html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2014  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 77
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 use Sort::Naturally;
  34 require '/var/ipfire/general-functions.pl';
  35 require "${General::swroot}/lang.pl";
  36 require "${General::swroot}/header.pl";
  37 require "${General::swroot}/countries.pl";
  38 require "${General::swroot}/location-functions.pl";
  39
  40 # enable only the following on debugging purpose
  41 #use warnings;
  42 #use CGI::Carp 'fatalsToBrowser';
  43
  44 #workaround to suppress a warning when a variable is used only once
  45 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
  46 undef (@dummy);
  47
  48 my %color = ();
  49 my %mainsettings = ();
  50 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  51 &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
  52
  53 ###
  54 ### Initialize variables
  55 ###
  56 my %ccdconfhash=();
  57 my %ccdroutehash=();
  58 my %ccdroute2hash=();
  59 my %netsettings=();
  60 my %cgiparams=();
  61 my %vpnsettings=();
  62 my %checked=();
  63 my %confighash=();
  64 my %cahash=();
  65 my %selected=();
  66 my $warnmessage = '';
  67 my $errormessage = '';
  68 my $cryptoerror = '';
  69 my $cryptowarning = '';
  70 my %settings=();
  71 my $routes_push_file = '';
  72 my $confighost="${General::swroot}/fwhosts/customhosts";
  73 my $configgrp="${General::swroot}/fwhosts/customgroups";
  74 my $customnet="${General::swroot}/fwhosts/customnetworks";
  75 my $name;
  76 my $col="";
  77 my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local";
  78 my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local";
  79
  80 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  81 $cgiparams{'ENABLED'} = 'off';
  82 $cgiparams{'ENABLED_BLUE'} = 'off';
  83 $cgiparams{'ENABLED_ORANGE'} = 'off';
  84 $cgiparams{'EDIT_ADVANCED'} = 'off';
  85 $cgiparams{'NAT'} = 'off';
  86 $cgiparams{'COMPRESSION'} = 'off';
  87 $cgiparams{'ONLY_PROPOSED'} = 'off';
  88 $cgiparams{'ACTION'} = '';
  89 $cgiparams{'CA_NAME'} = '';
  90 $cgiparams{'DH_NAME'} = 'dh1024.pem';
  91 $cgiparams{'DHLENGHT'} = '';
  92 $cgiparams{'DHCP_DOMAIN'} = '';
  93 $cgiparams{'DHCP_DNS'} = '';
  94 $cgiparams{'DHCP_WINS'} = '';
  95 $cgiparams{'ROUTES_PUSH'} = '';
  96 $cgiparams{'DCOMPLZO'} = 'off';
  97 $cgiparams{'MSSFIX'} = '';
  98 $cgiparams{'number'} = '';
  99 $cgiparams{'DCIPHER'} = '';
 100 $cgiparams{'DAUTH'} = '';
 101 $cgiparams{'TLSAUTH'} = '';
 102 $routes_push_file = "${General::swroot}/ovpn/routes_push";
 103 # Perform crypto and configration test
 104 &pkiconfigcheck;
 105
 106 # Add CCD files if not already presant
 107 unless (-e $routes_push_file) {
 108         open(RPF, ">$routes_push_file");
 109         close(RPF);
 110 }
 111 unless (-e "${General::swroot}/ovpn/ccd.conf") {
 112         open(CCDC, ">${General::swroot}/ovpn/ccd.conf");
 113         close (CCDC);
 114 }
 115 unless (-e "${General::swroot}/ovpn/ccdroute") {
 116         open(CCDR, ">${General::swroot}/ovpn/ccdroute");
 117         close (CCDR);
 118 }
 119 unless (-e "${General::swroot}/ovpn/ccdroute2") {
 120         open(CCDRT, ">${General::swroot}/ovpn/ccdroute2");
 121         close (CCDRT);
 122 }
 123 # Add additional configs if not already presant
 124 unless (-e "$local_serverconf") {
 125         open(LSC, ">$local_serverconf");
 126        close (LSC);
 127 }
 128 unless (-e "$local_clientconf") {
 129        open(LCC, ">$local_clientconf");
 130        close (LCC);
 131 }
 132
 133 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
 134
 135 # prepare openvpn config file
 136 ###
 137 ### Useful functions
 138 ###
 139 sub haveOrangeNet
 140 {
 141         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
 142         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 143         return 0;
 144 }
 145
 146 sub haveBlueNet
 147 {
 148         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
 149         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 150         return 0;
 151 }
 152
 153 sub sizeformat{
 154     my $bytesize = shift;
 155     my $i = 0;
 156
 157     while(abs($bytesize) >= 1024){
 158         $bytesize=$bytesize/1024;
 159         $i++;
 160         last if($i==6);
 161     }
 162
 163     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 164     my $newsize=(int($bytesize*100 +0.5))/100;
 165     return("$newsize $units[$i]");
 166 }
 167
 168 sub cleanssldatabase
 169 {
 170     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 171         print FILE "01";
 172         close FILE;
 173     }
 174     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 175         print FILE "";
 176         close FILE;
 177     }
 178     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
 179       print FILE "";
 180       close FILE;
 181     }
 182     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 183     unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
 184     unlink ("${General::swroot}/ovpn/certs/serial.old");
 185     unlink ("${General::swroot}/ovpn/certs/01.pem");
 186 }
 187
 188 sub newcleanssldatabase
 189 {
 190     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 191         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 192         print FILE "01";
 193         close FILE;
 194     }
 195     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 196         &General::system("touch", "${General::swroot}/ovpn/certs/index.txt");
 197     }
 198     if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
 199         &General::system("touch", "${General::swroot}/ovpn/certs/index.txt.attr");
 200     }
 201     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 202     unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
 203     unlink ("${General::swroot}/ovpn/certs/serial.old");
 204 }
 205
 206 sub deletebackupcert
 207 {
 208         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 209                 my $hexvalue = <FILE>;
 210                 chomp $hexvalue;
 211                 close FILE;
 212                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 213         }
 214 }
 215
 216 ###
 217 ### Check for PKI and configure problems
 218 ###
 219
 220 sub pkiconfigcheck
 221 {
 222         # Warning if DH parameter is 1024 bit
 223         if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
 224                 my @dhparameter = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
 225                 my $dhbit;
 226
 227                 # Loop through the output and search for the DH bit lenght.
 228                 foreach my $line (@dhparameter) {
 229                         if ($line =~ (/(\d+)/)) {
 230                                 # Assign match to dhbit value.
 231                                 $dhbit = $1;
 232
 233                                 last;
 234                         }
 235                 }
 236
 237                 # Check if the used key lenght is at least 2048 bit.
 238                 if ($dhbit < 2048) {
 239                         $cryptoerror = "$Lang::tr{'ovpn error dh'}";
 240                         goto CRYPTO_ERROR;
 241                 }
 242         }
 243
 244         # Warning if md5 is in usage
 245         if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
 246                 my @signature = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
 247                 if (grep(/md5WithRSAEncryption/, @signature) ) {
 248                         $cryptoerror = "$Lang::tr{'ovpn error md5'}";
 249                         goto CRYPTO_ERROR;
 250                 }
 251         }
 252
 253         CRYPTO_ERROR:
 254
 255         # Warning if certificate is not compliant to RFC3280 TLS rules
 256         if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
 257                 my @extendkeyusage = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
 258                 if ( ! grep(/TLS Web Server Authentication/, @extendkeyusage)) {
 259                         $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
 260                         goto CRYPTO_WARNING;
 261                 }
 262         }
 263
 264         CRYPTO_WARNING:
 265 }
 266
 267 sub writeserverconf {
 268     my %sovpnsettings = ();
 269     my @temp = ();
 270     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 271     &read_routepushfile;
 272
 273     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 274     flock CONF, 2;
 275     print CONF "#OpenVPN Server conf\n";
 276     print CONF "\n";
 277     print CONF "daemon openvpnserver\n";
 278     print CONF "writepid /var/run/openvpn.pid\n";
 279     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 280     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 281     print CONF "dev tun\n";
 282     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 283     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 284     print CONF "script-security 3\n";
 285     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 286     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 287     print CONF "tls-server\n";
 288     print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 289     print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 290     print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 291     print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
 292     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 293     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 294     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 295
 296     print CONF "tun-mtu $sovpnsettings{'DMTU'}\n";
 297
 298     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 299                 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 300                 foreach (@temp)
 301                 {
 302                         @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 303                         print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 304                 }
 305         }
 306 # a.marx ccd
 307         my %ccdconfhash=();
 308         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 309         foreach my $key (keys %ccdconfhash) {
 310                 my $a=$ccdconfhash{$key}[1];
 311                 my ($b,$c) = split (/\//, $a);
 312                 print CONF "route $b ".&General::cidrtosub($c)."\n";
 313         }
 314         my %ccdroutehash=();
 315         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 316         foreach my $key (keys %ccdroutehash) {
 317                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
 318                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
 319                         print CONF "route $a $b\n";
 320                 }
 321         }
 322 # ccd end
 323
 324         if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 325         print CONF "client-to-client\n";
 326     }
 327     if ($sovpnsettings{MSSFIX} eq 'on') {
 328                 print CONF "mssfix\n";
 329     } else {
 330                 print CONF "mssfix 0\n";
 331     }
 332     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 333                 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 334     }
 335
 336     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 337         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 338     }
 339     print CONF "status-version 1\n";
 340     print CONF "status /var/run/ovpnserver.log 30\n";
 341     print CONF "ncp-disable\n";
 342     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 343         print CONF "auth $sovpnsettings{'DAUTH'}\n";
 344     # Set TLSv2 as minimum
 345     print CONF "tls-version-min 1.2\n";
 346
 347     if ($sovpnsettings{'TLSAUTH'} eq 'on') {
 348         print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
 349     }
 350     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 351         print CONF "comp-lzo\n";
 352     }
 353     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 354         print CONF "push \"redirect-gateway def1\"\n";
 355     }
 356     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 357         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 358     }
 359
 360     if ($sovpnsettings{DHCP_DNS} ne '') {
 361         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 362     }
 363
 364     if ($sovpnsettings{DHCP_WINS} ne '') {
 365         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 366     }
 367
 368     if ($sovpnsettings{MAX_CLIENTS} eq '') {
 369         print CONF "max-clients 100\n";
 370     }
 371     if ($sovpnsettings{MAX_CLIENTS} ne '') {
 372         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 373     }
 374     print CONF "tls-verify /usr/lib/openvpn/verify\n";
 375     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 376     print CONF "auth-user-pass-verify \"/usr/lib/openvpn/otp-verify\" via-file\n";
 377     print CONF "auth-user-pass-optional\n";
 378     print CONF "reneg-sec 86400\n";
 379     print CONF "user nobody\n";
 380     print CONF "group nobody\n";
 381     print CONF "persist-key\n";
 382     print CONF "persist-tun\n";
 383         if ($sovpnsettings{LOG_VERB} ne '') {
 384                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 385         } else {
 386                 print CONF "verb 3\n";
 387         }
 388
 389     print CONF "# Log clients connecting/disconnecting\n";
 390     print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n";
 391     print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n";
 392
 393     # Print server.conf.local if entries exist to server.conf
 394     if ( !-z $local_serverconf  && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
 395        open (LSC, "$local_serverconf");
 396                print CONF "\n#---------------------------\n";
 397                print CONF "# Start of custom directives\n";
 398                print CONF "# from server.conf.local\n";
 399                print CONF "#---------------------------\n\n";
 400        while (<LSC>) {
 401                print CONF $_;
 402        }
 403                print CONF "\n#-----------------------------\n";
 404                print CONF "# End of custom directives\n";
 405                print CONF "#-----------------------------\n";
 406        close (LSC);
 407     }
 408     print CONF "\n";
 409
 410     close(CONF);
 411 }
 412
 413 sub emptyserverlog{
 414     if (open(FILE, ">/var/run/ovpnserver.log")) {
 415         flock FILE, 2;
 416         print FILE "";
 417         close FILE;
 418     }
 419
 420 }
 421
 422 sub delccdnet
 423 {
 424         my %ccdconfhash = ();
 425         my %ccdhash = ();
 426         my $ccdnetname=$_[0];
 427         if (-f "${General::swroot}/ovpn/ovpnconfig"){
 428                 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 429                 foreach my $key (keys %ccdhash) {
 430                         if ($ccdhash{$key}[32] eq $ccdnetname) {
 431                                 $errormessage=$Lang::tr{'ccd err hostinnet'};
 432                                 return;
 433                         }
 434                 }
 435         }
 436         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 437         foreach my $key (keys %ccdconfhash) {
 438                         if ($ccdconfhash{$key}[0] eq $ccdnetname){
 439                                 delete $ccdconfhash{$key};
 440                         }
 441         }
 442         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 443
 444         &writeserverconf;
 445         return 0;
 446 }
 447
 448 sub addccdnet
 449 {
 450         my %ccdconfhash=();
 451         my @ccdconf=();
 452         my $ccdname=$_[0];
 453         my $ccdnet=$_[1];
 454         my $subcidr;
 455         my @ip2=();
 456         my $checkup;
 457         my $ccdip;
 458         my $baseaddress;
 459
 460
 461         #check name
 462         if ($ccdname eq '')
 463         {
 464                 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
 465                 return
 466         }
 467
 468         if(!&General::validhostname($ccdname))
 469         {
 470                 $errormessage=$Lang::tr{'ccd err invalidname'};
 471                 return;
 472         }
 473
 474         ($ccdip,$subcidr) = split (/\//,$ccdnet);
 475         $subcidr=&General::iporsubtocidr($subcidr);
 476         #check subnet
 477         if ($subcidr > 30)
 478         {
 479                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 480                 return;
 481         }
 482         #check ip
 483         if (!&General::validipandmask($ccdnet)){
 484                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 485                 return;
 486         }
 487
 488         if (!$errormessage) {
 489                 my %ccdconfhash=();
 490                 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
 491                 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 492                 my $key = &General::findhasharraykey (\%ccdconfhash);
 493                 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
 494                 $ccdconfhash{$key}[0] = $ccdname;
 495                 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
 496                 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 497                 &writeserverconf;
 498                 $cgiparams{'ccdname'}='';
 499                 $cgiparams{'ccdsubnet'}='';
 500                 return 1;
 501         }
 502 }
 503
 504 sub modccdnet
 505 {
 506
 507         my $newname=$_[0];
 508         my $oldname=$_[1];
 509         my %ccdconfhash=();
 510         my %ccdhash=();
 511
 512         # Check if the new name is valid.
 513         if(!&General::validhostname($newname)) {
 514                 $errormessage=$Lang::tr{'ccd err invalidname'};
 515                 return;
 516         }
 517
 518         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 519         foreach my $key (keys %ccdconfhash) {
 520                 if ($ccdconfhash{$key}[0] eq $oldname) {
 521                         foreach my $key1 (keys %ccdconfhash) {
 522                                 if ($ccdconfhash{$key1}[0] eq $newname){
 523                                         $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
 524                                         return;
 525                                 }else{
 526                                         $ccdconfhash{$key}[0]= $newname;
 527                                         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 528                                         last;
 529                                 }
 530                         }
 531                 }
 532         }
 533
 534         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 535                 foreach my $key (keys %ccdhash) {
 536                         if ($ccdhash{$key}[32] eq $oldname) {
 537                                 $ccdhash{$key}[32]=$newname;
 538                                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 539                                 last;
 540                         }
 541                 }
 542
 543         return 0;
 544 }
 545 sub ccdmaxclients
 546 {
 547         my $ccdnetwork=$_[0];
 548         my @octets=();
 549         my @subnet=();
 550         @octets=split("\/",$ccdnetwork);
 551         @subnet= split /\./, &General::cidrtosub($octets[1]);
 552         my ($a,$b,$c,$d,$e);
 553         $a=256-$subnet[0];
 554         $b=256-$subnet[1];
 555         $c=256-$subnet[2];
 556         $d=256-$subnet[3];
 557         $e=($a*$b*$c*$d)/4;
 558         return $e-1;
 559 }
 560
 561 sub getccdadresses
 562 {
 563         my $ipin=$_[0];
 564         my ($ip1,$ip2,$ip3,$ip4)=split  /\./, $ipin;
 565         my $cidr=$_[1];
 566         chomp($cidr);
 567         my $count=$_[2];
 568         my $hasip=$_[3];
 569         chomp($hasip);
 570         my @iprange=();
 571         my %ccdhash=();
 572         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 573         $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
 574         for (my $i=1;$i<=$count;$i++) {
 575                 my $tmpip=$iprange[$i-1];
 576                 my $stepper=$i*4;
 577                 $iprange[$i]= &General::getnextip($tmpip,4);
 578         }
 579         my $r=0;
 580         foreach my $key (keys %ccdhash) {
 581                 $r=0;
 582                 foreach  my $tmp (@iprange){
 583                         my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
 584                         if ($net eq $tmp) {
 585                                 if ( $hasip ne  $ccdhash{$key}[33] ){
 586                                         splice (@iprange,$r,1);
 587                                 }
 588                         }
 589                         $r++;
 590                 }
 591         }
 592         return @iprange;
 593 }
 594
 595 sub fillselectbox
 596 {
 597         my $boxname=$_[1];
 598         my ($ccdip,$subcidr) = split("/",$_[0]);
 599         my $tz=$_[2];
 600         my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
 601         print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
 602         foreach (@allccdips) {
 603                 my $ip=$_."/30";
 604                 chomp($ip);
 605                 print "<option value='$ip' ";
 606                 if ( $ip eq $cgiparams{$boxname} ){
 607                         print"selected";
 608                 }
 609                 print ">$ip</option>";
 610         }
 611         print "</select>";
 612 }
 613
 614 sub hostsinnet
 615 {
 616         my $name=$_[0];
 617         my %ccdhash=();
 618         my $i=0;
 619         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 620         foreach my $key (keys %ccdhash) {
 621                 if ($ccdhash{$key}[32] eq $name){ $i++;}
 622         }
 623         return $i;
 624 }
 625
 626 sub check_routes_push
 627 {
 628                         my $val=$_[0];
 629                         my ($ip,$cidr) = split (/\//, $val);
 630                         ##check for existing routes in routes_push
 631                         if (-e "${General::swroot}/ovpn/routes_push") {
 632                                 open(FILE,"${General::swroot}/ovpn/routes_push");
 633                                 while (<FILE>) {
 634                                         $_=~s/\s*$//g;
 635
 636                                         my ($ip2,$cidr2) = split (/\//,"$_");
 637                                         my $val2=$ip2."/".&General::iporsubtodec($cidr2);
 638
 639                                         if($val eq $val2){
 640                                                 return 0;
 641                                         }
 642                                         #subnetcheck
 643                                         if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
 644                                                 return 0;
 645                                         }
 646                                 };
 647                                 close(FILE);
 648                         }
 649         return 1;
 650 }
 651
 652 sub check_ccdroute
 653 {
 654         my %ccdroutehash=();
 655         my $val=$_[0];
 656         my ($ip,$cidr) = split (/\//, $val);
 657         #check for existing routes in ccdroute
 658         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 659         foreach my $key (keys %ccdroutehash) {
 660                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 661                         if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
 662                                 return 0;
 663                         }
 664                         my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
 665                         #subnetcheck
 666                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
 667                                 return 0;
 668                         }
 669                 }
 670         }
 671         return 1;
 672 }
 673 sub check_ccdconf
 674 {
 675         my %ccdconfhash=();
 676         my $val=$_[0];
 677         my ($ip,$cidr) = split (/\//, $val);
 678         #check for existing routes in ccdroute
 679         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 680         foreach my $key (keys %ccdconfhash) {
 681                 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
 682                                 return 0;
 683                         }
 684                         my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
 685                         #subnetcheck
 686                         if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
 687                                 return 0;
 688                         }
 689
 690         }
 691         return 1;
 692 }
 693
 694 ###
 695 # m.a.d net2net
 696 ###
 697
 698 sub validdotmask
 699 {
 700         my $ipdotmask = $_[0];
 701         if (&General::validip($ipdotmask)) { return 0; }
 702         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 703         my $mask = $2;
 704         if (($mask =~ /\./ )) { return 0; }
 705   return 1;
 706 }
 707
 708 # -------------------------------------------------------------------
 709
 710 sub write_routepushfile
 711 {
 712         open(FILE, ">$routes_push_file");
 713         flock(FILE, 2);
 714         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 715                 print FILE $vpnsettings{'ROUTES_PUSH'};
 716         }
 717         close(FILE);
 718 }
 719
 720 sub read_routepushfile
 721 {
 722         if (-e "$routes_push_file") {
 723                 open(FILE,"$routes_push_file");
 724                 delete $vpnsettings{'ROUTES_PUSH'};
 725                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 726                 close(FILE);
 727                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 728
 729         }
 730 }
 731
 732 sub writecollectdconf {
 733         my $vpncollectd;
 734         my %ccdhash=();
 735
 736         open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!";
 737         print COLLECTDVPN "Loadplugin openvpn\n";
 738         print COLLECTDVPN "\n";
 739         print COLLECTDVPN "<Plugin openvpn>\n";
 740         print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n";
 741
 742         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 743         foreach my $key (keys %ccdhash) {
 744                 if ($ccdhash{$key}[0] eq 'on' && $ccdhash{$key}[3] eq 'net') {
 745                         print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ccdhash{$key}[1]-n2n\"\n";
 746                 }
 747         }
 748
 749         print COLLECTDVPN "</Plugin>\n";
 750         close(COLLECTDVPN);
 751
 752         # Reload collectd afterwards
 753         &General::system("/usr/local/bin/collectdctrl", "restart");
 754 }
 755
 756 #hier die refresh page
 757 if ( -e "${General::swroot}/ovpn/gencanow") {
 758     my $refresh = '';
 759     $refresh = "<meta http-equiv='refresh' content='15;' />";
 760     &Header::showhttpheaders();
 761     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 762     &Header::openbigbox('100%', 'center');
 763     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 764     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 765     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 766     &Header::closebox();
 767     &Header::closebigbox();
 768     &Header::closepage();
 769     exit (0);
 770 }
 771 ##hier die refresh page
 772
 773
 774 ###
 775 ### OpenVPN Server Control
 776 ###
 777 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 778     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 779     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 780     #start openvpn server
 781     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 782         &emptyserverlog();
 783         &General::system("/usr/local/bin/openvpnctrl", "-s");
 784     }
 785     #stop openvpn server
 786     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 787         &General::system("/usr/local/bin/openvpnctrl", "-k");
 788         &emptyserverlog();
 789     }
 790 #    #restart openvpn server
 791 #    if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 792 #workarund, till SIGHUP also works when running as nobody
 793 #       system('/usr/local/bin/openvpnctrl', '-r');
 794 #       &emptyserverlog();
 795 #    }
 796 }
 797
 798 ###
 799 ### Save Advanced options
 800 ###
 801
 802 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 803     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 804     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 805     #DAN this value has to leave.
 806 #new settings for daemon
 807     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 808     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 809     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 810     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 811     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 812     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 813     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
 814     $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
 815     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 816     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 817     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 818     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 819     my @temp=();
 820
 821     if ($cgiparams{'FRAGMENT'} eq '') {
 822         delete $vpnsettings{'FRAGMENT'};
 823     } else {
 824         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 825             $errormessage = "Incorrect value, please insert only numbers.";
 826         goto ADV_ERROR;
 827                 } else {
 828                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 829         }
 830     }
 831
 832     if ($cgiparams{'MSSFIX'} ne 'on') {
 833         delete $vpnsettings{'MSSFIX'};
 834     } else {
 835         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 836     }
 837
 838     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 839         unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 840                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 841         goto ADV_ERROR;
 842         }
 843     }
 844     if ($cgiparams{'DHCP_DNS'} ne ''){
 845         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 846                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 847         goto ADV_ERROR;
 848         }
 849     }
 850     if ($cgiparams{'DHCP_WINS'} ne ''){
 851         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 852                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 853                 goto ADV_ERROR;
 854         }
 855     }
 856     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 857         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 858         undef $vpnsettings{'ROUTES_PUSH'};
 859
 860         foreach my $tmpip (@temp)
 861         {
 862                 s/^\s+//g; s/\s+$//g;
 863
 864                 if ($tmpip)
 865                 {
 866                         $tmpip=~s/\s*$//g;
 867                         unless (&General::validipandmask($tmpip)) {
 868                                 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
 869                                 goto ADV_ERROR;
 870                         }
 871                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
 872
 873                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 874                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 875                                 goto ADV_ERROR;
 876                         }
 877 # a.marx ccd
 878                         my %ccdroutehash=();
 879                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 880                         foreach my $key (keys %ccdroutehash) {
 881                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 882                                         if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
 883                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 884                                                 goto ADV_ERROR;
 885                                         }
 886                                         my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
 887                                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
 888                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 889                                                 goto ADV_ERROR;
 890                                         }
 891                                 }
 892                         }
 893
 894 # ccd end
 895
 896                         $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
 897                 }
 898         }
 899     &write_routepushfile;
 900         undef $vpnsettings{'ROUTES_PUSH'};
 901     }
 902         else {
 903         undef $vpnsettings{'ROUTES_PUSH'};
 904         &write_routepushfile;
 905     }
 906     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
 907         $errormessage = $Lang::tr{'invalid input for max clients'};
 908         goto ADV_ERROR;
 909     }
 910     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 911         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 912             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 913         goto ADV_ERROR;
 914         }
 915     }
 916     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 917         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 918             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 919         goto ADV_ERROR;
 920         }
 921     }
 922     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 923         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 924         goto ADV_ERROR;
 925     }
 926     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 927     &writeserverconf();#hier ok
 928 }
 929
 930 ###
 931 # m.a.d net2net
 932 ###
 933
 934 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 935 {
 936
 937 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 938 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 939 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 940 my $tunmtu =  '';
 941
 942 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 943 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 944
 945   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 946
 947   flock SERVERCONF, 2;
 948   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 949   print SERVERCONF "\n";
 950   print SERVERCONF "# User Security\n";
 951   print SERVERCONF "user nobody\n";
 952   print SERVERCONF "group nobody\n";
 953   print SERVERCONF "persist-tun\n";
 954   print SERVERCONF "persist-key\n";
 955   print SERVERCONF "script-security 2\n";
 956   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 957
 958   if ($cgiparams{'REMOTE'} ne '') {
 959   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 960   }
 961
 962   print SERVERCONF "float\n";
 963   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 964   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 965   print SERVERCONF "# Client Gateway Network\n";
 966   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 967   print SERVERCONF "up \"/etc/init.d/static-routes start\"\n";
 968   print SERVERCONF "# tun Device\n";
 969   print SERVERCONF "dev tun\n";
 970   print SERVERCONF "#Logfile for statistics\n";
 971   print SERVERCONF "status-version 1\n";
 972   print SERVERCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
 973   print SERVERCONF "# Port and Protokol\n";
 974   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 975
 976   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 977   print SERVERCONF "proto tcp4-server\n";
 978   print SERVERCONF "# Packet size\n";
 979   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 980   print SERVERCONF "tun-mtu $tunmtu\n";
 981   }
 982
 983   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 984   print SERVERCONF "proto udp4\n";
 985   print SERVERCONF "# Paketsize\n";
 986   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 987   print SERVERCONF "tun-mtu $tunmtu\n";
 988   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 989   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; } else { print SERVERCONF "mssfix 0\n" };
 990   }
 991
 992   print SERVERCONF "# Auth. Server\n";
 993   print SERVERCONF "tls-server\n";
 994   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 995   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 996   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 997   print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
 998   print SERVERCONF "# Cipher\n";
 999   print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
1000
1001   # If GCM cipher is used, do not use --auth
1002   if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1003       ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1004       ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1005     print SERVERCONF unless "# HMAC algorithm\n";
1006     print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n";
1007   } else {
1008     print SERVERCONF "# HMAC algorithm\n";
1009     print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
1010   }
1011
1012   # Set TLSv1.2 as minimum
1013   print SERVERCONF "tls-version-min 1.2\n";
1014
1015   if ($cgiparams{'COMPLZO'} eq 'on') {
1016    print SERVERCONF "# Enable Compression\n";
1017    print SERVERCONF "comp-lzo\n";
1018      }
1019   print SERVERCONF "# Debug Level\n";
1020   print SERVERCONF "verb 3\n";
1021   print SERVERCONF "# Tunnel check\n";
1022   print SERVERCONF "keepalive 10 60\n";
1023   print SERVERCONF "# Start as daemon\n";
1024   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1025   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1026   print SERVERCONF "# Activate Management Interface and Port\n";
1027   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1028   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1029   close(SERVERCONF);
1030
1031 }
1032
1033 ###
1034 # m.a.d net2net
1035 ###
1036
1037 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1038 {
1039
1040         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
1041         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1042         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
1043         my $tunmtu =  '';
1044
1045 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1046 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1047
1048   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1049
1050   flock CLIENTCONF, 2;
1051   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1052   print CLIENTCONF "#\n";
1053   print CLIENTCONF "# User Security\n";
1054   print CLIENTCONF "user nobody\n";
1055   print CLIENTCONF "group nobody\n";
1056   print CLIENTCONF "persist-tun\n";
1057   print CLIENTCONF "persist-key\n";
1058   print CLIENTCONF "script-security 2\n";
1059   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1060   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1061   print CLIENTCONF "float\n";
1062   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1063   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1064   print CLIENTCONF "# Server Gateway Network\n";
1065   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1066   print CLIENTCONF "up \"/etc/init.d/static-routes start\"\n";
1067   print CLIENTCONF "# tun Device\n";
1068   print CLIENTCONF "dev tun\n";
1069   print CLIENTCONF "#Logfile for statistics\n";
1070   print CLIENTCONF "status-version 1\n";
1071   print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
1072   print CLIENTCONF "# Port and Protokol\n";
1073   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1074
1075   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1076   print CLIENTCONF "proto tcp4-client\n";
1077   print CLIENTCONF "# Packet size\n";
1078   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1079   print CLIENTCONF "tun-mtu $tunmtu\n";
1080   }
1081
1082   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1083   print CLIENTCONF "proto udp4\n";
1084   print CLIENTCONF "# Paketsize\n";
1085   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1086   print CLIENTCONF "tun-mtu $tunmtu\n";
1087   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1088   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; } else { print CLIENTCONF "mssfix 0\n" };
1089   }
1090
1091   # Check host certificate if X509 is RFC3280 compliant.
1092   # If not, old --ns-cert-type directive will be used.
1093   # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
1094   my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1095   if ( ! grep(/TLS Web Server Authentication/, @hostcert)) {
1096        print CLIENTCONF "ns-cert-type server\n";
1097   } else {
1098        print CLIENTCONF "remote-cert-tls server\n";
1099   }
1100   print CLIENTCONF "# Auth. Client\n";
1101   print CLIENTCONF "tls-client\n";
1102   print CLIENTCONF "# Cipher\n";
1103   print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
1104   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1105
1106   # If GCM cipher is used, do not use --auth
1107   if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1108       ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1109       ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1110     print CLIENTCONF unless "# HMAC algorithm\n";
1111     print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n";
1112   } else {
1113     print CLIENTCONF "# HMAC algorithm\n";
1114     print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1115   }
1116
1117   # Set TLSv1.2 as minimum
1118   print CLIENTCONF "tls-version-min 1.2\n";
1119
1120   if ($cgiparams{'COMPLZO'} eq 'on') {
1121    print CLIENTCONF "# Enable Compression\n";
1122    print CLIENTCONF "comp-lzo\n";
1123   }
1124   print CLIENTCONF "# Debug Level\n";
1125   print CLIENTCONF "verb 3\n";
1126   print CLIENTCONF "# Tunnel check\n";
1127   print CLIENTCONF "keepalive 10 60\n";
1128   print CLIENTCONF "# Start as daemon\n";
1129   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1130   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1131   print CLIENTCONF "# Activate Management Interface and Port\n";
1132   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1133   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1134   close(CLIENTCONF);
1135
1136 }
1137
1138 ###
1139 ### Save main settings
1140 ###
1141
1142 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1143     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1144     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1145     #DAN this value has to leave.
1146     if ($cgiparams{'ENABLED'} eq 'on'){
1147         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1148                 $errormessage = $Lang::tr{'invalid input for hostname'};
1149         goto SETTINGS_ERROR;
1150         }
1151     }
1152
1153     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1154             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1155                         goto SETTINGS_ERROR;
1156     }
1157     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1158
1159     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1160         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1161         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1162         goto SETTINGS_ERROR;
1163     }
1164
1165     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1166         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1167         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1168         goto SETTINGS_ERROR;
1169     }
1170
1171     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1172         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1173         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1174         goto SETTINGS_ERROR;
1175     }
1176
1177     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1178         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1179         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1180         goto SETTINGS_ERROR;
1181     }
1182     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1183     while (<ALIASES>)
1184     {
1185         chomp($_);
1186         my @tempalias = split(/\,/,$_);
1187         if ($tempalias[1] eq 'on') {
1188             if (&General::IpInSubnet ($tempalias[0] ,
1189                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1190                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1191             }
1192         }
1193     }
1194     close(ALIASES);
1195     if ($errormessage ne ''){
1196         goto SETTINGS_ERROR;
1197     }
1198     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1199         $errormessage = $Lang::tr{'invalid input'};
1200         goto SETTINGS_ERROR;
1201     }
1202     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1203         $errormessage = $Lang::tr{'invalid mtu input'};
1204         goto SETTINGS_ERROR;
1205     }
1206
1207     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1208         $errormessage = $Lang::tr{'invalid port'};
1209         goto SETTINGS_ERROR;
1210     }
1211
1212         # Create ta.key for tls-auth if not presant
1213         if ($cgiparams{'TLSAUTH'} eq 'on') {
1214                 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
1215                         # This system call is safe, because all arguements are passed as an array.
1216                         system("/usr/sbin/openvpn", "--genkey", "secret", "${General::swroot}/ovpn/certs/ta.key");
1217                         if ($?) {
1218                                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1219                                 goto SETTINGS_ERROR;
1220                         }
1221                 }
1222         }
1223
1224     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1225     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1226     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1227     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1228 #new settings for daemon
1229     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1230     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1231     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1232     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1233     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1234     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1235     $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
1236     $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
1237 #wrtie enable
1238
1239   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {
1240           &General::system("touch", "${General::swroot}/ovpn/enable_blue");
1241   } else {
1242           unlink("${General::swroot}/ovpn/enable_blue");
1243   }
1244
1245   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {
1246           &General::system("touch", "${General::swroot}/ovpn/enable_orange");
1247   } else {
1248           unlink("${General::swroot}/ovpn/enable_orange");
1249   }
1250
1251   if ( $vpnsettings{'ENABLED'} eq 'on' ) {
1252           &General::system("touch", "${General::swroot}/ovpn/enable");
1253   } else {
1254           unlink("${General::swroot}/ovpn/enable");
1255   }
1256
1257 #new settings for daemon
1258     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1259     &writeserverconf();#hier ok
1260 SETTINGS_ERROR:
1261 ###
1262 ### Reset all step 2
1263 ###
1264 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
1265     my $file = '';
1266     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1267
1268     # Kill all N2N connections
1269     &General::system("/usr/local/bin/openvpnctrl", "-kn2n");
1270
1271     foreach my $key (keys %confighash) {
1272         my $name = $confighash{$cgiparams{'$key'}}[1];
1273
1274         if ($confighash{$key}[4] eq 'cert') {
1275             delete $confighash{$cgiparams{'$key'}};
1276         }
1277
1278         &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$name");
1279     }
1280     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1281         unlink $file;
1282     }
1283     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1284         unlink $file;
1285     }
1286     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1287         unlink $file;
1288     }
1289         &cleanssldatabase();
1290     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1291         print FILE "";
1292         close FILE;
1293     }
1294     if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1295         print FILE "";
1296         close FILE;
1297     }
1298     if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1299         print FILE "";
1300         close FILE;
1301     }
1302     while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1303         unlink $file
1304     }
1305     while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1306         unlink $file
1307     }
1308     if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1309         print FILE "";
1310         close FILE;
1311     }
1312     if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1313         print FILE "";
1314         close FILE;
1315     }
1316     while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1317         unlink($file);
1318     }
1319
1320     # Remove everything from the collectd configuration
1321     &writecollectdconf();
1322
1323     #&writeserverconf();
1324 ###
1325 ### Reset all step 1
1326 ###
1327 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
1328     &Header::showhttpheaders();
1329     &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1330     &Header::openbigbox('100%', 'left', '', '');
1331     &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1332     print <<END;
1333         <form method='post'>
1334                 <table width='100%'>
1335                         <tr>
1336                                 <td align='center'>
1337                                 <input type='hidden' name='AREUSURE' value='yes' />
1338                                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1339                                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1340                         </tr>
1341                         <tr>
1342                                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1343                                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1344                         </tr>
1345                 </table>
1346         </form>
1347 END
1348     ;
1349     &Header::closebox();
1350     &Header::closebigbox();
1351     &Header::closepage();
1352     exit (0);
1353
1354 ###
1355 ### Generate DH key step 2
1356 ###
1357 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
1358     # Delete if old key exists
1359     if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1360         unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1361         }
1362         # Create Diffie Hellmann Parameter
1363         # The system call is safe, because all arguments are passed as an array.
1364         system("/usr/bin/openssl", "dhparam", "-out", "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1365         if ($?) {
1366                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1367                 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1368         }
1369
1370 ###
1371 ### Generate DH key step 1
1372 ###
1373 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1374         &Header::showhttpheaders();
1375         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1376         &Header::openbigbox('100%', 'LEFT', '', '');
1377         &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1378         print <<END;
1379         <table width='100%'>
1380         <tr>
1381                 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
1382         </tr>
1383         <tr>
1384                 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1385                 <td align='center'>
1386                 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1387                 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1388                         <select name='DHLENGHT'>
1389                                 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1390                                 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1391                                 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1392                         </select>
1393                 </td>
1394         </tr>
1395         <tr><td colspan='4'><br></td></tr>
1396         </table>
1397         <table width='100%'>
1398         <tr>
1399                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
1400         </tr>
1401         <tr>
1402                 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1403         </tr>
1404         <tr><td colspan='2'><br></td></tr>
1405         <tr>
1406                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1407                 </form>
1408         </tr>
1409         </table>
1410
1411 END
1412         ;
1413         &Header::closebox();
1414         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1415         &Header::closebigbox();
1416         &Header::closepage();
1417         exit (0);
1418
1419 ###
1420 ### Upload DH key
1421 ###
1422 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
1423     unless (ref ($cgiparams{'FH'})) {
1424          $errormessage = $Lang::tr{'there was no file upload'};
1425          goto UPLOADCA_ERROR;
1426     }
1427     # Move uploaded dh key to a temporary file
1428     (my $fh, my $filename) = tempfile( );
1429     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1430         $errormessage = $!;
1431         goto UPLOADCA_ERROR;
1432     }
1433     my @temp = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$filename");
1434     if ( ! grep(/DH Parameters: \((2048|3072|4096) bit\)/, @temp)) {
1435         $errormessage = $Lang::tr{'not a valid dh key'};
1436         unlink ($filename);
1437         goto UPLOADCA_ERROR;
1438     } else {
1439         # Delete if old key exists
1440         if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1441                 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1442         }
1443
1444         unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}")) {
1445                 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1446                 unlink ($filename);
1447                 goto UPLOADCA_ERROR;
1448         }
1449     }
1450 ###
1451 ### Upload CA Certificate
1452 ###
1453 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1454     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1455
1456     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1457         $errormessage = $Lang::tr{'name must only contain characters'};
1458         goto UPLOADCA_ERROR;
1459     }
1460
1461     if (length($cgiparams{'CA_NAME'}) >60) {
1462         $errormessage = $Lang::tr{'name too long'};
1463         goto VPNCONF_ERROR;
1464     }
1465
1466     if ($cgiparams{'CA_NAME'} eq 'ca') {
1467         $errormessage = $Lang::tr{'name is invalid'};
1468         goto UPLOADCA_ERROR;
1469     }
1470
1471     # Check if there is no other entry with this name
1472     foreach my $key (keys %cahash) {
1473         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1474             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1475             goto UPLOADCA_ERROR;
1476         }
1477     }
1478
1479     unless (ref ($cgiparams{'FH'})) {
1480         $errormessage = $Lang::tr{'there was no file upload'};
1481         goto UPLOADCA_ERROR;
1482     }
1483     # Move uploaded ca to a temporary file
1484     (my $fh, my $filename) = tempfile( );
1485     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1486         $errormessage = $!;
1487         goto UPLOADCA_ERROR;
1488     }
1489     my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
1490     if ( ! grep(/CA:TRUE/i, @temp )) {
1491         $errormessage = $Lang::tr{'not a valid ca certificate'};
1492         unlink ($filename);
1493         goto UPLOADCA_ERROR;
1494     } else {
1495         unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem")) {
1496             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1497             unlink ($filename);
1498             goto UPLOADCA_ERROR;
1499         }
1500     }
1501
1502     my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1503     my $casubject;
1504
1505     foreach my $line (@casubject) {
1506         if ($line =~ /Subject: (.*)[\n]/) {
1507                 $casubject    = $1;
1508                 $casubject    =~ s+/Email+, E+;
1509                 $casubject    =~ s/ ST=/ S=/;
1510
1511                 last;
1512         }
1513     }
1514
1515     $casubject    = &Header::cleanhtml($casubject);
1516
1517     my $key = &General::findhasharraykey (\%cahash);
1518     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1519     $cahash{$key}[1] = $casubject;
1520     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1521 #    system('/usr/local/bin/ipsecctrl', 'R');
1522
1523     UPLOADCA_ERROR:
1524
1525 ###
1526 ### Display ca certificate
1527 ###
1528 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1529     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1530
1531     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1532         &Header::showhttpheaders();
1533         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1534         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1535         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1536         my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1537         my $output = &Header::cleanhtml(join("", @output),"y");
1538         print "<pre>$output</pre>\n";
1539         &Header::closebox();
1540         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1541         &Header::closebigbox();
1542         &Header::closepage();
1543         exit(0);
1544     } else {
1545         $errormessage = $Lang::tr{'invalid key'};
1546     }
1547
1548 ###
1549 ### Download ca certificate
1550 ###
1551 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1552     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1553
1554     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1555         print "Content-Type: application/octet-stream\r\n";
1556         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1557
1558         my @tmp =  &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1559         print "@tmp";
1560
1561         exit(0);
1562     } else {
1563         $errormessage = $Lang::tr{'invalid key'};
1564     }
1565
1566 ###
1567 ### Remove ca certificate (step 2)
1568 ###
1569 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1570     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1571     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1572
1573     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1574         foreach my $key (keys %confighash) {
1575             my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1576             if (grep(/: OK/, @test)) {
1577                 # Delete connection
1578 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1579 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1580 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1581 #               }
1582                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1583                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1584                 delete $confighash{$key};
1585                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1586 #               &writeipsecfiles();
1587             }
1588         }
1589         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1590         delete $cahash{$cgiparams{'KEY'}};
1591         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1592 #       system('/usr/local/bin/ipsecctrl', 'R');
1593     } else {
1594         $errormessage = $Lang::tr{'invalid key'};
1595     }
1596 ###
1597 ### Remove ca certificate (step 1)
1598 ###
1599 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1600     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1601     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1602
1603     my $assignedcerts = 0;
1604     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1605         foreach my $key (keys %confighash) {
1606             my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1607             if (grep(/: OK/, @test)) {
1608                 $assignedcerts++;
1609             }
1610         }
1611         if ($assignedcerts) {
1612             &Header::showhttpheaders();
1613             &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1614             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1615             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1616             print <<END;
1617                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1618                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1619                     <tr><td align='center'>
1620                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1621                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1622                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1623                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1624                 </form></table>
1625 END
1626             ;
1627             &Header::closebox();
1628             &Header::closebigbox();
1629             &Header::closepage();
1630             exit (0);
1631         } else {
1632             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1633             delete $cahash{$cgiparams{'KEY'}};
1634             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1635 #           system('/usr/local/bin/ipsecctrl', 'R');
1636         }
1637     } else {
1638         $errormessage = $Lang::tr{'invalid key'};
1639     }
1640
1641 ###
1642 ### Display root certificate
1643 ###
1644 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1645     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1646     my @output;
1647     &Header::showhttpheaders();
1648     &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1649     &Header::openbigbox('100%', 'LEFT', '', '');
1650     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1651         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1652         @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1653     } else {
1654         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1655         @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1656     }
1657     my $output = &Header::cleanhtml(join("", @output), "y");
1658     print "<pre>$output</pre>\n";
1659     &Header::closebox();
1660     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1661     &Header::closebigbox();
1662     &Header::closepage();
1663     exit(0);
1664
1665 ###
1666 ### Download root certificate
1667 ###
1668 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1669     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1670         print "Content-Type: application/octet-stream\r\n";
1671         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1672
1673         my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1674         print "@tmp";
1675
1676         exit(0);
1677     }
1678
1679 ###
1680 ### Download host certificate
1681 ###
1682 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1683     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1684         print "Content-Type: application/octet-stream\r\n";
1685         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1686
1687         my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1688         print "@tmp";
1689
1690         exit(0);
1691     }
1692
1693 ###
1694 ### Download tls-auth key
1695 ###
1696 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1697     if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1698         print "Content-Type: application/octet-stream\r\n";
1699         print "Content-Disposition: filename=ta.key\r\n\r\n";
1700
1701         open(FILE, "${General::swroot}/ovpn/certs/ta.key");
1702         my @tmp = <FILE>;
1703         close(FILE);
1704
1705         print "@tmp";
1706
1707         exit(0);
1708     }
1709
1710 ###
1711 ### Form for generating a root certificate
1712 ###
1713 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1714          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1715
1716     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1717     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1718         $errormessage = $Lang::tr{'valid root certificate already exists'};
1719         $cgiparams{'ACTION'} = '';
1720         goto ROOTCERT_ERROR;
1721     }
1722
1723     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1724         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1725             my $ipaddr = <IPADDR>;
1726             close IPADDR;
1727             chomp ($ipaddr);
1728             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1729             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1730                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1731             }
1732         }
1733     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1734         unless (ref ($cgiparams{'FH'})) {
1735             $errormessage = $Lang::tr{'there was no file upload'};
1736             goto ROOTCERT_ERROR;
1737         }
1738
1739         # Move uploaded certificate request to a temporary file
1740         (my $fh, my $filename) = tempfile( );
1741         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1742             $errormessage = $!;
1743             goto ROOTCERT_ERROR;
1744         }
1745
1746         # Create a temporary dirctory
1747         my $tempdir = tempdir( CLEANUP => 1 );
1748
1749         # Extract the CA certificate from the file
1750         my $pid = open(OPENSSL, "|-");
1751         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1752         if ($pid) {     # parent
1753             if ($cgiparams{'P12_PASS'} ne '') {
1754                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1755             }
1756             close (OPENSSL);
1757             if ($?) {
1758                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1759                 unlink ($filename);
1760                 goto ROOTCERT_ERROR;
1761             }
1762         } else {        # child
1763             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1764                     '-in', $filename,
1765                     '-out', "$tempdir/cacert.pem")) {
1766                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1767                 unlink ($filename);
1768                 goto ROOTCERT_ERROR;
1769             }
1770         }
1771
1772         # Extract the Host certificate from the file
1773         $pid = open(OPENSSL, "|-");
1774         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1775         if ($pid) {     # parent
1776             if ($cgiparams{'P12_PASS'} ne '') {
1777                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1778             }
1779             close (OPENSSL);
1780             if ($?) {
1781                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1782                 unlink ($filename);
1783                 goto ROOTCERT_ERROR;
1784             }
1785         } else {        # child
1786             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1787                     '-in', $filename,
1788                     '-out', "$tempdir/hostcert.pem")) {
1789                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1790                 unlink ($filename);
1791                 goto ROOTCERT_ERROR;
1792             }
1793         }
1794
1795         # Extract the Host key from the file
1796         $pid = open(OPENSSL, "|-");
1797         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1798         if ($pid) {     # parent
1799             if ($cgiparams{'P12_PASS'} ne '') {
1800                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1801             }
1802             close (OPENSSL);
1803             if ($?) {
1804                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1805                 unlink ($filename);
1806                 goto ROOTCERT_ERROR;
1807             }
1808         } else {        # child
1809             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1810                     '-nodes',
1811                     '-in', $filename,
1812                     '-out', "$tempdir/serverkey.pem")) {
1813                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1814                 unlink ($filename);
1815                 goto ROOTCERT_ERROR;
1816             }
1817         }
1818
1819         unless(move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem")) {
1820             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1821             unlink ($filename);
1822             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1823             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1824             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1825             goto ROOTCERT_ERROR;
1826         }
1827
1828         unless(move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem")) {
1829             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1830             unlink ($filename);
1831             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1832             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1833             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1834             goto ROOTCERT_ERROR;
1835         }
1836
1837         unless(move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem")) {
1838             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1839             unlink ($filename);
1840             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1841             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1842             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1843             goto ROOTCERT_ERROR;
1844         }
1845
1846         goto ROOTCERT_SUCCESS;
1847
1848     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1849
1850         # Validate input since the form was submitted
1851         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1852             $errormessage = $Lang::tr{'organization cant be empty'};
1853             goto ROOTCERT_ERROR;
1854         }
1855         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1856             $errormessage = $Lang::tr{'organization too long'};
1857             goto ROOTCERT_ERROR;
1858         }
1859         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1860             $errormessage = $Lang::tr{'invalid input for organization'};
1861             goto ROOTCERT_ERROR;
1862         }
1863         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1864             $errormessage = $Lang::tr{'hostname cant be empty'};
1865             goto ROOTCERT_ERROR;
1866         }
1867         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1868             $errormessage = $Lang::tr{'invalid input for hostname'};
1869             goto ROOTCERT_ERROR;
1870         }
1871         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1872             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1873             goto ROOTCERT_ERROR;
1874         }
1875         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1876             $errormessage = $Lang::tr{'e-mail address too long'};
1877             goto ROOTCERT_ERROR;
1878         }
1879         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1880             $errormessage = $Lang::tr{'invalid input for department'};
1881             goto ROOTCERT_ERROR;
1882         }
1883         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1884             $errormessage = $Lang::tr{'invalid input for city'};
1885             goto ROOTCERT_ERROR;
1886         }
1887         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1888             $errormessage = $Lang::tr{'invalid input for state or province'};
1889             goto ROOTCERT_ERROR;
1890         }
1891         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1892             $errormessage = $Lang::tr{'invalid input for country'};
1893             goto ROOTCERT_ERROR;
1894         }
1895
1896         # Copy the cgisettings to vpnsettings and save the configfile
1897         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1898         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1899         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1900         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1901         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1902         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1903         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1904         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1905
1906         # Replace empty strings with a .
1907         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1908         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1909         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1910
1911         # refresh
1912         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1913
1914         # Create the CA certificate
1915         my $pid = open(OPENSSL, "|-");
1916         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1917         if ($pid) {     # parent
1918             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1919             print OPENSSL "$state\n";
1920             print OPENSSL "$city\n";
1921             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1922             print OPENSSL "$ou\n";
1923             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1924             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1925             close (OPENSSL);
1926             if ($?) {
1927                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1928                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1929                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1930                 goto ROOTCERT_ERROR;
1931             }
1932         } else {        # child
1933             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
1934                         '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
1935                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1936                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1937                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1938                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1939                 goto ROOTCERT_ERROR;
1940             }
1941         }
1942
1943         # Create the Host certificate request
1944         $pid = open(OPENSSL, "|-");
1945         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1946         if ($pid) {     # parent
1947             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1948             print OPENSSL "$state\n";
1949             print OPENSSL "$city\n";
1950             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1951             print OPENSSL "$ou\n";
1952             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1953             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1954             print OPENSSL ".\n";
1955             print OPENSSL ".\n";
1956             close (OPENSSL);
1957             if ($?) {
1958                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1959                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1960                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1961                 goto ROOTCERT_ERROR;
1962             }
1963         } else {        # child
1964             unless (exec ('/usr/bin/openssl', 'req', '-nodes',
1965                         '-newkey', 'rsa:2048',
1966                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1967                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1968                         '-extensions', 'server',
1969                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1970                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1971                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1972                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1973                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1974                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1975                 goto ROOTCERT_ERROR;
1976             }
1977         }
1978
1979         # Sign the host certificate request
1980         # This system call is safe, because all argeuments are passed as an array.
1981         system('/usr/bin/openssl', 'ca', '-days', '999999',
1982                 '-batch', '-notext',
1983                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1984                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1985                 '-extensions', 'server',
1986                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1987         if ($?) {
1988             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1989             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1990             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1991             unlink ("${General::swroot}/ovpn/serverkey.pem");
1992             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1993             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1994             &newcleanssldatabase();
1995             goto ROOTCERT_ERROR;
1996         } else {
1997             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1998             &deletebackupcert();
1999         }
2000
2001         # Create an empty CRL
2002         # System call is safe, because all arguments are passed as array.
2003         system('/usr/bin/openssl', 'ca', '-gencrl',
2004                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
2005                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
2006         if ($?) {
2007             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2008             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2009             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2010             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2011             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
2012             &cleanssldatabase();
2013             goto ROOTCERT_ERROR;
2014 #       } else {
2015 #           &cleanssldatabase();
2016         }
2017         # Create ta.key for tls-auth
2018         # This system call is safe, because all arguments are passed as an array.
2019         system('/usr/sbin/openvpn', '--genkey', 'secret', "${General::swroot}/ovpn/certs/ta.key");
2020         if ($?) {
2021             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2022             &cleanssldatabase();
2023             goto ROOTCERT_ERROR;
2024         }
2025         # Create Diffie Hellmann Parameter
2026         # The system call is safe, because all arguments are passed as an array.
2027         system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
2028         if ($?) {
2029             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2030             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2031             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2032             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2033             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
2034             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
2035             &cleanssldatabase();
2036             goto ROOTCERT_ERROR;
2037 #       } else {
2038 #           &cleanssldatabase();
2039         }
2040         goto ROOTCERT_SUCCESS;
2041     }
2042     ROOTCERT_ERROR:
2043     if ($cgiparams{'ACTION'} ne '') {
2044         &Header::showhttpheaders();
2045         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2046         &Header::openbigbox('100%', 'LEFT', '', '');
2047         if ($errormessage) {
2048             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2049             print "<class name='base'>$errormessage";
2050             print "&nbsp;</class>";
2051             &Header::closebox();
2052         }
2053         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
2054         print <<END;
2055         <form method='post' enctype='multipart/form-data'>
2056         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
2057         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2058             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
2059             <td width='35%' colspan='2'>&nbsp;</td></tr>
2060         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2061             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
2062             <td colspan='2'>&nbsp;</td></tr>
2063         <tr><td class='base'>$Lang::tr{'your e-mail'}:</td>
2064             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
2065             <td colspan='2'>&nbsp;</td></tr>
2066         <tr><td class='base'>$Lang::tr{'your department'}:</td>
2067             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
2068             <td colspan='2'>&nbsp;</td></tr>
2069         <tr><td class='base'>$Lang::tr{'city'}:</td>
2070             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
2071             <td colspan='2'>&nbsp;</td></tr>
2072         <tr><td class='base'>$Lang::tr{'state or province'}:</td>
2073             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
2074             <td colspan='2'>&nbsp;</td></tr>
2075         <tr><td class='base'>$Lang::tr{'country'}:</td>
2076             <td class='base'><select name='ROOTCERT_COUNTRY'>
2077
2078 END
2079         ;
2080         foreach my $country (sort keys %{Countries::countries}) {
2081             print "<option value='$Countries::countries{$country}'";
2082             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
2083                 print " selected='selected'";
2084             }
2085             print ">$country</option>";
2086         }
2087         print <<END;
2088             </select></td>
2089         <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
2090                 <td class='base'><select name='DHLENGHT'>
2091                                 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2092                                 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2093                                 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2094                         </select>
2095                 </td>
2096         </tr>
2097
2098         <tr><td>&nbsp;</td>
2099             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
2100             <td>&nbsp;</td><td>&nbsp;</td></tr>
2101         <tr><td class='base' colspan='4' align='left'>
2102             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
2103         <tr><td colspan='2'><br></td></tr>
2104         <table width='100%'>
2105         <tr>
2106                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2107                 <td class='base'>$Lang::tr{'dh key warn'}</td>
2108         </tr>
2109         <tr>
2110                 <td class='base'>$Lang::tr{'dh key warn1'}</td>
2111         </tr>
2112         <tr><td colspan='2'><br></td></tr>
2113         <tr>
2114         </table>
2115
2116         <table width='100%'>
2117         <tr><td colspan='4'><hr></td></tr>
2118         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2119             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2120             <td colspan='2'>&nbsp;</td></tr>
2121         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
2122             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2123             <td colspan='2'>&nbsp;</td></tr>
2124         <tr><td>&nbsp;</td>
2125             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2126             <td colspan='2'>&nbsp;</td></tr>
2127         <tr><td class='base' colspan='4' align='left'>
2128             <img src='/blob.gif' valign='top' alt='*' >&nbsp;$Lang::tr{'required field'}</td>
2129         </tr>
2130         </form></table>
2131 END
2132         ;
2133         &Header::closebox();
2134         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2135         &Header::closebigbox();
2136         &Header::closepage();
2137         exit(0)
2138     }
2139
2140     ROOTCERT_SUCCESS:
2141     &General::system("chmod", "600", "${General::swroot}/ovpn/certs/serverkey.pem");
2142 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
2143 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2144 #       system('/usr/local/bin/ipsecctrl', 'S');
2145 #    }
2146
2147 ###
2148 ### Enable/Disable connection
2149 ###
2150
2151 ###
2152 # m.a.d net2net
2153 ###
2154
2155 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2156
2157     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2158     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2159     my $n2nactive = '';
2160     my @ps = &General::system_output("/bin/ps", "ax");
2161
2162     if(grep(/$confighash{$cgiparams{'KEY'}}[1]/, @ps)) {
2163         $n2nactive = "1";
2164     }
2165
2166     if ($confighash{$cgiparams{'KEY'}}) {
2167                 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2168                         $confighash{$cgiparams{'KEY'}}[0] = 'on';
2169                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2170
2171                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2172                                 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2173                                 &writecollectdconf();
2174                         }
2175                 } else {
2176
2177                         $confighash{$cgiparams{'KEY'}}[0] = 'off';
2178                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2179
2180                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2181                                 if ($n2nactive ne '') {
2182                                         &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2183                                         &writecollectdconf();
2184                                 }
2185                         }
2186                 }
2187   }
2188
2189 ###
2190 ### Download OpenVPN client package
2191 ###
2192
2193
2194 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2195     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2196     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2197     my $file = '';
2198     my $clientovpn = '';
2199     my @fileholder;
2200     my $tempdir = tempdir( CLEANUP => 1 );
2201     my $zippath = "$tempdir/";
2202
2203 ###
2204 # m.a.d net2net
2205 ###
2206
2207 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2208
2209         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2210         my $zippathname = "$zippath$zipname";
2211         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2212         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
2213         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
2214         my $tunmtu = '';
2215         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
2216         my $n2nfragment = '';
2217
2218     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2219     flock CLIENTCONF, 2;
2220
2221     my $zip = Archive::Zip->new();
2222    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2223    print CLIENTCONF "# \n";
2224    print CLIENTCONF "# User Security\n";
2225    print CLIENTCONF "user nobody\n";
2226    print CLIENTCONF "group nobody\n";
2227    print CLIENTCONF "persist-tun\n";
2228    print CLIENTCONF "persist-key\n";
2229    print CLIENTCONF "script-security 2\n";
2230    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2231    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2232    print CLIENTCONF "float\n";
2233    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2234    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2235    print CLIENTCONF "# Server Gateway Network\n";
2236    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2237    print CLIENTCONF "# tun Device\n";
2238    print CLIENTCONF "dev tun\n";
2239    print CLIENTCONF "#Logfile for statistics\n";
2240    print CLIENTCONF "status-version 1\n";
2241    print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
2242    print CLIENTCONF "# Port and Protokoll\n";
2243    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2244
2245    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2246    print CLIENTCONF "proto tcp4-client\n";
2247    print CLIENTCONF "# Packet size\n";
2248    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2249    print CLIENTCONF "tun-mtu $tunmtu\n";
2250    }
2251
2252    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2253    print CLIENTCONF "proto udp4\n";
2254    print CLIENTCONF "# Paketsize\n";
2255    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2256    print CLIENTCONF "tun-mtu $tunmtu\n";
2257    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2258    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} else { print CLIENTCONF "mssfix 0\n"; }
2259    }
2260    # Check host certificate if X509 is RFC3280 compliant.
2261    # If not, old --ns-cert-type directive will be used.
2262    # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2263    my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2264    if (! grep(/TLS Web Server Authentication/, @hostcert)) {
2265                print CLIENTCONF "ns-cert-type server\n";
2266    } else {
2267                print CLIENTCONF "remote-cert-tls server\n";
2268    }
2269    print CLIENTCONF "# Auth. Client\n";
2270    print CLIENTCONF "tls-client\n";
2271    print CLIENTCONF "# Cipher\n";
2272    print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2273     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2274          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2275      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2276    }
2277
2278    # If GCM cipher is used, do not use --auth
2279    if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
2280        ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
2281        ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
2282         print CLIENTCONF unless "# HMAC algorithm\n";
2283         print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2284    } else {
2285         print CLIENTCONF "# HMAC algorithm\n";
2286         print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2287    }
2288
2289    if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2290    print CLIENTCONF "# Enable Compression\n";
2291    print CLIENTCONF "comp-lzo\n";
2292      }
2293    print CLIENTCONF "# Debug Level\n";
2294    print CLIENTCONF "verb 3\n";
2295    print CLIENTCONF "# Tunnel check\n";
2296    print CLIENTCONF "keepalive 10 60\n";
2297    print CLIENTCONF "# Start as daemon\n";
2298    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2299    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2300    print CLIENTCONF "# Activate Management Interface and Port\n";
2301    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2302     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2303    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2304
2305
2306     close(CLIENTCONF);
2307
2308     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2309     my $status = $zip->writeToFileNamed($zippathname);
2310
2311     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2312     @fileholder = <DLFILE>;
2313     print "Content-Type:application/x-download\n";
2314     print "Content-Disposition:attachment;filename=$zipname\n\n";
2315     print @fileholder;
2316     exit (0);
2317 }
2318 else
2319 {
2320         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2321         my $zippathname = "$zippath$zipname";
2322         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2323
2324 ###
2325 # m.a.d net2net
2326 ###
2327
2328     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2329     flock CLIENTCONF, 2;
2330
2331     my $zip = Archive::Zip->new();
2332
2333     print CLIENTCONF "#OpenVPN Client conf\r\n";
2334     print CLIENTCONF "tls-client\r\n";
2335     print CLIENTCONF "client\r\n";
2336     print CLIENTCONF "nobind\r\n";
2337     print CLIENTCONF "dev tun\r\n";
2338     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2339     print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n";
2340
2341     if ( $vpnsettings{'ENABLED'} eq 'on'){
2342         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2343         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2344             print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Blue interface\r\n";
2345             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2346         }
2347         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2348             print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
2349             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2350         }
2351     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2352         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2353         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2354             print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
2355             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2356         }
2357     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2358         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2359     }
2360
2361     my $file_crt = new File::Temp( UNLINK => 1 );
2362     my $file_key = new File::Temp( UNLINK => 1 );
2363     my $include_certs = 0;
2364
2365     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2366         if ($cgiparams{'MODE'} eq 'insecure') {
2367                 $include_certs = 1;
2368
2369                 # Add the CA
2370                 print CLIENTCONF ";ca cacert.pem\r\n";
2371                 $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2372
2373                 # Extract the certificate
2374                 # This system call is safe, because all arguments are passed as an array.
2375                 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2376                         '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
2377                 if ($?) {
2378                         die "openssl error: $?";
2379                 }
2380
2381                 $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die;
2382                 print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n";
2383
2384                 # Extract the key
2385                 # This system call is safe, because all arguments are passed as an array.
2386                 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2387                         '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
2388                 if ($?) {
2389                         die "openssl error: $?";
2390                 }
2391
2392                 $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die;
2393                 print CLIENTCONF ";key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2394         } else {
2395                 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2396                 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2397         }
2398     } else {
2399         print CLIENTCONF "ca cacert.pem\r\n";
2400         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2401         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2402         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2403         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2404     }
2405     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2406         print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2407
2408     if ($vpnsettings{'TLSAUTH'} eq 'on') {
2409         if ($cgiparams{'MODE'} eq 'insecure') {
2410                 print CLIENTCONF ";";
2411         }
2412         print CLIENTCONF "tls-auth ta.key\r\n";
2413         $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key")  or die "Can't add file ta.key\n";
2414     }
2415     if ($vpnsettings{DCOMPLZO} eq 'on') {
2416         print CLIENTCONF "comp-lzo\r\n";
2417     }
2418     print CLIENTCONF "verb 3\r\n";
2419         # Check host certificate if X509 is RFC3280 compliant.
2420         # If not, old --ns-cert-type directive will be used.
2421         # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2422         my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2423         if (! grep(/TLS Web Server Authentication/, @hostcert)) {
2424                 print CLIENTCONF "ns-cert-type server\r\n";
2425         } else {
2426                 print CLIENTCONF "remote-cert-tls server\r\n";
2427         }
2428     print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
2429     if ($vpnsettings{MSSFIX} eq 'on') {
2430         print CLIENTCONF "mssfix\r\n";
2431     } else {
2432         print CLIENTCONF "mssfix 0\r\n";
2433     }
2434     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2435         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2436     }
2437    if ($confighash{$cgiparams{'KEY'}}[43] eq 'on') {
2438       print CLIENTCONF "auth-nocache\r\n";
2439       print CLIENTCONF "auth-user-pass credentials\r\n";
2440       print CLIENTCONF "static-challenge \"One Time Password (OTP): \" 1\r\n";
2441
2442       open(CLIENTCREDS, ">$tempdir/credentials") or die "Unable to open tempfile: $!";
2443       print CLIENTCREDS "user\r\n";
2444       print CLIENTCREDS "password";
2445       close(CLIENTCREDS);
2446       $zip->addFile( "$tempdir/credentials", "credentials")  or die "Can't add file credentials\n";
2447    }
2448
2449     if ($include_certs) {
2450         print CLIENTCONF "\r\n";
2451
2452         # CA
2453         open(FILE, "<${General::swroot}/ovpn/ca/cacert.pem");
2454         print CLIENTCONF "<ca>\r\n";
2455         while (<FILE>) {
2456                 chomp($_);
2457                 print CLIENTCONF "$_\r\n";
2458         }
2459         print CLIENTCONF "</ca>\r\n\r\n";
2460         close(FILE);
2461
2462         # Cert
2463         open(FILE, "<$file_crt");
2464         print CLIENTCONF "<cert>\r\n";
2465         while (<FILE>) {
2466                 chomp($_);
2467                 print CLIENTCONF "$_\r\n";
2468         }
2469         print CLIENTCONF "</cert>\r\n\r\n";
2470         close(FILE);
2471
2472         # Key
2473         open(FILE, "<$file_key");
2474         print CLIENTCONF "<key>\r\n";
2475         while (<FILE>) {
2476                 chomp($_);
2477                 print CLIENTCONF "$_\r\n";
2478         }
2479         print CLIENTCONF "</key>\r\n\r\n";
2480         close(FILE);
2481
2482         # TLS auth
2483         if ($vpnsettings{'TLSAUTH'} eq 'on') {
2484                 open(FILE, "<${General::swroot}/ovpn/certs/ta.key");
2485                 print CLIENTCONF "<tls-auth>\r\n";
2486                 while (<FILE>) {
2487                         chomp($_);
2488                         print CLIENTCONF "$_\r\n";
2489                 }
2490                 print CLIENTCONF "</tls-auth>\r\n\r\n";
2491                 close(FILE);
2492         }
2493     }
2494
2495     # Print client.conf.local if entries exist to client.ovpn
2496     if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
2497        open (LCC, "$local_clientconf");
2498                print CLIENTCONF "\n#---------------------------\n";
2499                print CLIENTCONF "# Start of custom directives\n";
2500                print CLIENTCONF "# from client.conf.local\n";
2501                print CLIENTCONF "#---------------------------\n\n";
2502        while (<LCC>) {
2503                print CLIENTCONF $_;
2504        }
2505                print CLIENTCONF "\n#---------------------------\n";
2506                print CLIENTCONF "# End of custom directives\n";
2507                print CLIENTCONF "#---------------------------\n\n";
2508        close (LCC);
2509     }
2510     close(CLIENTCONF);
2511
2512     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2513     my $status = $zip->writeToFileNamed($zippathname);
2514
2515     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2516     @fileholder = <DLFILE>;
2517     print "Content-Type:application/x-download\n";
2518     print "Content-Disposition:attachment;filename=$zipname\n\n";
2519     print @fileholder;
2520     exit (0);
2521    }
2522
2523
2524
2525 ###
2526 ### Remove connection
2527 ###
2528
2529
2530 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2531         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2532         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2533
2534         if ($confighash{$cgiparams{'KEY'}}) {
2535                 # Revoke certificate if certificate was deleted and rewrite the CRL
2536                 &General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2537                 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2538
2539 ###
2540 # m.a.d net2net
2541 ###
2542
2543                 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2544                         # Stop the N2N connection before it is removed
2545                         &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2546
2547                         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2548                         my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2549                         unlink ($certfile);
2550                         unlink ($conffile);
2551
2552                         if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2553                                 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2554                         }
2555                 }
2556
2557                 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2558                 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2559
2560 # A.Marx CCD delete ccd files and routes
2561
2562                 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2563                 {
2564                         unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2565                 }
2566
2567                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2568                 foreach my $key (keys %ccdroutehash) {
2569                         if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2570                                 delete $ccdroutehash{$key};
2571                         }
2572                 }
2573                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2574
2575                 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2576                 foreach my $key (keys %ccdroute2hash) {
2577                         if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2578                                 delete $ccdroute2hash{$key};
2579                         }
2580                 }
2581                 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2582                 &writeserverconf;
2583
2584 # CCD end
2585                 # Update collectd configuration and delete all RRD files of the removed connection
2586                 &writecollectdconf();
2587                 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]");
2588
2589                 delete $confighash{$cgiparams{'KEY'}};
2590                 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2591                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2592
2593         } else {
2594                 $errormessage = $Lang::tr{'invalid key'};
2595         }
2596         &General::firewall_reload();
2597
2598 ###
2599 ### Download PKCS12 file
2600 ###
2601 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2602     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2603
2604     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2605     print "Content-Type: application/octet-stream\r\n\r\n";
2606
2607     open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2608     my @tmp = <FILE>;
2609     close(FILE);
2610
2611     print "@tmp";
2612     exit (0);
2613
2614 ###
2615 ### Display certificate
2616 ###
2617 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2618     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2619
2620     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2621         &Header::showhttpheaders();
2622         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2623         &Header::openbigbox('100%', 'LEFT', '', '');
2624         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2625         my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2626         my $output = &Header::cleanhtml(join("", @output), "y");
2627         print "<pre>$output</pre>\n";
2628         &Header::closebox();
2629         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2630         &Header::closebigbox();
2631         &Header::closepage();
2632         exit(0);
2633     }
2634
2635 ###
2636 ### Display OTP QRCode
2637 ###
2638 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show otp qrcode'}) {
2639    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2640
2641    use MIME::Base32;
2642    use MIME::Base64;
2643    use Imager::QRCode;
2644    my $qrcode = Imager::QRCode->new(
2645       size          => 6,
2646       margin        => 0,
2647       version       => 0,
2648       level         => 'M',
2649       mode          => '8-bit',
2650       casesensitive => 1,
2651       lightcolor    => Imager::Color->new(255, 255, 255),
2652       darkcolor     => Imager::Color->new(0, 0, 0),
2653    );
2654    my $cn = $confighash{$cgiparams{'KEY'}}[2];
2655    my $secret = encode_base32($confighash{$cgiparams{'KEY'}}[44]);
2656    my $issuer = "$mainsettings{'HOSTNAME'}.$mainsettings{'DOMAINNAME'}";
2657    my $qrcodeimg = $qrcode->plot("otpauth://totp/$cn?secret=$secret&issuer=$issuer");
2658    my $qrcodeimgdata;
2659    $qrcodeimg->write(data => \$qrcodeimgdata, type=> 'png')
2660       or die $qrcodeimg->errstr;
2661    $qrcodeimgdata = encode_base64($qrcodeimgdata, '');
2662
2663    &Header::showhttpheaders();
2664    &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2665    &Header::openbigbox('100%', 'LEFT', '', '');
2666    &Header::openbox('100%', 'LEFT', "$Lang::tr{'otp qrcode'}:");
2667    print <<END;
2668 $Lang::tr{'secret'}:&nbsp;$secret</br></br>
2669 <img alt="$Lang::tr{'otp qrcode'}" src="data:image/png;base64,$qrcodeimgdata">
2670 END
2671    &Header::closebox();
2672    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2673    &Header::closebigbox();
2674    &Header::closepage();
2675    exit(0);
2676
2677 ###
2678 ### Display Diffie-Hellman key
2679 ###
2680 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2681
2682     if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
2683         $errormessage = $Lang::tr{'not present'};
2684         } else {
2685                 &Header::showhttpheaders();
2686                 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2687                 &Header::openbigbox('100%', 'LEFT', '', '');
2688                 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2689                 my @output = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
2690                 my $output = &Header::cleanhtml(join("", @output) ,"y");
2691                 print "<pre>$output</pre>\n";
2692                 &Header::closebox();
2693                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2694                 &Header::closebigbox();
2695                 &Header::closepage();
2696                 exit(0);
2697     }
2698
2699 ###
2700 ### Display tls-auth key
2701 ###
2702 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2703
2704     if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2705         $errormessage = $Lang::tr{'not present'};
2706         } else {
2707                 &Header::showhttpheaders();
2708                 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2709                 &Header::openbigbox('100%', 'LEFT', '', '');
2710                 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2711
2712                 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
2713                 my @output = <FILE>;
2714                 close(FILE);
2715
2716                 my $output = &Header::cleanhtml(join("", @output),"y");
2717                 print "<pre>$output</pre>\n";
2718                 &Header::closebox();
2719                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2720                 &Header::closebigbox();
2721                 &Header::closepage();
2722                 exit(0);
2723     }
2724
2725 ###
2726 ### Display Certificate Revoke List
2727 ###
2728 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2729 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2730
2731     if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2732         $errormessage = $Lang::tr{'not present'};
2733         } else {
2734         &Header::showhttpheaders();
2735         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2736         &Header::openbigbox('100%', 'LEFT', '', '');
2737         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2738         my @output = &General::system_output("/usr/bin/openssl", "crl", "-text", "-noout", "-in", "${General::swroot}/ovpn/crls/cacrl.pem");
2739         my $output = &Header::cleanhtml(join("", @output), "y");
2740         print "<pre>$output</pre>\n";
2741         &Header::closebox();
2742         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2743         &Header::closebigbox();
2744         &Header::closepage();
2745         exit(0);
2746     }
2747
2748 ###
2749 ### Advanced Server Settings
2750 ###
2751
2752 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2753     %cgiparams = ();
2754     %cahash = ();
2755     %confighash = ();
2756     my $disabled;
2757     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2758     read_routepushfile;
2759
2760
2761 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2762 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
2763 #    }
2764 ADV_ERROR:
2765     if ($cgiparams{'MAX_CLIENTS'} eq '') {
2766                 $cgiparams{'MAX_CLIENTS'} =  '100';
2767     }
2768     if ($cgiparams{'KEEPALIVE_1'} eq '') {
2769                 $cgiparams{'KEEPALIVE_1'} =  '10';
2770     }
2771     if ($cgiparams{'KEEPALIVE_2'} eq '') {
2772                 $cgiparams{'KEEPALIVE_2'} =  '60';
2773     }
2774     if ($cgiparams{'LOG_VERB'} eq '') {
2775                 $cgiparams{'LOG_VERB'} =  '3';
2776     }
2777     if ($cgiparams{'TLSAUTH'} eq '') {
2778                 $cgiparams{'TLSAUTH'} = 'off';
2779     }
2780     $checked{'CLIENT2CLIENT'}{'off'} = '';
2781     $checked{'CLIENT2CLIENT'}{'on'} = '';
2782     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2783     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2784     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2785     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2786     $checked{'DCOMPLZO'}{'off'} = '';
2787     $checked{'DCOMPLZO'}{'on'} = '';
2788     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
2789     $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
2790     $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
2791     $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
2792     $checked{'MSSFIX'}{'off'} = '';
2793     $checked{'MSSFIX'}{'on'} = '';
2794     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2795     $selected{'LOG_VERB'}{'0'} = '';
2796     $selected{'LOG_VERB'}{'1'} = '';
2797     $selected{'LOG_VERB'}{'2'} = '';
2798     $selected{'LOG_VERB'}{'3'} = '';
2799     $selected{'LOG_VERB'}{'4'} = '';
2800     $selected{'LOG_VERB'}{'5'} = '';
2801     $selected{'LOG_VERB'}{'6'} = '';
2802     $selected{'LOG_VERB'}{'7'} = '';
2803     $selected{'LOG_VERB'}{'8'} = '';
2804     $selected{'LOG_VERB'}{'9'} = '';
2805     $selected{'LOG_VERB'}{'10'} = '';
2806     $selected{'LOG_VERB'}{'11'} = '';
2807     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2808
2809     &Header::showhttpheaders();
2810     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2811     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2812     if ($errormessage) {
2813         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2814         print "<class name='base'>$errormessage\n";
2815         print "&nbsp;</class>\n";
2816         &Header::closebox();
2817     }
2818     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2819     print <<END;
2820     <form method='post' enctype='multipart/form-data'>
2821 <table width='100%' border=0>
2822         <tr>
2823                 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2824     </tr>
2825     <tr>
2826                 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2827     </tr>
2828     <tr>
2829                 <td class='base'>Domain</td>
2830         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30'  /></td>
2831     </tr>
2832     <tr>
2833                 <td class='base'>DNS</td>
2834                 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2835     </tr>
2836     <tr>
2837                 <td class='base'>WINS</td>
2838                 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2839         </tr>
2840     <tr>
2841                 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2842     </tr>
2843     <tr>
2844                 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2845                 <td colspan='2'>
2846                 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2847 END
2848 ;
2849
2850 if ($cgiparams{'ROUTES_PUSH'} ne '')
2851 {
2852         print $cgiparams{'ROUTES_PUSH'};
2853 }
2854
2855 print <<END;
2856 </textarea></td>
2857 </tr>
2858     </tr>
2859 </table>
2860 <hr size='1'>
2861 <table width='100%'>
2862         <tr>
2863                 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2864         </tr>
2865
2866         <tr>
2867                 <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td>
2868         </tr>
2869
2870         <tr>
2871                 <td class='base'>Client-To-Client</td>
2872                 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2873         </tr>
2874
2875         <tr>
2876                 <td class='base'>Redirect-Gateway def1</td>
2877                 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2878         </tr>
2879
2880     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
2881         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
2882         <td>$Lang::tr{'openvpn default'}: off <font color='red'>($Lang::tr{'attention'} exploitable via Voracle)</font></td>
2883     </tr>
2884
2885         <tr>
2886                 <td class='base'>$Lang::tr{'ovpn add conf'}</td>
2887                 <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
2888                 <td>$Lang::tr{'openvpn default'}: off</td>
2889         </tr>
2890
2891         <tr>
2892                 <td class='base'>mssfix</td>
2893                 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2894                 <td>$Lang::tr{'openvpn default'}: off</td>
2895         </tr>
2896
2897         <tr>
2898                 <td class='base'>fragment <br></td>
2899                 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2900         </tr>
2901
2902
2903         <tr>
2904                 <td class='base'>Max-Clients</td>
2905                 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2906         </tr>
2907         <tr>
2908                 <td class='base'>Keepalive <br />
2909                 (ping/ping-restart)</td>
2910                 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2911                 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2912         </tr>
2913 </table>
2914
2915 <hr size='1'>
2916 <table width='100%'>
2917     <tr>
2918         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2919     </tr>
2920     <tr>
2921         <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
2922     </tr>
2923
2924     <tr><td class='base'>VERB</td>
2925         <td><select name='LOG_VERB'>
2926                         <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option>
2927                         <option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2928                         <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2929                         <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2930                         <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2931                         <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2932                         <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2933                         <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2934                         <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2935                         <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2936                         <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2937                         <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2938         </td></select>
2939     </table>
2940
2941 <hr size='1'>
2942 END
2943
2944 if ( -e "/var/run/openvpn.pid"){
2945 print"  <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2946                 $Lang::tr{'server restart'}<br><br>
2947                 <hr>";
2948         print<<END;
2949 <table width='100%'>
2950 <tr>
2951     <td>&nbsp;</td>
2952     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2953     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2954     <td>&nbsp;</td>
2955 </tr>
2956 </table>
2957 </form>
2958 END
2959 ;
2960
2961
2962 }else{
2963
2964         print<<END;
2965 <table width='100%'>
2966 <tr>
2967     <td>&nbsp;</td>
2968     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2969     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2970     <td>&nbsp;</td>
2971 </tr>
2972 </table>
2973 </form>
2974 END
2975 ;
2976 }
2977     &Header::closebox();
2978 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2979     &Header::closebigbox();
2980     &Header::closepage();
2981     exit(0);
2982
2983
2984 # A.Marx CCD   Add,delete or edit CCD net
2985
2986 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2987                 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2988                 $cgiparams{'ACTION'} eq "kill" ||
2989                 $cgiparams{'ACTION'} eq "edit" ||
2990                 $cgiparams{'ACTION'} eq 'editsave'){
2991         &Header::showhttpheaders();
2992         &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2993         &Header::openbigbox('100%', 'LEFT', '', '');
2994
2995         if ($cgiparams{'ACTION'} eq "kill"){
2996                 &delccdnet($cgiparams{'net'});
2997         }
2998
2999         if ($cgiparams{'ACTION'} eq 'editsave'){
3000                 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
3001                 if ( $a ne $b){ &modccdnet($a,$b);}
3002                 $cgiparams{'ccdname'}='';
3003                 $cgiparams{'ccdsubnet'}='';
3004         }
3005
3006         if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
3007                 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
3008         }
3009         if ($errormessage) {
3010             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3011             print "<class name='base'>$errormessage";
3012             print "&nbsp;</class>";
3013             &Header::closebox();
3014         }
3015 if ($cgiparams{'ACTION'} eq "edit"){
3016
3017         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
3018
3019         print <<END;
3020     <table width='100%' border='0'>
3021     <tr><form method='post'>
3022         <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
3023         <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly='readonly' /></td></tr>
3024         <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
3025         <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
3026         </td></tr>
3027         </table></form>
3028 END
3029 ;
3030         &Header::closebox();
3031
3032         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
3033         print <<END;
3034     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
3035     <tr>
3036         <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
3037 END
3038 ;
3039 }
3040 else{
3041         if (! -e "/var/run/openvpn.pid"){
3042         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
3043         print <<END;
3044             <table width='100%' border='0'>
3045             <tr><form method='post'>
3046                 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
3047                 <tr>
3048                 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
3049                 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
3050                 <tr><td colspan=4><hr /></td></tr><tr>
3051                 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
3052                 </table></form>
3053 END
3054
3055         &Header::closebox();
3056 }
3057         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
3058         if ( -e "/var/run/openvpn.pid"){
3059                 print "<b>$Lang::tr{'attention'}:</b><br>";
3060                 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
3061         }
3062
3063     print <<END;
3064     <table width='100%' cellpadding='0' cellspacing='1'>
3065     <tr>
3066         <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
3067 END
3068 ;
3069 }
3070         my %ccdconfhash=();
3071         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
3072         my @ccdconf=();
3073         my $count=0;
3074         foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
3075                 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
3076                 $count++;
3077                 my $ccdhosts = &hostsinnet($ccdconf[0]);
3078                 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
3079                 else{            print" <tr bgcolor='$color{'color20'}'>";}
3080                 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
3081         print <<END;
3082                 <form method='post' />
3083                 <input type='image' src='/images/edit.gif' align='middle' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
3084                 <input type='hidden' name='ACTION' value='edit'/>
3085                 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
3086                 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
3087                 </form></td>
3088                 <form method='post' />
3089                 <td><input type='hidden' name='ACTION' value='kill'/>
3090                 <input type='hidden' name='number' value='$count' />
3091                 <input type='hidden' name='net' value='$ccdconf[0]' />
3092                 <input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /></form></td></tr>
3093 END
3094 ;
3095         }
3096         print "</table></form>";
3097         &Header::closebox();
3098         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3099         &Header::closebigbox();
3100         &Header::closepage();
3101         exit(0);
3102
3103 #END CCD
3104
3105 ###
3106 ### Openvpn Connections Statistics
3107 ###
3108 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
3109         &Header::showhttpheaders();
3110         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
3111         &Header::openbigbox('100%', 'LEFT', '', '');
3112     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
3113
3114 #
3115 #       <td><b>$Lang::tr{'protocol'}</b></td>
3116 # protocol temp removed
3117     print <<END;
3118     <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
3119     <tr>
3120         <th><b>$Lang::tr{'common name'}</b></th>
3121         <th><b>$Lang::tr{'real address'}</b></th>
3122         <th><b>$Lang::tr{'country'}</b></th>
3123         <th><b>$Lang::tr{'virtual address'}</b></th>
3124         <th><b>$Lang::tr{'loged in at'}</b></th>
3125         <th><b>$Lang::tr{'bytes sent'}</b></th>
3126         <th><b>$Lang::tr{'bytes received'}</b></th>
3127         <th><b>$Lang::tr{'last activity'}</b></th>
3128     </tr>
3129 END
3130 ;
3131         my $filename = "/var/run/ovpnserver.log";
3132         open(FILE, $filename) or die 'Unable to open config file.';
3133         my @current = <FILE>;
3134         close(FILE);
3135         my @users =();
3136         my $status;
3137         my $uid = 0;
3138         my $cn;
3139         my @match = ();
3140         my $proto = "udp";
3141         my $address;
3142         my %userlookup = ();
3143         foreach my $line (@current)
3144         {
3145             chomp($line);
3146             if ( $line =~ /^Updated,(.+)/){
3147                 @match = split( /^Updated,(.+)/, $line);
3148                 $status = $match[1];
3149             }
3150 #gian
3151             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3152                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3153                 if ($match[1] ne "Common Name") {
3154                     $cn = $match[1];
3155                     $userlookup{$match[2]} = $uid;
3156                     $users[$uid]{'CommonName'} = $match[1];
3157                     $users[$uid]{'RealAddress'} = $match[2];
3158                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
3159                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
3160                     $users[$uid]{'Since'} = $match[5];
3161                     $users[$uid]{'Proto'} = $proto;
3162
3163                     # get country code for "RealAddress"...
3164                     my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]);
3165                     my $flag_icon = &Location::Functions::get_flag_icon($ccode);
3166                     $users[$uid]{'Country'} = "<a href='country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a>";
3167                     $uid++;
3168                 }
3169             }
3170             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
3171                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
3172                 if ($match[1] ne "Virtual Address") {
3173                     $address = $match[3];
3174                     #find the uid in the lookup table
3175                     $uid = $userlookup{$address};
3176                     $users[$uid]{'VirtualAddress'} = $match[1];
3177                     $users[$uid]{'LastRef'} = $match[4];
3178                 }
3179             }
3180         }
3181         my $user2 = @users;
3182         if ($user2 >= 1){
3183                 for (my $idx = 1; $idx <= $user2; $idx++){
3184                                                 if ($idx % 2) {
3185                                                         print "<tr>";
3186                                                         $col="bgcolor='$color{'color22'}'";
3187                                                 } else {
3188                                                         print "<tr>";
3189                                                         $col="bgcolor='$color{'color20'}'";
3190                                                 }
3191                                                 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
3192                                                 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
3193                                                 print "<td align='center' $col>$users[$idx-1]{'Country'}</td>";
3194                                                 print "<td align='center' $col>$users[$idx-1]{'VirtualAddress'}</td>";
3195                                                 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
3196                                                 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
3197                                                 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
3198                                                 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
3199                         }
3200         }
3201
3202         print "</table>";
3203         print <<END;
3204         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
3205         <tr><td></td></tr>
3206         <tr><td></td></tr>
3207         <tr><td></td></tr>
3208         <tr><td></td></tr>
3209         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
3210         </table>
3211 END
3212 ;
3213         &Header::closebox();
3214         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3215         &Header::closebigbox();
3216         &Header::closepage();
3217         exit(0);
3218
3219 ###
3220 ### Download Certificate
3221 ###
3222 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
3223     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3224
3225     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
3226         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
3227         print "Content-Type: application/octet-stream\r\n\r\n";
3228
3229         open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3230         my @tmp = <FILE>;
3231         close(FILE);
3232
3233         print "@tmp";
3234         exit (0);
3235     }
3236
3237 ###
3238 ### Enable/Disable connection
3239 ###
3240
3241 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
3242
3243     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3244     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3245
3246     if ($confighash{$cgiparams{'KEY'}}) {
3247            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
3248             $confighash{$cgiparams{'KEY'}}[0] = 'on';
3249             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3250             #&writeserverconf();
3251 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
3252 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3253 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3254 #           }
3255         } else {
3256             $confighash{$cgiparams{'KEY'}}[0] = 'off';
3257 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
3258 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3259 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3260 #           }
3261             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3262             #&writeserverconf();
3263         }
3264     } else {
3265         $errormessage = $Lang::tr{'invalid key'};
3266     }
3267
3268 ###
3269 ### Restart connection
3270 ###
3271 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3272     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3273     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3274
3275     if ($confighash{$cgiparams{'KEY'}}) {
3276 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
3277 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3278 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3279 #       }
3280     } else {
3281         $errormessage = $Lang::tr{'invalid key'};
3282     }
3283
3284 ###
3285 # m.a.d net2net
3286 ###
3287
3288 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3289         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3290         &Header::showhttpheaders();
3291         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
3292         &Header::openbigbox('100%', 'LEFT', '', '');
3293         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
3294
3295 if ( -s "${General::swroot}/ovpn/settings") {
3296
3297         print <<END;
3298             <b>$Lang::tr{'connection type'}:</b><br />
3299             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
3300             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3301                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3302             <tr><td><input type='radio' name='TYPE' value='net' /></td>
3303                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3304                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
3305                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3306           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
3307           <tr><td>&nbsp;</td><td>Import Connection Name</td></tr>
3308     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>$Lang::tr{'openvpn default'}: Client Packagename</td></tr>
3309           <tr><td colspan='3'><hr /></td></tr>
3310     <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
3311             </form></table>
3312 END
3313         ;
3314
3315
3316 } else {
3317         print <<END;
3318                     <b>$Lang::tr{'connection type'}:</b><br />
3319             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
3320             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3321             <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
3322             </form></table>
3323 END
3324         ;
3325
3326 }
3327
3328         &Header::closebox();
3329         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3330         &Header::closebigbox();
3331         &Header::closepage();
3332         exit (0);
3333
3334 ###
3335 # m.a.d net2net
3336 ###
3337
3338 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3339
3340         my @firen2nconf;
3341         my @confdetails;
3342         my $uplconffilename ='';
3343         my $uplconffilename2 ='';
3344         my $uplp12name = '';
3345         my $uplp12name2 = '';
3346         my @rem_subnet;
3347         my @rem_subnet2;
3348         my @tmposupnet3;
3349         my $key;
3350         my @n2nname;
3351
3352         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3353
3354         # Check if a file is uploaded
3355         unless (ref ($cgiparams{'FH'})) {
3356                 $errormessage = $Lang::tr{'there was no file upload'};
3357                 goto N2N_ERROR;
3358     }
3359
3360 # Move uploaded IPfire n2n package to temporary file
3361
3362     (my $fh, my $filename) = tempfile( );
3363     if (copy ($cgiparams{'FH'}, $fh) != 1) {
3364                 $errormessage = $!;
3365                 goto N2N_ERROR;
3366     }
3367
3368         my $zip = Archive::Zip->new();
3369         my $zipName = $filename;
3370         my $status = $zip->read( $zipName );
3371         if ($status != AZ_OK) {
3372                 $errormessage = "Read of $zipName failed\n";
3373                 goto N2N_ERROR;
3374         }
3375
3376         my $tempdir = tempdir( CLEANUP => 1 );
3377         my @files = $zip->memberNames();
3378         for(@files) {
3379         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3380         }
3381         my $countfiles = @files;
3382
3383 # Check if we have not more then 2 files
3384
3385         if ( $countfiles == 2){
3386                 foreach (@files){
3387                         if ( $_ =~ /.conf$/){
3388                                 $uplconffilename = $_;
3389                         }
3390                         if ( $_ =~ /.p12$/){
3391                                 $uplp12name = $_;
3392                         }
3393                 }
3394                 if (($uplconffilename eq '') || ($uplp12name eq '')){
3395                         $errormessage = "Either no *.conf or no *.p12 file found\n";
3396                         goto N2N_ERROR;
3397                 }
3398
3399                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3400                 @firen2nconf = <FILE>;
3401                 close (FILE);
3402                 chomp(@firen2nconf);
3403         } else {
3404
3405                 $errormessage = "Filecount does not match only 2 files are allowed\n";
3406                 goto N2N_ERROR;
3407         }
3408
3409 ###
3410 # m.a.d net2net
3411 ###
3412
3413  if ($cgiparams{'n2nname'} ne ''){
3414
3415   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3416   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
3417   $n2nname[0] = $cgiparams{'n2nname'};
3418   my @n2nname2 = split(/\./,$uplconffilename);
3419   $n2nname2[0] =~ s/\n|\r//g;
3420   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3421         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3422         my $input2 = "$n2nname2[0]n2n";
3423   my $output2 = "$n2nname[0]n2n";
3424   my $filename = "$tempdir/$uplconffilename";
3425   open(FILE, "< $filename") or die 'Unable to open config file.';
3426         my @current = <FILE>;
3427         close(FILE);
3428         foreach (@current) {s/$input1/$output1/g;}
3429         foreach (@current) {s/$input2/$output2/g;}
3430   open (OUT, "> $filename") || die 'Unable to open config file.';
3431   print OUT @current;
3432   close OUT;
3433
3434     }else{
3435     $uplconffilename2 =  $uplconffilename;
3436     $uplp12name2 = $uplp12name;
3437     @n2nname = split(/\./,$uplconffilename);
3438     $n2nname[0] =~ s/\n|\r//g;
3439    }
3440     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3441     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
3442
3443         #Add collectd settings to configfile
3444         open(FILE, ">> $tempdir/$uplconffilename") or die 'Unable to open config file.';
3445         print FILE "# Logfile\n";
3446         print FILE "status-version 1\n";
3447         print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
3448         close FILE;
3449
3450         unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2")) {
3451             $errormessage = "*.conf move failed: $!";
3452             unlink ($filename);
3453             goto N2N_ERROR;
3454         }
3455
3456         unless(move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2")) {
3457             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3458             unlink ($filename);
3459             goto N2N_ERROR;
3460         }
3461
3462         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3463
3464 my $complzoactive;
3465 my $mssfixactive;
3466 my $authactive;
3467 my $n2nfragment;
3468 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
3469 my @n2nproto = split(/-/, $n2nproto2[1]);
3470 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3471 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3472 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3473 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
3474 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
3475 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
3476 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
3477 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
3478 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3479 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3480 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
3481 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
3482 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
3483 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3484 my @n2ncipher = split(/ /, (grep { /^cipher/ } @firen2nconf)[0]);
3485 my @n2nauth = split(/ /, (grep { /^auth/ } @firen2nconf)[0]);;
3486
3487 ###
3488 # m.a.d delete CR and LF from arrays for this chomp doesnt work
3489 ###
3490
3491 $n2nremote[1] =~ s/\n|\r//g;
3492 $n2novpnsub[0] =~ s/\n|\r//g;
3493 $n2novpnsub[1] =~ s/\n|\r//g;
3494 $n2novpnsub[2] =~ s/\n|\r//g;
3495 $n2nproto[0] =~ s/\n|\r//g;
3496 $n2nport[1] =~ s/\n|\r//g;
3497 $n2ntunmtu[1] =~ s/\n|\r//g;
3498 $n2nremsub[1] =~ s/\n|\r//g;
3499 $n2nremsub[2] =~ s/\n|\r//g;
3500 $n2nlocalsub[2] =~ s/\n|\r//g;
3501 $n2nfragment[1] =~ s/\n|\r//g;
3502 $n2nmgmt[2] =~ s/\n|\r//g;
3503 $n2ncipher[1] =~ s/\n|\r//g;
3504 $n2nauth[1] =~ s/\n|\r//g;
3505 chomp ($complzoactive);
3506 chomp ($mssfixactive);
3507
3508 ###
3509 # m.a.d net2net
3510 ###
3511
3512 ###
3513 # Check if there is no other entry with this name
3514 ###
3515
3516         foreach my $dkey (keys %confighash) {
3517                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3518                         $errormessage = $Lang::tr{'a connection with this name already exists'};
3519                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3520             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3521       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3522                         goto N2N_ERROR;
3523                 }
3524         }
3525
3526 ###
3527 # Check if OpenVPN Subnet is valid
3528 ###
3529
3530 foreach my $dkey (keys %confighash) {
3531                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3532                         $errormessage = 'The OpenVPN Subnet is already in use';
3533                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3534             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3535       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3536                         goto N2N_ERROR;
3537                 }
3538         }
3539
3540 ###
3541 # Check if Dest Port is vaild
3542 ###
3543
3544 foreach my $dkey (keys %confighash) {
3545                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3546                         $errormessage = 'The OpenVPN Port is already in use';
3547                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3548             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3549       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3550                         goto N2N_ERROR;
3551                 }
3552         }
3553
3554
3555
3556   $key = &General::findhasharraykey (\%confighash);
3557
3558         foreach my $i (0 .. 42) { $confighash{$key}[$i] = "";}
3559
3560         $confighash{$key}[0] = 'off';
3561         $confighash{$key}[1] = $n2nname[0];
3562         $confighash{$key}[2] = $n2nname[0];
3563         $confighash{$key}[3] = 'net';
3564         $confighash{$key}[4] = 'cert';
3565         $confighash{$key}[6] = 'client';
3566         $confighash{$key}[8] =  $n2nlocalsub[2];
3567         $confighash{$key}[10] = $n2nremote[1];
3568         $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3569         $confighash{$key}[22] = $n2nmgmt[2];
3570         $confighash{$key}[23] = $mssfixactive;
3571         $confighash{$key}[24] = $n2nfragment[1];
3572         $confighash{$key}[25] = 'IPFire n2n Client';
3573         $confighash{$key}[26] = 'red';
3574         $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3575         $confighash{$key}[28] = $n2nproto[0];
3576         $confighash{$key}[29] = $n2nport[1];
3577         $confighash{$key}[30] = $complzoactive;
3578         $confighash{$key}[31] = $n2ntunmtu[1];
3579         $confighash{$key}[39] = $n2nauth[1];
3580         $confighash{$key}[40] = $n2ncipher[1];
3581         $confighash{$key}[41] = 'disabled';
3582
3583   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3584
3585   N2N_ERROR:
3586
3587         &Header::showhttpheaders();
3588         &Header::openpage('Validate imported configuration', 1, '');
3589         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3590         if ($errormessage) {
3591             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3592             print "<class name='base'>$errormessage";
3593             print "&nbsp;</class>";
3594             &Header::closebox();
3595
3596         } else
3597   {
3598                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3599         }
3600         if ($errormessage eq ''){
3601         print <<END;
3602                 <!-- ipfire net2net config gui -->
3603                 <table width='100%'>
3604                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3605     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3606     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3607                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3608                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3609                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3610                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}:</td><td><b>$confighash{$key}[11]</b></td></tr>
3611                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3612                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3613                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3614                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3615                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td><b>$confighash{$key}[23]</b></td></tr>
3616                 <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td><b>$confighash{$key}[24]</b></td></tr>
3617                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3618                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3619                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn tls auth'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
3620                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td><b>$confighash{$key}[40]</b></td></tr>
3621                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3622     </table>
3623 END
3624 ;
3625                 &Header::closebox();
3626         }
3627
3628         if ($errormessage) {
3629                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3630         } else {
3631                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3632                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3633                 print "<input type='hidden' name='KEY' value='$key' />";
3634                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3635         }
3636         &Header::closebigbox();
3637         &Header::closepage();
3638         exit(0);
3639
3640
3641 ##
3642 ### Accept IPFire n2n Package Settings
3643 ###
3644
3645   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3646
3647 ###
3648 ### Discard and Rollback IPFire n2n Package Settings
3649 ###
3650
3651   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3652
3653      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3654
3655 if ($confighash{$cgiparams{'KEY'}}) {
3656
3657      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3658      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3659      unlink ($certfile) or die "Removing $certfile fail: $!";
3660      unlink ($conffile) or die "Removing $conffile fail: $!";
3661      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3662      delete $confighash{$cgiparams{'KEY'}};
3663     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3664
3665      } else {
3666                 $errormessage = $Lang::tr{'invalid key'};
3667    }
3668
3669
3670 ###
3671 # m.a.d net2net
3672 ###
3673
3674
3675 ###
3676 ### Adding a new connection
3677 ###
3678 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3679          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3680          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3681
3682     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3683     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3684     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3685
3686     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3687                 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3688                     $errormessage = $Lang::tr{'invalid key'};
3689                     goto VPNCONF_END;
3690                 }
3691                 $cgiparams{'ENABLED'}           = $confighash{$cgiparams{'KEY'}}[0];
3692                 $cgiparams{'NAME'}              = $confighash{$cgiparams{'KEY'}}[1];
3693                 $cgiparams{'TYPE'}              = $confighash{$cgiparams{'KEY'}}[3];
3694                 $cgiparams{'AUTH'}              = $confighash{$cgiparams{'KEY'}}[4];
3695                 $cgiparams{'PSK'}               = $confighash{$cgiparams{'KEY'}}[5];
3696                 $cgiparams{'SIDE'}              = $confighash{$cgiparams{'KEY'}}[6];
3697                 $cgiparams{'LOCAL_SUBNET'}      = $confighash{$cgiparams{'KEY'}}[8];
3698                 $cgiparams{'REMOTE'}            = $confighash{$cgiparams{'KEY'}}[10];
3699                 $cgiparams{'REMOTE_SUBNET'}     = $confighash{$cgiparams{'KEY'}}[11];
3700                 $cgiparams{'OVPN_MGMT'}         = $confighash{$cgiparams{'KEY'}}[22];
3701                 $cgiparams{'MSSFIX'}            = $confighash{$cgiparams{'KEY'}}[23];
3702                 $cgiparams{'FRAGMENT'}          = $confighash{$cgiparams{'KEY'}}[24];
3703                 $cgiparams{'REMARK'}            = $confighash{$cgiparams{'KEY'}}[25];
3704                 $cgiparams{'INTERFACE'}         = $confighash{$cgiparams{'KEY'}}[26];
3705                 $cgiparams{'OVPN_SUBNET'}       = $confighash{$cgiparams{'KEY'}}[27];
3706                 $cgiparams{'PROTOCOL'}          = $confighash{$cgiparams{'KEY'}}[28];
3707                 $cgiparams{'DEST_PORT'}         = $confighash{$cgiparams{'KEY'}}[29];
3708                 $cgiparams{'COMPLZO'}           = $confighash{$cgiparams{'KEY'}}[30];
3709                 $cgiparams{'MTU'}               = $confighash{$cgiparams{'KEY'}}[31];
3710                 $cgiparams{'CHECK1'}            = $confighash{$cgiparams{'KEY'}}[32];
3711                 $name=$cgiparams{'CHECK1'}      ;
3712                 $cgiparams{$name}               = $confighash{$cgiparams{'KEY'}}[33];
3713                 $cgiparams{'RG'}                = $confighash{$cgiparams{'KEY'}}[34];
3714                 $cgiparams{'CCD_DNS1'}          = $confighash{$cgiparams{'KEY'}}[35];
3715                 $cgiparams{'CCD_DNS2'}          = $confighash{$cgiparams{'KEY'}}[36];
3716                 $cgiparams{'CCD_WINS'}          = $confighash{$cgiparams{'KEY'}}[37];
3717                 $cgiparams{'DAUTH'}             = $confighash{$cgiparams{'KEY'}}[39];
3718                 $cgiparams{'DCIPHER'}           = $confighash{$cgiparams{'KEY'}}[40];
3719                 $cgiparams{'TLSAUTH'}           = $confighash{$cgiparams{'KEY'}}[41];
3720                 $cgiparams{'OTP_STATE'}         = $confighash{$cgiparams{'KEY'}}[43];
3721         } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3722         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3723
3724 #A.Marx CCD check iroute field and convert it to decimal
3725 if ($cgiparams{'TYPE'} eq 'host') {
3726         my @temp=();
3727         my %ccdroutehash=();
3728         my $keypoint=0;
3729         my $ip;
3730         my $cidr;
3731         if ($cgiparams{'IR'} ne ''){
3732                 @temp = split("\n",$cgiparams{'IR'});
3733                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3734                 #find key to use
3735                 foreach my $key (keys %ccdroutehash) {
3736                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3737                                 $keypoint=$key;
3738                                 delete $ccdroutehash{$key};
3739                         }else{
3740                                 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3741                         }
3742                 }
3743                 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3744                 my $i=1;
3745                 my $val=0;
3746                 foreach $val (@temp){
3747                         chomp($val);
3748                         $val=~s/\s*$//g;
3749                         #check if iroute exists in ccdroute or if new iroute is part of an existing one
3750                         foreach my $key (keys %ccdroutehash) {
3751                                 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3752                                                 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3753                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3754                                                         goto VPNCONF_ERROR;
3755                                                 }
3756                                                 my ($ip1,$cidr1) = split (/\//, $val);
3757                                                 $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1));
3758                                                 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3759                                                 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3760                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3761                                                         goto VPNCONF_ERROR;
3762                                                 }
3763
3764                                 }
3765                         }
3766                         if (!&General::validipandmask($val)){
3767                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3768                                 goto VPNCONF_ERROR;
3769                         }else{
3770                                 ($ip,$cidr) = split(/\//,$val);
3771                                 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3772                                 $cidr=&General::iporsubtodec($cidr);
3773                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3774
3775                         }
3776
3777                         #check for existing network IP's
3778                         if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3779                         {
3780                                 $errormessage=$Lang::tr{'ccd err green'};
3781                                 goto VPNCONF_ERROR;
3782                         }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3783                         {
3784                                 $errormessage=$Lang::tr{'ccd err red'};
3785                                 goto VPNCONF_ERROR;
3786                         }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3787                         {
3788                                 $errormessage=$Lang::tr{'ccd err blue'};
3789                                 goto VPNCONF_ERROR;
3790                         }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3791                         {
3792                                 $errormessage=$Lang::tr{'ccd err orange'};
3793                                 goto VPNCONF_ERROR;
3794                         }
3795
3796                         if (&General::validipandmask($val)){
3797                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3798                         }else{
3799                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3800                                 goto VPNCONF_ERROR;
3801                         }
3802                         $i++;
3803                 }
3804                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3805                 &writeserverconf;
3806         }else{
3807                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3808                 foreach my $key (keys %ccdroutehash) {
3809                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3810                                 delete $ccdroutehash{$key};
3811                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3812                                 &writeserverconf;
3813                         }
3814                 }
3815         }
3816         undef @temp;
3817         #check route field and convert it to decimal
3818         my $val=0;
3819         my $i=1;
3820         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3821         #find key to use
3822         foreach my $key (keys %ccdroute2hash) {
3823                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3824                         $keypoint=$key;
3825                         delete $ccdroute2hash{$key};
3826                 }else{
3827                         $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3828                         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3829                         &writeserverconf;
3830                 }
3831         }
3832         $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3833         if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3834         @temp = split(/\|/,$cgiparams{'IFROUTE'});
3835         my %ownnet=();
3836         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3837         foreach $val (@temp){
3838                 chomp($val);
3839                 $val=~s/\s*$//g;
3840                 if ($val eq $Lang::tr{'green'})
3841                 {
3842                         $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3843                 }
3844                 if ($val eq $Lang::tr{'blue'})
3845                 {
3846                         $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3847                 }
3848                 if ($val eq $Lang::tr{'orange'})
3849                 {
3850                         $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3851                 }
3852                 my ($ip,$cidr) = split (/\//, $val);
3853
3854                 if ($val ne $Lang::tr{'ccd none'})
3855                 {
3856                         if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3857                         if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3858                         if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3859                         if (&General::validipandmask($val)){
3860                                 $val=$ip."/".&General::iporsubtodec($cidr);
3861                                 $ccdroute2hash{$keypoint}[$i] = $val;
3862                         }else{
3863                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3864                                 goto VPNCONF_ERROR;
3865                         }
3866                 }else{
3867                         $ccdroute2hash{$keypoint}[$i]='';
3868                 }
3869                 $i++;
3870         }
3871         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3872
3873         #check dns1 ip
3874         if ($cgiparams{'CCD_DNS1'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS1'})) {
3875                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3876                         goto VPNCONF_ERROR;
3877         }
3878         #check dns2 ip
3879         if ($cgiparams{'CCD_DNS2'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS2'})) {
3880                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3881                         goto VPNCONF_ERROR;
3882         }
3883         #check wins ip
3884         if ($cgiparams{'CCD_WINS'} ne '' &&  ! &General::validip($cgiparams{'CCD_WINS'})) {
3885                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3886                         goto VPNCONF_ERROR;
3887         }
3888 }
3889
3890 #CCD End
3891
3892
3893         if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3894                 $errormessage = $Lang::tr{'connection type is invalid'};
3895                 if ($cgiparams{'TYPE'} eq 'net') {
3896                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3897                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3898                         goto VPNCONF_ERROR;
3899                 }
3900                 goto VPNCONF_ERROR;
3901         }
3902
3903         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3904                 $errormessage = $Lang::tr{'name must only contain characters'};
3905                 if ($cgiparams{'TYPE'} eq 'net') {
3906                         goto VPNCONF_ERROR;
3907                 }
3908                 goto VPNCONF_ERROR;
3909         }
3910
3911         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3912                 $errormessage = $Lang::tr{'name is invalid'};
3913                 if ($cgiparams{'TYPE'} eq 'net') {
3914                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3915                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3916                         goto VPNCONF_ERROR;
3917                 }
3918                 goto VPNCONF_ERROR;
3919         }
3920
3921         if (length($cgiparams{'NAME'}) >60) {
3922                 $errormessage = $Lang::tr{'name too long'};
3923                 if ($cgiparams{'TYPE'} eq 'net') {
3924                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3925                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3926                         goto VPNCONF_ERROR;
3927                 }
3928                 goto VPNCONF_ERROR;
3929         }
3930
3931 ###
3932 # m.a.d net2net
3933 ###
3934
3935 if ($cgiparams{'TYPE'} eq 'net') {
3936         if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
3937                         $errormessage = $Lang::tr{'openvpn destination port used'};
3938                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3939             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3940       goto VPNCONF_ERROR;
3941                 }
3942     #Bugfix 10357
3943     foreach my $key (sort keys %confighash){
3944                 if ( ($confighash{$key}[22] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1]) || ($confighash{$key}[29] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1])){
3945                         $errormessage = $Lang::tr{'openvpn destination port used'};
3946                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3947             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3948       goto VPNCONF_ERROR;
3949                 }
3950         }
3951     if ($cgiparams{'DEST_PORT'} eq  '') {
3952                         $errormessage = $Lang::tr{'invalid port'};
3953                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3954             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3955       goto VPNCONF_ERROR;
3956                 }
3957
3958     # Check if the input for the transfer net is valid.
3959     if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
3960                         $errormessage = $Lang::tr{'ccd err invalidnet'};
3961                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3962             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3963                         goto VPNCONF_ERROR;
3964                 }
3965
3966     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
3967                         $errormessage = $Lang::tr{'openvpn subnet is used'};
3968                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3969             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3970                         goto VPNCONF_ERROR;
3971                 }
3972
3973           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3974             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3975             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3976             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3977             goto VPNCONF_ERROR;
3978     }
3979
3980     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3981             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3982             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3983             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3984             goto VPNCONF_ERROR;
3985     }
3986
3987     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
3988                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3989                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3990             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3991                   goto VPNCONF_ERROR;
3992                 }
3993
3994     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
3995                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3996                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3997             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3998                   goto VPNCONF_ERROR;
3999                 }
4000
4001     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
4002                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
4003                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4004             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4005                   goto VPNCONF_ERROR;
4006                 }
4007
4008         if ($cgiparams{'DEST_PORT'} <= 1023) {
4009                 $errormessage = $Lang::tr{'ovpn port in root range'};
4010                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4011             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4012                   goto VPNCONF_ERROR;
4013                 }
4014
4015         if ($cgiparams{'OVPN_MGMT'} eq '') {
4016                 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
4017                 }
4018
4019         if ($cgiparams{'OVPN_MGMT'} <= 1023) {
4020                 $errormessage = $Lang::tr{'ovpn mgmt in root range'};
4021                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4022             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4023                   goto VPNCONF_ERROR;
4024         }
4025         #Check if remote subnet is used elsewhere
4026         my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'});
4027         $warnmessage=&General::checksubnets('',$n2nip,'ovpn');
4028         if ($warnmessage){
4029                 $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
4030         }
4031 }
4032
4033 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
4034 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
4035 #           goto VPNCONF_ERROR;
4036 #       }
4037
4038         # Check if there is no other entry with this name
4039         if (! $cgiparams{'KEY'}) {
4040             foreach my $key (keys %confighash) {
4041                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4042                     $errormessage = $Lang::tr{'a connection with this name already exists'};
4043                     if ($cgiparams{'TYPE'} eq 'net') {
4044         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4045               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4046         }
4047                     goto VPNCONF_ERROR;
4048                 }
4049             }
4050         }
4051
4052         # Check if a remote host/IP has been set for the client.
4053         if ($cgiparams{'TYPE'} eq 'net') {
4054                 if ($cgiparams{'SIDE'} ne 'server' && $cgiparams{'REMOTE'} eq '') {
4055                         $errormessage = $Lang::tr{'invalid input for remote host/ip'};
4056
4057                         # Check if this is a N2N connection and drop temporary config.
4058                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4059                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4060
4061                         goto VPNCONF_ERROR;
4062                 }
4063
4064                 # Check if a remote host/IP has been configured - the field can be empty on the server side.
4065                 if ($cgiparams{'REMOTE'} ne '') {
4066                         # Check if the given IP is valid - otherwise check if it is a valid domain.
4067                         if (! &General::validip($cgiparams{'REMOTE'})) {
4068                                 # Check for a valid domain.
4069                                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
4070                                         $errormessage = $Lang::tr{'invalid input for remote host/ip'};
4071
4072                                         # Check if this is a N2N connection and drop temporary config.
4073                                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4074                                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4075
4076                                         goto VPNCONF_ERROR;
4077                                 }
4078                         }
4079                 }
4080         }
4081
4082         if ($cgiparams{'TYPE'} ne 'host') {
4083             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
4084                     $errormessage = $Lang::tr{'local subnet is invalid'};
4085                     if ($cgiparams{'TYPE'} eq 'net') {
4086               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4087                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4088               }
4089                         goto VPNCONF_ERROR;}
4090         }
4091         # Check if there is no other entry without IP-address and PSK
4092         if ($cgiparams{'REMOTE'} eq '') {
4093             foreach my $key (keys %confighash) {
4094                 if(($cgiparams{'KEY'} ne $key) &&
4095                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
4096                     $confighash{$key}[10] eq '') {
4097                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
4098                         goto VPNCONF_ERROR;
4099                 }
4100             }
4101         }
4102         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
4103                 $errormessage = $Lang::tr{'remote subnet is invalid'};
4104                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4105                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4106                 goto VPNCONF_ERROR;
4107         }
4108
4109         # Check for N2N that OpenSSL maximum of valid days will not be exceeded
4110         if ($cgiparams{'TYPE'} eq 'net') {
4111                 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4112                         $errormessage = $Lang::tr{'invalid input for valid till days'};
4113                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4114                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4115                         goto VPNCONF_ERROR;
4116                 }
4117         }
4118
4119         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
4120             $errormessage = $Lang::tr{'invalid input'};
4121             goto VPNCONF_ERROR;
4122         }
4123         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
4124             $errormessage = $Lang::tr{'invalid input'};
4125             goto VPNCONF_ERROR;
4126         }
4127
4128 #fixplausi
4129         if ($cgiparams{'AUTH'} eq 'psk')  {
4130 #           if (! length($cgiparams{'PSK'}) ) {
4131 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
4132 #               goto VPNCONF_ERROR;
4133 #           }
4134 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
4135 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
4136 #               goto VPNCONF_ERROR;
4137 #           }
4138         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
4139             if ($cgiparams{'KEY'}) {
4140                 $errormessage = $Lang::tr{'cant change certificates'};
4141                 goto VPNCONF_ERROR;
4142             }
4143             unless (ref ($cgiparams{'FH'})) {
4144                 $errormessage = $Lang::tr{'there was no file upload'};
4145                 goto VPNCONF_ERROR;
4146             }
4147
4148             # Move uploaded certificate request to a temporary file
4149             (my $fh, my $filename) = tempfile( );
4150             if (copy ($cgiparams{'FH'}, $fh) != 1) {
4151                 $errormessage = $!;
4152                 goto VPNCONF_ERROR;
4153             }
4154
4155             # Sign the certificate request and move it
4156             # Sign the host certificate request
4157             # The system call is safe, because all arguments are passed as an array.
4158             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
4159                 '-batch', '-notext',
4160                 '-in', $filename,
4161                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4162                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4163             if ($?) {
4164                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4165                 unlink ($filename);
4166                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4167                 &newcleanssldatabase();
4168                 goto VPNCONF_ERROR;
4169             } else {
4170                 unlink ($filename);
4171                 &deletebackupcert();
4172             }
4173
4174             my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4175             my $temp;
4176
4177             foreach my $line (@temp) {
4178                 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4179                         $temp = $1;
4180                         $temp =~ s+/Email+, E+;
4181                         $temp =~ s/ ST=/ S=/;
4182
4183                         last;
4184                 }
4185             }
4186
4187             $cgiparams{'CERT_NAME'} = $temp;
4188             $cgiparams{'CERT_NAME'} =~ s/,//g;
4189             $cgiparams{'CERT_NAME'} =~ s/\'//g;
4190             if ($cgiparams{'CERT_NAME'} eq '') {
4191                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4192                 goto VPNCONF_ERROR;
4193             }
4194         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
4195             if ($cgiparams{'KEY'}) {
4196                 $errormessage = $Lang::tr{'cant change certificates'};
4197                 goto VPNCONF_ERROR;
4198             }
4199             unless (ref ($cgiparams{'FH'})) {
4200                 $errormessage = $Lang::tr{'there was no file upload'};
4201                 goto VPNCONF_ERROR;
4202             }
4203             # Move uploaded certificate to a temporary file
4204             (my $fh, my $filename) = tempfile( );
4205             if (copy ($cgiparams{'FH'}, $fh) != 1) {
4206                 $errormessage = $!;
4207                 goto VPNCONF_ERROR;
4208             }
4209
4210             # Verify the certificate has a valid CA and move it
4211             my $validca = 0;
4212             my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/cacert.pem", "$filename");
4213             if (grep(/: OK/, @test)) {
4214                 $validca = 1;
4215             } else {
4216                 foreach my $key (keys %cahash) {
4217                     @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem", "$filename");
4218                     if (grep(/: OK/, @test)) {
4219                         $validca = 1;
4220                     }
4221                 }
4222             }
4223             if (! $validca) {
4224                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
4225                 unlink ($filename);
4226                 goto VPNCONF_ERROR;
4227             } else {
4228                 unless(move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem")) {
4229                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
4230                     unlink ($filename);
4231                     goto VPNCONF_ERROR;
4232                 }
4233             }
4234
4235             my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4236             my $temp;
4237
4238             foreach my $line (@temp) {
4239                 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4240                         $temp = $1;
4241                         $temp =~ s+/Email+, E+;
4242                         $temp =~ s/ ST=/ S=/;
4243
4244                         last;
4245                 }
4246             }
4247
4248             $cgiparams{'CERT_NAME'} = $temp;
4249             $cgiparams{'CERT_NAME'} =~ s/,//g;
4250             $cgiparams{'CERT_NAME'} =~ s/\'//g;
4251             if ($cgiparams{'CERT_NAME'} eq '') {
4252                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4253                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4254                 goto VPNCONF_ERROR;
4255             }
4256         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
4257             if ($cgiparams{'KEY'}) {
4258                 $errormessage = $Lang::tr{'cant change certificates'};
4259                 goto VPNCONF_ERROR;
4260             }
4261             # Validate input since the form was submitted
4262             if (length($cgiparams{'CERT_NAME'}) >60) {
4263                 $errormessage = $Lang::tr{'name too long'};
4264                 goto VPNCONF_ERROR;
4265             }
4266             if ($cgiparams{'CERT_NAME'} eq '' || $cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4267                 $errormessage = $Lang::tr{'invalid input for name'};
4268                 goto VPNCONF_ERROR;
4269             }
4270             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
4271                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
4272                 goto VPNCONF_ERROR;
4273             }
4274             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
4275                 $errormessage = $Lang::tr{'e-mail address too long'};
4276                 goto VPNCONF_ERROR;
4277             }
4278             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4279                 $errormessage = $Lang::tr{'invalid input for department'};
4280                 goto VPNCONF_ERROR;
4281             }
4282             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
4283                 $errormessage = $Lang::tr{'organization too long'};
4284                 goto VPNCONF_ERROR;
4285             }
4286             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4287                 $errormessage = $Lang::tr{'invalid input for organization'};
4288                 goto VPNCONF_ERROR;
4289             }
4290             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4291                 $errormessage = $Lang::tr{'invalid input for city'};
4292                 goto VPNCONF_ERROR;
4293             }
4294             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4295                 $errormessage = $Lang::tr{'invalid input for state or province'};
4296                 goto VPNCONF_ERROR;
4297             }
4298             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
4299                 $errormessage = $Lang::tr{'invalid input for country'};
4300                 goto VPNCONF_ERROR;
4301             }
4302             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
4303                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
4304                     $errormessage = $Lang::tr{'password too short'};
4305                     goto VPNCONF_ERROR;
4306                 }
4307             }
4308             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
4309                 $errormessage = $Lang::tr{'passwords do not match'};
4310                 goto VPNCONF_ERROR;
4311             }
4312             if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
4313                 $errormessage = $Lang::tr{'invalid input for valid till days'};
4314                 goto VPNCONF_ERROR;
4315             }
4316
4317             # Check for RW that OpenSSL maximum of valid days will not be exceeded
4318             if ($cgiparams{'TYPE'} eq 'host') {
4319                 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4320                         $errormessage = $Lang::tr{'invalid input for valid till days'};
4321                         goto VPNCONF_ERROR;
4322                 }
4323             }
4324
4325                 # Check for RW if client name is already set
4326                 if ($cgiparams{'TYPE'} eq 'host') {
4327                         foreach my $key (keys %confighash) {
4328                                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4329                                         $errormessage = $Lang::tr{'a connection with this name already exists'};
4330                                         goto VPNCONF_ERROR;
4331                                 }
4332                         }
4333                 }
4334
4335             # Replace empty strings with a .
4336             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
4337             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
4338             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
4339
4340             # Create the Host certificate request client
4341             my $pid = open(OPENSSL, "|-");
4342             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
4343             if ($pid) { # parent
4344                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
4345                 print OPENSSL "$state\n";
4346                 print OPENSSL "$city\n";
4347                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
4348                 print OPENSSL "$ou\n";
4349                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
4350                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
4351                 print OPENSSL ".\n";
4352                 print OPENSSL ".\n";
4353                 close (OPENSSL);
4354                 if ($?) {
4355                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4356                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
4357                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
4358                     goto VPNCONF_ERROR;
4359                 }
4360             } else {    # child
4361                 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4362                         '-newkey', 'rsa:2048',
4363                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4364                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4365                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
4366                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
4367                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4368                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4369                     goto VPNCONF_ERROR;
4370                 }
4371             }
4372
4373             # Sign the host certificate request
4374             # The system call is safe, because all arguments are passed as an array.
4375             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
4376                 '-batch', '-notext',
4377                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4378                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4379                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4380             if ($?) {
4381                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4382                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4383                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4384                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4385                 &newcleanssldatabase();
4386                 goto VPNCONF_ERROR;
4387             } else {
4388                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4389                 &deletebackupcert();
4390             }
4391
4392             # Create the pkcs12 file
4393             # The system call is safe, because all arguments are passed as an array.
4394             system('/usr/bin/openssl', 'pkcs12', '-export',
4395                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4396                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4397                 '-name', $cgiparams{'NAME'},
4398                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
4399                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
4400                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
4401                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4402             if ($?) {
4403                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4404                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4405                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4406                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4407                 goto VPNCONF_ERROR;
4408             } else {
4409                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4410             }
4411         } elsif ($cgiparams{'AUTH'} eq 'cert') {
4412             ;# Nothing, just editing
4413         } else {
4414             $errormessage = $Lang::tr{'invalid input for authentication method'};
4415             goto VPNCONF_ERROR;
4416         }
4417
4418         # Check if there is no other entry with this common name
4419         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
4420             foreach my $key (keys %confighash) {
4421                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
4422                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
4423                     goto VPNCONF_ERROR;
4424                 }
4425             }
4426         }
4427
4428     # Save the config
4429         my $key = $cgiparams{'KEY'};
4430
4431         if (! $key) {
4432             $key = &General::findhasharraykey (\%confighash);
4433             foreach my $i (0 .. 43) { $confighash{$key}[$i] = "";}
4434         }
4435         $confighash{$key}[0]            = $cgiparams{'ENABLED'};
4436         $confighash{$key}[1]            = $cgiparams{'NAME'};
4437         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
4438             $confighash{$key}[2]        = $cgiparams{'CERT_NAME'};
4439         }
4440
4441         $confighash{$key}[3]            = $cgiparams{'TYPE'};
4442         if ($cgiparams{'AUTH'} eq 'psk') {
4443             $confighash{$key}[4]        = 'psk';
4444             $confighash{$key}[5]        = $cgiparams{'PSK'};
4445         } else {
4446             $confighash{$key}[4]        = 'cert';
4447         }
4448         if ($cgiparams{'TYPE'} eq 'net') {
4449             $confighash{$key}[6]        = $cgiparams{'SIDE'};
4450             $confighash{$key}[11]       = $cgiparams{'REMOTE_SUBNET'};
4451         }
4452         $confighash{$key}[8]            = $cgiparams{'LOCAL_SUBNET'};
4453         $confighash{$key}[10]           = $cgiparams{'REMOTE'};
4454         if ($cgiparams{'OVPN_MGMT'} eq '') {
4455         $confighash{$key}[22]           = $confighash{$key}[29];
4456         } else {
4457         $confighash{$key}[22]           = $cgiparams{'OVPN_MGMT'};
4458         }
4459         $confighash{$key}[23]           = $cgiparams{'MSSFIX'};
4460         $confighash{$key}[24]           = $cgiparams{'FRAGMENT'};
4461         $confighash{$key}[25]           = $cgiparams{'REMARK'};
4462         $confighash{$key}[26]           = $cgiparams{'INTERFACE'};
4463 # new fields
4464         $confighash{$key}[27]           = $cgiparams{'OVPN_SUBNET'};
4465         $confighash{$key}[28]           = $cgiparams{'PROTOCOL'};
4466         $confighash{$key}[29]           = $cgiparams{'DEST_PORT'};
4467         $confighash{$key}[30]           = $cgiparams{'COMPLZO'};
4468         $confighash{$key}[31]           = $cgiparams{'MTU'};
4469         $confighash{$key}[32]           = $cgiparams{'CHECK1'};
4470         $name=$cgiparams{'CHECK1'};
4471         $confighash{$key}[33]           = $cgiparams{$name};
4472         $confighash{$key}[34]           = $cgiparams{'RG'};
4473         $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
4474         $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
4475         $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
4476         $confighash{$key}[39]           = $cgiparams{'DAUTH'};
4477         $confighash{$key}[40]           = $cgiparams{'DCIPHER'};
4478
4479         if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) {
4480                 $confighash{$key}[41] = "no-pass";
4481         }
4482
4483    $confighash{$key}[42] = 'HOTP/T30/6';
4484         $confighash{$key}[43] = $cgiparams{'OTP_STATE'};
4485         if (($confighash{$key}[43] == 'on') && ($confighash{$key}[44] == '')) {
4486                 my @otp_secret = &General::system_output("/usr/bin/openssl", "rand", "-hex", "20");
4487                 $confighash{$key}[44] = $otp_secret[0];
4488         } elsif ($confighash{$key}[43] == '') {
4489                 $confighash{$key}[44] = '';
4490         }
4491
4492         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4493
4494         if ($cgiparams{'CHECK1'} ){
4495
4496                 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
4497                 my ($a,$b,$c,$d) = split (/\./,$ccdip);
4498                         if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
4499                                 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
4500                         }
4501                         open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
4502                         print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n";
4503                         if($cgiparams{'CHECK1'} eq 'dynamic'){
4504                                 print CCDRWCONF "#This client uses the dynamic pool\n";
4505                         }else{
4506                                 print CCDRWCONF "#Ip address client and server\n";
4507                                 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
4508                         }
4509                         if ($confighash{$key}[34] eq 'on'){
4510                                 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
4511                                 print CCDRWCONF "push redirect-gateway\n";
4512                         }
4513                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4514                         if ($cgiparams{'IR'} ne ''){
4515                                 print CCDRWCONF "\n#Client routes these networks (behind Client)\n";
4516                                 foreach my $key (keys %ccdroutehash){
4517                                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
4518                                                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
4519                                                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
4520                                                         print CCDRWCONF "iroute $a $b\n";
4521                                                 }
4522                                         }
4523                                 }
4524                         }
4525                         if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
4526                         if ($cgiparams{'IFROUTE'} ne ''){
4527                                 print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n";
4528                                 foreach my $key (keys %ccdroute2hash){
4529                                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4530                                                 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
4531                                                         if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
4532                                                                 my %blue=();
4533                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
4534                                                                 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
4535                                                         }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
4536                                                                 my %orange=();
4537                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
4538                                                                 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS}  $orange{ORANGE_NETMASK}\n";
4539                                                         }else{
4540                                                                 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
4541                                                                 print CCDRWCONF "push \"route $a $b\"\n";
4542                                                         }
4543                                                 }
4544                                         }
4545                                 }
4546                         }
4547                         if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
4548                         if($cgiparams{'CCD_DNS1'} ne ''){
4549                                 print CCDRWCONF "\n#Client gets these nameservers\n";
4550                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4551                         }
4552                         if($cgiparams{'CCD_DNS2'} ne ''){
4553                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4554                         }
4555                         if($cgiparams{'CCD_WINS'} ne ''){
4556                                 print CCDRWCONF "\n#Client gets this WINS server\n";
4557                                 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4558                         }
4559                         close CCDRWCONF;
4560         }
4561
4562 ###
4563 # m.a.d n2n begin
4564 ###
4565
4566         if ($cgiparams{'TYPE'} eq 'net') {
4567
4568                 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4569                         &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4570
4571                         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4572                         my $key = $cgiparams{'KEY'};
4573                         if (! $key) {
4574                             $key = &General::findhasharraykey (\%confighash);
4575                             foreach my $i (0 .. 31) {
4576                                     $confighash{$key}[$i] = "";
4577                             }
4578                         }
4579
4580                         $confighash{$key}[0] = 'on';
4581                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4582
4583                         &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4584                 }
4585         }
4586
4587 ###
4588 # m.a.d n2n end
4589 ###
4590
4591         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4592             $cgiparams{'KEY'} = $key;
4593             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4594         }
4595         goto VPNCONF_END;
4596     } else {
4597         $cgiparams{'ENABLED'} = 'on';
4598 ###
4599 # m.a.d n2n begin
4600 ###
4601         $cgiparams{'MSSFIX'} = 'on';
4602         $cgiparams{'FRAGMENT'} = '1300';
4603         $cgiparams{'DAUTH'} = 'SHA512';
4604 ###
4605 # m.a.d n2n end
4606 ###
4607         $cgiparams{'SIDE'} = 'left';
4608         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4609             $cgiparams{'AUTH'} = 'psk';
4610         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4611             $cgiparams{'AUTH'} = 'certfile';
4612         } else {
4613             $cgiparams{'AUTH'} = 'certgen';
4614         }
4615         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4616         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4617         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
4618         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
4619         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
4620         $cgiparams{'DAYS_VALID'}        = $vpnsettings{'DAYS_VALID'} = '730';
4621     }
4622
4623     VPNCONF_ERROR:
4624     $checked{'ENABLED'}{'off'} = '';
4625     $checked{'ENABLED'}{'on'} = '';
4626     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4627     $checked{'ENABLED_BLUE'}{'off'} = '';
4628     $checked{'ENABLED_BLUE'}{'on'} = '';
4629     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4630     $checked{'ENABLED_ORANGE'}{'off'} = '';
4631     $checked{'ENABLED_ORANGE'}{'on'} = '';
4632     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4633
4634
4635     $checked{'EDIT_ADVANCED'}{'off'} = '';
4636     $checked{'EDIT_ADVANCED'}{'on'} = '';
4637     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
4638
4639     $selected{'SIDE'}{'server'} = '';
4640     $selected{'SIDE'}{'client'} = '';
4641     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
4642
4643     $selected{'PROTOCOL'}{'udp'} = '';
4644     $selected{'PROTOCOL'}{'tcp'} = '';
4645     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4646
4647
4648     $checked{'AUTH'}{'psk'} = '';
4649     $checked{'AUTH'}{'certreq'} = '';
4650     $checked{'AUTH'}{'certgen'} = '';
4651     $checked{'AUTH'}{'certfile'} = '';
4652     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
4653
4654     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
4655
4656     $checked{'COMPLZO'}{'off'} = '';
4657     $checked{'COMPLZO'}{'on'} = '';
4658     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
4659
4660     $checked{'MSSFIX'}{'off'} = '';
4661     $checked{'MSSFIX'}{'on'} = '';
4662     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4663
4664     $selected{'DCIPHER'}{'AES-256-GCM'} = '';
4665     $selected{'DCIPHER'}{'AES-192-GCM'} = '';
4666     $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4667     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
4668     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
4669     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
4670     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4671     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4672     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4673     $selected{'DCIPHER'}{'DESX-CBC'} = '';
4674     $selected{'DCIPHER'}{'SEED-CBC'} = '';
4675     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4676     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4677     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4678     $selected{'DCIPHER'}{'BF-CBC'} = '';
4679     $selected{'DCIPHER'}{'DES-CBC'} = '';
4680     # If no cipher has been chossen yet, select
4681     # the old default (AES-256-CBC) for compatiblity reasons.
4682     if ($cgiparams{'DCIPHER'} eq '') {
4683         $cgiparams{'DCIPHER'} = 'AES-256-CBC';
4684     }
4685     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4686     $selected{'DAUTH'}{'whirlpool'} = '';
4687     $selected{'DAUTH'}{'SHA512'} = '';
4688     $selected{'DAUTH'}{'SHA384'} = '';
4689     $selected{'DAUTH'}{'SHA256'} = '';
4690     $selected{'DAUTH'}{'SHA1'} = '';
4691     $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
4692     $checked{'TLSAUTH'}{'off'} = '';
4693     $checked{'TLSAUTH'}{'on'} = '';
4694     $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
4695
4696     if (1) {
4697         &Header::showhttpheaders();
4698         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
4699         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4700         if ($errormessage) {
4701             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4702             print "<class name='base'>$errormessage";
4703             print "&nbsp;</class>";
4704             &Header::closebox();
4705         }
4706
4707         if ($warnmessage) {
4708             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4709             print "<class name='base'>$warnmessage";
4710             print "&nbsp;</class>";
4711             &Header::closebox();
4712         }
4713
4714         print "<form method='post' enctype='multipart/form-data'>";
4715         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
4716
4717         if ($cgiparams{'KEY'}) {
4718             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4719             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4720         }
4721
4722         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4723         print "<table width='100%'  border='0'>\n";
4724
4725         print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>";
4726
4727         if ($cgiparams{'TYPE'} eq 'host') {
4728             if ($cgiparams{'KEY'}) {
4729                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4730             } else {
4731                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4732             }
4733 #           print "<tr><td>$Lang::tr{'interface'}</td>";
4734 #           print "<td><select name='INTERFACE'>";
4735 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4736 #               if ($netsettings{'BLUE_DEV'} ne '') {
4737 #                       print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4738 #               }
4739 #               print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4740 #               print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4741 #               print "</select></td></tr>";
4742 #               print <<END;
4743         } else {
4744             print "<input type='hidden' name='INTERFACE' value='red' />";
4745             if ($cgiparams{'KEY'}) {
4746                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4747             } else {
4748                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4749             }
4750
4751                 # If GCM ciphers are in usage, HMAC menu is disabled
4752                 my $hmacdisabled;
4753                 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
4754                         ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
4755                         ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
4756                                 $hmacdisabled = "disabled='disabled'";
4757                 };
4758
4759             print <<END;
4760                     <td width='25%'>&nbsp;</td>
4761                     <td width='25%'>&nbsp;</td></tr>
4762         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4763                 <td><select name='SIDE'>
4764                                 <option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4765                                 <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option>
4766                         </select>
4767                 </td>
4768
4769                 <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4770                 <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td>
4771         </tr>
4772
4773         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4774                 <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4775
4776                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4777                 <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td>
4778         </tr>
4779
4780         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4781                 <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td>
4782
4783                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4784                 <td><select name='PROTOCOL'>
4785                         <option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4786                         <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4787         </tr>
4788
4789         <tr>
4790                 <td class='boldbase'>$Lang::tr{'destination port'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
4791                 <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td>
4792
4793                 <td class='boldbase' nowrap='nowrap'>Management Port ($Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}):</td>
4794                 <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4795         </tr>
4796
4797         <tr><td colspan=4><hr /></td></tr><tr>
4798
4799         <tr>
4800                 <td class'base'><b>$Lang::tr{'MTU settings'}</b></td>
4801         </tr>
4802
4803         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td>
4804                 <td><input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4805                 <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4806         </tr>
4807
4808         <tr><td class='boldbase' nowrap='nowrap'>fragment:</td>
4809                 <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4810                 <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4811         </tr>
4812
4813         <tr><td class='boldbase' nowrap='nowrap'>mssfix:</td>
4814                 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4815                 <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4816         </tr>
4817
4818         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4819                 <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4820         </tr>
4821
4822 <tr><td colspan=4><hr /></td></tr><tr>
4823         <tr>
4824                 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
4825         </tr>
4826
4827         <tr><td class='boldbase'>$Lang::tr{'cipher'}</td>
4828                 <td><select name='DCIPHER'  id="n2ncipher" required>
4829                                 <option value='AES-256-GCM'             $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
4830                                 <option value='AES-192-GCM'             $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
4831                                 <option value='AES-128-GCM'             $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
4832                                 <option value='CAMELLIA-256-CBC'        $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
4833                                 <option value='CAMELLIA-192-CBC'        $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4834                                 <option value='CAMELLIA-128-CBC'        $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
4835                                 <option value='AES-256-CBC'             $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option>
4836                                 <option value='AES-192-CBC'             $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
4837                                 <option value='AES-128-CBC'             $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
4838                                 <option value='SEED-CBC'                        $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
4839                                 <option value='DES-EDE3-CBC'            $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4840                                 <option value='DESX-CBC'                        $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4841                                 <option value='DES-EDE-CBC'             $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4842                                 <option value='BF-CBC'                          $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4843                                 <option value='CAST5-CBC'                       $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4844                         </select>
4845                 </td>
4846
4847                 <td class='boldbase'>$Lang::tr{'ovpn ha'}:</td>
4848                 <td><select name='DAUTH' id="n2nhmac" $hmacdisabled>
4849                                 <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
4850                                 <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
4851                                 <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
4852                                 <option value='SHA256'                  $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
4853                                 <option value='SHA1'                    $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4854                         </select>
4855                 </td>
4856         </tr>
4857         <tr><td colspan=4><hr /></td></tr><tr>
4858
4859 END
4860 ;
4861         }
4862
4863 #### JAVA SCRIPT ####
4864 # Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange
4865 print<<END;
4866         <script>
4867                 var disable_options = false;
4868                 document.getElementById('n2ncipher').onchange = function () {
4869                         if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) {
4870                                 document.getElementById('n2nhmac').setAttribute('disabled', true);
4871                         } else {
4872                                 document.getElementById('n2nhmac').removeAttribute('disabled');
4873                         }
4874                 }
4875         </script>
4876 END
4877
4878 #jumper
4879         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}</td>";
4880         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4881
4882         if ($cgiparams{'TYPE'} eq 'host') {
4883       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4884     }
4885
4886                 print"</tr></table><br><br>";
4887 #A.Marx CCD new client
4888 if ($cgiparams{'TYPE'} eq 'host') {
4889             print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4890             my %vpnnet=();
4891             my $vpnip;
4892             &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4893             $vpnip=$vpnnet{'DOVPN_SUBNET'};
4894             &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4895             my @ccdconf=();
4896                 my $count=0;
4897                 my $checked;
4898                 $checked{'check1'}{'off'} = '';
4899             $checked{'check1'}{'on'} = '';
4900             $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4901             print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4902             print"</td></tr></table><br><br>";
4903                 my $name=$cgiparams{'CHECK1'};
4904                 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4905                 $checked{'OTP_STATE'}{$cgiparams{'OTP_STATE'}} = 'CHECKED';
4906
4907         if (! -z "${General::swroot}/ovpn/ccd.conf"){
4908                 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4909                 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
4910                         $count++;
4911                         @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4912                         if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4913                         print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4914                         &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4915                         print"</td></tr>";
4916                 }
4917                 print "</table><br><br><hr><br><br>";
4918         }
4919 }
4920 # ccd end
4921         &Header::closebox();
4922         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4923
4924                 } elsif (! $cgiparams{'KEY'}) {
4925
4926
4927             my $disabled='';
4928             my $cakeydisabled='';
4929             my $cacrtdisabled='';
4930             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4931             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4932
4933             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4934
4935
4936  if ($cgiparams{'TYPE'} eq 'host') {
4937
4938         print <<END;
4939             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4940
4941             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4942             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4943             <tr><td colspan='3'>&nbsp;</td></tr>
4944       <tr><td colspan='3'><hr /></td></tr>
4945       <tr><td colspan='3'>&nbsp;</td></tr>
4946             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4947             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4948             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4949             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4950             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4951             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4952             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4953             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4954 END
4955 ;
4956
4957 ###
4958 # m.a.d net2net
4959 ###
4960
4961 } else {
4962
4963         print <<END;
4964             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4965
4966             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4967             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4968             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4969             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4970             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4971             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4972             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4973             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4974
4975
4976 END
4977 ;
4978
4979 }
4980
4981 ###
4982 # m.a.d net2net
4983 ###
4984
4985             foreach my $country (sort keys %{Countries::countries}) {
4986                 print "<option value='$Countries::countries{$country}'";
4987                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4988                     print " selected='selected'";
4989                 }
4990                 print ">$country</option>";
4991             }
4992 ###
4993 # m.a.d net2net
4994 ###
4995
4996 if ($cgiparams{'TYPE'} eq 'host') {
4997         print <<END;
4998         </select></td></tr>
4999                 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
5000                 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
5001                 <tr><td>&nbsp;</td>
5002                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
5003                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
5004                 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<br>($Lang::tr{'confirmation'})</td>
5005                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
5006                 <tr><td colspan='3'>&nbsp;</td></tr>
5007                 <tr><td colspan='3'><hr /></td></tr>
5008                 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
5009         </table>
5010 END
5011 }else{
5012         print <<END;
5013         </select></td></tr>
5014                 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
5015                 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
5016                 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
5017                 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
5018                 <tr><td colspan='3'><hr /></td></tr>
5019                 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
5020        </table>
5021
5022 END
5023 }
5024
5025 ###
5026 # m.a.d net2net
5027 ###
5028             ;
5029             &Header::closebox();
5030
5031         }
5032
5033 #A.Marx CCD new client
5034 if ($cgiparams{'TYPE'} eq 'host') {
5035             print"<br><br>";
5036             &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
5037
5038
5039         print <<END;
5040         <table border='0' width='100%'>
5041         <tr><td width='20%'>$Lang::tr{'enable otp'}:</td><td colspan='3'><input type='checkbox' name='OTP_STATE' $checked{'OTP_STATE'}{'on'} /></td></tr>
5042         <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
5043         <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
5044         <tr><td colspan='4'>&nbsp</td></tr>
5045         <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
5046 END
5047
5048         if ($cgiparams{'IR'} ne ''){
5049                 print $cgiparams{'IR'};
5050         }else{
5051                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
5052                 foreach my $key (keys %ccdroutehash) {
5053                         if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
5054                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
5055                                                 if ($ccdroutehash{$key}[$i] ne ''){
5056                                                         print $ccdroutehash{$key}[$i]."\n";
5057                                                 }
5058                                                 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
5059                                 }
5060                         }
5061                 }
5062         }
5063
5064         print <<END;
5065 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
5066         <tr><td colspan='4'><br></td></tr>
5067         <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
5068 END
5069
5070         my $set=0;
5071         my $selorange=0;
5072         my $selblue=0;
5073         my $selgreen=0;
5074         my $helpblue=0;
5075         my $helporange=0;
5076         my $other=0;
5077         my $none=0;
5078         my @temp=();
5079
5080         our @current = ();
5081         open(FILE, "${General::swroot}/main/routing") ;
5082         @current = <FILE>;
5083         close (FILE);
5084         &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
5085         #check for "none"
5086         foreach my $key (keys %ccdroute2hash) {
5087                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5088                         if ($ccdroute2hash{$key}[1] eq ''){
5089                                 $none=1;
5090                                 last;
5091                         }
5092                 }
5093         }
5094         if ($none ne '1'){
5095                 print"<option>$Lang::tr{'ccd none'}</option>";
5096         }else{
5097                 print"<option selected>$Lang::tr{'ccd none'}</option>";
5098         }
5099         #check if static routes are defined for client
5100         foreach my $line (@current) {
5101                 chomp($line);
5102                 $line=~s/\s*$//g;                       # remove newline
5103                 @temp=split(/\,/,$line);
5104                 $temp[1] = '' unless defined $temp[1]; # not always populated
5105                 my ($a,$b) = split(/\//,$temp[1]);
5106                 $temp[1] = $a."/".&General::iporsubtocidr($b);
5107                 foreach my $key (keys %ccdroute2hash) {
5108                         if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5109                                 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5110                                         if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
5111                                                 $set=1;
5112                                         }
5113                                 }
5114                         }
5115                 }
5116                 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
5117         }
5118
5119         my %vpnconfig = ();
5120         &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
5121         foreach my $vpn (keys %vpnconfig) {
5122                 # Skip all disabled VPN connections
5123                 my $enabled = $vpnconfig{$vpn}[0];
5124                 next unless ($enabled eq "on");
5125
5126                 my $name = $vpnconfig{$vpn}[1];
5127
5128                 # Remote subnets
5129                 my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
5130                 foreach my $network (@networks) {
5131                         my $selected = "";
5132
5133                         foreach my $key (keys %ccdroute2hash) {
5134                                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
5135                                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5136                                                 if ($ccdroute2hash{$key}[$i] eq $network) {
5137                                                         $selected = "selected";
5138                                                 }
5139                                         }
5140                                 }
5141                         }
5142
5143                         print "<option value=\"$network\" $selected>$name ($network)</option>\n";
5144                 }
5145         }
5146
5147         #check if green,blue,orange are defined for client
5148         foreach my $key (keys %ccdroute2hash) {
5149                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5150                         $other=1;
5151                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5152                                 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
5153                                         $selgreen=1;
5154                                 }
5155                                 if (&haveBlueNet()){
5156                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
5157                                                 $selblue=1;
5158                                         }
5159                                 }
5160                                 if (&haveOrangeNet()){
5161                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
5162                                                 $selorange=1;
5163                                         }
5164                                 }
5165                         }
5166                 }
5167         }
5168         if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
5169         if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
5170         if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
5171
5172         print<<END;
5173         </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
5174         <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
5175         <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
5176
5177 END
5178 ;
5179      &Header::closebox();
5180 }
5181         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5182         if ($cgiparams{'KEY'}) {
5183 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
5184         }
5185         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
5186         &Header::closebigbox();
5187         &Header::closepage();
5188         exit (0);
5189     }
5190     VPNCONF_END:
5191 }
5192
5193 #    SETTINGS_ERROR:
5194 ###
5195 ### Default status page
5196 ###
5197     %cgiparams = ();
5198     %cahash = ();
5199     %confighash = ();
5200     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
5201     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
5202     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
5203
5204     open(FILE, "/var/run/ovpnserver.log");
5205     my @status = <FILE>;
5206     close(FILE);
5207
5208     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
5209                 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
5210                     my $ipaddr = <IPADDR>;
5211                     close IPADDR;
5212                     chomp ($ipaddr);
5213                     $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
5214                     if ($cgiparams{'VPN_IP'} eq '') {
5215                                 $cgiparams{'VPN_IP'} = $ipaddr;
5216                     }
5217                 }
5218     }
5219
5220 #default setzen
5221     if ($cgiparams{'DCIPHER'} eq '') {
5222                 $cgiparams{'DCIPHER'} =  'AES-256-CBC';
5223     }
5224     if ($cgiparams{'DDEST_PORT'} eq '') {
5225                 $cgiparams{'DDEST_PORT'} =  '1194';
5226     }
5227     if ($cgiparams{'DMTU'} eq '') {
5228                 $cgiparams{'DMTU'} =  '1400';
5229     }
5230     if ($cgiparams{'MSSFIX'} eq '') {
5231                 $cgiparams{'MSSFIX'} = 'off';
5232     }
5233         if ($cgiparams{'DAUTH'} eq '') {
5234                 if (-z "${General::swroot}/ovpn/ovpnconfig") {
5235                         $cgiparams{'DAUTH'} = 'SHA512';
5236                 }
5237                 foreach my $key (keys %confighash) {
5238                         if ($confighash{$key}[3] ne 'host') {
5239                                 $cgiparams{'DAUTH'} = 'SHA512';
5240                         } else {
5241                                 $cgiparams{'DAUTH'} = 'SHA1';
5242                         }
5243                 }
5244         }
5245         if ($cgiparams{'TLSAUTH'} eq '') {
5246                 $cgiparams{'TLSAUTH'} = 'off';
5247         }
5248     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
5249                 $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
5250     }
5251     $checked{'ENABLED'}{'off'} = '';
5252     $checked{'ENABLED'}{'on'} = '';
5253     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
5254     $checked{'ENABLED_BLUE'}{'off'} = '';
5255     $checked{'ENABLED_BLUE'}{'on'} = '';
5256     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
5257     $checked{'ENABLED_ORANGE'}{'off'} = '';
5258     $checked{'ENABLED_ORANGE'}{'on'} = '';
5259     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
5260
5261     $selected{'DPROTOCOL'}{'udp'} = '';
5262     $selected{'DPROTOCOL'}{'tcp'} = '';
5263     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
5264
5265     $selected{'DCIPHER'}{'AES-256-GCM'} = '';
5266     $selected{'DCIPHER'}{'AES-192-GCM'} = '';
5267     $selected{'DCIPHER'}{'AES-128-GCM'} = '';
5268     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
5269     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
5270     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
5271     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
5272     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
5273     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
5274     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
5275     $selected{'DCIPHER'}{'DESX-CBC'} = '';
5276     $selected{'DCIPHER'}{'SEED-CBC'} = '';
5277     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
5278     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
5279     $selected{'DCIPHER'}{'BF-CBC'} = '';
5280     $selected{'DCIPHER'}{'DES-CBC'} = '';
5281     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
5282
5283     $selected{'DAUTH'}{'whirlpool'} = '';
5284     $selected{'DAUTH'}{'SHA512'} = '';
5285     $selected{'DAUTH'}{'SHA384'} = '';
5286     $selected{'DAUTH'}{'SHA256'} = '';
5287     $selected{'DAUTH'}{'SHA1'} = '';
5288     $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
5289
5290     $checked{'TLSAUTH'}{'off'} = '';
5291     $checked{'TLSAUTH'}{'on'} = '';
5292     $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
5293
5294     $checked{'DCOMPLZO'}{'off'} = '';
5295     $checked{'DCOMPLZO'}{'on'} = '';
5296     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
5297
5298 # m.a.d
5299     $checked{'MSSFIX'}{'off'} = '';
5300     $checked{'MSSFIX'}{'on'} = '';
5301     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
5302 #new settings
5303     &Header::showhttpheaders();
5304     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
5305     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
5306
5307     if ($errormessage) {
5308         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
5309         print "<class name='base'>$errormessage\n";
5310         print "&nbsp;</class>\n";
5311         &Header::closebox();
5312     }
5313
5314         if ($cryptoerror) {
5315                 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
5316                 print "<class name='base'>$cryptoerror";
5317                 print "&nbsp;</class>";
5318                 &Header::closebox();
5319         }
5320
5321         if ($cryptowarning) {
5322                 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
5323                 print "<class name='base'>$cryptowarning";
5324                 print "&nbsp;</class>";
5325                 &Header::closebox();
5326         }
5327
5328         if ($warnmessage) {
5329                 &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
5330                 print "$warnmessage<br>";
5331                 print "$Lang::tr{'fwdfw warn1'}<br>";
5332                 &Header::closebox();
5333                 print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>";
5334                 &Header::closepage();
5335                 exit 0;
5336         }
5337
5338     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
5339     my $srunning = "no";
5340     my $activeonrun = "";
5341     if ( -e "/var/run/openvpn.pid"){
5342         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
5343         $srunning ="yes";
5344         $activeonrun = "";
5345     } else {
5346         $activeonrun = "disabled='disabled'";
5347     }
5348     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
5349         print <<END;
5350     <table width='100%' border='0'>
5351     <form method='post'>
5352     <td width='25%'>&nbsp;</td>
5353     <td width='25%'>&nbsp;</td>
5354     <td width='25%'>&nbsp;</td></tr>
5355     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
5356     <td align='left'>$sactive</td>
5357     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
5358     <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
5359 END
5360 ;
5361     if (&haveBlueNet()) {
5362         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
5363         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
5364     }
5365     if (&haveOrangeNet()) {
5366         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
5367         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
5368     }
5369
5370         print <<END;
5371
5372         <tr><td colspan='4'><br></td></tr>
5373         <tr>
5374                 <td class'base'><b>$Lang::tr{'net config'}:</b></td>
5375         </tr>
5376     <tr><td colspan='1'><br></td></tr>
5377
5378     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
5379         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
5380     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
5381         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
5382                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
5383         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
5384         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
5385     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
5386         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}' size='5' /></td>
5387     </tr>
5388
5389         <tr><td colspan='4'><br></td></tr>
5390         <tr>
5391                 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
5392         </tr>
5393         <tr><td colspan='1'><br></td></tr>
5394
5395         <tr>
5396                 <td class='base'>$Lang::tr{'ovpn ha'}</td>
5397                 <td><select name='DAUTH'>
5398                                 <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
5399                                 <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
5400                                 <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
5401                                 <option value='SHA256'                  $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
5402                                 <option value='SHA1'                    $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5403                         </select>
5404                 </td>
5405
5406                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
5407                 <td><select name='DCIPHER'>
5408                                 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
5409                                 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
5410                                 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
5411                                 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
5412                                 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
5413                                 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
5414                                 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option>
5415                                 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
5416                                 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
5417                                 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
5418                                 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5419                                 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5420                                 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5421                                 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5422                                 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5423                         </select>
5424                 </td>
5425         </tr>
5426
5427     <tr><td colspan='4'><br></td></tr>
5428         <tr>
5429                 <td class='base'>$Lang::tr{'ovpn tls auth'}</td>
5430                 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
5431         </tr>
5432
5433     <tr><td colspan='4'><br><br></td></tr>
5434 END
5435 ;
5436
5437     if ( $srunning eq "yes" ) {
5438         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
5439         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5440         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5441         print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
5442     } else{
5443         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5444         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5445         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5446         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
5447              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
5448              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
5449              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
5450             (( $cgiparams{'ENABLED'} eq 'on') ||
5451             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
5452             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
5453             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
5454         } else {
5455             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
5456         }
5457     }
5458     print "</form></table>";
5459     &Header::closebox();
5460
5461     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
5462 ###
5463 # m.a.d net2net
5464 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
5465 ###
5466
5467     &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' });
5468         ;
5469         my $id = 0;
5470         my $gif;
5471         my $col1="";
5472         my $lastnet;
5473         foreach my $key (sort { ncmp ($confighash{$a}[32],$confighash{$b}[32]) } sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
5474                 if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]=$Lang::tr{'fwhost OpenVPN N-2-N'};}
5475                 if ($confighash{$key}[32] eq "dynamic"){$confighash{$key}[32]=$Lang::tr{'ccd dynrange'};}
5476                 if($id == 0){
5477                         print"<b>$confighash{$key}[32]</b>";
5478                         print <<END;
5479         <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5480 <tr>
5481         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5482         <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5483         <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5484         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
5485         <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5486 </tr>
5487 END
5488                 }
5489                 if ($id > 0 && $lastnet ne $confighash{$key}[32]){
5490                         print "</table><br>";
5491                         print"<b>$confighash{$key}[32]</b>";
5492                         print <<END;
5493         <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5494 <tr>
5495         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5496         <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5497         <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5498         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
5499         <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5500 </tr>
5501 END
5502                 }
5503         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
5504         if ($id % 2) {
5505                 print "<tr>";
5506                 $col="bgcolor='$color{'color20'}'";
5507         } else {
5508                 print "<tr>";
5509                 $col="bgcolor='$color{'color22'}'";
5510         }
5511         print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
5512         print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
5513         #if ($confighash{$key}[4] eq 'cert') {
5514             #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
5515         #} else {
5516             #print "<td align='left'>&nbsp;</td>";
5517         #}
5518         my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
5519         my $cavalid;
5520
5521         foreach my $line (@cavalid) {
5522                 if ($line =~ /Not After : (.*)[\n]/) {
5523                         $cavalid    = $1;
5524
5525                         last;
5526                 }
5527         }
5528
5529         print "<td align='center' $col>$confighash{$key}[25]</td>";
5530         $col1="bgcolor='${Header::colourred}'";
5531         my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
5532
5533         if ($confighash{$key}[0] eq 'off') {
5534                 $col1="bgcolor='${Header::colourblue}'";
5535                 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
5536         } else {
5537
5538 ###
5539 # m.a.d net2net
5540 ###
5541
5542        if ($confighash{$key}[3] eq 'net') {
5543
5544         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
5545           my @output = "";
5546           my @tustate = "";
5547           my $tport = $confighash{$key}[22];
5548           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
5549           if ($tport ne '') {
5550           $tnet->open('127.0.0.1');
5551           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
5552           @tustate = split(/\,/, $output[1]);
5553 ###
5554 #CONNECTING    -- OpenVPN's initial state.
5555 #WAIT          -- (Client only) Waiting for initial response from server.
5556 #AUTH          -- (Client only) Authenticating with server.
5557 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
5558 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
5559 #ADD_ROUTES    -- Adding routes to system.
5560 #CONNECTED     -- Initialization Sequence Completed.
5561 #RECONNECTING  -- A restart has occurred.
5562 #EXITING       -- A graceful exit is in progress.
5563 ####
5564
5565                 if (($tustate[1] eq 'CONNECTED') || ($tustate[1] eq 'WAIT')) {
5566                         $col1="bgcolor='${Header::colourgreen}'";
5567                         $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5568                 }else {
5569                         $col1="bgcolor='${Header::colourred}'";
5570                         $active = "<b><font color='#FFFFFF'>$tustate[1]</font></b>";
5571                 }
5572            }
5573            }
5574         }else {
5575
5576                                 my $cn;
5577                                 my @match = ();
5578                 foreach my $line (@status) {
5579                         chomp($line);
5580                         if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
5581                                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
5582                                 if ($match[1] ne "Common Name") {
5583                                         $cn = $match[1];
5584                                 }
5585                                 $cn =~ s/[_]/ /g;
5586                                 if ($cn eq "$confighash{$key}[2]") {
5587                                         $col1="bgcolor='${Header::colourgreen}'";
5588                                         $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5589                                 }
5590                         }
5591                 }
5592         }
5593 }
5594
5595
5596     print <<END;
5597         <td align='center' $col1>$active</td>
5598
5599         <form method='post' name='frm${key}a'><td align='center' $col>
5600             <input type='image'  name='$Lang::tr{'dl client arch'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
5601             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5602             <input type='hidden' name='KEY' value='$key' />
5603         </td></form>
5604 END
5605         ;
5606
5607         if ($confighash{$key}[41] eq "no-pass") {
5608                 print <<END;
5609                         <form method='post' name='frm${key}g'><td align='center' $col>
5610                                 <input type='image'  name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png'
5611                                         alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' />
5612                                 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5613                                 <input type='hidden' name='MODE' value='insecure' />
5614                                 <input type='hidden' name='KEY' value='$key' />
5615                         </td></form>
5616 END
5617         } else {
5618                 print "<td $col>&nbsp;</td>";
5619         }
5620
5621         if ($confighash{$key}[4] eq 'cert') {
5622             print <<END;
5623             <form method='post' name='frm${key}b'><td align='center' $col>
5624                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
5625                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
5626                 <input type='hidden' name='KEY' value='$key' />
5627             </td></form>
5628 END
5629         ; } else {
5630             print "<td>&nbsp;</td>";
5631         }
5632
5633    if ($confighash{$key}[43] eq 'on') {
5634       print <<END;
5635 <form method='post' name='frm${key}o'><td align='center' $col>
5636 <input type='image' name='$Lang::tr{'show otp qrcode'}' src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}' title='$Lang::tr{'show otp qrcode'}' border='0' />
5637 <input type='hidden' name='ACTION' value='$Lang::tr{'show otp qrcode'}' />
5638 <input type='hidden' name='KEY' value='$key' />
5639 </td></form>
5640 END
5641 ; } else {
5642       print "<td $col>&nbsp;</td>";
5643    }
5644
5645         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
5646             print <<END;
5647             <form method='post' name='frm${key}c'><td align='center' $col>
5648                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
5649                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
5650                 <input type='hidden' name='KEY' value='$key' />
5651             </td></form>
5652 END
5653         ; } elsif ($confighash{$key}[4] eq 'cert') {
5654             print <<END;
5655             <form method='post' name='frm${key}c'><td align='center' $col>
5656                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
5657                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
5658                 <input type='hidden' name='KEY' value='$key' />
5659             </td></form>
5660 END
5661         ; } else {
5662             print "<td>&nbsp;</td>";
5663         }
5664         print <<END
5665         <form method='post' name='frm${key}d'><td align='center' $col>
5666             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
5667             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
5668             <input type='hidden' name='KEY' value='$key' />
5669         </td></form>
5670
5671         <form method='post' name='frm${key}e'><td align='center' $col>
5672             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5673             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5674             <input type='hidden' name='KEY' value='$key' />
5675         </td></form>
5676         <form method='post' name='frm${key}f'><td align='center' $col>
5677             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5678             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5679             <input type='hidden' name='KEY' value='$key' />
5680         </td></form>
5681         </tr>
5682 END
5683         ;
5684         $id++;
5685         $lastnet = $confighash{$key}[32];
5686     }
5687     print"</table>";
5688     ;
5689
5690     # If the config file contains entries, print Key to action icons
5691     if ( $id ) {
5692     print <<END;
5693     <table border='0'>
5694     <tr>
5695                 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5696                 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5697                 <td class='base'>$Lang::tr{'click to disable'}</td>
5698                 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5699                 <td class='base'>$Lang::tr{'show certificate'}</td>
5700                 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5701                 <td class='base'>$Lang::tr{'edit'}</td>
5702                 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5703                 <td class='base'>$Lang::tr{'remove'}</td>
5704     </tr>
5705     <tr>
5706                 <td>&nbsp; </td>
5707                 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5708                 <td class='base'>$Lang::tr{'click to enable'}</td>
5709                 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5710                 <td class='base'>$Lang::tr{'download certificate'}</td>
5711                 <td>&nbsp; &nbsp; <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5712                 <td class='base'>$Lang::tr{'dl client arch'}</td>
5713                 <td>&nbsp; &nbsp; <img src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}'/></td>
5714                 <td class='base'>$Lang::tr{'show otp qrcode'}</td>
5715                 </tr>
5716     </table><br>
5717 END
5718     ;
5719     }
5720
5721     print <<END;
5722     <table width='100%'>
5723     <form method='post'>
5724     <tr><td align='right'>
5725                 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5726                 <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td>
5727         </tr>
5728     </form>
5729     </table>
5730 END
5731     ;
5732         &Header::closebox();
5733         }
5734
5735     # CA/key listing
5736     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}");
5737     print <<END;
5738     <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5739     <tr>
5740                 <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5741                 <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
5742                 <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
5743     </tr>
5744 END
5745     ;
5746     my $col1="bgcolor='$color{'color22'}'";
5747     my $col2="bgcolor='$color{'color20'}'";
5748     # DH parameter line
5749     my $col3="bgcolor='$color{'color22'}'";
5750     # ta.key line
5751     my $col4="bgcolor='$color{'color20'}'";
5752
5753     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
5754                 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
5755                 my $casubject;
5756
5757                 foreach my $line (@casubject) {
5758                         if ($line =~ /Subject: (.*)[\n]/) {
5759                                 $casubject    = $1;
5760                                 $casubject    =~ s+/Email+, E+;
5761                                 $casubject    =~ s/ ST=/ S=/;
5762
5763                                 last;
5764                         }
5765                 }
5766
5767                 print <<END;
5768                 <tr>
5769                         <td class='base' $col1>$Lang::tr{'root certificate'}</td>
5770                         <td class='base' $col1>$casubject</td>
5771                         <form method='post' name='frmrootcrta'><td width='3%' align='center' $col1>
5772                         <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
5773                         <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
5774                         </form>
5775                         <form method='post' name='frmrootcrtb'><td width='3%' align='center' $col1>
5776                         <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
5777                         <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
5778                         </form>
5779                         <td width='4%' $col1>&nbsp;</td>
5780                 </tr>
5781 END
5782                 ;
5783     } else {
5784                 # display rootcert generation buttons
5785                 print <<END;
5786                 <tr>
5787                         <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
5788                         <td class='base' $col1>$Lang::tr{'not present'}</td>
5789                         <td colspan='3' $col1>&nbsp;</td>
5790                 </tr>
5791 END
5792                 ;
5793     }
5794
5795     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
5796                 my @hostsubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
5797                 my $hostsubject;
5798
5799                 foreach my $line (@hostsubject) {
5800                         if ($line =~ /Subject: (.*)[\n]/) {
5801                                 $hostsubject    = $1;
5802                                 $hostsubject    =~ s+/Email+, E+;
5803                                 $hostsubject    =~ s/ ST=/ S=/;
5804
5805                                 last;
5806                         }
5807                 }
5808
5809                 print <<END;
5810                 <tr>
5811                         <td class='base' $col2>$Lang::tr{'host certificate'}</td>
5812                         <td class='base' $col2>$hostsubject</td>
5813                         <form method='post' name='frmhostcrta'><td width='3%' align='center' $col2>
5814                         <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
5815                         <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
5816                         </form>
5817                         <form method='post' name='frmhostcrtb'><td width='3%' align='center' $col2>
5818                         <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/media-floppy.png' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" border='0' />
5819                         <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
5820                         </td></form>
5821                         <td width='4%' $col2>&nbsp;</td>
5822                 </tr>
5823 END
5824                 ;
5825     } else {
5826                 # Nothing
5827                 print <<END;
5828                 <tr>
5829                         <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
5830                         <td class='base' $col2>$Lang::tr{'not present'}</td>
5831                         </td><td colspan='3' $col2>&nbsp;</td>
5832                 </tr>
5833 END
5834                 ;
5835     }
5836
5837     # Adding DH parameter to chart
5838     if (-f "${General::swroot}/ovpn/ca/dh1024.pem") {
5839                 my @dhsubject = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
5840                 my $dhsubject;
5841
5842                 foreach my $line (@dhsubject) {
5843                         if ($line =~ /    (.*)[\n]/) {
5844                                 $dhsubject = $1;
5845
5846                                 last;
5847                         }
5848                 }
5849
5850         print <<END;
5851                 <tr>
5852                         <td class='base' $col3>$Lang::tr{'dh parameter'}</td>
5853                         <td class='base' $col3>$dhsubject</td>
5854                         <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
5855                         <input type='hidden' name='ACTION' value='$Lang::tr{'show dh'}' />
5856                         <input type='image' name='$Lang::tr{'show dh'}' src='/images/info.gif' alt='$Lang::tr{'show dh'}' title='$Lang::tr{'show dh'}' width='20' height='20' border='0' />
5857                         </form>
5858                         <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
5859                         </form>
5860                         <td width='4%' $col3>&nbsp;</td>
5861                 </tr>
5862 END
5863                 ;
5864     } else {
5865                 # Nothing
5866                 print <<END;
5867                 <tr>
5868                         <td width='25%' class='base' $col3>$Lang::tr{'dh parameter'}:</td>
5869                         <td class='base' $col3>$Lang::tr{'not present'}</td>
5870                         </td><td colspan='3' $col3>&nbsp;</td>
5871                 </tr>
5872 END
5873                 ;
5874     }
5875
5876     # Adding ta.key to chart
5877     if (-f "${General::swroot}/ovpn/certs/ta.key") {
5878                 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
5879                 my @tasubject = <FILE>;
5880                 close(FILE);
5881
5882                 my $tasubject;
5883                 foreach my $line (@tasubject) {
5884                         if($line =~ /# (.*)[\n]/) {
5885                                 $tasubject    = $1;
5886
5887                                 last;
5888                         }
5889                 }
5890
5891                 print <<END;
5892
5893                 <tr>
5894                         <td class='base' $col4>$Lang::tr{'ta key'}</td>
5895                         <td class='base' $col4>$tasubject</td>
5896                         <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5897                         <input type='hidden' name='ACTION' value='$Lang::tr{'show tls-auth key'}' />
5898                         <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show tls-auth key'}' title='$Lang::tr{'show tls-auth key'}' width='20' height='20' border='0' />
5899                         </form>
5900                         <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5901                         <input type='image' name='$Lang::tr{'download tls-auth key'}' src='/images/media-floppy.png' alt='$Lang::tr{'download tls-auth key'}' title='$Lang::tr{'download tls-auth key'}' border='0' />
5902                         <input type='hidden' name='ACTION' value='$Lang::tr{'download tls-auth key'}' />
5903                         </form>
5904                         <td width='4%' $col4>&nbsp;</td>
5905                 </tr>
5906 END
5907                 ;
5908     } else {
5909                 # Nothing
5910                 print <<END;
5911                 <tr>
5912                         <td width='25%' class='base' $col4>$Lang::tr{'ta key'}:</td>
5913                         <td class='base' $col4>$Lang::tr{'not present'}</td>
5914                         <td colspan='3' $col4>&nbsp;</td>
5915                 </tr>
5916 END
5917                 ;
5918     }
5919
5920     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
5921         print "<tr><td colspan='5' align='center'><form method='post'>";
5922                 print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
5923         print "</form></td></tr>\n";
5924     }
5925
5926     if (keys %cahash > 0) {
5927                 foreach my $key (keys %cahash) {
5928                         if (($key + 1) % 2) {
5929                                 print "<tr bgcolor='$color{'color20'}'>\n";
5930                         } else {
5931                                 print "<tr bgcolor='$color{'color22'}'>\n";
5932                         }
5933                         print "<td class='base'>$cahash{$key}[0]</td>\n";
5934                         print "<td class='base'>$cahash{$key}[1]</td>\n";
5935                         print <<END;
5936                         <form method='post' name='cafrm${key}a'><td align='center'>
5937                                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
5938                                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
5939                                 <input type='hidden' name='KEY' value='$key' />
5940                         </td></form>
5941                         <form method='post' name='cafrm${key}b'><td align='center'>
5942                                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
5943                                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
5944                                 <input type='hidden' name='KEY' value='$key' />
5945                         </td></form>
5946                         <form method='post' name='cafrm${key}c'><td align='center'>
5947                                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
5948                                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
5949                                 <input type='hidden' name='KEY' value='$key' />
5950                         </td></form></tr>
5951 END
5952                         ;
5953                 }
5954     }
5955
5956     print "</table>";
5957
5958     # If the file contains entries, print Key to action icons
5959     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
5960                 print <<END;
5961                 <table>
5962                 <tr>
5963                         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5964                         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5965                         <td class='base'>$Lang::tr{'show certificate'}</td>
5966                         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
5967                         <td class='base'>$Lang::tr{'download certificate'}</td>
5968                 </tr>
5969                 </table>
5970 END
5971                 ;
5972     }
5973
5974         print <<END
5975
5976         <br><hr><br>
5977
5978         <form method='post' enctype='multipart/form-data'>
5979                 <table border='0' width='100%'>
5980                         <tr>
5981                                 <td colspan='4'><b>$Lang::tr{'upload ca certificate'}</b></td>
5982                         </tr>
5983
5984                         <tr>
5985                                 <td width='10%'>$Lang::tr{'ca name'}:</td>
5986                                 <td width='30%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'></td>
5987                                 <td width='30%'><input type='file' name='FH' size='25'>
5988                                 <td width='30%'align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}'></td>
5989                         </tr>
5990
5991                         <tr>
5992                                 <td colspan='3'>&nbsp;</td>
5993                                 <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
5994                         </tr>
5995                 </table>
5996
5997                 <br>
5998
5999                 <table border='0' width='100%'>
6000                         <tr>
6001                                 <td colspan='4'><b>$Lang::tr{'ovpn dh parameters'}</b></td>
6002                         </tr>
6003
6004                         <tr>
6005                                 <td width='40%'>$Lang::tr{'ovpn dh upload'}:</td>
6006                                 <td width='30%'><input type='file' name='FH' size='25'>
6007                                 <td width='30%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload dh key'}'></td>
6008                         </tr>
6009
6010                         <tr>
6011                                 <td width='40%'>$Lang::tr{'ovpn dh new key'}:</td>
6012                                 <td colspan='2' width='60%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
6013                         </tr>
6014                 </table>
6015         </form>
6016
6017         <br><hr>
6018 END
6019         ;
6020
6021     if ( $srunning eq "yes" ) {
6022                 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' disabled='disabled' /></div></form>\n";
6023     } else {
6024                 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></div></form>\n";
6025     }
6026         &Header::closebox();
6027 END
6028         ;
6029
6030 &Header::closepage();
6031