OpenVPN: Added auth and cipher menu, changed design, fixed bugs.
[ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
ab4cf06c 5# Copyright (C) 2007-2013 IPFire Team <info@ipfire.org> #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535 21###
4c962356 22# Based on IPFireCore 76
54fd0535 23###
6e13d0a5
MT
24use CGI;
25use CGI qw/:standard/;
26use Net::DNS;
ce9abb66 27use Net::Ping;
54fd0535 28use Net::Telnet;
6e13d0a5
MT
29use File::Copy;
30use File::Temp qw/ tempfile tempdir /;
31use strict;
32use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
eff2dbf8 33use Sort::Naturally;
6e13d0a5 34require '/var/ipfire/general-functions.pl';
6e13d0a5
MT
35require "${General::swroot}/lang.pl";
36require "${General::swroot}/header.pl";
37require "${General::swroot}/countries.pl";
38
39# enable only the following on debugging purpose
8c877a82
AM
40#use warnings;
41#use CGI::Carp 'fatalsToBrowser';
6e13d0a5 42#workaround to suppress a warning when a variable is used only once
8c877a82 43my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
6e13d0a5
MT
44undef (@dummy);
45
f2fdd0c1
CS
46my %color = ();
47my %mainsettings = ();
48&General::readhash("${General::swroot}/main/settings", \%mainsettings);
49&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
6e13d0a5
MT
50
51###
52### Initialize variables
53###
e81be1e1
AM
54my %ccdconfhash=();
55my %ccdroutehash=();
56my %ccdroute2hash=();
6e13d0a5
MT
57my %netsettings=();
58my %cgiparams=();
59my %vpnsettings=();
60my %checked=();
61my %confighash=();
62my %cahash=();
63my %selected=();
64my $warnmessage = '';
65my $errormessage = '';
66my %settings=();
54fd0535 67my $routes_push_file = '';
df9b48b7
AM
68my $confighost="${General::swroot}/fwhosts/customhosts";
69my $configgrp="${General::swroot}/fwhosts/customgroups";
70my $customnet="${General::swroot}/fwhosts/customnetworks";
71my $name;
99bfa85c 72my $col="";
6e13d0a5
MT
73&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
74$cgiparams{'ENABLED'} = 'off';
75$cgiparams{'ENABLED_BLUE'} = 'off';
76$cgiparams{'ENABLED_ORANGE'} = 'off';
77$cgiparams{'EDIT_ADVANCED'} = 'off';
78$cgiparams{'NAT'} = 'off';
79$cgiparams{'COMPRESSION'} = 'off';
80$cgiparams{'ONLY_PROPOSED'} = 'off';
81$cgiparams{'ACTION'} = '';
82$cgiparams{'CA_NAME'} = '';
4c962356
EK
83$cgiparams{'DH_NAME'} = 'dh1024.pem';
84$cgiparams{'DHLENGHT'} = '';
6e13d0a5
MT
85$cgiparams{'DHCP_DOMAIN'} = '';
86$cgiparams{'DHCP_DNS'} = '';
87$cgiparams{'DHCP_WINS'} = '';
54fd0535 88$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 89$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 90$cgiparams{'MSSFIX'} = '';
8c877a82 91$cgiparams{'number'} = '';
2ee746be 92$cgiparams{'PMTU_DISCOVERY'} = '';
4c962356
EK
93$cgiparams{'DAUTH'} = '';
94$cgiparams{'DCIPHER'} = '';
54fd0535
MT
95$routes_push_file = "${General::swroot}/ovpn/routes_push";
96unless (-e $routes_push_file) { system("touch $routes_push_file"); }
8c877a82
AM
97unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
98unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
99unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
ce9abb66 100
6e13d0a5
MT
101&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
102
103# prepare openvpn config file
104###
105### Useful functions
106###
c6c9630e
MT
107sub haveOrangeNet
108{
13211b21
CS
109 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
110 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
111 return 0;
112}
113
114sub haveBlueNet
115{
13211b21 116 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 117 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
118 return 0;
119}
120
121sub sizeformat{
122 my $bytesize = shift;
123 my $i = 0;
124
125 while(abs($bytesize) >= 1024){
126 $bytesize=$bytesize/1024;
127 $i++;
128 last if($i==6);
129 }
130
131 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
132 my $newsize=(int($bytesize*100 +0.5))/100;
133 return("$newsize $units[$i]");
134}
135
c6c9630e
MT
136sub cleanssldatabase
137{
138 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
139 print FILE "01";
140 close FILE;
141 }
142 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
143 print FILE "";
144 close FILE;
145 }
146 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
147 unlink ("${General::swroot}/ovpn/certs/serial.old");
148 unlink ("${General::swroot}/ovpn/certs/01.pem");
149}
150
151sub newcleanssldatabase
152{
153 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
154 open(FILE, ">${General::swroot}(ovpn/certs/serial");
155 print FILE "01";
156 close FILE;
157 }
158 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
159 system ("touch ${General::swroot}/ovpn/certs/index.txt");
160 }
161 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
162 unlink ("${General::swroot}/ovpn/certs/serial.old");
163}
164
165sub deletebackupcert
166{
167 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
168 my $hexvalue = <FILE>;
169 chomp $hexvalue;
170 close FILE;
171 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
172 }
173}
c6c9630e 174sub checkportfw {
6945e463
AM
175 my $DPORT = shift;
176 my $DPROT = shift;
177 my %natconfig =();
6d8eb5de 178 my $confignat = "${General::swroot}/firewall/config";
6945e463
AM
179 $DPROT= uc ($DPROT);
180 &General::readhasharray($confignat, \%natconfig);
181 foreach my $key (sort keys %natconfig){
6945e463
AM
182 my @portarray = split (/\|/,$natconfig{$key}[30]);
183 foreach my $value (@portarray){
6945e463
AM
184 if ($value =~ /:/i){
185 my ($a,$b) = split (":",$value);
186 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
187 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
188 }
189 }else{
190 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
191 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
192 }
193 }
c6c9630e
MT
194 }
195 }
6945e463 196 return;
c6c9630e
MT
197}
198
199sub checkportoverlap
200{
201 my $portrange1 = $_[0]; # New port range
202 my $portrange2 = $_[1]; # existing port range
203 my @tempr1 = split(/\:/,$portrange1);
204 my @tempr2 = split(/\:/,$portrange2);
205
206 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
207 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
208
209 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
210 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
211
212 return 1; # Everything checks out!
213}
214
215# Darren Critchley - we want to make sure that a port entry is not within an already existing range
216sub checkportinc
217{
218 my $port1 = $_[0]; # Port
219 my $portrange2 = $_[1]; # Port range
220 my @tempr1 = split(/\:/,$portrange2);
221
222 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
223 return 1;
224 } else {
225 return 0;
226 }
227}
c6c9630e 228
4c962356
EK
229# Darren Critchley - certain ports are reserved for IPFire
230# TCP 67,68,81,222,444
231# UDP 67,68
232# Params passed in -> port, rangeyn, protocol
233sub disallowreserved
234{
235 # port 67 and 68 same for tcp and udp, don't bother putting in an array
236 my $msg = "";
237 my @tcp_reserved = (81,222,444);
238 my $prt = $_[0]; # the port or range
239 my $ryn = $_[1]; # tells us whether or not it is a port range
240 my $prot = $_[2]; # protocol
241 my $srcdst = $_[3]; # source or destination
242 if ($ryn) { # disect port range
243 if ($srcdst eq "src") {
244 $msg = "$Lang::tr{'rsvd src port overlap'}";
245 } else {
246 $msg = "$Lang::tr{'rsvd dst port overlap'}";
247 }
248 my @tmprng = split(/\:/,$prt);
249 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
250 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
251 if ($prot eq "tcp") {
252 foreach my $prange (@tcp_reserved) {
253 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
254 }
255 }
256 } else {
257 if ($srcdst eq "src") {
258 $msg = "$Lang::tr{'reserved src port'}";
259 } else {
260 $msg = "$Lang::tr{'reserved dst port'}";
261 }
262 if ($prt == 67) { $errormessage="$msg 67"; return; }
263 if ($prt == 68) { $errormessage="$msg 68"; return; }
264 if ($prot eq "tcp") {
265 foreach my $prange (@tcp_reserved) {
266 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
267 }
268 }
269 }
270 return;
271}
272
273
c6c9630e 274sub writeserverconf {
54fd0535
MT
275 my %sovpnsettings = ();
276 my @temp = ();
c6c9630e 277 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535
MT
278 &read_routepushfile;
279
c6c9630e
MT
280 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
281 flock CONF, 2;
282 print CONF "#OpenVPN Server conf\n";
283 print CONF "\n";
284 print CONF "daemon openvpnserver\n";
285 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 286 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e
MT
287 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
288 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
c6c9630e
MT
289 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
290 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
2b29c22e 291 print CONF "script-security 3 system\n";
07675dc3 292 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 293 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e 294 print CONF "tls-server\n";
4c962356
EK
295 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
296 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
297 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
298 print CONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
c6c9630e
MT
299 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
300 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
8c877a82 301 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
4c962356 302
2ee746be
SS
303 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
304 # If we doesn't use one of them, we can use the configured mtu value.
305 if ($sovpnsettings{'MSSFIX'} eq 'on')
306 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
307 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
308 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
1647059d 309 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
4c962356
EK
310 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
311 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2ee746be
SS
312 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
313 else
314 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
315
54fd0535 316 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
8c877a82
AM
317 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
318 foreach (@temp)
319 {
320 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
321 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
322 }
54fd0535 323 }
8c877a82
AM
324# a.marx ccd
325 my %ccdconfhash=();
326 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
327 foreach my $key (keys %ccdconfhash) {
328 my $a=$ccdconfhash{$key}[1];
329 my ($b,$c) = split (/\//, $a);
330 print CONF "route $b ".&General::cidrtosub($c)."\n";
331 }
332 my %ccdroutehash=();
333 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
334 foreach my $key (keys %ccdroutehash) {
335 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
336 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
337 print CONF "route $a $b\n";
338 }
339 }
340# ccd end
54fd0535 341
8c877a82 342 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
c6c9630e
MT
343 print CONF "client-to-client\n";
344 }
1de5c945 345 if ($sovpnsettings{MSSFIX} eq 'on') {
4c962356 346 print CONF "mssfix\n";
1de5c945
EK
347 }
348 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
4c962356 349 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 350 }
2ee746be 351
1647059d
SS
352 # Check if a valid operating mode has been choosen and use it.
353 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
354 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
355 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
356 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
2ee746be
SS
357 }
358
c6c9630e
MT
359 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
360 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
361 }
362 print CONF "status-version 1\n";
4e17adad 363 print CONF "status /var/log/ovpnserver.log 30\n";
c6c9630e 364 print CONF "cipher $sovpnsettings{DCIPHER}\n";
4c962356 365 print CONF "auth $sovpnsettings{DAUTH}\n";
c6c9630e
MT
366 if ($sovpnsettings{DCOMPLZO} eq 'on') {
367 print CONF "comp-lzo\n";
368 }
369 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
370 print CONF "push \"redirect-gateway def1\"\n";
371 }
372 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
373 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
374 }
375
376 if ($sovpnsettings{DHCP_DNS} ne '') {
377 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
378 }
379
380 if ($sovpnsettings{DHCP_WINS} ne '') {
381 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
382 }
383
384 if ($sovpnsettings{DHCP_WINS} eq '') {
385 print CONF "max-clients 100\n";
a79fa1d6 386 }
c6c9630e
MT
387 if ($sovpnsettings{DHCP_WINS} ne '') {
388 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
389 }
1d0a260a 390 print CONF "tls-verify /usr/lib/openvpn/verify\n";
c6c9630e
MT
391 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
392 print CONF "user nobody\n";
393 print CONF "group nobody\n";
394 print CONF "persist-key\n";
395 print CONF "persist-tun\n";
396 if ($sovpnsettings{LOG_VERB} ne '') {
397 print CONF "verb $sovpnsettings{LOG_VERB}\n";
398 } else {
399 print CONF "verb 3\n";
400 }
401 print CONF "\n";
402
403 close(CONF);
404}
8c877a82 405
c6c9630e 406sub emptyserverlog{
4e17adad 407 if (open(FILE, ">/var/log/ovpnserver.log")) {
c6c9630e
MT
408 flock FILE, 2;
409 print FILE "";
410 close FILE;
411 }
412
413}
414
8c877a82
AM
415sub delccdnet
416{
417 my %ccdconfhash = ();
418 my %ccdhash = ();
419 my $ccdnetname=$_[0];
420 if (-f "${General::swroot}/ovpn/ovpnconfig"){
421 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
422 foreach my $key (keys %ccdhash) {
423 if ($ccdhash{$key}[32] eq $ccdnetname) {
424 $errormessage=$Lang::tr{'ccd err hostinnet'};
425 return;
426 }
427 }
428 }
429 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
430 foreach my $key (keys %ccdconfhash) {
431 if ($ccdconfhash{$key}[0] eq $ccdnetname){
432 delete $ccdconfhash{$key};
433 }
434 }
435 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
436
437 &writeserverconf;
438 return 0;
439}
440
441sub addccdnet
442{
443 my %ccdconfhash=();
444 my @ccdconf=();
445 my $ccdname=$_[0];
446 my $ccdnet=$_[1];
8c877a82
AM
447 my $subcidr;
448 my @ip2=();
449 my $checkup;
450 my $ccdip;
451 my $baseaddress;
290007b3
AM
452
453
454 #check name
455 if ($ccdname eq '')
456 {
457 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
458 return
459 }
460
461 if(!&General::validhostname($ccdname))
462 {
8c877a82
AM
463 $errormessage=$Lang::tr{'ccd err invalidname'};
464 return;
465 }
290007b3
AM
466
467 ($ccdip,$subcidr) = split (/\//,$ccdnet);
468 $subcidr=&General::iporsubtocidr($subcidr);
469 #check subnet
470 if ($subcidr > 30)
471 {
8c877a82
AM
472 $errormessage=$Lang::tr{'ccd err invalidnet'};
473 return;
474 }
290007b3
AM
475 #check ip
476 if (!&General::validipandmask($ccdnet)){
477 $errormessage=$Lang::tr{'ccd err invalidnet'};
478 return;
8c877a82 479 }
290007b3 480
e2429e8d 481 $errormessage=&General::checksubnets($ccdname,$ccdnet);
290007b3 482
8c877a82
AM
483
484 if (!$errormessage) {
485 my %ccdconfhash=();
486 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
487 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
488 my $key = &General::findhasharraykey (\%ccdconfhash);
489 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
490 $ccdconfhash{$key}[0] = $ccdname;
491 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
492 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
493 &writeserverconf;
494 $cgiparams{'ccdname'}='';
495 $cgiparams{'ccdsubnet'}='';
496 return 1;
497 }
498}
499
500sub modccdnet
501{
502
503 my $newname=$_[0];
504 my $oldname=$_[1];
505 my %ccdconfhash=();
506 my %ccdhash=();
507 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
508 foreach my $key (keys %ccdconfhash) {
509 if ($ccdconfhash{$key}[0] eq $oldname) {
510 foreach my $key1 (keys %ccdconfhash) {
511 if ($ccdconfhash{$key1}[0] eq $newname){
512 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
513 return;
514 }else{
515 $ccdconfhash{$key}[0]= $newname;
516 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
517 last;
518 }
519 }
520 }
521 }
522
523 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
524 foreach my $key (keys %ccdhash) {
525 if ($ccdhash{$key}[32] eq $oldname) {
526 $ccdhash{$key}[32]=$newname;
527 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
528 last;
529 }
530 }
531
532 return 0;
533}
534sub ccdmaxclients
535{
536 my $ccdnetwork=$_[0];
537 my @octets=();
538 my @subnet=();
539 @octets=split("\/",$ccdnetwork);
540 @subnet= split /\./, &General::cidrtosub($octets[1]);
541 my ($a,$b,$c,$d,$e);
542 $a=256-$subnet[0];
543 $b=256-$subnet[1];
544 $c=256-$subnet[2];
545 $d=256-$subnet[3];
546 $e=($a*$b*$c*$d)/4;
547 return $e-1;
548}
549
550sub getccdadresses
551{
552 my $ipin=$_[0];
553 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
554 my $cidr=$_[1];
555 chomp($cidr);
556 my $count=$_[2];
557 my $hasip=$_[3];
558 chomp($hasip);
559 my @iprange=();
560 my %ccdhash=();
561 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
4c962356 562 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
ac87f371 563 for (my $i=1;$i<=$count;$i++) {
8c877a82
AM
564 my $tmpip=$iprange[$i-1];
565 my $stepper=$i*4;
566 $iprange[$i]= &General::getnextip($tmpip,4);
567 }
568 my $r=0;
569 foreach my $key (keys %ccdhash) {
570 $r=0;
571 foreach my $tmp (@iprange){
572 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
573 if ($net eq $tmp) {
574 if ( $hasip ne $ccdhash{$key}[33] ){
575 splice (@iprange,$r,1);
576 }
577 }
578 $r++;
579 }
580 }
581 return @iprange;
582}
583
584sub fillselectbox
585{
586 my $boxname=$_[1];
587 my ($ccdip,$subcidr) = split("/",$_[0]);
588 my $tz=$_[2];
589 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
590 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
591 foreach (@allccdips) {
592 my $ip=$_."/30";
593 chomp($ip);
594 print "<option value='$ip' ";
595 if ( $ip eq $cgiparams{$boxname} ){
596 print"selected";
597 }
598 print ">$ip</option>";
599 }
600 print "</select>";
601}
602
603sub hostsinnet
604{
605 my $name=$_[0];
606 my %ccdhash=();
607 my $i=0;
608 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
609 foreach my $key (keys %ccdhash) {
610 if ($ccdhash{$key}[32] eq $name){ $i++;}
611 }
612 return $i;
613}
614
615sub check_routes_push
616{
617 my $val=$_[0];
618 my ($ip,$cidr) = split (/\//, $val);
619 ##check for existing routes in routes_push
620 if (-e "${General::swroot}/ovpn/routes_push") {
621 open(FILE,"${General::swroot}/ovpn/routes_push");
622 while (<FILE>) {
623 $_=~s/\s*$//g;
624
625 my ($ip2,$cidr2) = split (/\//,"$_");
626 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
627
628 if($val eq $val2){
629 return 0;
630 }
631 #subnetcheck
632 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
633 return 0;
634 }
635 };
636 close(FILE);
637 }
638 return 1;
639}
640
641sub check_ccdroute
642{
643 my %ccdroutehash=();
644 my $val=$_[0];
645 my ($ip,$cidr) = split (/\//, $val);
646 #check for existing routes in ccdroute
647 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
648 foreach my $key (keys %ccdroutehash) {
649 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
650 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
651 return 0;
652 }
653 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
654 #subnetcheck
655 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
656 return 0;
657 }
658 }
659 }
660 return 1;
661}
662sub check_ccdconf
663{
664 my %ccdconfhash=();
665 my $val=$_[0];
666 my ($ip,$cidr) = split (/\//, $val);
667 #check for existing routes in ccdroute
668 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
669 foreach my $key (keys %ccdconfhash) {
670 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
671 return 0;
672 }
673 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
674 #subnetcheck
675 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
676 return 0;
677 }
678
679 }
680 return 1;
681}
682
7c1d9faf
AH
683###
684# m.a.d net2net
685###
686
687sub validdotmask
688{
689 my $ipdotmask = $_[0];
690 if (&General::validip($ipdotmask)) { return 0; }
691 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
692 my $mask = $2;
693 if (($mask =~ /\./ )) { return 0; }
694 return 1;
695}
54fd0535
MT
696
697# -------------------------------------------------------------------
698
699sub write_routepushfile
700{
701 open(FILE, ">$routes_push_file");
702 flock(FILE, 2);
703 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
704 print FILE $vpnsettings{'ROUTES_PUSH'};
705 }
706 close(FILE);
707}
708
709sub read_routepushfile
710{
711 if (-e "$routes_push_file") {
712 open(FILE,"$routes_push_file");
713 delete $vpnsettings{'ROUTES_PUSH'};
714 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
715 close(FILE);
716 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
8c877a82 717
54fd0535
MT
718 }
719}
7c1d9faf
AH
720
721
c6c9630e
MT
722#hier die refresh page
723if ( -e "${General::swroot}/ovpn/gencanow") {
724 my $refresh = '';
725 $refresh = "<meta http-equiv='refresh' content='15;' />";
726 &Header::showhttpheaders();
727 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
728 &Header::openbigbox('100%', 'center');
729 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
730 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
731 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
732 &Header::closebox();
733 &Header::closebigbox();
734 &Header::closepage();
735 exit (0);
736}
737##hier die refresh page
738
6e13d0a5
MT
739
740###
741### OpenVPN Server Control
742###
743if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
744 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
745 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT
746 #start openvpn server
747 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 748 &emptyserverlog();
6e13d0a5
MT
749 system('/usr/local/bin/openvpnctrl', '-s');
750 }
751 #stop openvpn server
752 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
6e13d0a5 753 system('/usr/local/bin/openvpnctrl', '-k');
c6c9630e 754 &emptyserverlog();
6e13d0a5
MT
755 }
756# #restart openvpn server
8c877a82 757# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
6e13d0a5 758#workarund, till SIGHUP also works when running as nobody
8c877a82
AM
759# system('/usr/local/bin/openvpnctrl', '-r');
760# &emptyserverlog();
761# }
6e13d0a5
MT
762}
763
764###
765### Save Advanced options
766###
767
768if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
769 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
770 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
771 #DAN this value has to leave.
772#new settings for daemon
773 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
774 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
775 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
776 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
777 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
778 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
779 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
780 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
781 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535 782 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
2ee746be 783 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
4c962356 784 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
54fd0535 785 my @temp=();
6e13d0a5 786
a79fa1d6
JPT
787 if ($cgiparams{'FRAGMENT'} eq '') {
788 delete $vpnsettings{'FRAGMENT'};
789 } else {
790 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
791 $errormessage = "Incorrect value, please insert only numbers.";
792 goto ADV_ERROR;
793 } else {
794 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
795 }
796 }
797 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 798 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT
799 } else {
800 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
801 }
2ee746be 802
1647059d
SS
803 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
804 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
805 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
806
2ee746be
SS
807 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
808 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
809 goto ADV_ERROR;
810 }
811 }
812
6e13d0a5 813 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
81da1b01 814 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
6e13d0a5
MT
815 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
816 goto ADV_ERROR;
817 }
818 }
819 if ($cgiparams{'DHCP_DNS'} ne ''){
820 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
821 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
822 goto ADV_ERROR;
823 }
824 }
825 if ($cgiparams{'DHCP_WINS'} ne ''){
826 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
827 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT
828 goto ADV_ERROR;
829 }
830 }
831 if ($cgiparams{'ROUTES_PUSH'} ne ''){
832 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
833 undef $vpnsettings{'ROUTES_PUSH'};
8c877a82
AM
834
835 foreach my $tmpip (@temp)
54fd0535
MT
836 {
837 s/^\s+//g; s/\s+$//g;
8c877a82
AM
838
839 if ($tmpip)
54fd0535 840 {
8c877a82
AM
841 $tmpip=~s/\s*$//g;
842 unless (&General::validipandmask($tmpip)) {
843 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
844 goto ADV_ERROR;
54fd0535 845 }
8c877a82
AM
846 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
847
54fd0535
MT
848 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
849 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
8c877a82
AM
850 goto ADV_ERROR;
851 }
852# a.marx ccd
853 my %ccdroutehash=();
854 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
855 foreach my $key (keys %ccdroutehash) {
856 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
857 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
858 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
859 goto ADV_ERROR;
860 }
861 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
862 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
863 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
864 goto ADV_ERROR;
865 }
866 }
54fd0535 867 }
8c877a82
AM
868
869# ccd end
870
871 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
54fd0535 872 }
8c877a82
AM
873 }
874 &write_routepushfile;
54fd0535 875 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP
876 }
877 else {
878 undef $vpnsettings{'ROUTES_PUSH'};
879 &write_routepushfile;
6e13d0a5 880 }
6e13d0a5
MT
881 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
882 $errormessage = $Lang::tr{'invalid input for max clients'};
883 goto ADV_ERROR;
884 }
885 if ($cgiparams{'KEEPALIVE_1'} ne '') {
886 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
887 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
888 goto ADV_ERROR;
889 }
890 }
891 if ($cgiparams{'KEEPALIVE_2'} ne ''){
892 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
893 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
894 goto ADV_ERROR;
895 }
896 }
897 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
898 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
899 goto ADV_ERROR;
900 }
901
902 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 903 &writeserverconf();#hier ok
6e13d0a5
MT
904}
905
ce9abb66 906###
7c1d9faf 907# m.a.d net2net
ce9abb66
AH
908###
909
910if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
911{
c6c9630e 912
ce9abb66
AH
913my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
914my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 915my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 916my $tunmtu = '';
531f0835
AH
917
918unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
919unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
920
921 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
922
923 flock SERVERCONF, 2;
7c1d9faf 924 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
ce9abb66 925 print SERVERCONF "\n";
b278daf3 926 print SERVERCONF "# User Security\n";
ce9abb66
AH
927 print SERVERCONF "user nobody\n";
928 print SERVERCONF "group nobody\n";
929 print SERVERCONF "persist-tun\n";
930 print SERVERCONF "persist-key\n";
7c1d9faf 931 print SERVERCONF "script-security 2\n";
60f396d7 932 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
c125d8a2
SS
933
934 if ($cgiparams{'REMOTE'} ne '') {
ce9abb66 935 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
c125d8a2
SS
936 }
937
b278daf3 938 print SERVERCONF "float\n";
60f396d7 939 print SERVERCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 940 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
60f396d7 941 print SERVERCONF "# Client Gateway Network\n";
54fd0535 942 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 943 print SERVERCONF "# tun Device\n";
ce9abb66 944 print SERVERCONF "dev tun\n";
60f396d7 945 print SERVERCONF "# Port and Protokol\n";
ce9abb66 946 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
947
948 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
949 print SERVERCONF "proto tcp-server\n";
950 print SERVERCONF "# Packet size\n";
d96c89eb 951 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 952 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 953 }
60f396d7
AH
954
955 if ($cgiparams{'PROTOCOL'} eq 'udp') {
956 print SERVERCONF "proto udp\n";
957 print SERVERCONF "# Paketsize\n";
958 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
959 print SERVERCONF "tun-mtu $tunmtu\n";
54fd0535
MT
960 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
961 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
d96c89eb 962 }
1647059d
SS
963
964 # Check if a valid operating mode has been choosen and use it.
965 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
966 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
967 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
968 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
969 if($cgiparams{'MTU'} eq '1500') {
970 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
971 }
972 }
973 }
60f396d7 974 print SERVERCONF "# Auth. Server\n";
ce9abb66
AH
975 print SERVERCONF "tls-server\n";
976 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
977 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
978 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
4c962356 979 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
b278daf3 980 print SERVERCONF "# Cipher\n";
4c962356
EK
981 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
982 print SERVERCONF "# HMAC algorithm\n";
983 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
ce9abb66 984 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 985 print SERVERCONF "# Enable Compression\n";
ce9abb66 986 print SERVERCONF "comp-lzo\r\n";
b278daf3 987 }
60f396d7 988 print SERVERCONF "# Debug Level\n";
ce9abb66 989 print SERVERCONF "verb 3\n";
b278daf3 990 print SERVERCONF "# Tunnel check\n";
ce9abb66 991 print SERVERCONF "keepalive 10 60\n";
60f396d7 992 print SERVERCONF "# Start as daemon\n";
ce9abb66
AH
993 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
994 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 995 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT
996 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
997 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH
998 close(SERVERCONF);
999
1000}
1001
1002###
7c1d9faf 1003# m.a.d net2net
ce9abb66 1004###
7c1d9faf 1005
ce9abb66
AH
1006if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1007{
4c962356 1008
ce9abb66 1009 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 1010 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1011 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 1012 my $tunmtu = '';
54fd0535 1013
531f0835
AH
1014unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1015unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
1016
1017 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1018
1019 flock CLIENTCONF, 2;
7c1d9faf 1020 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 1021 print CLIENTCONF "#\n";
b278daf3 1022 print CLIENTCONF "# User Security\n";
ce9abb66
AH
1023 print CLIENTCONF "user nobody\n";
1024 print CLIENTCONF "group nobody\n";
1025 print CLIENTCONF "persist-tun\n";
1026 print CLIENTCONF "persist-key\n";
7c1d9faf 1027 print CLIENTCONF "script-security 2\n";
60f396d7 1028 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 1029 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 1030 print CLIENTCONF "float\n";
60f396d7 1031 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1032 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
60f396d7 1033 print CLIENTCONF "# Server Gateway Network\n";
54fd0535 1034 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 1035 print CLIENTCONF "# tun Device\n";
ce9abb66 1036 print CLIENTCONF "dev tun\n";
60f396d7 1037 print CLIENTCONF "# Port and Protokol\n";
ce9abb66 1038 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
1039
1040 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1041 print CLIENTCONF "proto tcp-client\n";
1042 print CLIENTCONF "# Packet size\n";
d96c89eb 1043 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 1044 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1045 }
60f396d7
AH
1046
1047 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1048 print CLIENTCONF "proto udp\n";
1049 print CLIENTCONF "# Paketsize\n";
1050 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1051 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535
MT
1052 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1053 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
d96c89eb 1054 }
1647059d
SS
1055
1056 # Check if a valid operating mode has been choosen and use it.
1057 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1058 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1059 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
1060 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1061 if ($cgiparams{'MTU'} eq '1500') {
1062 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1063 }
1064 }
1647059d
SS
1065 }
1066
54fd0535 1067 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
1068 print CLIENTCONF "# Auth. Client\n";
1069 print CLIENTCONF "tls-client\n";
b278daf3 1070 print CLIENTCONF "# Cipher\n";
4c962356
EK
1071 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
1072 print CLIENTCONF "# HMAC algorithm\n";
1073 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
ce9abb66 1074 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
ce9abb66 1075 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1076 print CLIENTCONF "# Enable Compression\n";
ce9abb66 1077 print CLIENTCONF "comp-lzo\r\n";
4c962356 1078 }
ce9abb66
AH
1079 print CLIENTCONF "# Debug Level\n";
1080 print CLIENTCONF "verb 3\n";
b278daf3 1081 print CLIENTCONF "# Tunnel check\n";
ce9abb66 1082 print CLIENTCONF "keepalive 10 60\n";
60f396d7 1083 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
1084 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1085 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1086 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
1087 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1088 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 1089 close(CLIENTCONF);
c6c9630e 1090
ce9abb66
AH
1091}
1092
6e13d0a5
MT
1093###
1094### Save main settings
1095###
ce9abb66
AH
1096
1097
6e13d0a5
MT
1098if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1099 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT
1100 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1101 #DAN this value has to leave.
1102 if ($cgiparams{'ENABLED'} eq 'on'){
1103 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1104 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 1105 goto SETTINGS_ERROR;
6e13d0a5
MT
1106 }
1107 }
6e13d0a5 1108 if ($errormessage) { goto SETTINGS_ERROR; }
48cc0e12 1109
6e13d0a5 1110 if ($cgiparams{'ENABLED'} eq 'on'){
6945e463 1111 &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
6e13d0a5 1112 }
6e13d0a5
MT
1113 if ($errormessage) { goto SETTINGS_ERROR; }
1114
1115 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e 1116 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
4c962356 1117 goto SETTINGS_ERROR;
c6c9630e
MT
1118 }
1119 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1120
1121 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1122 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1123 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1124 goto SETTINGS_ERROR;
1125 }
1126
1127 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1128 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1129 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1130 goto SETTINGS_ERROR;
1131 }
1132
1133 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1134 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1135 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1136 goto SETTINGS_ERROR;
1137 }
1138
1139 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1140 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1141 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1142 goto SETTINGS_ERROR;
1143 }
1144 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1145 while (<ALIASES>)
1146 {
1147 chomp($_);
1148 my @tempalias = split(/\,/,$_);
1149 if ($tempalias[1] eq 'on') {
1150 if (&General::IpInSubnet ($tempalias[0] ,
1151 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1152 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1153 }
1154 }
1155 }
1156 close(ALIASES);
6e13d0a5 1157 if ($errormessage ne ''){
c6c9630e 1158 goto SETTINGS_ERROR;
6e13d0a5
MT
1159 }
1160 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1161 $errormessage = $Lang::tr{'invalid input'};
1162 goto SETTINGS_ERROR;
1163 }
1164 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1165 $errormessage = $Lang::tr{'invalid mtu input'};
1166 goto SETTINGS_ERROR;
1167 }
1168
1169 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT
1170 $errormessage = $Lang::tr{'invalid port'};
1171 goto SETTINGS_ERROR;
6e13d0a5 1172 }
8c252e6a 1173
6e13d0a5
MT
1174 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1175 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1176 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1177 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1178#new settings for daemon
1179 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1180 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1181 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1182 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1183 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1184 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1185 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
3ffee04b
CS
1186#wrtie enable
1187
1188 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1189 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1190 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
6e13d0a5
MT
1191#new settings for daemon
1192 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 1193 &writeserverconf();#hier ok
6e13d0a5
MT
1194SETTINGS_ERROR:
1195###
1196### Reset all step 2
1197###
4c962356 1198}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
6e13d0a5
MT
1199 my $file = '';
1200 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1201
1202 foreach my $key (keys %confighash) {
c6c9630e
MT
1203 if ($confighash{$key}[4] eq 'cert') {
1204 delete $confighash{$cgiparams{'$key'}};
1205 }
6e13d0a5
MT
1206 }
1207 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
4c962356 1208 unlink $file
6e13d0a5
MT
1209 }
1210 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
4c962356 1211 unlink $file
6e13d0a5
MT
1212 }
1213 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
4c962356 1214 unlink $file
6e13d0a5 1215 }
4c962356 1216 &cleanssldatabase();
6e13d0a5
MT
1217 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1218 print FILE "";
1219 close FILE;
1220 }
4c962356
EK
1221 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1222 print FILE "";
1223 close FILE;
1224 }
1225 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1226 print FILE "";
1227 close FILE;
1228 }
1229 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1230 unlink $file
1231 }
1232 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1233 print FILE "";
1234 close FILE;
1235 }
1236 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1237 print FILE "";
1238 close FILE;
1239 }
1240 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1241 system ("rm -rf $file")
1242 }
6e13d0a5
MT
1243###
1244### Reset all step 1
1245###
4c962356 1246}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
6e13d0a5 1247 &Header::showhttpheaders();
4c962356
EK
1248 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1249 &Header::openbigbox('100%', 'left', '', '');
1250 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1251 print <<END;
1252 <form method='post'>
1253 <table width='100%'>
1254 <tr>
1255 <td align='center'>
1256 <input type='hidden' name='AREUSURE' value='yes' />
1257 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1258 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1259 </tr>
1260 <tr>
1261 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1262 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1263 </tr>
1264 </table>
1265 </form>
6e13d0a5
MT
1266END
1267 ;
1268 &Header::closebox();
1269 &Header::closebigbox();
1270 &Header::closepage();
1271 exit (0);
1272
4c962356
EK
1273###
1274### Generate DH key step 2
1275###
1276} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
1277 # Delete if old key exists
1278 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1279 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1280 }
1281 # Create Diffie Hellmann Parameter
1282 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1283 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1284 if ($?) {
1285 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1286 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1287 }
1288
1289###
1290### Generate DH key step 1
1291###
1292} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1293 &Header::showhttpheaders();
1294 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1295 &Header::openbigbox('100%', 'LEFT', '', '');
1296 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1297 print <<END;
1298 <table width='100%'>
1299 <tr>
1300 <td width='15%'> </td> <td width='15%'></td> <td width='65%'></td>
1301 </tr>
1302 <tr>
1303 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1304 <td align='center'>
1305 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1306 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1307 <select name='DHLENGHT'>
1308 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1309 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1310 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1311 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1312 </select>
1313 </td>
1314 </tr>
1315 <tr><td colspan='4'><br></td></tr>
1316 </table>
1317 <table width='100%'>
1318 <tr>
1319 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}:</font></b>
1320 $Lang::tr{'dh key warn'}
1321 </td>
1322 </tr>
1323 <tr>
1324 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1325 </form>
1326 </tr>
1327 </table>
1328
1329END
1330 ;
1331 &Header::closebox();
1332 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1333 &Header::closebigbox();
1334 &Header::closepage();
1335 exit (0);
1336
1337###
1338### Upload DH key
1339###
1340} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
1341 if ($cgiparams{'DH_NAME'} !~ /dh1024.pem/) {
1342 $errormessage = $Lang::tr{'dh name is invalid'};
1343 goto UPLOADCA_ERROR;
1344 }
1345 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1346 $errormessage = $Lang::tr{'there was no file upload'};
1347 goto UPLOADCA_ERROR;
1348 }
1349 # Move uploaded dh key to a temporary file
1350 (my $fh, my $filename) = tempfile( );
1351 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1352 $errormessage = $!;
1353 goto UPLOADCA_ERROR;
1354 }
1355 my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
1356 if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
1357 $errormessage = $Lang::tr{'not a valid dh key'};
1358 unlink ($filename);
1359 goto UPLOADCA_ERROR;
1360 } else {
1361 # Delete if old key exists
1362 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1363 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1364 }
1365 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
1366 if ($? ne 0) {
1367 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1368 unlink ($filename);
1369 goto UPLOADCA_ERROR;
1370 }
1371 }
1372
1373
6e13d0a5
MT
1374###
1375### Upload CA Certificate
1376###
1377} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1378 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1379
1380 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1381 $errormessage = $Lang::tr{'name must only contain characters'};
1382 goto UPLOADCA_ERROR;
1383 }
1384
1385 if (length($cgiparams{'CA_NAME'}) >60) {
1386 $errormessage = $Lang::tr{'name too long'};
1387 goto VPNCONF_ERROR;
1388 }
1389
1390 if ($cgiparams{'CA_NAME'} eq 'ca') {
1391 $errormessage = $Lang::tr{'name is invalid'};
4c962356 1392 goto UPLOADCA_ERROR;
6e13d0a5
MT
1393 }
1394
1395 # Check if there is no other entry with this name
1396 foreach my $key (keys %cahash) {
c6c9630e
MT
1397 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1398 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1399 goto UPLOADCA_ERROR;
1400 }
6e13d0a5
MT
1401 }
1402
1403 if (ref ($cgiparams{'FH'}) ne 'Fh') {
c6c9630e
MT
1404 $errormessage = $Lang::tr{'there was no file upload'};
1405 goto UPLOADCA_ERROR;
6e13d0a5
MT
1406 }
1407 # Move uploaded ca to a temporary file
1408 (my $fh, my $filename) = tempfile( );
1409 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT
1410 $errormessage = $!;
1411 goto UPLOADCA_ERROR;
6e13d0a5
MT
1412 }
1413 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
c6c9630e
MT
1414 if ($temp !~ /CA:TRUE/i) {
1415 $errormessage = $Lang::tr{'not a valid ca certificate'};
1416 unlink ($filename);
1417 goto UPLOADCA_ERROR;
6e13d0a5 1418 } else {
c6c9630e
MT
1419 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1420 if ($? ne 0) {
1421 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1422 unlink ($filename);
1423 goto UPLOADCA_ERROR;
1424 }
6e13d0a5
MT
1425 }
1426
1427 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1428 $casubject =~ /Subject: (.*)[\n]/;
1429 $casubject = $1;
1430 $casubject =~ s+/Email+, E+;
1431 $casubject =~ s/ ST=/ S=/;
1432 $casubject = &Header::cleanhtml($casubject);
1433
1434 my $key = &General::findhasharraykey (\%cahash);
1435 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1436 $cahash{$key}[1] = $casubject;
1437 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT
1438# system('/usr/local/bin/ipsecctrl', 'R');
1439
6e13d0a5
MT
1440 UPLOADCA_ERROR:
1441
1442###
1443### Display ca certificate
1444###
1445} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT
1446 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1447
1448 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1449 &Header::showhttpheaders();
4c962356 1450 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
1451 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1452 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1453 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1454 $output = &Header::cleanhtml($output,"y");
1455 print "<pre>$output</pre>\n";
1456 &Header::closebox();
1457 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1458 &Header::closebigbox();
1459 &Header::closepage();
1460 exit(0);
1461 } else {
1462 $errormessage = $Lang::tr{'invalid key'};
1463 }
1464
6e13d0a5
MT
1465###
1466### Download ca certificate
1467###
1468} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1469 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1470
1471 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1472 print "Content-Type: application/octet-stream\r\n";
1473 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1474 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1475 exit(0);
1476 } else {
1477 $errormessage = $Lang::tr{'invalid key'};
1478 }
1479
1480###
1481### Remove ca certificate (step 2)
1482###
1483} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1484 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1485 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1486
1487 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1488 foreach my $key (keys %confighash) {
1489 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1490 if ($test =~ /: OK/) {
c6c9630e
MT
1491 # Delete connection
1492# if ($vpnsettings{'ENABLED'} eq 'on' ||
1493# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1494# system('/usr/local/bin/ipsecctrl', 'D', $key);
1495# }
6e13d0a5
MT
1496 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1497 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1498 delete $confighash{$key};
1499 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1500# &writeipsecfiles();
6e13d0a5
MT
1501 }
1502 }
1503 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1504 delete $cahash{$cgiparams{'KEY'}};
1505 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1506# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT
1507 } else {
1508 $errormessage = $Lang::tr{'invalid key'};
1509 }
1510###
1511### Remove ca certificate (step 1)
1512###
1513} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1514 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1515 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1516
1517 my $assignedcerts = 0;
1518 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1519 foreach my $key (keys %confighash) {
1520 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1521 if ($test =~ /: OK/) {
1522 $assignedcerts++;
1523 }
1524 }
1525 if ($assignedcerts) {
1526 &Header::showhttpheaders();
4c962356 1527 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT
1528 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1529 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
4c962356 1530 print <<END;
6e13d0a5
MT
1531 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1532 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1533 <tr><td align='center'>
1534 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1535 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1536 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1537 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1538 </form></table>
1539END
1540 ;
1541 &Header::closebox();
1542 &Header::closebigbox();
1543 &Header::closepage();
1544 exit (0);
1545 } else {
1546 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1547 delete $cahash{$cgiparams{'KEY'}};
1548 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1549# system('/usr/local/bin/ipsecctrl', 'R');
1550 }
1551 } else {
1552 $errormessage = $Lang::tr{'invalid key'};
1553 }
1554
1555###
1556### Display root certificate
1557###
c6c9630e
MT
1558}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1559 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1560 my $output;
1561 &Header::showhttpheaders();
4c962356 1562 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
1563 &Header::openbigbox('100%', 'LEFT', '', '');
1564 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1565 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1566 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1567 } else {
1568 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1569 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1570 }
1571 $output = &Header::cleanhtml($output,"y");
1572 print "<pre>$output</pre>\n";
1573 &Header::closebox();
1574 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1575 &Header::closebigbox();
1576 &Header::closepage();
1577 exit(0);
1578
6e13d0a5
MT
1579###
1580### Download root certificate
1581###
1582}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1583 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1584 print "Content-Type: application/octet-stream\r\n";
1585 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1586 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1587 exit(0);
1588 }
1589
1590###
1591### Download host certificate
1592###
1593}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1594 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1595 print "Content-Type: application/octet-stream\r\n";
1596 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1597 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1598 exit(0);
1599 }
1600###
1601### Form for generating a root certificate
1602###
1603}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1604 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1605
1606 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1607 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1608 $errormessage = $Lang::tr{'valid root certificate already exists'};
1609 $cgiparams{'ACTION'} = '';
1610 goto ROOTCERT_ERROR;
1611 }
1612
1613 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1614 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1615 my $ipaddr = <IPADDR>;
1616 close IPADDR;
1617 chomp ($ipaddr);
1618 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1619 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1620 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1621 }
1622 }
1623 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1624
1625 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1626 $errormessage = $Lang::tr{'there was no file upload'};
1627 goto ROOTCERT_ERROR;
1628 }
1629
1630 # Move uploaded certificate request to a temporary file
1631 (my $fh, my $filename) = tempfile( );
1632 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1633 $errormessage = $!;
1634 goto ROOTCERT_ERROR;
1635 }
1636
1637 # Create a temporary dirctory
1638 my $tempdir = tempdir( CLEANUP => 1 );
1639
1640 # Extract the CA certificate from the file
1641 my $pid = open(OPENSSL, "|-");
1642 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1643 if ($pid) { # parent
1644 if ($cgiparams{'P12_PASS'} ne '') {
1645 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1646 }
1647 close (OPENSSL);
1648 if ($?) {
1649 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1650 unlink ($filename);
1651 goto ROOTCERT_ERROR;
1652 }
1653 } else { # child
1654 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1655 '-in', $filename,
1656 '-out', "$tempdir/cacert.pem")) {
1657 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1658 unlink ($filename);
1659 goto ROOTCERT_ERROR;
1660 }
1661 }
1662
1663 # Extract the Host certificate from the file
1664 $pid = open(OPENSSL, "|-");
1665 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1666 if ($pid) { # parent
1667 if ($cgiparams{'P12_PASS'} ne '') {
1668 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1669 }
1670 close (OPENSSL);
1671 if ($?) {
1672 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1673 unlink ($filename);
1674 goto ROOTCERT_ERROR;
1675 }
1676 } else { # child
1677 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1678 '-in', $filename,
1679 '-out', "$tempdir/hostcert.pem")) {
1680 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1681 unlink ($filename);
1682 goto ROOTCERT_ERROR;
1683 }
1684 }
1685
1686 # Extract the Host key from the file
1687 $pid = open(OPENSSL, "|-");
1688 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1689 if ($pid) { # parent
1690 if ($cgiparams{'P12_PASS'} ne '') {
1691 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1692 }
1693 close (OPENSSL);
1694 if ($?) {
1695 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1696 unlink ($filename);
1697 goto ROOTCERT_ERROR;
1698 }
1699 } else { # child
1700 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1701 '-nodes',
1702 '-in', $filename,
1703 '-out', "$tempdir/serverkey.pem")) {
1704 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1705 unlink ($filename);
1706 goto ROOTCERT_ERROR;
1707 }
1708 }
1709
1710 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1711 if ($? ne 0) {
1712 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1713 unlink ($filename);
1714 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1715 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1716 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1717 goto ROOTCERT_ERROR;
1718 }
1719
1720 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1721 if ($? ne 0) {
1722 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1723 unlink ($filename);
1724 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1725 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1726 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1727 goto ROOTCERT_ERROR;
1728 }
1729
1730 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1731 if ($? ne 0) {
1732 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1733 unlink ($filename);
1734 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1735 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1736 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1737 goto ROOTCERT_ERROR;
1738 }
1739
1740 goto ROOTCERT_SUCCESS;
1741
1742 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1743
1744 # Validate input since the form was submitted
1745 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1746 $errormessage = $Lang::tr{'organization cant be empty'};
1747 goto ROOTCERT_ERROR;
1748 }
1749 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1750 $errormessage = $Lang::tr{'organization too long'};
1751 goto ROOTCERT_ERROR;
1752 }
1753 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1754 $errormessage = $Lang::tr{'invalid input for organization'};
1755 goto ROOTCERT_ERROR;
1756 }
1757 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1758 $errormessage = $Lang::tr{'hostname cant be empty'};
1759 goto ROOTCERT_ERROR;
1760 }
1761 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1762 $errormessage = $Lang::tr{'invalid input for hostname'};
1763 goto ROOTCERT_ERROR;
1764 }
1765 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1766 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1767 goto ROOTCERT_ERROR;
1768 }
1769 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1770 $errormessage = $Lang::tr{'e-mail address too long'};
1771 goto ROOTCERT_ERROR;
1772 }
1773 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1774 $errormessage = $Lang::tr{'invalid input for department'};
1775 goto ROOTCERT_ERROR;
1776 }
1777 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1778 $errormessage = $Lang::tr{'invalid input for city'};
1779 goto ROOTCERT_ERROR;
1780 }
1781 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1782 $errormessage = $Lang::tr{'invalid input for state or province'};
1783 goto ROOTCERT_ERROR;
1784 }
1785 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1786 $errormessage = $Lang::tr{'invalid input for country'};
1787 goto ROOTCERT_ERROR;
1788 }
1789
1790 # Copy the cgisettings to vpnsettings and save the configfile
1791 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1792 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1793 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1794 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1795 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1796 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1797 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1798 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1799
1800 # Replace empty strings with a .
1801 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1802 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1803 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1804
1805 # refresh
c6c9630e 1806 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT
1807
1808 # Create the CA certificate
1809 my $pid = open(OPENSSL, "|-");
1810 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1811 if ($pid) { # parent
1812 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1813 print OPENSSL "$state\n";
1814 print OPENSSL "$city\n";
1815 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1816 print OPENSSL "$ou\n";
1817 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1818 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1819 close (OPENSSL);
1820 if ($?) {
1821 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1822 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1823 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1824 goto ROOTCERT_ERROR;
1825 }
1826 } else { # child
1827 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
4c962356 1828 '-days', '999999', '-newkey', 'rsa:4096',
6e13d0a5
MT
1829 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1830 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1831 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1832 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1833 goto ROOTCERT_ERROR;
1834 }
1835 }
1836
1837 # Create the Host certificate request
1838 $pid = open(OPENSSL, "|-");
1839 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1840 if ($pid) { # parent
1841 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1842 print OPENSSL "$state\n";
1843 print OPENSSL "$city\n";
1844 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1845 print OPENSSL "$ou\n";
1846 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1847 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1848 print OPENSSL ".\n";
1849 print OPENSSL ".\n";
1850 close (OPENSSL);
1851 if ($?) {
1852 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1853 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1854 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1855 goto ROOTCERT_ERROR;
1856 }
1857 } else { # child
1858 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
4c962356 1859 '-newkey', 'rsa:2048',
6e13d0a5
MT
1860 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1861 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1862 '-extensions', 'server',
1863 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1864 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1865 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1866 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1867 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1868 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1869 goto ROOTCERT_ERROR;
1870 }
1871 }
1872
1873 # Sign the host certificate request
1874 system('/usr/bin/openssl', 'ca', '-days', '999999',
1875 '-batch', '-notext',
1876 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1877 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1878 '-extensions', 'server',
1879 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1880 if ($?) {
1881 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1882 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1883 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1884 unlink ("${General::swroot}/ovpn/serverkey.pem");
1885 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1886 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1887 &newcleanssldatabase();
6e13d0a5
MT
1888 goto ROOTCERT_ERROR;
1889 } else {
1890 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1891 &deletebackupcert();
6e13d0a5
MT
1892 }
1893
1894 # Create an empty CRL
1895 system('/usr/bin/openssl', 'ca', '-gencrl',
1896 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1897 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1898 if ($?) {
1899 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1900 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1901 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1902 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1903 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 1904 &cleanssldatabase();
6e13d0a5 1905 goto ROOTCERT_ERROR;
c6c9630e
MT
1906# } else {
1907# &cleanssldatabase();
6e13d0a5
MT
1908 }
1909 # Create Diffie Hellmann Parameter
1910 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
4c962356 1911 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
6e13d0a5
MT
1912 if ($?) {
1913 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1914 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1915 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1916 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1917 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1918 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 1919 &cleanssldatabase();
6e13d0a5 1920 goto ROOTCERT_ERROR;
c6c9630e
MT
1921# } else {
1922# &cleanssldatabase();
6e13d0a5
MT
1923 }
1924 goto ROOTCERT_SUCCESS;
1925 }
1926 ROOTCERT_ERROR:
1927 if ($cgiparams{'ACTION'} ne '') {
1928 &Header::showhttpheaders();
4c962356 1929 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT
1930 &Header::openbigbox('100%', 'LEFT', '', '');
1931 if ($errormessage) {
1932 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1933 print "<class name='base'>$errormessage";
1934 print "&nbsp;</class>";
1935 &Header::closebox();
1936 }
1937 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
4c962356 1938 print <<END;
6e13d0a5
MT
1939 <form method='post' enctype='multipart/form-data'>
1940 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1941 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1942 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1943 <td width='35%' colspan='2'>&nbsp;</td></tr>
1944 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1945 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1946 <td colspan='2'>&nbsp;</td></tr>
1947 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1948 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1949 <td colspan='2'>&nbsp;</td></tr>
1950 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1951 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1952 <td colspan='2'>&nbsp;</td></tr>
1953 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1954 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1955 <td colspan='2'>&nbsp;</td></tr>
1956 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1957 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1958 <td colspan='2'>&nbsp;</td></tr>
1959 <tr><td class='base'>$Lang::tr{'country'}:</td>
1960 <td class='base'><select name='ROOTCERT_COUNTRY'>
1961
1962END
1963 ;
1964 foreach my $country (sort keys %{Countries::countries}) {
1965 print "<option value='$Countries::countries{$country}'";
1966 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1967 print " selected='selected'";
1968 }
1969 print ">$country</option>";
1970 }
4c962356
EK
1971 print <<END;
1972 </select></td>
1973 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
1974 <td class='base'><select name='DHLENGHT'>
1975 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1976 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1977 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1978 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1979 </select>
1980 </td>
1981 </tr>
1982
6e13d0a5
MT
1983 <tr><td>&nbsp;</td>
1984 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1985 <td>&nbsp;</td><td>&nbsp;</td></tr>
1986 <tr><td class='base' colspan='4' align='left'>
1987 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4c962356
EK
1988 <tr><td colspan='4'><br><br></td></tr>
1989 <tr><td class='base' colspan='4' align='center'>
1990 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}:</font></b>
1991 $Lang::tr{'ovpn generating the root and host certificates'}
1992 </td>
1993 </tr>
1994 <tr><td class='base' colspan='4' align='center'>
1995 $Lang::tr{'dh key warn'}
1996 </td>
1997 </tr>
1998
1999 <tr><td colspan='4'><hr></td></tr>
6e13d0a5
MT
2000 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
2001 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2002 <td colspan='2'>&nbsp;</td></tr>
2003 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
2004 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2005 <td colspan='2'>&nbsp;</td></tr>
2006 <tr><td>&nbsp;</td>
2007 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2008 <td colspan='2'>&nbsp;</td></tr>
2009 <tr><td class='base' colspan='4' align='left'>
4c962356
EK
2010 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td>
2011 </tr>
6e13d0a5
MT
2012 </form></table>
2013END
2014 ;
2015 &Header::closebox();
4c962356 2016 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2017 &Header::closebigbox();
2018 &Header::closepage();
2019 exit(0)
2020 }
2021
2022 ROOTCERT_SUCCESS:
2023 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT
2024# if ($vpnsettings{'ENABLED'} eq 'on' ||
2025# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2026# system('/usr/local/bin/ipsecctrl', 'S');
2027# }
6e13d0a5
MT
2028
2029###
2030### Enable/Disable connection
2031###
ce9abb66
AH
2032
2033###
7c1d9faf 2034# m.a.d net2net
ce9abb66
AH
2035###
2036
6e13d0a5 2037}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT
2038
2039 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 2040 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH
2041# my $n2nactive = '';
2042 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
2043
6e13d0a5 2044 if ($confighash{$cgiparams{'KEY'}}) {
8c877a82
AM
2045 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2046 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2047 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2048
8c877a82 2049 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 2050 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
8c877a82
AM
2051 }
2052 } else {
ce9abb66 2053
8c877a82
AM
2054 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2055 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2056
8c877a82 2057 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 2058 if ($n2nactive ne ''){
8c877a82
AM
2059 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
2060 }
ce9abb66 2061
8c877a82 2062 } else {
ce9abb66 2063 $errormessage = $Lang::tr{'invalid key'};
8c877a82 2064 }
ce9abb66
AH
2065 }
2066 }
6e13d0a5
MT
2067
2068###
2069### Download OpenVPN client package
2070###
ce9abb66
AH
2071
2072
6e13d0a5
MT
2073} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2074 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2075 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2076 my $file = '';
2077 my $clientovpn = '';
2078 my @fileholder;
2079 my $tempdir = tempdir( CLEANUP => 1 );
2080 my $zippath = "$tempdir/";
ce9abb66
AH
2081
2082###
7c1d9faf
AH
2083# m.a.d net2net
2084###
ce9abb66
AH
2085
2086if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2087
2088 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2089 my $zippathname = "$zippath$zipname";
2090 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2091 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 2092 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 2093 my $tunmtu = '';
7c1d9faf 2094 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 2095 my $n2nfragment = '';
ce9abb66
AH
2096
2097 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2098 flock CLIENTCONF, 2;
2099
2100 my $zip = Archive::Zip->new();
7c1d9faf 2101 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 2102 print CLIENTCONF "# \n";
b278daf3 2103 print CLIENTCONF "# User Security\n";
ce9abb66
AH
2104 print CLIENTCONF "user nobody\n";
2105 print CLIENTCONF "group nobody\n";
2106 print CLIENTCONF "persist-tun\n";
2107 print CLIENTCONF "persist-key\n";
7c1d9faf 2108 print CLIENTCONF "script-security 2\n";
60f396d7 2109 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 2110 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 2111 print CLIENTCONF "float\n";
60f396d7 2112 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 2113 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
b278daf3 2114 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 2115 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
b278daf3 2116 print CLIENTCONF "# tun Device\n";
ce9abb66 2117 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
60f396d7 2118 print CLIENTCONF "# Port and Protokoll\n";
ce9abb66 2119 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
60f396d7
AH
2120
2121 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2122 print CLIENTCONF "proto tcp-client\n";
2123 print CLIENTCONF "# Packet size\n";
d96c89eb 2124 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 2125 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 2126 }
60f396d7
AH
2127
2128 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2129 print CLIENTCONF "proto udp\n";
2130 print CLIENTCONF "# Paketsize\n";
2131 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2132 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 2133 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
60f396d7 2134 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
d96c89eb 2135 }
1647059d
SS
2136 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2137 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2138 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2ee746be
SS
2139 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2140 if ($tunmtu eq '1500' ) {
350f2980 2141 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2ee746be
SS
2142 }
2143 }
2144 }
54fd0535 2145 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
2146 print CLIENTCONF "# Auth. Client\n";
2147 print CLIENTCONF "tls-client\n";
b278daf3 2148 print CLIENTCONF "# Cipher\n";
4c962356
EK
2149 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2150 print CLIENTCONF "# HMAC algorithm\n";
2151 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
ce9abb66
AH
2152 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2153 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2154 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2155 }
4c962356 2156 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 2157 print CLIENTCONF "# Enable Compression\n";
ce9abb66 2158 print CLIENTCONF "comp-lzo\r\n";
b278daf3 2159 }
ce9abb66
AH
2160 print CLIENTCONF "# Debug Level\n";
2161 print CLIENTCONF "verb 3\n";
b278daf3 2162 print CLIENTCONF "# Tunnel check\n";
ce9abb66 2163 print CLIENTCONF "keepalive 10 60\n";
b278daf3 2164 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
2165 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2166 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
b278daf3 2167 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
2168 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2169 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 2170 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 2171
ce9abb66
AH
2172
2173 close(CLIENTCONF);
2174
2175 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2176 my $status = $zip->writeToFileNamed($zippathname);
2177
2178 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2179 @fileholder = <DLFILE>;
2180 print "Content-Type:application/x-download\n";
2181 print "Content-Disposition:attachment;filename=$zipname\n\n";
2182 print @fileholder;
2183 exit (0);
2184}
2185else
2186{
2187 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2188 my $zippathname = "$zippath$zipname";
2189 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2190
2191###
7c1d9faf 2192# m.a.d net2net
ce9abb66
AH
2193###
2194
c6c9630e 2195 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT
2196 flock CLIENTCONF, 2;
2197
2198 my $zip = Archive::Zip->new();
2199
8c877a82 2200 print CLIENTCONF "#OpenVPN Client conf\r\n";
6e13d0a5
MT
2201 print CLIENTCONF "tls-client\r\n";
2202 print CLIENTCONF "client\r\n";
4f6e3ae3 2203 print CLIENTCONF "nobind\r\n";
6e13d0a5 2204 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
c6c9630e 2205 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2ee746be
SS
2206
2207 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2208 # or use configured value.
2209 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
4f6e3ae3 2210 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be 2211 elsif ($vpnsettings{MSSFIX} eq 'on')
4f6e3ae3 2212 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
1647059d
SS
2213 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2214 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2215 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
4f6e3ae3 2216 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be
SS
2217 else
2218 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2219
6e13d0a5
MT
2220 if ( $vpnsettings{'ENABLED'} eq 'on'){
2221 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT
2222 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2223 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2224 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2225 }
2226 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2227 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2228 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2229 }
2230 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2231 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2232 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2233 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2234 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2235 }
2236 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2237 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT
2238 }
2239
2240 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
c6c9630e
MT
2241 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2242 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
6e13d0a5 2243 } else {
c6c9630e
MT
2244 print CLIENTCONF "ca cacert.pem\r\n";
2245 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2246 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2247 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2248 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT
2249 }
2250 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
4c962356 2251 print CLIENTCONF "auth $vpnsettings{DAUTH}\r\n";
6e13d0a5
MT
2252 if ($vpnsettings{DCOMPLZO} eq 'on') {
2253 print CLIENTCONF "comp-lzo\r\n";
2254 }
2255 print CLIENTCONF "verb 3\r\n";
2256 print CLIENTCONF "ns-cert-type server\r\n";
a79fa1d6
JPT
2257 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2258 if ($vpnsettings{MSSFIX} eq 'on') {
2259 print CLIENTCONF "mssfix\r\n";
2260 }
74225cce 2261 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT
2262 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2263 }
1647059d
SS
2264
2265 # Check if a valid operating mode has been choosen and use it.
2266 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2267 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2268 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be 2269 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
4f6e3ae3 2270 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2ee746be
SS
2271 }
2272 }
6e13d0a5 2273 close(CLIENTCONF);
ce9abb66 2274
6e13d0a5
MT
2275 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2276 my $status = $zip->writeToFileNamed($zippathname);
2277
2278 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2279 @fileholder = <DLFILE>;
2280 print "Content-Type:application/x-download\n";
2281 print "Content-Disposition:attachment;filename=$zipname\n\n";
2282 print @fileholder;
2283 exit (0);
ce9abb66
AH
2284 }
2285
2286
2287
6e13d0a5
MT
2288###
2289### Remove connection
2290###
ce9abb66
AH
2291
2292
6e13d0a5
MT
2293} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2294 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2295 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e
MT
2296
2297 if ($confighash{$cgiparams{'KEY'}}) {
2298# if ($vpnsettings{'ENABLED'} eq 'on' ||
2299# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2300# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2301# }
2302#
2303 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
ce9abb66
AH
2304
2305###
7c1d9faf 2306# m.a.d net2net
ce9abb66 2307###
7c1d9faf 2308
8e6a8fd5 2309if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
ce9abb66 2310 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
8e6a8fd5
MT
2311 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2312 unlink ($certfile);
2313 unlink ($conffile);
2314
2315 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2316 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2317 }
ce9abb66 2318}
ce9abb66
AH
2319
2320 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
8c877a82
AM
2321 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2322
2323# A.Marx CCD delete ccd files and routes
2324
2325
2326 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2327 {
2328 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2329 }
e81be1e1 2330
8c877a82
AM
2331 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2332 foreach my $key (keys %ccdroutehash) {
2333 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2334 delete $ccdroutehash{$key};
2335 }
2336 }
2337 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
e81be1e1 2338
8c877a82
AM
2339 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2340 foreach my $key (keys %ccdroute2hash) {
2341 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2342 delete $ccdroute2hash{$key};
2343 }
2344 }
2345 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
52d08bcb 2346 &writeserverconf;
8c877a82
AM
2347
2348
2349# CCD end
2350
2351
c6c9630e
MT
2352 delete $confighash{$cgiparams{'KEY'}};
2353 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2354 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
8c877a82 2355
c6c9630e 2356 #&writeserverconf();
6e13d0a5 2357 } else {
c6c9630e 2358 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5 2359 }
ce9abb66
AH
2360
2361
6e13d0a5
MT
2362###
2363### Download PKCS12 file
2364###
2365} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2366 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2367
2368 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2369 print "Content-Type: application/octet-stream\r\n\r\n";
2370 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2371 exit (0);
2372
2373###
2374### Display certificate
2375###
2376} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2377 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2378
2379 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e 2380 &Header::showhttpheaders();
4c962356 2381 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
2382 &Header::openbigbox('100%', 'LEFT', '', '');
2383 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2384 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2385 $output = &Header::cleanhtml($output,"y");
2386 print "<pre>$output</pre>\n";
2387 &Header::closebox();
2388 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2389 &Header::closebigbox();
2390 &Header::closepage();
2391 exit(0);
6e13d0a5 2392 }
4c962356
EK
2393
2394###
2395### Display Diffie-Hellman key
2396###
2397} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2398
2399 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
2400 $errormessage = $Lang::tr{'not present'};
2401 } else {
2402 &Header::showhttpheaders();
2403 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2404 &Header::openbigbox('100%', 'LEFT', '', '');
2405 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2406 my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
2407 $output = &Header::cleanhtml($output,"y");
2408 print "<pre>$output</pre>\n";
2409 &Header::closebox();
2410 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2411 &Header::closebigbox();
2412 &Header::closepage();
2413 exit(0);
2414 }
2415
6e13d0a5
MT
2416###
2417### Display Certificate Revoke List
2418###
2419} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT
2420# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2421
6e13d0a5 2422 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
c6c9630e 2423 &Header::showhttpheaders();
4c962356 2424 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
2425 &Header::openbigbox('100%', 'LEFT', '', '');
2426 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2427 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2428 $output = &Header::cleanhtml($output,"y");
2429 print "<pre>$output</pre>\n";
2430 &Header::closebox();
2431 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2432 &Header::closebigbox();
2433 &Header::closepage();
2434 exit(0);
6e13d0a5
MT
2435 }
2436
2437###
2438### Advanced Server Settings
2439###
2440
2441} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2442 %cgiparams = ();
2443 %cahash = ();
2444 %confighash = ();
8c877a82 2445 my $disabled;
6e13d0a5 2446 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 2447 read_routepushfile;
8c877a82
AM
2448
2449
c6c9630e
MT
2450# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2451# $cgiparams{'CLIENT2CLIENT'} = 'on';
2452# }
6e13d0a5
MT
2453ADV_ERROR:
2454 if ($cgiparams{'MAX_CLIENTS'} eq '') {
4c962356 2455 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 2456 }
6e13d0a5 2457 if ($cgiparams{'KEEPALIVE_1'} eq '') {
4c962356 2458 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT
2459 }
2460 if ($cgiparams{'KEEPALIVE_2'} eq '') {
4c962356 2461 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT
2462 }
2463 if ($cgiparams{'LOG_VERB'} eq '') {
4c962356 2464 $cgiparams{'LOG_VERB'} = '3';
ae9f6139 2465 }
92b87e17 2466 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
4c962356
EK
2467 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2468 }
2469 if ($cgiparams{'DAUTH'} eq '') {
2470 $cgiparams{'DAUTH'} = 'SHA1';
92b87e17 2471 }
6e13d0a5
MT
2472 $checked{'CLIENT2CLIENT'}{'off'} = '';
2473 $checked{'CLIENT2CLIENT'}{'on'} = '';
2474 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2475 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2476 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2477 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
a79fa1d6
JPT
2478 $checked{'MSSFIX'}{'off'} = '';
2479 $checked{'MSSFIX'}{'on'} = '';
2480 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2ee746be 2481 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
6e13d0a5
MT
2482 $selected{'LOG_VERB'}{'1'} = '';
2483 $selected{'LOG_VERB'}{'2'} = '';
2484 $selected{'LOG_VERB'}{'3'} = '';
2485 $selected{'LOG_VERB'}{'4'} = '';
2486 $selected{'LOG_VERB'}{'5'} = '';
2487 $selected{'LOG_VERB'}{'6'} = '';
2488 $selected{'LOG_VERB'}{'7'} = '';
2489 $selected{'LOG_VERB'}{'8'} = '';
2490 $selected{'LOG_VERB'}{'9'} = '';
2491 $selected{'LOG_VERB'}{'10'} = '';
2492 $selected{'LOG_VERB'}{'11'} = '';
2493 $selected{'LOG_VERB'}{'0'} = '';
2494 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
4c962356
EK
2495 $selected{'DAUTH'}{'whirlpool'} = '';
2496 $selected{'DAUTH'}{'SHA512'} = '';
2497 $selected{'DAUTH'}{'SHA384'} = '';
2498 $selected{'DAUTH'}{'SHA256'} = '';
2499 $selected{'DAUTH'}{'ecdsa-with-SHA1'} = '';
2500 $selected{'DAUTH'}{'SHA1'} = '';
2501 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
2502
6e13d0a5
MT
2503 &Header::showhttpheaders();
2504 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2505 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2506 if ($errormessage) {
c6c9630e
MT
2507 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2508 print "<class name='base'>$errormessage\n";
2509 print "&nbsp;</class>\n";
2510 &Header::closebox();
6e13d0a5
MT
2511 }
2512 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
4c962356 2513 print <<END;
b376fae4 2514 <form method='post' enctype='multipart/form-data'>
4c962356
EK
2515<table width='100%' border=0>
2516 <tr>
2517 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
6e13d0a5
MT
2518 </tr>
2519 <tr>
4c962356 2520 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT
2521 </tr>
2522 <tr>
4c962356 2523 <td class='base'>Domain</td>
8c877a82 2524 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
6e13d0a5
MT
2525 </tr>
2526 <tr>
4c962356
EK
2527 <td class='base'>DNS</td>
2528 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
6e13d0a5
MT
2529 </tr>
2530 <tr>
4c962356
EK
2531 <td class='base'>WINS</td>
2532 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2533 </tr>
54fd0535 2534 <tr>
4c962356 2535 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
54fd0535
MT
2536 </tr>
2537 <tr>
4c962356
EK
2538 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2539 <td colspan='2'>
2540 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
54fd0535
MT
2541END
2542;
2543
2544if ($cgiparams{'ROUTES_PUSH'} ne '')
2545{
2546 print $cgiparams{'ROUTES_PUSH'};
2547}
2548
8c877a82 2549print <<END;
54fd0535
MT
2550</textarea></td>
2551</tr>
6e13d0a5
MT
2552 </tr>
2553</table>
2554<hr size='1'>
4c962356 2555<table width='100%'>
6e13d0a5 2556 <tr>
4c962356 2557 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
6e13d0a5
MT
2558 </tr>
2559 <tr>
4c962356 2560 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
6e13d0a5
MT
2561 </tr>
2562 <tr>
4c962356
EK
2563 <td class='base'>Client-To-Client</td>
2564 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
6e13d0a5
MT
2565 </tr>
2566 <tr>
4c962356
EK
2567 <td class='base'>Redirect-Gateway def1</td>
2568 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
6e13d0a5
MT
2569 </tr>
2570 <tr>
2571 <td class='base'>Max-Clients</td>
a79fa1d6 2572 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
6e13d0a5 2573 </tr>
4c962356 2574 <tr>
f0ccae18 2575 <td class='base'>Keepalive <br />
a79fa1d6
JPT
2576 (ping/ping-restart)</td>
2577 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2578 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2579 </tr>
4c962356 2580 <tr>
a79fa1d6
JPT
2581 <td class='base'>fragment <br></td>
2582 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
4c962356
EK
2583 </tr>
2584 <tr>
a79fa1d6
JPT
2585 <td class='base'>mssfix</td>
2586 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4c962356 2587 </tr>
2ee746be
SS
2588 <tr>
2589 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2590 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2591 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2592 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2593 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2594 </tr>
a79fa1d6
JPT
2595</table>
2596
a79fa1d6 2597<hr size='1'>
4c962356 2598<table width='100%'>
a79fa1d6 2599 <tr>
4c962356 2600 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
a79fa1d6
JPT
2601 </tr>
2602 <tr>
4c962356
EK
2603 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
2604 </tr>
2605
2606 <tr><td class='base'>VERB</td>
2607 <td><select name='LOG_VERB'>
2608 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option>
2609 <option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2610 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2611 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2612 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2613 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2614 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2615 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2616 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2617 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2618 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2619 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
a79fa1d6 2620 </select>
4c962356
EK
2621 </td>
2622 </tr>
6e13d0a5 2623</table>
4c962356 2624
6e13d0a5 2625<hr size='1'>
4c962356 2626<table width='100%'>
6e13d0a5 2627 <tr>
4c962356
EK
2628 <td class'base'><b>$Lang::tr{'ovpn crypt options'}</b></td>
2629 </tr>
2630 <tr>
2631 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
6e13d0a5 2632 </tr>
4c962356
EK
2633 <tr><td class='base'>$Lang::tr{'ovpn ha'}</td>
2634 <td><select name='DAUTH'>
2635 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
2636 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
2637 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
2638 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
2639 <option value='ecdsa-with-SHA1' $selected{'DAUTH'}{'ecdsa-with-SHA1'}>ECDSA-SHA1 (160 $Lang::tr{'bit'})</option>
2640 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'})</option>
2641 </select>
2642 </td>
2643 <td>Default: <span class="base">SHA1 (160 $Lang::tr{'bit'})</span></td>
8c877a82 2644</table><hr>
4c962356 2645
8c877a82
AM
2646END
2647
2648if ( -e "/var/run/openvpn.pid"){
2649print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2650 $Lang::tr{'server restart'}<br><br>
2651 <hr>";
52d08bcb
AM
2652 print<<END
2653<table width='100%'>
2654<tr>
2655 <td>&nbsp;</td>
2656 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2657 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2658 <td>&nbsp;</td>
2659</tr>
2660</table>
2661</form>
2662END
2663;
2664
2665
2666}else{
8c877a82
AM
2667
2668print<<END
6e13d0a5
MT
2669<table width='100%'>
2670<tr>
2671 <td>&nbsp;</td>
2672 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2673 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2674 <td>&nbsp;</td>
2675</tr>
2676</table>
2677</form>
2678END
2679;
52d08bcb 2680}
6e13d0a5 2681 &Header::closebox();
c6c9630e 2682# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2683 &Header::closebigbox();
2684 &Header::closepage();
2685 exit(0);
2686
8c877a82
AM
2687
2688# A.Marx CCD Add,delete or edit CCD net
2689
2690} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2691 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2692 $cgiparams{'ACTION'} eq "kill" ||
2693 $cgiparams{'ACTION'} eq "edit" ||
2694 $cgiparams{'ACTION'} eq 'editsave'){
2695 &Header::showhttpheaders();
2696 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2697 &Header::openbigbox('100%', 'LEFT', '', '');
2698
2699 if ($cgiparams{'ACTION'} eq "kill"){
2700 &delccdnet($cgiparams{'net'});
2701 }
2702
2703 if ($cgiparams{'ACTION'} eq 'editsave'){
2704 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2705 if ( $a ne $b){ &modccdnet($a,$b);}
5068ac38
AM
2706 $cgiparams{'ccdname'}='';
2707 $cgiparams{'ccdsubnet'}='';
8c877a82
AM
2708 }
2709
2710 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
e2429e8d 2711 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
8c877a82
AM
2712 }
2713 if ($errormessage) {
2714 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2715 print "<class name='base'>$errormessage";
2716 print "&nbsp;</class>";
2717 &Header::closebox();
2718 }
2719if ($cgiparams{'ACTION'} eq "edit"){
2720
2721 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2722
4c962356
EK
2723 print <<END;
2724 <table width='100%' border=0>
8c877a82
AM
2725 <tr><form method='post'>
2726 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
4c962356 2727 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
8c877a82
AM
2728 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2729 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2730 </td></tr>
2731 </table></form>
2732END
2733;
2734 &Header::closebox();
2735
2736 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
4c962356 2737 print <<END;
8c877a82
AM
2738 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2739 <tr>
2740 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2741END
2742;
2743}
2744else{
2745 if (! -e "/var/run/openvpn.pid"){
2746 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2747 print <<END;
2748 <table width='100%' border='0'>
2749 <tr><form method='post'>
2750 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2751 <tr>
2752 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2753 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2754 <tr><td colspan=4><hr /></td></tr><tr>
2755 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2756 </table></form>
2757END
2758
2759 &Header::closebox();
2760}
2761 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
5068ac38
AM
2762 if ( -e "/var/run/openvpn.pid"){
2763 print "<b>$Lang::tr{'attention'}:</b><br>";
2764 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2765 }
2766
4c962356 2767 print <<END;
99bfa85c 2768 <table width='100%' cellpadding='0' cellspacing='1'>
8c877a82
AM
2769 <tr>
2770 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2771END
2772;
2773}
2774 my %ccdconfhash=();
2775 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2776 my @ccdconf=();
2777 my $count=0;
df9b48b7 2778 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM
2779 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2780 $count++;
2781 my $ccdhosts = &hostsinnet($ccdconf[0]);
2782 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2783 else{ print" <tr bgcolor='$color{'color20'}'>";}
2784 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
4c962356 2785 print <<END;
8c877a82 2786 <form method='post' />
4c962356 2787 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
8c877a82
AM
2788 <input type='hidden' name='ACTION' value='edit'/>
2789 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2790 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2791 </form></td>
2792 <form method='post' />
2793 <td><input type='hidden' name='ACTION' value='kill'/>
2794 <input type='hidden' name='number' value='$count' />
2795 <input type='hidden' name='net' value='$ccdconf[0]' />
4c962356 2796 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
8c877a82
AM
2797END
2798;
2799 }
2800 print "</table></form>";
2801 &Header::closebox();
2802 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2803 &Header::closebigbox();
2804 &Header::closepage();
2805 exit(0);
2806
2807#END CCD
2808
6e13d0a5
MT
2809###
2810### Openvpn Connections Statistics
2811###
2812} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2813 &Header::showhttpheaders();
2814 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2815 &Header::openbigbox('100%', 'LEFT', '', '');
2816 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2817
2818#
2819# <td><b>$Lang::tr{'protocol'}</b></td>
2820# protocol temp removed
4c962356 2821 print <<END;
99bfa85c 2822 <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
6e13d0a5 2823 <tr>
99bfa85c
AM
2824 <th><b>$Lang::tr{'common name'}</b></th>
2825 <th><b>$Lang::tr{'real address'}</b></th>
2826 <th><b>$Lang::tr{'virtual address'}</b></th>
2827 <th><b>$Lang::tr{'loged in at'}</b></th>
2828 <th><b>$Lang::tr{'bytes sent'}</b></th>
2829 <th><b>$Lang::tr{'bytes received'}</b></th>
2830 <th><b>$Lang::tr{'last activity'}</b></th>
6e13d0a5
MT
2831 </tr>
2832END
2833;
4e17adad 2834 my $filename = "/var/log/ovpnserver.log";
6e13d0a5
MT
2835 open(FILE, $filename) or die 'Unable to open config file.';
2836 my @current = <FILE>;
2837 close(FILE);
2838 my @users =();
2839 my $status;
2840 my $uid = 0;
2841 my $cn;
2842 my @match = ();
2843 my $proto = "udp";
2844 my $address;
2845 my %userlookup = ();
2846 foreach my $line (@current)
2847 {
2848 chomp($line);
2849 if ( $line =~ /^Updated,(.+)/){
2850 @match = split( /^Updated,(.+)/, $line);
2851 $status = $match[1];
2852 }
c6c9630e 2853#gian
6e13d0a5
MT
2854 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2855 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2856 if ($match[1] ne "Common Name") {
2857 $cn = $match[1];
2858 $userlookup{$match[2]} = $uid;
2859 $users[$uid]{'CommonName'} = $match[1];
2860 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT
2861 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2862 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT
2863 $users[$uid]{'Since'} = $match[5];
2864 $users[$uid]{'Proto'} = $proto;
2865 $uid++;
2866 }
2867 }
2868 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2869 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2870 if ($match[1] ne "Virtual Address") {
2871 $address = $match[3];
2872 #find the uid in the lookup table
2873 $uid = $userlookup{$address};
2874 $users[$uid]{'VirtualAddress'} = $match[1];
2875 $users[$uid]{'LastRef'} = $match[4];
2876 }
2877 }
2878 }
2879 my $user2 = @users;
2880 if ($user2 >= 1){
99bfa85c 2881 for (my $idx = 1; $idx <= $user2; $idx++){
6e13d0a5 2882 if ($idx % 2) {
99bfa85c
AM
2883 print "<tr>";
2884 $col="bgcolor='$color{'color22'}'";
2885 } else {
2886 print "<tr>";
2887 $col="bgcolor='$color{'color20'}'";
6e13d0a5 2888 }
99bfa85c
AM
2889 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
2890 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
2891 print "<td align='left' $col>$users[$idx-1]{'VirtualAddress'}</td>";
2892 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
2893 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
2894 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
2895 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
2896 }
2897 }
6e13d0a5
MT
2898
2899 print "</table>";
4c962356 2900 print <<END;
6e13d0a5
MT
2901 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2902 <tr><td></td></tr>
2903 <tr><td></td></tr>
2904 <tr><td></td></tr>
2905 <tr><td></td></tr>
2906 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2907 </table>
2908END
2909;
2910 &Header::closebox();
2911 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2912 &Header::closebigbox();
2913 &Header::closepage();
2914 exit(0);
2915
2916###
2917### Download Certificate
2918###
2919} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2920 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2921
6e13d0a5 2922 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
2923 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2924 print "Content-Type: application/octet-stream\r\n\r\n";
2925 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2926 exit (0);
2927 }
2928
2929###
2930### Enable/Disable connection
2931###
ce9abb66 2932
c6c9630e
MT
2933} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2934
2935 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2936 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2937
2938 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 2939 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT
2940 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2941 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2942 #&writeserverconf();
2943# if ($vpnsettings{'ENABLED'} eq 'on' ||
2944# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2945# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2946# }
2947 } else {
2948 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2949# if ($vpnsettings{'ENABLED'} eq 'on' ||
2950# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2951# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2952# }
2953 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2954 #&writeserverconf();
2955 }
2956 } else {
2957 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
2958 }
2959
2960###
2961### Restart connection
2962###
2963} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2964 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2965 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2966
2967 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT
2968# if ($vpnsettings{'ENABLED'} eq 'on' ||
2969# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2970# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2971# }
6e13d0a5 2972 } else {
c6c9630e 2973 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
2974 }
2975
2976###
c6c9630e 2977### Remove connection
6e13d0a5 2978###
c6c9630e
MT
2979} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2980 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2981 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2982
2983 if ($confighash{$cgiparams{'KEY'}}) {
2984# if ($vpnsettings{'ENABLED'} eq 'on' ||
2985# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2986# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2987# }
2988 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2989 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2990 delete $confighash{$cgiparams{'KEY'}};
2991 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2992 #&writeserverconf();
2993 } else {
2994 $errormessage = $Lang::tr{'invalid key'};
2995 }
ce9abb66
AH
2996#test33
2997
2998###
2999### Choose between adding a host-net or net-net connection
3000###
3001
3002###
7c1d9faf 3003# m.a.d net2net
ce9abb66
AH
3004###
3005
3006} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3007 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3008 &Header::showhttpheaders();
4c962356 3009 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
ce9abb66
AH
3010 &Header::openbigbox('100%', 'LEFT', '', '');
3011 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH
3012
3013if ( -s "${General::swroot}/ovpn/settings") {
3014
4c962356 3015 print <<END;
ce9abb66 3016 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3017 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
ce9abb66
AH
3018 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3019 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3020 <tr><td><input type='radio' name='TYPE' value='net' /></td>
3021 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3022 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
3023 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3024 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
54fd0535 3025 <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
4c962356 3026 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr>
54fd0535 3027 <tr><td colspan='3'><hr /></td></tr>
8c877a82 3028 <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
54fd0535 3029 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
ce9abb66
AH
3030 </form></table>
3031END
3032 ;
8c877a82 3033
ce9abb66 3034
b278daf3 3035} else {
4c962356 3036 print <<END;
b278daf3 3037 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3038 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
b278daf3 3039 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
8c877a82 3040 <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
b278daf3
AH
3041 </form></table>
3042END
3043 ;
3044
3045}
3046
ce9abb66 3047 &Header::closebox();
4c962356 3048 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
ce9abb66
AH
3049 &Header::closebigbox();
3050 &Header::closepage();
3051 exit (0);
3052
3053###
7c1d9faf 3054# m.a.d net2net
ce9abb66
AH
3055###
3056
3057} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3058
3059 my @firen2nconf;
3060 my @confdetails;
3061 my $uplconffilename ='';
54fd0535 3062 my $uplconffilename2 ='';
ce9abb66 3063 my $uplp12name = '';
54fd0535 3064 my $uplp12name2 = '';
ce9abb66
AH
3065 my @rem_subnet;
3066 my @rem_subnet2;
3067 my @tmposupnet3;
3068 my $key;
54fd0535 3069 my @n2nname;
ce9abb66
AH
3070
3071 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3072
3073# Check if a file is uploaded
3074
3075 if (ref ($cgiparams{'FH'}) ne 'Fh') {
3076 $errormessage = $Lang::tr{'there was no file upload'};
3077 goto N2N_ERROR;
3078 }
3079
3080# Move uploaded IPfire n2n package to temporary file
3081
3082 (my $fh, my $filename) = tempfile( );
3083 if (copy ($cgiparams{'FH'}, $fh) != 1) {
3084 $errormessage = $!;
3085 goto N2N_ERROR;
3086 }
3087
3088 my $zip = Archive::Zip->new();
3089 my $zipName = $filename;
3090 my $status = $zip->read( $zipName );
3091 if ($status != AZ_OK) {
3092 $errormessage = "Read of $zipName failed\n";
3093 goto N2N_ERROR;
3094 }
3095
3096 my $tempdir = tempdir( CLEANUP => 1 );
3097 my @files = $zip->memberNames();
3098 for(@files) {
3099 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3100 }
3101 my $countfiles = @files;
3102
3103# Check if we have not more then 2 files
3104
3105 if ( $countfiles == 2){
3106 foreach (@files){
3107 if ( $_ =~ /.conf$/){
3108 $uplconffilename = $_;
3109 }
3110 if ( $_ =~ /.p12$/){
3111 $uplp12name = $_;
3112 }
3113 }
3114 if (($uplconffilename eq '') || ($uplp12name eq '')){
3115 $errormessage = "Either no *.conf or no *.p12 file found\n";
3116 goto N2N_ERROR;
3117 }
3118
3119 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3120 @firen2nconf = <FILE>;
3121 close (FILE);
3122 chomp(@firen2nconf);
3123
3124 } else {
3125
3126 $errormessage = "Filecount does not match only 2 files are allowed\n";
3127 goto N2N_ERROR;
3128 }
3129
7c1d9faf
AH
3130###
3131# m.a.d net2net
ce9abb66 3132###
54fd0535
MT
3133
3134 if ($cgiparams{'n2nname'} ne ''){
3135
3136 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3137 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
3138 $n2nname[0] = $cgiparams{'n2nname'};
3139 my @n2nname2 = split(/\./,$uplconffilename);
3140 $n2nname2[0] =~ s/\n|\r//g;
3141 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3142 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3143 my $input2 = "$n2nname2[0]n2n";
3144 my $output2 = "$n2nname[0]n2n";
3145 my $filename = "$tempdir/$uplconffilename";
3146 open(FILE, "< $filename") or die 'Unable to open config file.';
3147 my @current = <FILE>;
3148 close(FILE);
3149 foreach (@current) {s/$input1/$output1/g;}
3150 foreach (@current) {s/$input2/$output2/g;}
3151 open (OUT, "> $filename") || die 'Unable to open config file.';
3152 print OUT @current;
3153 close OUT;
ce9abb66 3154
54fd0535
MT
3155 }else{
3156 $uplconffilename2 = $uplconffilename;
3157 $uplp12name2 = $uplp12name;
3158 @n2nname = split(/\./,$uplconffilename);
ce9abb66 3159 $n2nname[0] =~ s/\n|\r//g;
54fd0535 3160 }
7c1d9faf
AH
3161 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3162 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
ce9abb66 3163
54fd0535 3164 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
ce9abb66
AH
3165
3166 if ($? ne 0) {
3167 $errormessage = "*.conf move failed: $!";
3168 unlink ($filename);
3169 goto N2N_ERROR;
3170 }
3171
54fd0535 3172 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
b278daf3
AH
3173 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3174
ce9abb66
AH
3175 if ($? ne 0) {
3176 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3177 unlink ($filename);
3178 goto N2N_ERROR;
3179 }
3180
3181my $complzoactive;
d96c89eb 3182my $mssfixactive;
4c962356 3183my $authactive;
d96c89eb 3184my $n2nfragment;
4c962356 3185my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);
60f396d7 3186my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
54fd0535 3187my @n2nproto = split(/-/, $n2nproto2[1]);
ce9abb66
AH
3188my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3189my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3190my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3191if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH
3192my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
3193if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
54fd0535 3194#my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
d96c89eb 3195my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH
3196my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3197my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3198my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
3199my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
54fd0535 3200my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
ce9abb66 3201my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
4c962356
EK
3202my @n2ncipher = split(/ /, (grep { /^cipher/ } @firen2nconf)[0]);
3203my @n2nauth = split(/ /, (grep { /^auth/ } @firen2nconf)[0]);
ce9abb66 3204
60f396d7 3205
ce9abb66
AH
3206###
3207# m.a.d delete CR and LF from arrays for this chomp doesnt work
3208###
3209
ce9abb66 3210$n2nremote[1] =~ s/\n|\r//g;
ce9abb66
AH
3211$n2novpnsub[0] =~ s/\n|\r//g;
3212$n2novpnsub[1] =~ s/\n|\r//g;
3213$n2novpnsub[2] =~ s/\n|\r//g;
60f396d7 3214$n2nproto[0] =~ s/\n|\r//g;
ce9abb66
AH
3215$n2nport[1] =~ s/\n|\r//g;
3216$n2ntunmtu[1] =~ s/\n|\r//g;
3217$n2nremsub[1] =~ s/\n|\r//g;
b278daf3 3218$n2nremsub[2] =~ s/\n|\r//g;
ce9abb66 3219$n2nlocalsub[2] =~ s/\n|\r//g;
d96c89eb 3220$n2nfragment[1] =~ s/\n|\r//g;
54fd0535 3221$n2nmgmt[2] =~ s/\n|\r//g;
2ee746be 3222$n2nmtudisc[1] =~ s/\n|\r//g;
4c962356
EK
3223$n2ncipher[1] =~ s/\n|\r//g;
3224$n2nauth[1] =~ s/\n|\r//g;
ce9abb66 3225chomp ($complzoactive);
d96c89eb 3226chomp ($mssfixactive);
ce9abb66
AH
3227
3228###
7c1d9faf 3229# m.a.d net2net
ce9abb66
AH
3230###
3231
3232###
3233# Check if there is no other entry with this name
3234###
3235
3236 foreach my $dkey (keys %confighash) {
3237 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3238 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH
3239 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3240 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3241 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
ce9abb66
AH
3242 goto N2N_ERROR;
3243 }
3244 }
3245
d96c89eb
AH
3246###
3247# Check if OpenVPN Subnet is valid
3248###
3249
3250foreach my $dkey (keys %confighash) {
3251 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3252 $errormessage = 'The OpenVPN Subnet is already in use';
b278daf3
AH
3253 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3254 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3255 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH
3256 goto N2N_ERROR;
3257 }
3258 }
3259
3260###
4c962356 3261# Check if Dest Port is vaild
d96c89eb
AH
3262###
3263
3264foreach my $dkey (keys %confighash) {
3265 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3266 $errormessage = 'The OpenVPN Port is already in use';
b278daf3
AH
3267 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3268 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3269 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH
3270 goto N2N_ERROR;
3271 }
3272 }
3273
3274
3275
ce9abb66
AH
3276 $key = &General::findhasharraykey (\%confighash);
3277
4c962356 3278 foreach my $i (0 .. 41) { $confighash{$key}[$i] = "";}
350f2980 3279
ce9abb66
AH
3280 $confighash{$key}[0] = 'off';
3281 $confighash{$key}[1] = $n2nname[0];
350f2980 3282 $confighash{$key}[2] = $n2nname[0];
ce9abb66
AH
3283 $confighash{$key}[3] = 'net';
3284 $confighash{$key}[4] = 'cert';
3285 $confighash{$key}[6] = 'client';
3286 $confighash{$key}[8] = $n2nlocalsub[2];
350f2980
SS
3287 $confighash{$key}[10] = $n2nremote[1];
3288 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
54fd0535 3289 $confighash{$key}[22] = $n2nmgmt[2];
350f2980 3290 $confighash{$key}[23] = $mssfixactive;
d96c89eb 3291 $confighash{$key}[24] = $n2nfragment[1];
350f2980 3292 $confighash{$key}[25] = 'IPFire n2n Client';
ce9abb66 3293 $confighash{$key}[26] = 'red';
350f2980
SS
3294 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3295 $confighash{$key}[28] = $n2nproto[0];
3296 $confighash{$key}[29] = $n2nport[1];
3297 $confighash{$key}[30] = $complzoactive;
3298 $confighash{$key}[31] = $n2ntunmtu[1];
3299 $confighash{$key}[38] = $n2nmtudisc[1];
4c962356
EK
3300 $confighash{$key}[39] = $n2nauth[1];
3301 $confighash{$key}[40] = $n2ncipher[1];
ce9abb66
AH
3302
3303 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
d96c89eb 3304
ce9abb66
AH
3305 N2N_ERROR: