 <td><input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4741 <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4742 </tr>
4c962356 4743
e3edceeb 4744 <tr><td class='boldbase' nowrap='nowrap'>fragment:</td>
f527e53f
EK		 4745 <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4746 <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4747 </tr>
4c962356 4748
e3edceeb 4749 <tr><td class='boldbase' nowrap='nowrap'>mssfix:</td>
f527e53f
EK		 4750 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4751 <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4752 </tr>
4c962356 4753
e3edceeb 4754 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
f527e53f
EK		 4755 <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4756 </tr>
2ee746be 4757
f527e53f
EK		 4758<tr><td colspan=4><hr /></td></tr><tr>
4759 <tr>
4760 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
4761 </tr>
4762
4763 <tr><td class='boldbase'>$Lang::tr{'cipher'}</td>
52f61e49
EKD		 4764 <td><select name='DCIPHER' id="n2ncipher" required>
4765 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
4766 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
4767 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
f527e53f
EK		 4768 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
4769 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4770 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
f7fb5bc5 4771 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option>
f527e53f
EK		 4772 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
4773 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
ea6dd5b0
EK		 4774 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
4775 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4776 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4777 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4778 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4779 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
f527e53f
EK		 4780 </select>
4781 </td>
4782
4783 <td class='boldbase'>$Lang::tr{'ovpn ha'}:</td>
52f61e49 4784 <td><select name='DAUTH' id="n2nhmac" $hmacdisabled>
f527e53f
EK		 4785 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
4786 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
4787 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
4788 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
f3dfb261 4789 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
f527e53f
EK		 4790 </select>
4791 </td>
4792 </tr>
4793 <tr><td colspan=4><hr /></td></tr><tr>
4794
ce9abb66 4795END
8c877a82 4796;
ce9abb66 4797 }
52f61e49
EKD		 4798
4799#### JAVA SCRIPT ####
4800# Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange
4801print<<END;
4802 <script>
4803 var disable_options = false;
4804 document.getElementById('n2ncipher').onchange = function () {
4805 if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) {
4806 document.getElementById('n2nhmac').setAttribute('disabled', true);
4807 } else {
4808 document.getElementById('n2nhmac').removeAttribute('disabled');
4809 }
4810 }
4811 </script>
4812END
4813
2ee746be 4814#jumper
e3edceeb 4815 print "<tr><td class='boldbase'>$Lang::tr{'remark title'}</td>";
8c877a82 4816 print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
c6c9630e 4817
ce9abb66 4818 if ($cgiparams{'TYPE'} eq 'host') {
8c877a82
AM		 4819 print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4820 }
ce9abb66 4821
8c877a82
AM		 4822 print"</tr></table><br><br>";
4823#A.Marx CCD new client
e81be1e1 4824if ($cgiparams{'TYPE'} eq 'host') {
8c877a82 4825 print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
8c877a82
AM		 4826 my %vpnnet=();
4827 my $vpnip;
4828 &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4829 $vpnip=$vpnnet{'DOVPN_SUBNET'};
4830 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4831 my @ccdconf=();
4832 my $count=0;
4833 my $checked;
4834 $checked{'check1'}{'off'} = '';
4835 $checked{'check1'}{'on'} = '';
4836 $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4837 print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4838 print"</td></tr></table><br><br>";
4839 my $name=$cgiparams{'CHECK1'};
4840 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4841
4842 if (! -z "${General::swroot}/ovpn/ccd.conf"){
4843 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
df9b48b7 4844 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM		 4845 $count++;
4846 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4847 if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4848 print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4849 &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4850 print"</td></tr>";
4851 }
4852 print "</table><br><br><hr><br><br>";
4853 }
e81be1e1 4854}
8c877a82 4855# ccd end
6e13d0a5
MT		 4856 &Header::closebox();
4857 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
8c877a82
AM		 4858
4859 } elsif (! $cgiparams{'KEY'}) {
4860
4861
6e13d0a5
MT		 4862 my $disabled='';
4863 my $cakeydisabled='';
4864 my $cacrtdisabled='';
4865 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4866 if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
8c877a82 4867
6e13d0a5 4868 &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
ce9abb66
AH		 4869
4870
4871 if ($cgiparams{'TYPE'} eq 'host') {
4872
49abe7af 4873 print <<END;
6e13d0a5 4874 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
54fd0535 4875
ce9abb66
AH		 4876 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4877 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
54fd0535
MT		 4878 <tr><td colspan='3'>&nbsp;</td></tr>
4879 <tr><td colspan='3'><hr /></td></tr>
4880 <tr><td colspan='3'>&nbsp;</td></tr>
ce9abb66 4881 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
e3edceeb
LS		 4882 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4883 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4884 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4885 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4886 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4887 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
ce9abb66 4888 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
6e13d0a5 4889END
ce9abb66
AH		 4890;
4891
4892###
7c1d9faf 4893# m.a.d net2net
ce9abb66
AH		 4894###
4895
4896} else {
4897
49abe7af 4898 print <<END;
ce9abb66
AH		 4899 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4900
4901 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
e3edceeb
LS		 4902 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4903 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4904 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4905 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4906 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4907 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
ce9abb66 4908 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
54fd0535
MT		 4909
4910
ce9abb66
AH		 4911END
4912;
4913
4914}
4915
4916###
7c1d9faf 4917# m.a.d net2net
ce9abb66 4918###
c6c9630e 4919
6e13d0a5
MT		 4920 foreach my $country (sort keys %{Countries::countries}) {
4921 print "<option value='$Countries::countries{$country}'";
4922 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4923 print " selected='selected'";
4924 }
4925 print ">$country</option>";
4926 }
ce9abb66 4927###
7c1d9faf 4928# m.a.d net2net
ce9abb66
AH		 4929###
4930
4931if ($cgiparams{'TYPE'} eq 'host') {
49abe7af 4932 print <<END;
f4fbb935 4933 </select></td></tr>
425465ed 4934 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
f4fbb935
EK		 4935 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4936 <tr><td>&nbsp;</td>
6e13d0a5
MT		 4937 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
4938 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
f4fbb935 4939 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<br>($Lang::tr{'confirmation'})</td>
6e13d0a5 4940 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
f4fbb935
EK		 4941 <tr><td colspan='3'>&nbsp;</td></tr>
4942 <tr><td colspan='3'><hr /></td></tr>
e3edceeb 4943 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
f4fbb935 4944 </table>
ce9abb66
AH		 4945END
4946}else{
49abe7af 4947 print <<END;
f4fbb935 4948 </select></td></tr>
425465ed 4949 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
f4fbb935
EK		 4950 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4951 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4952 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4953 <tr><td colspan='3'><hr /></td></tr>
e3edceeb 4954 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
ce9abb66
AH		 4955 </table>
4956
c6c9630e 4957END
ce9abb66
AH		 4958}
4959
4960###
7c1d9faf 4961# m.a.d net2net
ce9abb66 4962###
c6c9630e
MT		 4963 ;
4964 &Header::closebox();
8c877a82
AM		 4965
4966 }
e81be1e1
AM		 4967
4968#A.Marx CCD new client
4969if ($cgiparams{'TYPE'} eq 'host') {
8c877a82
AM		 4970 print"<br><br>";
4971 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
4972
8c877a82
AM		 4973
4974 print <<END;
4975 <table border='0' width='100%'>
4976 <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
4977 <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
4978 <tr><td colspan='4'>&nbsp</td></tr>
4979 <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
4980END
4981
4982 if ($cgiparams{'IR'} ne ''){
4983 print $cgiparams{'IR'};
4984 }else{
4985 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4986 foreach my $key (keys %ccdroutehash) {
4987 if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
4988 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
4989 if ($ccdroutehash{$key}[$i] ne ''){
4990 print $ccdroutehash{$key}[$i]."\n";
4991 }
4992 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
4993 }
4994 }
4995 }
c6c9630e 4996 }
8c877a82
AM		 4997
4998 print <<END;
4999</textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
5000 <tr><td colspan='4'><br></td></tr>
5001 <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
5002END
52d08bcb
AM		 5003
5004 my $set=0;
5005 my $selorange=0;
5006 my $selblue=0;
5007 my $selgreen=0;
5008 my $helpblue=0;
5009 my $helporange=0;
5010 my $other=0;
df9b48b7 5011 my $none=0;
52d08bcb
AM		 5012 my @temp=();
5013
8c877a82 5014 our @current = ();
52d08bcb
AM		 5015 open(FILE, "${General::swroot}/main/routing") ;
5016 @current = <FILE>;
5017 close (FILE);
5018 &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
df9b48b7
AM		 5019 #check for "none"
5020 foreach my $key (keys %ccdroute2hash) {
5021 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5022 if ($ccdroute2hash{$key}[1] eq ''){
5023 $none=1;
5024 last;
5025 }
5026 }
5027 }
5028 if ($none ne '1'){
5029 print"<option>$Lang::tr{'ccd none'}</option>";
5030 }else{
5031 print"<option selected>$Lang::tr{'ccd none'}</option>";
5032 }
52d08bcb
AM		 5033 #check if static routes are defined for client
5034 foreach my $line (@current) {
5035 chomp($line);
5036 $line=~s/\s*$//g; # remove newline
5037 @temp=split(/\,/,$line);
5038 $temp[1] = '' unless defined $temp[1]; # not always populated
5039 my ($a,$b) = split(/\//,$temp[1]);
5040 $temp[1] = $a."/".&General::iporsubtocidr($b);
5041 foreach my $key (keys %ccdroute2hash) {
5042 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5043 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5044 if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
5045 $set=1;
8c877a82
AM		 5046 }
5047 }
8c877a82 5048 }
52d08bcb
AM		 5049 }
5050 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
5051 }
3a445974
MT		 5052
5053 my %vpnconfig = ();
5054 &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
5055 foreach my $vpn (keys %vpnconfig) {
5056 # Skip all disabled VPN connections
5057 my $enabled = $vpnconfig{$vpn}[0];
5058 next unless ($enabled eq "on");
5059
5060 my $name = $vpnconfig{$vpn}[1];
5061
5062 # Remote subnets
5063 my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
5064 foreach my $network (@networks) {
5065 my $selected = "";
5066
5067 foreach my $key (keys %ccdroute2hash) {
5068 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
5069 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5070 if ($ccdroute2hash{$key}[$i] eq $network) {
5071 $selected = "selected";
5072 }
5073 }
5074 }
5075 }
5076
5077 print "<option value=\"$network\" $selected>$name ($network)</option>\n";
5078 }
5079 }
5080
52d08bcb
AM		 5081 #check if green,blue,orange are defined for client
5082 foreach my $key (keys %ccdroute2hash) {
5083 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5084 $other=1;
5085 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5086 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
5087 $selgreen=1;
5088 }
5089 if (&haveBlueNet()){
5090 if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
5091 $selblue=1;
5092 }
5093 }
5094 if (&haveOrangeNet()){
5095 if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
5096 $selorange=1;
5097 }
5098 }
5099 }
5100 }
5101 }
5102 if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
5103 if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
5104 if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
5105
49abe7af 5106 print<<END;
8c877a82
AM		 5107 </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
5108 <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
5109 <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
5110
5111END
5112;
5113 &Header::closebox();
e81be1e1 5114}
c6c9630e
MT		 5115 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5116 if ($cgiparams{'KEY'}) {
5117# print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
5118 }
5119 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
5120 &Header::closebigbox();
5121 &Header::closepage();
5122 exit (0);
6e13d0a5 5123 }
c6c9630e 5124 VPNCONF_END:
6e13d0a5 5125}
c6c9630e
MT		 5126
5127# SETTINGS_ERROR:
6e13d0a5
MT		 5128###
5129### Default status page
5130###
c6c9630e
MT		 5131 %cgiparams = ();
5132 %cahash = ();
5133 %confighash = ();
5134 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
5135 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
5136 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
5137
2feacd98
SS		 5138 open(FILE, "/var/run/ovpnserver.log");
5139 my @status = <FILE>;
5140 close(FILE);
c6c9630e
MT		 5141
5142 if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
8c877a82
AM		 5143 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
5144 my $ipaddr = <IPADDR>;
5145 close IPADDR;
5146 chomp ($ipaddr);
5147 $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
5148 if ($cgiparams{'VPN_IP'} eq '') {
5149 $cgiparams{'VPN_IP'} = $ipaddr;
5150 }
5151 }
c6c9630e
MT		 5152 }
5153
6e13d0a5 5154#default setzen
c6c9630e 5155 if ($cgiparams{'DCIPHER'} eq '') {
4c962356 5156 $cgiparams{'DCIPHER'} = 'AES-256-CBC';
c6c9630e 5157 }
c6c9630e 5158 if ($cgiparams{'DDEST_PORT'} eq '') {
4c962356 5159 $cgiparams{'DDEST_PORT'} = '1194';
c6c9630e
MT		 5160 }
5161 if ($cgiparams{'DMTU'} eq '') {
4c962356
EK		 5162 $cgiparams{'DMTU'} = '1400';
5163 }
5164 if ($cgiparams{'MSSFIX'} eq '') {
5165 $cgiparams{'MSSFIX'} = 'off';
5166 }
5167 if ($cgiparams{'DAUTH'} eq '') {
86308adb
EK		 5168 if (-z "${General::swroot}/ovpn/ovpnconfig") {
5169 $cgiparams{'DAUTH'} = 'SHA512';
5170 }
5171 foreach my $key (keys %confighash) {
5172 if ($confighash{$key}[3] ne 'host') {
5173 $cgiparams{'DAUTH'} = 'SHA512';
5174 } else {
5175 $cgiparams{'DAUTH'} = 'SHA1';
5176 }
5177 }
5178 }
0c4ffc69
EK		 5179 if ($cgiparams{'TLSAUTH'} eq '') {
5180 $cgiparams{'TLSAUTH'} = 'off';
5181 }
c6c9630e 5182 if ($cgiparams{'DOVPN_SUBNET'} eq '') {
4c962356 5183 $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
c6c9630e 5184 }
4c962356 5185 $checked{'ENABLED'}{'off'} = '';
c6c9630e
MT		 5186 $checked{'ENABLED'}{'on'} = '';
5187 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
5188 $checked{'ENABLED_BLUE'}{'off'} = '';
5189 $checked{'ENABLED_BLUE'}{'on'} = '';
5190 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
5191 $checked{'ENABLED_ORANGE'}{'off'} = '';
5192 $checked{'ENABLED_ORANGE'}{'on'} = '';
5193 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
c6c9630e
MT		 5194
5195 $selected{'DPROTOCOL'}{'udp'} = '';
5196 $selected{'DPROTOCOL'}{'tcp'} = '';
5197 $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
4c962356 5198
52f61e49
EKD		 5199 $selected{'DCIPHER'}{'AES-256-GCM'} = '';
5200 $selected{'DCIPHER'}{'AES-192-GCM'} = '';
5201 $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4c962356
EK		 5202 $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
5203 $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
5204 $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
5205 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
5206 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
5207 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
c6c9630e
MT		 5208 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
5209 $selected{'DCIPHER'}{'DESX-CBC'} = '';
4c962356
EK		 5210 $selected{'DCIPHER'}{'SEED-CBC'} = '';
5211 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
5212 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
5213 $selected{'DCIPHER'}{'BF-CBC'} = '';
4c962356 5214 $selected{'DCIPHER'}{'DES-CBC'} = '';
c6c9630e 5215 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4c962356
EK		 5216
5217 $selected{'DAUTH'}{'whirlpool'} = '';
5218 $selected{'DAUTH'}{'SHA512'} = '';
5219 $selected{'DAUTH'}{'SHA384'} = '';
5220 $selected{'DAUTH'}{'SHA256'} = '';
4c962356
EK		 5221 $selected{'DAUTH'}{'SHA1'} = '';
5222 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
5223
0c4ffc69
EK		 5224 $checked{'TLSAUTH'}{'off'} = '';
5225 $checked{'TLSAUTH'}{'on'} = '';
5226 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
5227
c6c9630e
MT		 5228 $checked{'DCOMPLZO'}{'off'} = '';
5229 $checked{'DCOMPLZO'}{'on'} = '';
5230 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
4c962356 5231
d96c89eb
AH		 5232# m.a.d
5233 $checked{'MSSFIX'}{'off'} = '';
5234 $checked{'MSSFIX'}{'on'} = '';
5235 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
6e13d0a5 5236#new settings
c6c9630e
MT		 5237 &Header::showhttpheaders();
5238 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
5239 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
6e13d0a5 5240
c6c9630e 5241 if ($errormessage) {
6e13d0a5
MT		 5242 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
5243 print "<class name='base'>$errormessage\n";
5244 print "&nbsp;</class>\n";
5245 &Header::closebox();
c6c9630e 5246 }
6e13d0a5 5247
400c8afd
EK		 5248 if ($cryptoerror) {
5249 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
5250 print "<class name='base'>$cryptoerror";
5251 print "&nbsp;</class>";
5252 &Header::closebox();
5253 }
5254
5255 if ($cryptowarning) {
5256 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
5257 print "<class name='base'>$cryptowarning";
5258 print "&nbsp;</class>";
5259 &Header::closebox();
5260 }
5261
b2e75449
MT		 5262 if ($warnmessage) {
5263 &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
5264 print "$warnmessage<br>";
5265 print "$Lang::tr{'fwdfw warn1'}<br>";
5266 &Header::closebox();
5267 print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>";
5268 &Header::closepage();
5269 exit 0;
5270 }
4d81e0f3 5271
c6c9630e
MT		 5272 my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
5273 my $srunning = "no";
5274 my $activeonrun = "";
5275 if ( -e "/var/run/openvpn.pid"){
6e13d0a5
MT		 5276 $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
5277 $srunning ="yes";
5278 $activeonrun = "";
c6c9630e 5279 } else {
6e13d0a5 5280 $activeonrun = "disabled='disabled'";
c6c9630e 5281 }
afabe9f7 5282 &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
4c962356 5283 print <<END;
631b67b7 5284 <table width='100%' border='0'>
c6c9630e
MT		 5285 <form method='post'>
5286 <td width='25%'>&nbsp;</td>
5287 <td width='25%'>&nbsp;</td>
5288 <td width='25%'>&nbsp;</td></tr>
5289 <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
5290 <td align='left'>$sactive</td>
5291 <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
8c877a82 5292 <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
c6c9630e
MT		 5293END
5294;
5295 if (&haveBlueNet()) {
5296 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
5297 print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
5298 }
5299 if (&haveOrangeNet()) {
5300 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
5301 print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
86308adb
EK		 5302 }
5303
5304 print <<END;
5305
5306 <tr><td colspan='4'><br></td></tr>
5307 <tr>
5308 <td class'base'><b>$Lang::tr{'net config'}:</b></td>
5309 </tr>
5310 <tr><td colspan='1'><br></td></tr>
5311
4e17adad
CS		 5312 <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
5313 <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
c6c9630e
MT		 5314 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
5315 <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
5316 <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
5317 <td class='boldbase'>$Lang::tr{'destination port'}:</td>
5318 <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
5319 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
bc2b3e94 5320 <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}' size='5' /></td>
86308adb
EK		 5321 </tr>
5322
5323 <tr><td colspan='4'><br></td></tr>
5324 <tr>
5325 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
5326 </tr>
5327 <tr><td colspan='1'><br></td></tr>
5328
5329 <tr>
5330 <td class='base'>$Lang::tr{'ovpn ha'}</td>
5331 <td><select name='DAUTH'>
5332 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
5333 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
5334 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
5335 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
5336 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5337 </select>
5338 </td>
f527e53f 5339
4c962356
EK		 5340 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
5341 <td><select name='DCIPHER'>
52f61e49
EKD		 5342 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
5343 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
5344 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
4c962356 5345 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
f527e53f 5346 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4c962356
EK		 5347 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
5348 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option>
5349 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
5350 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
4c962356 5351 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
ea6dd5b0
EK		 5352 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5353 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5354 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5355 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5356 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4c962356
EK		 5357 </select>
5358 </td>
4c962356 5359 </tr>
0c4ffc69
EK		 5360
5361 <tr><td colspan='4'><br></td></tr>
5362 <tr>
5363 <td class='base'>$Lang::tr{'ovpn tls auth'}</td>
5364 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
5365 </tr>
5366
f7edf97a 5367 <tr><td colspan='4'><br><br></td></tr>
c6c9630e
MT		 5368END
5369;
5370
5371 if ( $srunning eq "yes" ) {
8c877a82
AM		 5372 print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
5373 print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5374 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5375 print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
c6c9630e 5376 } else{
8c877a82
AM		 5377 print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5378 print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5379 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
c6c9630e
MT		 5380 if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
5381 -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
5382 -e "${General::swroot}/ovpn/certs/servercert.pem" &&
5383 -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
5384 (( $cgiparams{'ENABLED'} eq 'on') ||
5385 ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
5386 ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
8c877a82 5387 print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
c6c9630e 5388 } else {
8c877a82 5389 print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
c6c9630e
MT		 5390 }
5391 }
5392 print "</form></table>";
5393 &Header::closebox();
6e13d0a5 5394
c6c9630e 5395 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
ce9abb66 5396###
7c1d9faf 5397# m.a.d net2net
54fd0535 5398#<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
ce9abb66
AH		 5399###
5400
4c962356 5401 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' });
c6c9630e 5402 ;
99bfa85c
AM		 5403 my $id = 0;
5404 my $gif;
f7edf97a 5405 my $col1="";
5b942f7f 5406 my $lastnet;
c8b51e28 5407 foreach my $key (sort { ncmp ($confighash{$a}[32],$confighash{$b}[32]) } sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
5b942f7f
AM		 5408 if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]=$Lang::tr{'fwhost OpenVPN N-2-N'};}
5409 if ($confighash{$key}[32] eq "dynamic"){$confighash{$key}[32]=$Lang::tr{'ccd dynrange'};}
5410 if($id == 0){
5411 print"<b>$confighash{$key}[32]</b>";
5412 print <<END;
5413 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5414<tr>
5415 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5416 <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5417 <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5418 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
71af643c 5419 <th width='5%' class='boldbase' colspan='7' align='center'><b>$Lang::tr{'action'}</b></th>
5b942f7f
AM		 5420</tr>
5421END
5422 }
5423 if ($id > 0 && $lastnet ne $confighash{$key}[32]){
5424 print "</table><br>";
5425 print"<b>$confighash{$key}[32]</b>";
5426 print <<END;
5427 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5428<tr>
5429 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5430 <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5431 <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5432 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
71af643c 5433 <th width='5%' class='boldbase' colspan='7' align='center'><b>$Lang::tr{'action'}</b></th>
5b942f7f
AM		 5434</tr>
5435END
5436 }
eff2dbf8 5437 if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
c6c9630e 5438 if ($id % 2) {
99bfa85c
AM		 5439 print "<tr>";
5440 $col="bgcolor='$color{'color20'}'";
bb89e92a 5441 } else {
99bfa85c
AM		 5442 print "<tr>";
5443 $col="bgcolor='$color{'color22'}'";
c6c9630e 5444 }
99bfa85c
AM		 5445 print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
5446 print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
8c877a82
AM		 5447 #if ($confighash{$key}[4] eq 'cert') {
5448 #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
5449 #} else {
5450 #print "<td align='left'>&nbsp;</td>";
5451 #}
2feacd98
SS		 5452 my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
5453 my $cavalid;
5454
5455 foreach my $line (@cavalid) {
5456 if ($line =~ /Not After : (.*)[\n]/) {
5457 $cavalid = $1;
5458
5459 last;
5460 }
5461 }
5462
99bfa85c 5463 print "<td align='center' $col>$confighash{$key}[25]</td>";
f7edf97a
AM		 5464 $col1="bgcolor='${Header::colourred}'";
5465 my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
ce9abb66 5466
c6c9630e 5467 if ($confighash{$key}[0] eq 'off') {
f7edf97a
AM		 5468 $col1="bgcolor='${Header::colourblue}'";
5469 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
c6c9630e 5470 } else {
ce9abb66
AH		 5471
5472###
7c1d9faf 5473# m.a.d net2net
f7edf97a
AM		 5474###
5475
b278daf3 5476 if ($confighash{$key}[3] eq 'net') {
54fd0535
MT		 5477
5478 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
5479 my @output = "";
5480 my @tustate = "";
5481 my $tport = $confighash{$key}[22];
5482 my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
5483 if ($tport ne '') {
5484 $tnet->open('127.0.0.1');
5485 @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
5486 @tustate = split(/\,/, $output[1]);
5487###
5488#CONNECTING -- OpenVPN's initial state.
5489#WAIT -- (Client only) Waiting for initial response from server.
5490#AUTH -- (Client only) Authenticating with server.
5491#GET_CONFIG -- (Client only) Downloading configuration options from server.
5492#ASSIGN_IP -- Assigning IP address to virtual network interface.
5493#ADD_ROUTES -- Adding routes to system.
5494#CONNECTED -- Initialization Sequence Completed.
5495#RECONNECTING -- A restart has occurred.
5496#EXITING -- A graceful exit is in progress.
5497####
5498
ed4b4c19 5499 if (($tustate[1] eq 'CONNECTED') || ($tustate[1] eq 'WAIT')) {
f7edf97a
AM		 5500 $col1="bgcolor='${Header::colourgreen}'";
5501 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5502 }else {
5503 $col1="bgcolor='${Header::colourred}'";
5504 $active = "<b><font color='#FFFFFF'>$tustate[1]</font></b>";
5505 }
54fd0535 5506 }
54fd0535 5507 }
f7edf97a
AM		 5508 }else {
5509
5510 my $cn;
5511 my @match = ();
5512 foreach my $line (@status) {
5513 chomp($line);
5514 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
5515 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
5516 if ($match[1] ne "Common Name") {
5517 $cn = $match[1];
5518 }
5519 $cn =~ s/[_]/ /g;
5520 if ($cn eq "$confighash{$key}[2]") {
5521 $col1="bgcolor='${Header::colourgreen}'";
5522 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5523 }
5524 }
5525 }
c6c9630e 5526 }
7c1d9faf 5527}
ce9abb66
AH		 5528
5529
4c962356 5530 print <<END;
f7edf97a 5531 <td align='center' $col1>$active</td>
c6c9630e 5532
99bfa85c 5533 <form method='post' name='frm${key}a'><td align='center' $col>
96096995
AM		 5534 <input type='image' name='$Lang::tr{'dl client arch'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
5535 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5536 <input type='hidden' name='KEY' value='$key' />
c6c9630e
MT		 5537 </td></form>
5538END
5539 ;
71af643c
MT		 5540
5541 if ($confighash{$key}[41] eq "no-pass") {
5542 print <<END;
5543 <form method='post' name='frm${key}g'><td align='center' $col>
5544 <input type='image' name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png'
5545 alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' />
5546 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5547 <input type='hidden' name='MODE' value='insecure' />
5548 <input type='hidden' name='KEY' value='$key' />
5549 </td></form>
5550END
5551 } else {
5552 print "<td $col>&nbsp;</td>";
5553 }
5554
c6c9630e 5555 if ($confighash{$key}[4] eq 'cert') {
4c962356 5556 print <<END;
99bfa85c 5557 <form method='post' name='frm${key}b'><td align='center' $col>
c6c9630e
MT		 5558 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
5559 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
5560 <input type='hidden' name='KEY' value='$key' />
5561 </td></form>
5562END
5563 ; } else {
5564 print "<td>&nbsp;</td>";
5565 }
5566 if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
4c962356 5567 print <<END;
99bfa85c 5568 <form method='post' name='frm${key}c'><td align='center' $col>
438dd0cc 5569 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
c6c9630e
MT		 5570 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
5571 <input type='hidden' name='KEY' value='$key' />
5572 </td></form>
5573END
5574 ; } elsif ($confighash{$key}[4] eq 'cert') {
4c962356 5575 print <<END;
99bfa85c 5576 <form method='post' name='frm${key}c'><td align='center' $col>
438dd0cc 5577 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
c6c9630e
MT		 5578 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
5579 <input type='hidden' name='KEY' value='$key' />
5580 </td></form>
5581END
5582 ; } else {
5583 print "<td>&nbsp;</td>";
5584 }
5585 print <<END
99bfa85c 5586 <form method='post' name='frm${key}d'><td align='center' $col>
c6c9630e
MT		 5587 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
5588 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
5589 <input type='hidden' name='KEY' value='$key' />
5590 </td></form>
5591
99bfa85c 5592 <form method='post' name='frm${key}e'><td align='center' $col>
c6c9630e
MT		 5593 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5594 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5595 <input type='hidden' name='KEY' value='$key' />
5596 </td></form>
99bfa85c 5597 <form method='post' name='frm${key}f'><td align='center' $col>
c6c9630e
MT		 5598 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5599 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5600 <input type='hidden' name='KEY' value='$key' />
5601 </td></form>
5602 </tr>
5603END
5604 ;
5605 $id++;
5b942f7f 5606 $lastnet = $confighash{$key}[32];
c6c9630e 5607 }
5b942f7f 5608 print"</table>";
c6c9630e
MT		 5609 ;
5610
5611 # If the config file contains entries, print Key to action icons
5612 if ( $id ) {
4c962356 5613 print <<END;
8c877a82 5614 <table border='0'>
c6c9630e 5615 <tr>
4c962356
EK		 5616 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5617 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5618 <td class='base'>$Lang::tr{'click to disable'}</td>
5619 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5620 <td class='base'>$Lang::tr{'show certificate'}</td>
5621 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5622 <td class='base'>$Lang::tr{'edit'}</td>
5623 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5624 <td class='base'>$Lang::tr{'remove'}</td>
c6c9630e
MT		 5625 </tr>
5626 <tr>
4c962356
EK		 5627 <td>&nbsp; </td>
5628 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5629 <td class='base'>$Lang::tr{'click to enable'}</td>
5630 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5631 <td class='base'>$Lang::tr{'download certificate'}</td>
5632 <td>&nbsp; &nbsp; <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5633 <td class='base'>$Lang::tr{'dl client arch'}</td>
5634 </tr>
f7edf97a 5635 </table><br>
c6c9630e
MT		 5636END
5637 ;
5638 }
5639
4c962356 5640 print <<END;
c6c9630e
MT		 5641 <table width='100%'>
5642 <form method='post'>
4c962356
EK		 5643 <tr><td align='right'>
5644 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5645 <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td>
5646 </tr>
c6c9630e
MT		 5647 </form>
5648 </table>
5649END
4c962356
EK		 5650 ;
5651 &Header::closebox();
5652 }
fd5ccb2d
EK		 5653
5654 # CA/key listing
4c962356
EK		 5655 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}");
5656 print <<END;
5657 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5658 <tr>
5659 <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5660 <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
5661 <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
5662 </tr>
5663END
5664 ;
5665 my $col1="bgcolor='$color{'color22'}'";
f7fb5bc5 5666 my $col2="bgcolor='$color{'color20'}'";
c8f50356 5667 # DH parameter line
f7fb5bc5 5668 my $col3="bgcolor='$color{'color22'}'";
fd5ccb2d
EK		 5669 # ta.key line
5670 my $col4="bgcolor='$color{'color20'}'";
f7fb5bc5 5671
4c962356 5672 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
2feacd98
SS		 5673 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
5674 my $casubject;
5675
5676 foreach my $line (@casubject) {
5677 if ($line =~ /Subject: (.*)[\n]/) {
5678 $casubject = $1;
5679 $casubject =~ s+/Email+, E+;
5680 $casubject =~ s/ ST=/ S=/;
5681
5682 last;
5683 }
5684 }
5685
4c962356
EK		 5686 print <<END;
5687 <tr>
5688 <td class='base' $col1>$Lang::tr{'root certificate'}</td>
5689 <td class='base' $col1>$casubject</td>
c8f50356 5690 <form method='post' name='frmrootcrta'><td width='3%' align='center' $col1>
4c962356
EK		 5691 <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
5692 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
c8f50356
EK		 5693 </form>
5694 <form method='post' name='frmrootcrtb'><td width='3%' align='center' $col1>
4c962356
EK		 5695 <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
5696 <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
c8f50356
EK		 5697 </form>
5698 <td width='4%' $col1>&nbsp;</td>
5699 </tr>
4c962356
EK		 5700END
5701 ;
5702 } else {
5703 # display rootcert generation buttons
5704 print <<END;
5705 <tr>
5706 <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
5707 <td class='base' $col1>$Lang::tr{'not present'}</td>
c8f50356
EK		 5708 <td colspan='3' $col1>&nbsp;</td>
5709 </tr>
4c962356
EK		 5710END
5711 ;
5712 }
5713
5714 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
2feacd98
SS		 5715 my @hostsubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
5716 my $hostsubject;
5717
5718 foreach my $line (@hostsubject) {
5719 if ($line =~ /Subject: (.*)[\n]/) {
5720 $hostsubject = $1;
5721 $hostsubject =~ s+/Email+, E+;
5722 $hostsubject =~ s/ ST=/ S=/;
5723
5724 last;
5725 }
5726 }
4c962356
EK		 5727
5728 print <<END;
5729 <tr>
5730 <td class='base' $col2>$Lang::tr{'host certificate'}</td>
5731 <td class='base' $col2>$hostsubject</td>
c8f50356 5732 <form method='post' name='frmhostcrta'><td width='3%' align='center' $col2>
4c962356
EK		 5733 <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
5734 <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
c8f50356
EK		 5735 </form>
5736 <form method='post' name='frmhostcrtb'><td width='3%' align='center' $col2>
4c962356
EK		 5737 <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/media-floppy.png' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" border='0' />
5738 <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
c8f50356
EK		 5739 </td></form>
5740 <td width='4%' $col2>&nbsp;</td>
5741 </tr>
4c962356
EK		 5742END
5743 ;
5744 } else {
5745 # Nothing
5746 print <<END;
5747 <tr>
5748 <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
5749 <td class='base' $col2>$Lang::tr{'not present'}</td>
c8f50356
EK		 5750 </td><td colspan='3' $col2>&nbsp;</td>
5751 </tr>
4c962356
EK		 5752END
5753 ;
5754 }
ce9abb66 5755
f7fb5bc5
EK		 5756 # Adding DH parameter to chart
5757 if (-f "${General::swroot}/ovpn/ca/dh1024.pem") {
2feacd98
SS		 5758 my @dhsubject = &System_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
5759 my $dhsubject;
f7fb5bc5 5760
2feacd98
SS		 5761 foreach my $line (@dhsubject) {
5762 if ($line =~ / (.*)[\n]/) {
5763 $dhsubject = $1;
5764
5765 last;
5766 }
5767 }
f7fb5bc5
EK		 5768
5769 print <<END;
5770 <tr>
5771 <td class='base' $col3>$Lang::tr{'dh parameter'}</td>
5772 <td class='base' $col3>$dhsubject</td>
c8f50356 5773 <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
f7fb5bc5
EK		 5774 <input type='hidden' name='ACTION' value='$Lang::tr{'show dh'}' />
5775 <input type='image' name='$Lang::tr{'show dh'}' src='/images/info.gif' alt='$Lang::tr{'show dh'}' title='$Lang::tr{'show dh'}' width='20' height='20' border='0' />
c8f50356
EK		 5776 </form>
5777 <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
c8f50356
EK		 5778 </form>
5779 <td width='4%' $col3>&nbsp;</td>
5780 </tr>
f7fb5bc5
EK		 5781END
5782 ;
5783 } else {
5784 # Nothing
5785 print <<END;
5786 <tr>
5787 <td width='25%' class='base' $col3>$Lang::tr{'dh parameter'}:</td>
5788 <td class='base' $col3>$Lang::tr{'not present'}</td>
c8f50356
EK		 5789 </td><td colspan='3' $col3>&nbsp;</td>
5790 </tr>
f7fb5bc5
EK		 5791END
5792 ;
5793 }
5794
fd5ccb2d
EK		 5795 # Adding ta.key to chart
5796 if (-f "${General::swroot}/ovpn/certs/ta.key") {
2feacd98
SS		 5797 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
5798 my @tasubject = <FILE>;
5799 close(FILE);
5800
5801 my $tasubject;
5802 foreach my $line (@tasubject) {
5803 if($line =~ /# (.*)[\n]/) {
5804 $tasubject = $1;
5805
5806 last;
5807 }
5808 }
5809
fd5ccb2d
EK		 5810 print <<END;
5811
5812 <tr>
5813 <td class='base' $col4>$Lang::tr{'ta key'}</td>
5814 <td class='base' $col4>$tasubject</td>
5815 <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5816 <input type='hidden' name='ACTION' value='$Lang::tr{'show tls-auth key'}' />
5817 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show tls-auth key'}' title='$Lang::tr{'show tls-auth key'}' width='20' height='20' border='0' />
5818 </form>
5819 <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5820 <input type='image' name='$Lang::tr{'download tls-auth key'}' src='/images/media-floppy.png' alt='$Lang::tr{'download tls-auth key'}' title='$Lang::tr{'download tls-auth key'}' border='0' />
5821 <input type='hidden' name='ACTION' value='$Lang::tr{'download tls-auth key'}' />
5822 </form>
5823 <td width='4%' $col4>&nbsp;</td>
5824 </tr>
5825END
5826 ;
5827 } else {
5828 # Nothing
5829 print <<END;
5830 <tr>
5831 <td width='25%' class='base' $col4>$Lang::tr{'ta key'}:</td>
5832 <td class='base' $col4>$Lang::tr{'not present'}</td>
5833 <td colspan='3' $col4>&nbsp;</td>
5834 </tr>
5835END
5836 ;
5837 }
5838
4c962356
EK		 5839 if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
5840 print "<tr><td colspan='5' align='center'><form method='post'>";
5841 print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
5842 print "</form></td></tr>\n";
5843 }
5844
5845 if (keys %cahash > 0) {
5846 foreach my $key (keys %cahash) {
5847 if (($key + 1) % 2) {
5848 print "<tr bgcolor='$color{'color20'}'>\n";
5849 } else {
5850 print "<tr bgcolor='$color{'color22'}'>\n";
5851 }
5852 print "<td class='base'>$cahash{$key}[0]</td>\n";
5853 print "<td class='base'>$cahash{$key}[1]</td>\n";
5854 print <<END;
5855 <form method='post' name='cafrm${key}a'><td align='center'>
5856 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
5857 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
5858 <input type='hidden' name='KEY' value='$key' />
5859 </td></form>
5860 <form method='post' name='cafrm${key}b'><td align='center'>
5861 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
5862 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
5863 <input type='hidden' name='KEY' value='$key' />
5864 </td></form>
5865 <form method='post' name='cafrm${key}c'><td align='center'>
5866 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
5867 <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
5868 <input type='hidden' name='KEY' value='$key' />
5869 </td></form></tr>
5870END
5871 ;
5872 }
5873 }
5874
5875 print "</table>";
5876
5877 # If the file contains entries, print Key to action icons
5878 if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
5879 print <<END;
5880 <table>
5881 <tr>
5882 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5883 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5884 <td class='base'>$Lang::tr{'show certificate'}</td>
5885 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
5886 <td class='base'>$Lang::tr{'download certificate'}</td>
5887 </tr>
5888 </table>
5889END
5890 ;
5891 }
ce9abb66 5892
4c962356 5893 print <<END
578f23c8
SS		 5894
5895 <br><hr><br>
5896
4c962356 5897 <form method='post' enctype='multipart/form-data'>
578f23c8
SS		 5898 <table border='0' width='100%'>
5899 <tr>
5900 <td colspan='4'><b>$Lang::tr{'upload ca certificate'}</b></td>
5901 </tr>
4c962356 5902
578f23c8
SS		 5903 <tr>
5904 <td width='10%'>$Lang::tr{'ca name'}:</td>
5905 <td width='30%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'></td>
5906 <td width='30%'><input type='file' name='FH' size='25'>
5907 <td width='30%'align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}'></td>
5908 </tr>
f527e53f 5909
578f23c8
SS		 5910 <tr>
5911 <td colspan='3'>&nbsp;</td>
5912 <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
5913 </tr>
5914 </table>
f527e53f 5915
578f23c8
SS		 5916 <br>
5917
5918 <table border='0' width='100%'>
5919 <tr>
5920 <td colspan='4'><b>$Lang::tr{'ovpn dh parameters'}</b></td>
5921 </tr>
5922
5923 <tr>
5924 <td width='40%'>$Lang::tr{'ovpn dh upload'}:</td>
5925 <td width='30%'><input type='file' name='FH' size='25'>
5926 <td width='30%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload dh key'}'></td>
5927 </tr>
5928
5929 <tr>
5930 <td width='40%'>$Lang::tr{'ovpn dh new key'}:</td>
5931 <td colspan='2' width='60%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
5932 </tr>
5933 </table>
5934 </form>
f527e53f 5935
578f23c8 5936 <br><hr>
4c962356
EK		 5937END
5938 ;
5939
5940 if ( $srunning eq "yes" ) {
5941 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' disabled='disabled' /></div></form>\n";
5942 } else {
5943 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></div></form>\n";
5944 }
5945 &Header::closebox();
5946END
5947 ;
5948
5949&Header::closepage();
ce9abb66 5950
Peter's tree of IPFire 2.x