From 7c1d9faf271a1aa8289a8ed16e896d7ed6c519b5 Mon Sep 17 00:00:00 2001 From: Alfred Haas Date: Sun, 4 Sep 2011 17:57:47 +0200 Subject: [PATCH] Bugfixes on OpenVPN CGI. --- html/cgi-bin/ovpnmain.cgi | 135 ++++++++++++++++++++++---------------- 1 file changed, 80 insertions(+), 55 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 95eb67a1ec..5d4ebffdbd 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -397,6 +397,22 @@ sub emptyserverlog{ } +### +# m.a.d net2net +### + +sub validdotmask +{ + my $ipdotmask = $_[0]; + if (&General::validip($ipdotmask)) { return 0; } + if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { } + my $mask = $2; + if (($mask =~ /\./ )) { return 0; } + return 1; +} + + + #hier die refresh page if ( -e "${General::swroot}/ovpn/gencanow") { my $refresh = ''; @@ -517,7 +533,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { } ### -# m.a.d Save net2net server config +# m.a.d net2net ### if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server') @@ -534,13 +550,14 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!"; flock SERVERCONF, 2; - print SERVERCONF "# n2n Open VPN Server Config by ummeegge und m.a.d\n"; + print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n"; print SERVERCONF "\n"; print SERVERCONF "# User Sicherheit\n"; print SERVERCONF "user nobody\n"; print SERVERCONF "group nobody\n"; print SERVERCONF "persist-tun\n"; print SERVERCONF "persist-key\n"; + print SERVERCONF "script-security 2\n"; print SERVERCONF "\n"; print SERVERCONF "# IP/DNS fuer das Server Gateway - g2g Mode\n"; print SERVERCONF "remote $cgiparams{'REMOTE'}\n"; @@ -602,8 +619,9 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General } ### -# m.a.d Save net2net client config +# m.a.d net2net ### + if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client') { my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'}); @@ -617,13 +635,14 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!"; flock CLIENTCONF, 2; - print CLIENTCONF "# rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n"; + print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n"; print CLIENTCONF "#\n"; print CLIENTCONF "# User Sicherheit\n"; print CLIENTCONF "user nobody\n"; print CLIENTCONF "group nobody\n"; print CLIENTCONF "persist-tun\n"; print CLIENTCONF "persist-key\n"; + print CLIENTCONF "script-security 2\n"; print CLIENTCONF "#\n"; print CLIENTCONF "# IP/DNS fuer das Server Gateway - g2g Mode\n"; print CLIENTCONF "remote $cgiparams{'REMOTE'}\n"; @@ -632,7 +651,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n"; print CLIENTCONF "#\n"; print CLIENTCONF "# Netzwerk auf dem Server Gateway\n"; - print CLIENTCONF "route @remsubnet[0]/@remsubnet[1]\n"; + print CLIENTCONF "route @remsubnet[0] @remsubnet[1]\n"; print CLIENTCONF "# Device fuer den Tunnel\n"; print CLIENTCONF "dev tun\n"; print CLIENTCONF "#\n"; @@ -683,10 +702,6 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General } -### -# m.a.d Save net2net config end -### - ### ### Save main settings ### @@ -1488,7 +1503,7 @@ END ### ### -# m.a.d net2net Anpassung +# m.a.d net2net ### }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) { @@ -1540,8 +1555,8 @@ END my $zippath = "$tempdir/"; ### -# m.a.d net2net DL Client Package -### +# m.a.d net2net +### if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ @@ -1551,18 +1566,20 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]); my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]"; my $tunmtu = ''; + my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]); open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!"; flock CLIENTCONF, 2; my $zip = Archive::Zip->new(); - print CLIENTCONF "# n2n Open VPN Client Config by ummeegge und m.a.d\n"; + print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n"; print CLIENTCONF "# \n"; print CLIENTCONF "# User Sicherheit\n"; print CLIENTCONF "user nobody\n"; print CLIENTCONF "group nobody\n"; print CLIENTCONF "persist-tun\n"; print CLIENTCONF "persist-key\n"; + print CLIENTCONF "script-security 2\n"; print CLIENTCONF "#\n"; print CLIENTCONF "# IP/DNS fuer das Server Gateway - g2g Mode\n"; print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n"; @@ -1571,7 +1588,7 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n"; print CLIENTCONF "#\n"; print CLIENTCONF "# Netzwerk auf dem Server Gateway\n"; - print CLIENTCONF "route $confighash{$cgiparams{'KEY'}}[8]\n"; + print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n"; print CLIENTCONF "# Device fuer den Tunnel\n"; print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n"; print CLIENTCONF "#\n"; @@ -1642,7 +1659,7 @@ else $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn"; ### -# m.a.d net2net DL Client Package end +# m.a.d net2net ### open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!"; @@ -1732,8 +1749,9 @@ else my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`; ### -# m.a.d net2net Anpassung +# m.a.d net2net ### + if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') { my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf"); @@ -1743,9 +1761,6 @@ else rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!"; } -### -# m.a.d net2net Anpassung end -### unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); @@ -2185,7 +2200,7 @@ END ### ### -# m.a.d Anpassung wegen upload n2n Package +# m.a.d net2net ### } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') { @@ -2215,7 +2230,7 @@ END exit (0); ### -# m.a.d uploading a IPFire n2n Client package +# m.a.d net2net ### } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){ @@ -2288,15 +2303,15 @@ END goto N2N_ERROR; } -### -# m.a.d prepare imported ipfire net2net data +### +# m.a.d net2net ### my @n2nname = split(/\./,$uplconffilename); $n2nname[0] =~ s/\n|\r//g; - if ( !-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]") { - mkdir("${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770); } + unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";} + unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";} move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename"); @@ -2348,7 +2363,7 @@ chomp ($complzoactive); chomp ($mssfixactive); ### -# m.a.d Write n2n config +# m.a.d net2net ### ### @@ -2446,6 +2461,8 @@ foreach my $dkey (keys %confighash) { $Lang::tr{'protocol'}$confighash{$key}[28] $Lang::tr{'destination port'}:$confighash{$key}[29] $Lang::tr{'comp-lzo'}$confighash{$key}[30] + MSSFIX $confighash{$key}[23] + Fragment $confighash{$key}[24] $Lang::tr{'MTU'}$confighash{$key}[31]    @@ -2497,7 +2514,7 @@ if ($confighash{$cgiparams{'KEY'}}) { ### -# m.a.d end uploading a IPFire n2n Client package +# m.a.d net2net ### @@ -2565,10 +2582,12 @@ if ($confighash{$cgiparams{'KEY'}}) { } ### -# n2n Plausi m.a.d +# m.a.d net2net ### - if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) { +if ($cgiparams{'TYPE'} eq 'net') { + + if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) { $errormessage = 'The Destination Port is used by the OpenVPN Server please change'; goto VPNCONF_ERROR; } @@ -2587,11 +2606,22 @@ if ($confighash{$cgiparams{'KEY'}}) { $errormessage = 'fragment only allowed with udp'; goto VPNCONF_ERROR; } - -### -# n2n Plausi m.a.d -### + if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) { + $errormessage = 'Prefix not allowed for Local Subnet. Please enter Subnet Mask e.g. 255.255.255.0'; + goto VPNCONF_ERROR; + } + + if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) { + $errormessage = 'Prefix not allowed for OpenVPN Subnet. Please enter Subnet Mask e.g. 255.255.255.0'; + goto VPNCONF_ERROR; + } + + if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) { + $errormessage = 'Prefix not allowed for Remote Subnet. Please enter Subnet Mask e.g. 255.255.255.0'; + goto VPNCONF_ERROR; + } +} # if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) { # $errormessage = $Lang::tr{'ipfire side is invalid'}; @@ -3169,7 +3199,7 @@ END ; ### -# m.a.d Disbale upload cert for n2n connections +# m.a.d net2net ### } else { @@ -3192,7 +3222,7 @@ END } ### -# m.a.d Disbale upload cert for n2n connections end +# m.a.d net2net ### foreach my $country (sort keys %{Countries::countries}) { @@ -3203,7 +3233,7 @@ END print ">$country"; } ### -# m.a.d Disbale pkcs-password for n2n connections +# m.a.d net2net ### if ($cgiparams{'TYPE'} eq 'host') { @@ -3230,7 +3260,7 @@ END } ### -# m.a.d Disbale pkcs-password for n2n connections end +# m.a.d net2net ### ; &Header::closebox(); @@ -3575,7 +3605,7 @@ END if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) { ### -# m.a.d Client Status Table +# m.a.d net2net ### &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' }); @@ -3624,15 +3654,12 @@ END } else { ### -# m.a.d net2net Status -### - - if ($confighash{$cgiparams{'KEY'}}[3] eq 'host'){ - - my $cn; - my @match = (); - foreach my $line (@status) { +# m.a.d net2net +### + my $cn; + my @match = (); + foreach my $line (@status) { chomp($line); if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) { @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line); @@ -3641,15 +3668,15 @@ END } $cn =~ s/[_]/ /g; if ($cn eq "$confighash{$key}[2]") { - $active = "
$Lang::tr{'capsclosed'}
"; + $active = "
$Lang::tr{'capsopen'}
"; } - } - } - } else { + + if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') { + my @tempovpnsubnet = split("\/",$confighash{$key}[27]); my @ovpnip = split /\./,$tempovpnsubnet[0]; my $pingip = ""; - + if ($confighash{$key}[6] eq 'server') { $pingip = "$ovpnip[0].$ovpnip[1].$ovpnip[2].2"; } else { @@ -3665,10 +3692,8 @@ END } } - -### -# m.a.d net2net Status end -### +} +} my $disable_clientdl = "disabled='disabled'"; -- 2.39.5