openvpn: Properly remove all RRDs after a connection is removed
[ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
49abe7af 5# Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535 21###
f527e53f 22# Based on IPFireCore 77
54fd0535 23###
6e13d0a5
MT
24use CGI;
25use CGI qw/:standard/;
26use Net::DNS;
ce9abb66 27use Net::Ping;
54fd0535 28use Net::Telnet;
6e13d0a5
MT
29use File::Copy;
30use File::Temp qw/ tempfile tempdir /;
31use strict;
32use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
eff2dbf8 33use Sort::Naturally;
6e13d0a5 34require '/var/ipfire/general-functions.pl';
6e13d0a5
MT
35require "${General::swroot}/lang.pl";
36require "${General::swroot}/header.pl";
37require "${General::swroot}/countries.pl";
38
39# enable only the following on debugging purpose
8c877a82
AM
40#use warnings;
41#use CGI::Carp 'fatalsToBrowser';
6e13d0a5 42#workaround to suppress a warning when a variable is used only once
8c877a82 43my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
6e13d0a5
MT
44undef (@dummy);
45
f2fdd0c1
CS
46my %color = ();
47my %mainsettings = ();
48&General::readhash("${General::swroot}/main/settings", \%mainsettings);
49&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
6e13d0a5
MT
50
51###
52### Initialize variables
53###
e81be1e1
AM
54my %ccdconfhash=();
55my %ccdroutehash=();
56my %ccdroute2hash=();
6e13d0a5
MT
57my %netsettings=();
58my %cgiparams=();
59my %vpnsettings=();
60my %checked=();
61my %confighash=();
62my %cahash=();
63my %selected=();
64my $warnmessage = '';
65my $errormessage = '';
66my %settings=();
54fd0535 67my $routes_push_file = '';
df9b48b7
AM
68my $confighost="${General::swroot}/fwhosts/customhosts";
69my $configgrp="${General::swroot}/fwhosts/customgroups";
70my $customnet="${General::swroot}/fwhosts/customnetworks";
71my $name;
99bfa85c 72my $col="";
ffbe77c8
EK
73my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local";
74my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local";
75
6e13d0a5
MT
76&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
77$cgiparams{'ENABLED'} = 'off';
78$cgiparams{'ENABLED_BLUE'} = 'off';
79$cgiparams{'ENABLED_ORANGE'} = 'off';
80$cgiparams{'EDIT_ADVANCED'} = 'off';
81$cgiparams{'NAT'} = 'off';
82$cgiparams{'COMPRESSION'} = 'off';
83$cgiparams{'ONLY_PROPOSED'} = 'off';
84$cgiparams{'ACTION'} = '';
85$cgiparams{'CA_NAME'} = '';
4c962356
EK
86$cgiparams{'DH_NAME'} = 'dh1024.pem';
87$cgiparams{'DHLENGHT'} = '';
6e13d0a5
MT
88$cgiparams{'DHCP_DOMAIN'} = '';
89$cgiparams{'DHCP_DNS'} = '';
90$cgiparams{'DHCP_WINS'} = '';
54fd0535 91$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 92$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 93$cgiparams{'MSSFIX'} = '';
8c877a82 94$cgiparams{'number'} = '';
2ee746be 95$cgiparams{'PMTU_DISCOVERY'} = '';
4c962356 96$cgiparams{'DCIPHER'} = '';
49abe7af
EK
97$cgiparams{'DAUTH'} = '';
98$cgiparams{'TLSAUTH'} = '';
54fd0535 99$routes_push_file = "${General::swroot}/ovpn/routes_push";
ffbe77c8
EK
100
101# Add CCD files if not already presant
102unless (-e $routes_push_file) {
103 open(RPF, ">$routes_push_file");
104 close(RPF);
105}
106unless (-e "${General::swroot}/ovpn/ccd.conf") {
107 open(CCDC, ">${General::swroot}/ovpn/ccd.conf");
108 close (CCDC);
109}
110unless (-e "${General::swroot}/ovpn/ccdroute") {
111 open(CCDR, ">${General::swroot}/ovpn/ccdroute");
112 close (CCDR);
113}
114unless (-e "${General::swroot}/ovpn/ccdroute2") {
115 open(CCDRT, ">${General::swroot}/ovpn/ccdroute2");
116 close (CCDRT);
117}
118# Add additional configs if not already presant
119unless (-e "$local_serverconf") {
120 open(LSC, ">$local_serverconf");
121 close (LSC);
122}
123unless (-e "$local_clientconf") {
124 open(LCC, ">$local_clientconf");
125 close (LCC);
126}
ce9abb66 127
6e13d0a5
MT
128&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
129
130# prepare openvpn config file
131###
132### Useful functions
133###
c6c9630e
MT
134sub haveOrangeNet
135{
13211b21
CS
136 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
137 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
138 return 0;
139}
140
141sub haveBlueNet
142{
13211b21 143 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 144 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
145 return 0;
146}
147
148sub sizeformat{
149 my $bytesize = shift;
150 my $i = 0;
151
152 while(abs($bytesize) >= 1024){
153 $bytesize=$bytesize/1024;
154 $i++;
155 last if($i==6);
156 }
157
158 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
159 my $newsize=(int($bytesize*100 +0.5))/100;
160 return("$newsize $units[$i]");
161}
162
c6c9630e
MT
163sub cleanssldatabase
164{
165 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
166 print FILE "01";
167 close FILE;
168 }
169 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
170 print FILE "";
171 close FILE;
172 }
173 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
174 unlink ("${General::swroot}/ovpn/certs/serial.old");
175 unlink ("${General::swroot}/ovpn/certs/01.pem");
176}
177
178sub newcleanssldatabase
179{
180 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
181 open(FILE, ">${General::swroot}(ovpn/certs/serial");
182 print FILE "01";
183 close FILE;
184 }
185 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
186 system ("touch ${General::swroot}/ovpn/certs/index.txt");
187 }
188 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
189 unlink ("${General::swroot}/ovpn/certs/serial.old");
190}
191
192sub deletebackupcert
193{
194 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
195 my $hexvalue = <FILE>;
196 chomp $hexvalue;
197 close FILE;
198 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
199 }
200}
4c962356 201
c6c9630e 202sub writeserverconf {
54fd0535
MT
203 my %sovpnsettings = ();
204 my @temp = ();
c6c9630e 205 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535
MT
206 &read_routepushfile;
207
c6c9630e
MT
208 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
209 flock CONF, 2;
210 print CONF "#OpenVPN Server conf\n";
211 print CONF "\n";
212 print CONF "daemon openvpnserver\n";
213 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 214 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e
MT
215 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
216 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
c6c9630e
MT
217 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
218 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
2b29c22e 219 print CONF "script-security 3 system\n";
07675dc3 220 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 221 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e 222 print CONF "tls-server\n";
4c962356
EK
223 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
224 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
225 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 226 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
c6c9630e
MT
227 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
228 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
8c877a82 229 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
4c962356 230
2ee746be
SS
231 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
232 # If we doesn't use one of them, we can use the configured mtu value.
233 if ($sovpnsettings{'MSSFIX'} eq 'on')
234 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
235 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
236 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
1647059d 237 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
4c962356
EK
238 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
239 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2ee746be
SS
240 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
241 else
242 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
243
54fd0535 244 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
8c877a82
AM
245 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
246 foreach (@temp)
247 {
248 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
249 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
250 }
54fd0535 251 }
8c877a82
AM
252# a.marx ccd
253 my %ccdconfhash=();
254 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
255 foreach my $key (keys %ccdconfhash) {
256 my $a=$ccdconfhash{$key}[1];
257 my ($b,$c) = split (/\//, $a);
258 print CONF "route $b ".&General::cidrtosub($c)."\n";
259 }
260 my %ccdroutehash=();
261 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
262 foreach my $key (keys %ccdroutehash) {
263 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
264 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
265 print CONF "route $a $b\n";
266 }
267 }
268# ccd end
54fd0535 269
8c877a82 270 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
c6c9630e
MT
271 print CONF "client-to-client\n";
272 }
1de5c945 273 if ($sovpnsettings{MSSFIX} eq 'on') {
4c962356 274 print CONF "mssfix\n";
1de5c945
EK
275 }
276 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
4c962356 277 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 278 }
2ee746be 279
1647059d
SS
280 # Check if a valid operating mode has been choosen and use it.
281 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
282 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
283 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
284 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
2ee746be
SS
285 }
286
c6c9630e
MT
287 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
288 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
289 }
290 print CONF "status-version 1\n";
87fe47e9 291 print CONF "status /var/run/ovpnserver.log 30\n";
c6c9630e 292 print CONF "cipher $sovpnsettings{DCIPHER}\n";
49abe7af
EK
293 if ($sovpnsettings{'DAUTH'} eq '') {
294 print CONF "";
295 } else {
296 print CONF "auth $sovpnsettings{'DAUTH'}\n";
297 }
298 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
4be45949 299 print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
49abe7af 300 }
c6c9630e
MT
301 if ($sovpnsettings{DCOMPLZO} eq 'on') {
302 print CONF "comp-lzo\n";
303 }
304 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
305 print CONF "push \"redirect-gateway def1\"\n";
306 }
307 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
308 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
309 }
310
311 if ($sovpnsettings{DHCP_DNS} ne '') {
312 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
313 }
314
315 if ($sovpnsettings{DHCP_WINS} ne '') {
316 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
317 }
318
319 if ($sovpnsettings{DHCP_WINS} eq '') {
320 print CONF "max-clients 100\n";
a79fa1d6 321 }
c6c9630e
MT
322 if ($sovpnsettings{DHCP_WINS} ne '') {
323 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
324 }
1d0a260a 325 print CONF "tls-verify /usr/lib/openvpn/verify\n";
c6c9630e
MT
326 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
327 print CONF "user nobody\n";
328 print CONF "group nobody\n";
329 print CONF "persist-key\n";
330 print CONF "persist-tun\n";
331 if ($sovpnsettings{LOG_VERB} ne '') {
332 print CONF "verb $sovpnsettings{LOG_VERB}\n";
333 } else {
334 print CONF "verb 3\n";
ffbe77c8
EK
335 }
336 # Print server.conf.local if entries exist to server.conf
337 if ( !-z $local_serverconf && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
338 open (LSC, "$local_serverconf");
339 print CONF "\n#---------------------------\n";
340 print CONF "# Start of custom directives\n";
341 print CONF "# from server.conf.local\n";
342 print CONF "#---------------------------\n\n";
343 while (<LSC>) {
344 print CONF $_;
345 }
346 print CONF "\n#-----------------------------\n";
347 print CONF "# End of custom directives\n";
348 print CONF "#-----------------------------\n";
349 close (LSC);
350 }
c6c9630e
MT
351 print CONF "\n";
352
353 close(CONF);
354}
8c877a82 355
c6c9630e 356sub emptyserverlog{
87fe47e9 357 if (open(FILE, ">/var/run/ovpnserver.log")) {
c6c9630e
MT
358 flock FILE, 2;
359 print FILE "";
360 close FILE;
361 }
362
363}
364
8c877a82
AM
365sub delccdnet
366{
367 my %ccdconfhash = ();
368 my %ccdhash = ();
369 my $ccdnetname=$_[0];
370 if (-f "${General::swroot}/ovpn/ovpnconfig"){
371 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
372 foreach my $key (keys %ccdhash) {
373 if ($ccdhash{$key}[32] eq $ccdnetname) {
374 $errormessage=$Lang::tr{'ccd err hostinnet'};
375 return;
376 }
377 }
378 }
379 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
380 foreach my $key (keys %ccdconfhash) {
381 if ($ccdconfhash{$key}[0] eq $ccdnetname){
382 delete $ccdconfhash{$key};
383 }
384 }
385 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
386
387 &writeserverconf;
388 return 0;
389}
390
391sub addccdnet
392{
393 my %ccdconfhash=();
394 my @ccdconf=();
395 my $ccdname=$_[0];
396 my $ccdnet=$_[1];
8c877a82
AM
397 my $subcidr;
398 my @ip2=();
399 my $checkup;
400 my $ccdip;
401 my $baseaddress;
290007b3
AM
402
403
404 #check name
405 if ($ccdname eq '')
406 {
407 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
408 return
409 }
410
411 if(!&General::validhostname($ccdname))
412 {
8c877a82
AM
413 $errormessage=$Lang::tr{'ccd err invalidname'};
414 return;
415 }
290007b3
AM
416
417 ($ccdip,$subcidr) = split (/\//,$ccdnet);
418 $subcidr=&General::iporsubtocidr($subcidr);
419 #check subnet
420 if ($subcidr > 30)
421 {
8c877a82
AM
422 $errormessage=$Lang::tr{'ccd err invalidnet'};
423 return;
424 }
290007b3
AM
425 #check ip
426 if (!&General::validipandmask($ccdnet)){
427 $errormessage=$Lang::tr{'ccd err invalidnet'};
428 return;
8c877a82 429 }
290007b3 430
e2429e8d 431 $errormessage=&General::checksubnets($ccdname,$ccdnet);
290007b3 432
8c877a82
AM
433
434 if (!$errormessage) {
435 my %ccdconfhash=();
436 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
437 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
438 my $key = &General::findhasharraykey (\%ccdconfhash);
439 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
440 $ccdconfhash{$key}[0] = $ccdname;
441 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
442 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
443 &writeserverconf;
444 $cgiparams{'ccdname'}='';
445 $cgiparams{'ccdsubnet'}='';
446 return 1;
447 }
448}
449
450sub modccdnet
451{
452
453 my $newname=$_[0];
454 my $oldname=$_[1];
455 my %ccdconfhash=();
456 my %ccdhash=();
457 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
458 foreach my $key (keys %ccdconfhash) {
459 if ($ccdconfhash{$key}[0] eq $oldname) {
460 foreach my $key1 (keys %ccdconfhash) {
461 if ($ccdconfhash{$key1}[0] eq $newname){
462 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
463 return;
464 }else{
465 $ccdconfhash{$key}[0]= $newname;
466 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
467 last;
468 }
469 }
470 }
471 }
472
473 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
474 foreach my $key (keys %ccdhash) {
475 if ($ccdhash{$key}[32] eq $oldname) {
476 $ccdhash{$key}[32]=$newname;
477 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
478 last;
479 }
480 }
481
482 return 0;
483}
484sub ccdmaxclients
485{
486 my $ccdnetwork=$_[0];
487 my @octets=();
488 my @subnet=();
489 @octets=split("\/",$ccdnetwork);
490 @subnet= split /\./, &General::cidrtosub($octets[1]);
491 my ($a,$b,$c,$d,$e);
492 $a=256-$subnet[0];
493 $b=256-$subnet[1];
494 $c=256-$subnet[2];
495 $d=256-$subnet[3];
496 $e=($a*$b*$c*$d)/4;
497 return $e-1;
498}
499
500sub getccdadresses
501{
502 my $ipin=$_[0];
503 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
504 my $cidr=$_[1];
505 chomp($cidr);
506 my $count=$_[2];
507 my $hasip=$_[3];
508 chomp($hasip);
509 my @iprange=();
510 my %ccdhash=();
511 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
d9fe5693 512 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
ac87f371 513 for (my $i=1;$i<=$count;$i++) {
8c877a82
AM
514 my $tmpip=$iprange[$i-1];
515 my $stepper=$i*4;
516 $iprange[$i]= &General::getnextip($tmpip,4);
517 }
518 my $r=0;
519 foreach my $key (keys %ccdhash) {
520 $r=0;
521 foreach my $tmp (@iprange){
522 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
523 if ($net eq $tmp) {
524 if ( $hasip ne $ccdhash{$key}[33] ){
525 splice (@iprange,$r,1);
526 }
527 }
528 $r++;
529 }
530 }
531 return @iprange;
532}
533
534sub fillselectbox
535{
536 my $boxname=$_[1];
537 my ($ccdip,$subcidr) = split("/",$_[0]);
538 my $tz=$_[2];
539 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
540 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
541 foreach (@allccdips) {
542 my $ip=$_."/30";
543 chomp($ip);
544 print "<option value='$ip' ";
545 if ( $ip eq $cgiparams{$boxname} ){
546 print"selected";
547 }
548 print ">$ip</option>";
549 }
550 print "</select>";
551}
552
553sub hostsinnet
554{
555 my $name=$_[0];
556 my %ccdhash=();
557 my $i=0;
558 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
559 foreach my $key (keys %ccdhash) {
560 if ($ccdhash{$key}[32] eq $name){ $i++;}
561 }
562 return $i;
563}
564
565sub check_routes_push
566{
567 my $val=$_[0];
568 my ($ip,$cidr) = split (/\//, $val);
569 ##check for existing routes in routes_push
570 if (-e "${General::swroot}/ovpn/routes_push") {
571 open(FILE,"${General::swroot}/ovpn/routes_push");
572 while (<FILE>) {
573 $_=~s/\s*$//g;
574
575 my ($ip2,$cidr2) = split (/\//,"$_");
576 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
577
578 if($val eq $val2){
579 return 0;
580 }
581 #subnetcheck
582 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
583 return 0;
584 }
585 };
586 close(FILE);
587 }
588 return 1;
589}
590
591sub check_ccdroute
592{
593 my %ccdroutehash=();
594 my $val=$_[0];
595 my ($ip,$cidr) = split (/\//, $val);
596 #check for existing routes in ccdroute
597 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
598 foreach my $key (keys %ccdroutehash) {
599 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
600 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
601 return 0;
602 }
603 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
604 #subnetcheck
605 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
606 return 0;
607 }
608 }
609 }
610 return 1;
611}
612sub check_ccdconf
613{
614 my %ccdconfhash=();
615 my $val=$_[0];
616 my ($ip,$cidr) = split (/\//, $val);
617 #check for existing routes in ccdroute
618 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
619 foreach my $key (keys %ccdconfhash) {
620 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
621 return 0;
622 }
623 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
624 #subnetcheck
625 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
626 return 0;
627 }
628
629 }
630 return 1;
631}
632
7c1d9faf
AH
633###
634# m.a.d net2net
635###
636
637sub validdotmask
638{
639 my $ipdotmask = $_[0];
640 if (&General::validip($ipdotmask)) { return 0; }
641 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
642 my $mask = $2;
643 if (($mask =~ /\./ )) { return 0; }
644 return 1;
645}
54fd0535
MT
646
647# -------------------------------------------------------------------
648
649sub write_routepushfile
650{
651 open(FILE, ">$routes_push_file");
652 flock(FILE, 2);
653 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
654 print FILE $vpnsettings{'ROUTES_PUSH'};
655 }
656 close(FILE);
657}
658
659sub read_routepushfile
660{
661 if (-e "$routes_push_file") {
662 open(FILE,"$routes_push_file");
663 delete $vpnsettings{'ROUTES_PUSH'};
664 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
665 close(FILE);
666 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
8c877a82 667
54fd0535
MT
668 }
669}
7c1d9faf
AH
670
671
c6c9630e
MT
672#hier die refresh page
673if ( -e "${General::swroot}/ovpn/gencanow") {
674 my $refresh = '';
675 $refresh = "<meta http-equiv='refresh' content='15;' />";
676 &Header::showhttpheaders();
677 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
678 &Header::openbigbox('100%', 'center');
679 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
680 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
681 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
682 &Header::closebox();
683 &Header::closebigbox();
684 &Header::closepage();
685 exit (0);
686}
687##hier die refresh page
688
6e13d0a5
MT
689
690###
691### OpenVPN Server Control
692###
693if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
694 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
695 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT
696 #start openvpn server
697 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 698 &emptyserverlog();
6e13d0a5
MT
699 system('/usr/local/bin/openvpnctrl', '-s');
700 }
701 #stop openvpn server
702 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
6e13d0a5 703 system('/usr/local/bin/openvpnctrl', '-k');
c6c9630e 704 &emptyserverlog();
6e13d0a5
MT
705 }
706# #restart openvpn server
8c877a82 707# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
6e13d0a5 708#workarund, till SIGHUP also works when running as nobody
8c877a82
AM
709# system('/usr/local/bin/openvpnctrl', '-r');
710# &emptyserverlog();
711# }
6e13d0a5
MT
712}
713
714###
715### Save Advanced options
716###
717
718if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
719 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
720 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
721 #DAN this value has to leave.
722#new settings for daemon
723 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
724 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
725 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
726 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
727 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
728 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
ffbe77c8 729 $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
6e13d0a5
MT
730 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
731 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
732 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535 733 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
2ee746be 734 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
4c962356 735 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
49abe7af 736 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
54fd0535 737 my @temp=();
6e13d0a5 738
a79fa1d6
JPT
739 if ($cgiparams{'FRAGMENT'} eq '') {
740 delete $vpnsettings{'FRAGMENT'};
741 } else {
742 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
743 $errormessage = "Incorrect value, please insert only numbers.";
744 goto ADV_ERROR;
745 } else {
746 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
747 }
748 }
49abe7af 749
a79fa1d6 750 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 751 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT
752 } else {
753 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
754 }
2ee746be 755
1647059d
SS
756 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
757 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
758 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
759
2ee746be
SS
760 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
761 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
762 goto ADV_ERROR;
763 }
764 }
765
6e13d0a5 766 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
81da1b01 767 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
6e13d0a5
MT
768 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
769 goto ADV_ERROR;
770 }
771 }
772 if ($cgiparams{'DHCP_DNS'} ne ''){
773 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
774 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
775 goto ADV_ERROR;
776 }
777 }
778 if ($cgiparams{'DHCP_WINS'} ne ''){
779 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
780 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT
781 goto ADV_ERROR;
782 }
783 }
784 if ($cgiparams{'ROUTES_PUSH'} ne ''){
785 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
786 undef $vpnsettings{'ROUTES_PUSH'};
8c877a82
AM
787
788 foreach my $tmpip (@temp)
54fd0535
MT
789 {
790 s/^\s+//g; s/\s+$//g;
8c877a82
AM
791
792 if ($tmpip)
54fd0535 793 {
8c877a82
AM
794 $tmpip=~s/\s*$//g;
795 unless (&General::validipandmask($tmpip)) {
796 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
797 goto ADV_ERROR;
54fd0535 798 }
8c877a82
AM
799 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
800
54fd0535
MT
801 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
802 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
8c877a82
AM
803 goto ADV_ERROR;
804 }
805# a.marx ccd
806 my %ccdroutehash=();
807 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
808 foreach my $key (keys %ccdroutehash) {
809 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
810 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
811 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
812 goto ADV_ERROR;
813 }
814 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
815 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
816 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
817 goto ADV_ERROR;
818 }
819 }
54fd0535 820 }
8c877a82
AM
821
822# ccd end
823
824 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
54fd0535 825 }
8c877a82
AM
826 }
827 &write_routepushfile;
54fd0535 828 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP
829 }
830 else {
831 undef $vpnsettings{'ROUTES_PUSH'};
832 &write_routepushfile;
6e13d0a5 833 }
6e13d0a5
MT
834 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
835 $errormessage = $Lang::tr{'invalid input for max clients'};
836 goto ADV_ERROR;
837 }
838 if ($cgiparams{'KEEPALIVE_1'} ne '') {
839 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
840 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
841 goto ADV_ERROR;
842 }
843 }
844 if ($cgiparams{'KEEPALIVE_2'} ne ''){
845 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
846 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
847 goto ADV_ERROR;
848 }
849 }
850 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
851 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
852 goto ADV_ERROR;
853 }
4be45949
EK
854 # Create ta.key for tls-auth if not presant
855 if ($cgiparams{'TLSAUTH'} eq 'on') {
856 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
857 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
858 if ($?) {
859 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
860 goto ADV_ERROR;
861 }
862 }
863 }
6e13d0a5
MT
864
865 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 866 &writeserverconf();#hier ok
6e13d0a5
MT
867}
868
ce9abb66 869###
7c1d9faf 870# m.a.d net2net
ce9abb66
AH
871###
872
873if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
874{
c6c9630e 875
ce9abb66
AH
876my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
877my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 878my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 879my $tunmtu = '';
531f0835
AH
880
881unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
882unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
883
884 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
885
886 flock SERVERCONF, 2;
7c1d9faf 887 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
ce9abb66 888 print SERVERCONF "\n";
b278daf3 889 print SERVERCONF "# User Security\n";
ce9abb66
AH
890 print SERVERCONF "user nobody\n";
891 print SERVERCONF "group nobody\n";
892 print SERVERCONF "persist-tun\n";
893 print SERVERCONF "persist-key\n";
7c1d9faf 894 print SERVERCONF "script-security 2\n";
60f396d7 895 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
c125d8a2
SS
896
897 if ($cgiparams{'REMOTE'} ne '') {
ce9abb66 898 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
c125d8a2
SS
899 }
900
b278daf3 901 print SERVERCONF "float\n";
60f396d7 902 print SERVERCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 903 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
60f396d7 904 print SERVERCONF "# Client Gateway Network\n";
54fd0535 905 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 906 print SERVERCONF "# tun Device\n";
ce9abb66 907 print SERVERCONF "dev tun\n";
5795fc1b
AM
908 print SERVERCONF "#Logfile for statistics\n";
909 print SERVERCONF "status-version 1\n";
87fe47e9 910 print SERVERCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
60f396d7 911 print SERVERCONF "# Port and Protokol\n";
ce9abb66 912 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
5795fc1b 913
60f396d7
AH
914 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
915 print SERVERCONF "proto tcp-server\n";
916 print SERVERCONF "# Packet size\n";
d96c89eb 917 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 918 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 919 }
60f396d7
AH
920
921 if ($cgiparams{'PROTOCOL'} eq 'udp') {
922 print SERVERCONF "proto udp\n";
923 print SERVERCONF "# Paketsize\n";
924 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
925 print SERVERCONF "tun-mtu $tunmtu\n";
54fd0535
MT
926 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
927 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
d96c89eb 928 }
1647059d
SS
929
930 # Check if a valid operating mode has been choosen and use it.
931 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
932 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
933 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
934 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
935 if($cgiparams{'MTU'} eq '1500') {
936 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
937 }
938 }
939 }
60f396d7 940 print SERVERCONF "# Auth. Server\n";
ce9abb66
AH
941 print SERVERCONF "tls-server\n";
942 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
943 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
944 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 945 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
b278daf3 946 print SERVERCONF "# Cipher\n";
4c962356 947 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
49abe7af
EK
948 if ($cgiparams{'DAUTH'} eq '') {
949 print SERVERCONF "auth SHA1\n";
950 } else {
951 print SERVERCONF "# HMAC algorithm\n";
952 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
953 }
ce9abb66 954 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 955 print SERVERCONF "# Enable Compression\n";
66298ef2 956 print SERVERCONF "comp-lzo\n";
b278daf3 957 }
60f396d7 958 print SERVERCONF "# Debug Level\n";
ce9abb66 959 print SERVERCONF "verb 3\n";
b278daf3 960 print SERVERCONF "# Tunnel check\n";
ce9abb66 961 print SERVERCONF "keepalive 10 60\n";
60f396d7 962 print SERVERCONF "# Start as daemon\n";
ce9abb66
AH
963 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
964 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 965 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT
966 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
967 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH
968 close(SERVERCONF);
969
970}
971
972###
7c1d9faf 973# m.a.d net2net
ce9abb66 974###
7c1d9faf 975
ce9abb66
AH
976if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
977{
4c962356 978
ce9abb66 979 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 980 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 981 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 982 my $tunmtu = '';
54fd0535 983
531f0835
AH
984unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
985unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
986
987 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
988
989 flock CLIENTCONF, 2;
7c1d9faf 990 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 991 print CLIENTCONF "#\n";
b278daf3 992 print CLIENTCONF "# User Security\n";
ce9abb66
AH
993 print CLIENTCONF "user nobody\n";
994 print CLIENTCONF "group nobody\n";
995 print CLIENTCONF "persist-tun\n";
996 print CLIENTCONF "persist-key\n";
7c1d9faf 997 print CLIENTCONF "script-security 2\n";
60f396d7 998 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 999 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 1000 print CLIENTCONF "float\n";
60f396d7 1001 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1002 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
60f396d7 1003 print CLIENTCONF "# Server Gateway Network\n";
54fd0535 1004 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 1005 print CLIENTCONF "# tun Device\n";
ce9abb66 1006 print CLIENTCONF "dev tun\n";
60f396d7 1007 print CLIENTCONF "# Port and Protokol\n";
ce9abb66 1008 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
1009
1010 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1011 print CLIENTCONF "proto tcp-client\n";
1012 print CLIENTCONF "# Packet size\n";
d96c89eb 1013 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 1014 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1015 }
60f396d7
AH
1016
1017 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1018 print CLIENTCONF "proto udp\n";
1019 print CLIENTCONF "# Paketsize\n";
1020 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1021 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535
MT
1022 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1023 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
d96c89eb 1024 }
1647059d
SS
1025
1026 # Check if a valid operating mode has been choosen and use it.
1027 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1028 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1029 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
1030 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1031 if ($cgiparams{'MTU'} eq '1500') {
1032 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1033 }
1034 }
1647059d
SS
1035 }
1036
54fd0535 1037 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
1038 print CLIENTCONF "# Auth. Client\n";
1039 print CLIENTCONF "tls-client\n";
b278daf3 1040 print CLIENTCONF "# Cipher\n";
4c962356 1041 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
ce9abb66 1042 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
49abe7af
EK
1043 if ($cgiparams{'DAUTH'} eq '') {
1044 print CLIENTCONF "auth SHA1\n";
1045 } else {
1046 print CLIENTCONF "# HMAC algorithm\n";
1047 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1048 }
ce9abb66 1049 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1050 print CLIENTCONF "# Enable Compression\n";
66298ef2 1051 print CLIENTCONF "comp-lzo\n";
4c962356 1052 }
ce9abb66
AH
1053 print CLIENTCONF "# Debug Level\n";
1054 print CLIENTCONF "verb 3\n";
b278daf3 1055 print CLIENTCONF "# Tunnel check\n";
ce9abb66 1056 print CLIENTCONF "keepalive 10 60\n";
60f396d7 1057 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
1058 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1059 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1060 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
1061 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1062 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 1063 close(CLIENTCONF);
c6c9630e 1064
ce9abb66
AH
1065}
1066
6e13d0a5
MT
1067###
1068### Save main settings
1069###
ce9abb66 1070
6e13d0a5
MT
1071if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1072 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT
1073 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1074 #DAN this value has to leave.
1075 if ($cgiparams{'ENABLED'} eq 'on'){
1076 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1077 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 1078 goto SETTINGS_ERROR;
6e13d0a5
MT
1079 }
1080 }
f7fb5bc5 1081
6e13d0a5 1082 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e 1083 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
4c962356 1084 goto SETTINGS_ERROR;
c6c9630e
MT
1085 }
1086 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1087
1088 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1089 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1090 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1091 goto SETTINGS_ERROR;
1092 }
1093
1094 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1095 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1096 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1097 goto SETTINGS_ERROR;
1098 }
1099
1100 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1101 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1102 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1103 goto SETTINGS_ERROR;
1104 }
1105
1106 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1107 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1108 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1109 goto SETTINGS_ERROR;
1110 }
1111 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1112 while (<ALIASES>)
1113 {
1114 chomp($_);
1115 my @tempalias = split(/\,/,$_);
1116 if ($tempalias[1] eq 'on') {
1117 if (&General::IpInSubnet ($tempalias[0] ,
1118 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1119 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1120 }
1121 }
1122 }
1123 close(ALIASES);
6e13d0a5 1124 if ($errormessage ne ''){
c6c9630e 1125 goto SETTINGS_ERROR;
6e13d0a5
MT
1126 }
1127 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1128 $errormessage = $Lang::tr{'invalid input'};
1129 goto SETTINGS_ERROR;
1130 }
1131 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1132 $errormessage = $Lang::tr{'invalid mtu input'};
1133 goto SETTINGS_ERROR;
1134 }
1135
1136 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT
1137 $errormessage = $Lang::tr{'invalid port'};
1138 goto SETTINGS_ERROR;
6e13d0a5 1139 }
8c252e6a 1140
6e13d0a5
MT
1141 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1142 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1143 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1144 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1145#new settings for daemon
1146 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1147 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1148 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1149 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1150 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1151 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1152 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
3ffee04b
CS
1153#wrtie enable
1154
1155 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1156 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1157 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
6e13d0a5
MT
1158#new settings for daemon
1159 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 1160 &writeserverconf();#hier ok
6e13d0a5
MT
1161SETTINGS_ERROR:
1162###
1163### Reset all step 2
1164###
4c962356 1165}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
6e13d0a5
MT
1166 my $file = '';
1167 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1168
1169 foreach my $key (keys %confighash) {
c6c9630e
MT
1170 if ($confighash{$key}[4] eq 'cert') {
1171 delete $confighash{$cgiparams{'$key'}};
1172 }
6e13d0a5
MT
1173 }
1174 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
49abe7af 1175 unlink $file;
6e13d0a5
MT
1176 }
1177 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
49abe7af 1178 unlink $file;
6e13d0a5
MT
1179 }
1180 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
49abe7af 1181 unlink $file;
6e13d0a5 1182 }
4c962356 1183 &cleanssldatabase();
6e13d0a5
MT
1184 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1185 print FILE "";
1186 close FILE;
1187 }
49abe7af
EK
1188 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1189 print FILE "";
1190 close FILE;
1191 }
1192 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1193 print FILE "";
1194 close FILE;
1195 }
1196 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1197 unlink $file
1198 }
5795fc1b
AM
1199# Delete all RRD files for Roadwarrior connections
1200 chdir('/var/ipfire/ovpn/ccd');
1201 while ($file = glob("*")) {
1202 system ("/usr/local/bin/openvpnctrl -drrd $file");
1203 }
1204 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1205 unlink $file
1206 }
49abe7af
EK
1207 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1208 print FILE "";
1209 close FILE;
1210 }
1211 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1212 print FILE "";
1213 close FILE;
1214 }
1215 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1216 system ("rm -rf $file");
1217 }
1218
c6c9630e 1219 #&writeserverconf();
6e13d0a5
MT
1220###
1221### Reset all step 1
1222###
4c962356 1223}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
6e13d0a5 1224 &Header::showhttpheaders();
4c962356
EK
1225 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1226 &Header::openbigbox('100%', 'left', '', '');
1227 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1228 print <<END;
1229 <form method='post'>
1230 <table width='100%'>
1231 <tr>
1232 <td align='center'>
1233 <input type='hidden' name='AREUSURE' value='yes' />
49abe7af 1234 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
4c962356
EK
1235 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1236 </tr>
1237 <tr>
1238 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1239 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1240 </tr>
1241 </table>
1242 </form>
6e13d0a5
MT
1243END
1244 ;
1245 &Header::closebox();
1246 &Header::closebigbox();
1247 &Header::closepage();
1248 exit (0);
1249
4c962356
EK
1250###
1251### Generate DH key step 2
1252###
1253} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
49abe7af 1254 # Delete if old key exists
4c962356
EK
1255 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1256 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1257 }
1258 # Create Diffie Hellmann Parameter
badd8c1c 1259 system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
4c962356
EK
1260 if ($?) {
1261 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1262 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1263 }
1264
1265###
1266### Generate DH key step 1
1267###
1268} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1269 &Header::showhttpheaders();
1270 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1271 &Header::openbigbox('100%', 'LEFT', '', '');
1272 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1273 print <<END;
1274 <table width='100%'>
1275 <tr>
f527e53f 1276 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
49abe7af 1277 </tr>
4c962356
EK
1278 <tr>
1279 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1280 <td align='center'>
1281 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1282 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1283 <select name='DHLENGHT'>
1284 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1285 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1286 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1287 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1288 </select>
1289 </td>
1290 </tr>
1291 <tr><td colspan='4'><br></td></tr>
1292 </table>
1293 <table width='100%'>
1294 <tr>
49abe7af 1295 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
4c962356 1296 </tr>
49abe7af
EK
1297 <tr>
1298 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1299 </tr>
1300 <tr><td colspan='2'><br></td></tr>
4c962356
EK
1301 <tr>
1302 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1303 </form>
1304 </tr>
1305 </table>
1306
1307END
1308 ;
1309 &Header::closebox();
1310 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1311 &Header::closebigbox();
1312 &Header::closepage();
1313 exit (0);
1314
1315###
1316### Upload DH key
1317###
1318} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
4c962356
EK
1319 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1320 $errormessage = $Lang::tr{'there was no file upload'};
1321 goto UPLOADCA_ERROR;
1322 }
49abe7af 1323 # Move uploaded dh key to a temporary file
4c962356
EK
1324 (my $fh, my $filename) = tempfile( );
1325 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1326 $errormessage = $!;
49abe7af 1327 goto UPLOADCA_ERROR;
4c962356 1328 }
49abe7af 1329 my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
4c962356
EK
1330 if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
1331 $errormessage = $Lang::tr{'not a valid dh key'};
1332 unlink ($filename);
1333 goto UPLOADCA_ERROR;
1334 } else {
1335 # Delete if old key exists
1336 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1337 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1338 }
1339 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
49abe7af
EK
1340 if ($? ne 0) {
1341 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1342 unlink ($filename);
1343 goto UPLOADCA_ERROR;
1344 }
4c962356
EK
1345 }
1346
6e13d0a5
MT
1347###
1348### Upload CA Certificate
1349###
1350} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1351 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1352
1353 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1354 $errormessage = $Lang::tr{'name must only contain characters'};
1355 goto UPLOADCA_ERROR;
1356 }
1357
1358 if (length($cgiparams{'CA_NAME'}) >60) {
1359 $errormessage = $Lang::tr{'name too long'};
1360 goto VPNCONF_ERROR;
1361 }
1362
1363 if ($cgiparams{'CA_NAME'} eq 'ca') {
1364 $errormessage = $Lang::tr{'name is invalid'};
4c962356 1365 goto UPLOADCA_ERROR;
6e13d0a5
MT
1366 }
1367
1368 # Check if there is no other entry with this name
1369 foreach my $key (keys %cahash) {
c6c9630e
MT
1370 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1371 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1372 goto UPLOADCA_ERROR;
1373 }
6e13d0a5
MT
1374 }
1375
1376 if (ref ($cgiparams{'FH'}) ne 'Fh') {
c6c9630e
MT
1377 $errormessage = $Lang::tr{'there was no file upload'};
1378 goto UPLOADCA_ERROR;
6e13d0a5
MT
1379 }
1380 # Move uploaded ca to a temporary file
1381 (my $fh, my $filename) = tempfile( );
1382 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT
1383 $errormessage = $!;
1384 goto UPLOADCA_ERROR;
6e13d0a5
MT
1385 }
1386 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
c6c9630e
MT
1387 if ($temp !~ /CA:TRUE/i) {
1388 $errormessage = $Lang::tr{'not a valid ca certificate'};
1389 unlink ($filename);
1390 goto UPLOADCA_ERROR;
6e13d0a5 1391 } else {
c6c9630e
MT
1392 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1393 if ($? ne 0) {
1394 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1395 unlink ($filename);
1396 goto UPLOADCA_ERROR;
1397 }
6e13d0a5
MT
1398 }
1399
1400 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1401 $casubject =~ /Subject: (.*)[\n]/;
1402 $casubject = $1;
1403 $casubject =~ s+/Email+, E+;
1404 $casubject =~ s/ ST=/ S=/;
1405 $casubject = &Header::cleanhtml($casubject);
1406
1407 my $key = &General::findhasharraykey (\%cahash);
1408 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1409 $cahash{$key}[1] = $casubject;
1410 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT
1411# system('/usr/local/bin/ipsecctrl', 'R');
1412
6e13d0a5
MT
1413 UPLOADCA_ERROR:
1414
1415###
1416### Display ca certificate
1417###
1418} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT
1419 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1420
1421 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1422 &Header::showhttpheaders();
4c962356 1423 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
1424 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1425 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1426 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1427 $output = &Header::cleanhtml($output,"y");
1428 print "<pre>$output</pre>\n";
1429 &Header::closebox();
1430 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1431 &Header::closebigbox();
1432 &Header::closepage();
1433 exit(0);
1434 } else {
1435 $errormessage = $Lang::tr{'invalid key'};
1436 }
1437
6e13d0a5
MT
1438###
1439### Download ca certificate
1440###
1441} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1442 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1443
1444 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1445 print "Content-Type: application/octet-stream\r\n";
1446 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1447 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1448 exit(0);
1449 } else {
1450 $errormessage = $Lang::tr{'invalid key'};
1451 }
1452
1453###
1454### Remove ca certificate (step 2)
1455###
1456} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1457 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1458 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1459
1460 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1461 foreach my $key (keys %confighash) {
1462 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1463 if ($test =~ /: OK/) {
c6c9630e
MT
1464 # Delete connection
1465# if ($vpnsettings{'ENABLED'} eq 'on' ||
1466# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1467# system('/usr/local/bin/ipsecctrl', 'D', $key);
1468# }
6e13d0a5
MT
1469 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1470 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1471 delete $confighash{$key};
1472 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1473# &writeipsecfiles();
6e13d0a5
MT
1474 }
1475 }
1476 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1477 delete $cahash{$cgiparams{'KEY'}};
1478 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1479# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT
1480 } else {
1481 $errormessage = $Lang::tr{'invalid key'};
1482 }
1483###
1484### Remove ca certificate (step 1)
1485###
1486} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1487 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1488 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1489
1490 my $assignedcerts = 0;
1491 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1492 foreach my $key (keys %confighash) {
1493 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1494 if ($test =~ /: OK/) {
1495 $assignedcerts++;
1496 }
1497 }
1498 if ($assignedcerts) {
1499 &Header::showhttpheaders();
4c962356 1500 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT
1501 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1502 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
4c962356 1503 print <<END;
6e13d0a5
MT
1504 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1505 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1506 <tr><td align='center'>
1507 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1508 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1509 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1510 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1511 </form></table>
1512END
1513 ;
1514 &Header::closebox();
1515 &Header::closebigbox();
1516 &Header::closepage();
1517 exit (0);
1518 } else {
1519 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1520 delete $cahash{$cgiparams{'KEY'}};
1521 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1522# system('/usr/local/bin/ipsecctrl', 'R');
1523 }
1524 } else {
1525 $errormessage = $Lang::tr{'invalid key'};
1526 }
1527
1528###
1529### Display root certificate
1530###
c6c9630e
MT
1531}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1532 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1533 my $output;
1534 &Header::showhttpheaders();
4c962356 1535 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
1536 &Header::openbigbox('100%', 'LEFT', '', '');
1537 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1538 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1539 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1540 } else {
1541 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1542 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1543 }
1544 $output = &Header::cleanhtml($output,"y");
1545 print "<pre>$output</pre>\n";
1546 &Header::closebox();
1547 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1548 &Header::closebigbox();
1549 &Header::closepage();
1550 exit(0);
1551
6e13d0a5
MT
1552###
1553### Download root certificate
1554###
1555}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1556 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1557 print "Content-Type: application/octet-stream\r\n";
1558 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1559 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1560 exit(0);
1561 }
1562
1563###
1564### Download host certificate
1565###
1566}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1567 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1568 print "Content-Type: application/octet-stream\r\n";
1569 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1570 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1571 exit(0);
1572 }
f7fb5bc5 1573
fd5ccb2d
EK
1574###
1575### Download tls-auth key
1576###
1577}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1578 if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1579 print "Content-Type: application/octet-stream\r\n";
1580 print "Content-Disposition: filename=ta.key\r\n\r\n";
1581 print `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
1582 exit(0);
1583 }
1584
6e13d0a5
MT
1585###
1586### Form for generating a root certificate
1587###
1588}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1589 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1590
1591 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1592 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1593 $errormessage = $Lang::tr{'valid root certificate already exists'};
1594 $cgiparams{'ACTION'} = '';
1595 goto ROOTCERT_ERROR;
1596 }
1597
1598 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1599 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1600 my $ipaddr = <IPADDR>;
1601 close IPADDR;
1602 chomp ($ipaddr);
1603 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1604 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1605 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1606 }
1607 }
1608 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1609
1610 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1611 $errormessage = $Lang::tr{'there was no file upload'};
1612 goto ROOTCERT_ERROR;
1613 }
1614
1615 # Move uploaded certificate request to a temporary file
1616 (my $fh, my $filename) = tempfile( );
1617 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1618 $errormessage = $!;
1619 goto ROOTCERT_ERROR;
1620 }
1621
1622 # Create a temporary dirctory
1623 my $tempdir = tempdir( CLEANUP => 1 );
1624
1625 # Extract the CA certificate from the file
1626 my $pid = open(OPENSSL, "|-");
1627 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1628 if ($pid) { # parent
1629 if ($cgiparams{'P12_PASS'} ne '') {
1630 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1631 }
1632 close (OPENSSL);
1633 if ($?) {
1634 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1635 unlink ($filename);
1636 goto ROOTCERT_ERROR;
1637 }
1638 } else { # child
1639 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1640 '-in', $filename,
1641 '-out', "$tempdir/cacert.pem")) {
1642 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1643 unlink ($filename);
1644 goto ROOTCERT_ERROR;
1645 }
1646 }
1647
1648 # Extract the Host certificate from the file
1649 $pid = open(OPENSSL, "|-");
1650 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1651 if ($pid) { # parent
1652 if ($cgiparams{'P12_PASS'} ne '') {
1653 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1654 }
1655 close (OPENSSL);
1656 if ($?) {
1657 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1658 unlink ($filename);
1659 goto ROOTCERT_ERROR;
1660 }
1661 } else { # child
1662 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1663 '-in', $filename,
1664 '-out', "$tempdir/hostcert.pem")) {
1665 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1666 unlink ($filename);
1667 goto ROOTCERT_ERROR;
1668 }
1669 }
1670
1671 # Extract the Host key from the file
1672 $pid = open(OPENSSL, "|-");
1673 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1674 if ($pid) { # parent
1675 if ($cgiparams{'P12_PASS'} ne '') {
1676 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1677 }
1678 close (OPENSSL);
1679 if ($?) {
1680 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1681 unlink ($filename);
1682 goto ROOTCERT_ERROR;
1683 }
1684 } else { # child
1685 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1686 '-nodes',
1687 '-in', $filename,
1688 '-out', "$tempdir/serverkey.pem")) {
1689 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1690 unlink ($filename);
1691 goto ROOTCERT_ERROR;
1692 }
1693 }
1694
1695 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1696 if ($? ne 0) {
1697 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1698 unlink ($filename);
1699 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1700 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1701 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1702 goto ROOTCERT_ERROR;
1703 }
1704
1705 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1706 if ($? ne 0) {
1707 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1708 unlink ($filename);
1709 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1710 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1711 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1712 goto ROOTCERT_ERROR;
1713 }
1714
1715 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1716 if ($? ne 0) {
1717 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1718 unlink ($filename);
1719 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1720 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1721 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1722 goto ROOTCERT_ERROR;
1723 }
1724
1725 goto ROOTCERT_SUCCESS;
1726
1727 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1728
1729 # Validate input since the form was submitted
1730 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1731 $errormessage = $Lang::tr{'organization cant be empty'};
1732 goto ROOTCERT_ERROR;
1733 }
1734 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1735 $errormessage = $Lang::tr{'organization too long'};
1736 goto ROOTCERT_ERROR;
1737 }
1738 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1739 $errormessage = $Lang::tr{'invalid input for organization'};
1740 goto ROOTCERT_ERROR;
1741 }
1742 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1743 $errormessage = $Lang::tr{'hostname cant be empty'};
1744 goto ROOTCERT_ERROR;
1745 }
1746 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1747 $errormessage = $Lang::tr{'invalid input for hostname'};
1748 goto ROOTCERT_ERROR;
1749 }
1750 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1751 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1752 goto ROOTCERT_ERROR;
1753 }
1754 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1755 $errormessage = $Lang::tr{'e-mail address too long'};
1756 goto ROOTCERT_ERROR;
1757 }
1758 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1759 $errormessage = $Lang::tr{'invalid input for department'};
1760 goto ROOTCERT_ERROR;
1761 }
1762 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1763 $errormessage = $Lang::tr{'invalid input for city'};
1764 goto ROOTCERT_ERROR;
1765 }
1766 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1767 $errormessage = $Lang::tr{'invalid input for state or province'};
1768 goto ROOTCERT_ERROR;
1769 }
1770 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1771 $errormessage = $Lang::tr{'invalid input for country'};
1772 goto ROOTCERT_ERROR;
1773 }
1774
1775 # Copy the cgisettings to vpnsettings and save the configfile
1776 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1777 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1778 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1779 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1780 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1781 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1782 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1783 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1784
1785 # Replace empty strings with a .
1786 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1787 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1788 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1789
1790 # refresh
c6c9630e 1791 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT
1792
1793 # Create the CA certificate
1794 my $pid = open(OPENSSL, "|-");
1795 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1796 if ($pid) { # parent
1797 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1798 print OPENSSL "$state\n";
1799 print OPENSSL "$city\n";
1800 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1801 print OPENSSL "$ou\n";
1802 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1803 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1804 close (OPENSSL);
1805 if ($?) {
1806 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1807 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1808 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1809 goto ROOTCERT_ERROR;
1810 }
1811 } else { # child
badd8c1c 1812 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
49abe7af 1813 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
6e13d0a5
MT
1814 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1815 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1816 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1817 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1818 goto ROOTCERT_ERROR;
1819 }
1820 }
1821
1822 # Create the Host certificate request
1823 $pid = open(OPENSSL, "|-");
1824 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1825 if ($pid) { # parent
1826 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1827 print OPENSSL "$state\n";
1828 print OPENSSL "$city\n";
1829 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1830 print OPENSSL "$ou\n";
1831 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1832 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1833 print OPENSSL ".\n";
1834 print OPENSSL ".\n";
1835 close (OPENSSL);
1836 if ($?) {
1837 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1838 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1839 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1840 goto ROOTCERT_ERROR;
1841 }
1842 } else { # child
badd8c1c 1843 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4c962356 1844 '-newkey', 'rsa:2048',
6e13d0a5
MT
1845 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1846 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1847 '-extensions', 'server',
1848 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1849 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1850 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1851 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1852 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1853 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1854 goto ROOTCERT_ERROR;
1855 }
1856 }
1857
1858 # Sign the host certificate request
1859 system('/usr/bin/openssl', 'ca', '-days', '999999',
1860 '-batch', '-notext',
1861 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1862 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1863 '-extensions', 'server',
1864 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1865 if ($?) {
1866 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1867 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1868 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1869 unlink ("${General::swroot}/ovpn/serverkey.pem");
1870 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1871 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1872 &newcleanssldatabase();
6e13d0a5
MT
1873 goto ROOTCERT_ERROR;
1874 } else {
1875 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1876 &deletebackupcert();
6e13d0a5
MT
1877 }
1878
1879 # Create an empty CRL
1880 system('/usr/bin/openssl', 'ca', '-gencrl',
1881 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1882 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1883 if ($?) {
1884 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1885 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1886 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1887 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1888 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 1889 &cleanssldatabase();
6e13d0a5 1890 goto ROOTCERT_ERROR;
c6c9630e
MT
1891# } else {
1892# &cleanssldatabase();
6e13d0a5
MT
1893 }
1894 # Create Diffie Hellmann Parameter
badd8c1c 1895 system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
6e13d0a5
MT
1896 if ($?) {
1897 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1898 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1899 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1900 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1901 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1902 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 1903 &cleanssldatabase();
6e13d0a5 1904 goto ROOTCERT_ERROR;
c6c9630e
MT
1905# } else {
1906# &cleanssldatabase();
4be45949
EK
1907 }
1908 # Create ta.key for tls-auth
1909 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
1910 if ($?) {
1911 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1912 &cleanssldatabase();
1913 goto ROOTCERT_ERROR;
1914 }
6e13d0a5
MT
1915 goto ROOTCERT_SUCCESS;
1916 }
1917 ROOTCERT_ERROR:
1918 if ($cgiparams{'ACTION'} ne '') {
1919 &Header::showhttpheaders();
4c962356 1920 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT
1921 &Header::openbigbox('100%', 'LEFT', '', '');
1922 if ($errormessage) {
1923 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1924 print "<class name='base'>$errormessage";
1925 print "&nbsp;</class>";
1926 &Header::closebox();
1927 }
1928 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
49abe7af 1929 print <<END;
6e13d0a5
MT
1930 <form method='post' enctype='multipart/form-data'>
1931 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1932 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1933 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1934 <td width='35%' colspan='2'>&nbsp;</td></tr>
1935 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1936 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1937 <td colspan='2'>&nbsp;</td></tr>
1938 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1939 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1940 <td colspan='2'>&nbsp;</td></tr>
1941 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1942 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1943 <td colspan='2'>&nbsp;</td></tr>
1944 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1945 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1946 <td colspan='2'>&nbsp;</td></tr>
1947 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1948 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1949 <td colspan='2'>&nbsp;</td></tr>
1950 <tr><td class='base'>$Lang::tr{'country'}:</td>
1951 <td class='base'><select name='ROOTCERT_COUNTRY'>
1952
1953END
1954 ;
1955 foreach my $country (sort keys %{Countries::countries}) {
1956 print "<option value='$Countries::countries{$country}'";
1957 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1958 print " selected='selected'";
1959 }
1960 print ">$country</option>";
1961 }
49abe7af 1962 print <<END;
6e13d0a5 1963 </select></td>
4c962356
EK
1964 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
1965 <td class='base'><select name='DHLENGHT'>
1966 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1967 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1968 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1969 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1970 </select>
1971 </td>
1972 </tr>
1973
6e13d0a5
MT
1974 <tr><td>&nbsp;</td>
1975 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1976 <td>&nbsp;</td><td>&nbsp;</td></tr>
1977 <tr><td class='base' colspan='4' align='left'>
1978 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
49abe7af
EK
1979 <tr><td colspan='2'><br></td></tr>
1980 <table width='100%'>
1981 <tr>
1982 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
1983 <td class='base'>$Lang::tr{'dh key warn'}</td>
4c962356 1984 </tr>
49abe7af
EK
1985 <tr>
1986 <td class='base'>$Lang::tr{'dh key warn1'}</td>
4c962356 1987 </tr>
49abe7af
EK
1988 <tr><td colspan='2'><br></td></tr>
1989 <tr>
1990 </table>
4c962356 1991
49abe7af 1992 <table width='100%'>
4c962356 1993 <tr><td colspan='4'><hr></td></tr>
6e13d0a5
MT
1994 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1995 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1996 <td colspan='2'>&nbsp;</td></tr>
1997 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1998 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1999 <td colspan='2'>&nbsp;</td></tr>
2000 <tr><td>&nbsp;</td>
2001 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2002 <td colspan='2'>&nbsp;</td></tr>
2003 <tr><td class='base' colspan='4' align='left'>
4c962356
EK
2004 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td>
2005 </tr>
6e13d0a5
MT
2006 </form></table>
2007END
2008 ;
2009 &Header::closebox();
4c962356 2010 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2011 &Header::closebigbox();
2012 &Header::closepage();
2013 exit(0)
2014 }
2015
2016 ROOTCERT_SUCCESS:
2017 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT
2018# if ($vpnsettings{'ENABLED'} eq 'on' ||
2019# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2020# system('/usr/local/bin/ipsecctrl', 'S');
2021# }
6e13d0a5
MT
2022
2023###
2024### Enable/Disable connection
2025###
ce9abb66
AH
2026
2027###
7c1d9faf 2028# m.a.d net2net
ce9abb66
AH
2029###
2030
6e13d0a5 2031}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT
2032
2033 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 2034 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH
2035# my $n2nactive = '';
2036 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
2037
6e13d0a5 2038 if ($confighash{$cgiparams{'KEY'}}) {
8c877a82
AM
2039 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2040 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2041 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2042
8c877a82 2043 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 2044 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
8c877a82
AM
2045 }
2046 } else {
ce9abb66 2047
8c877a82
AM
2048 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2049 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2050
8c877a82 2051 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 2052 if ($n2nactive ne ''){
8c877a82
AM
2053 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
2054 }
ce9abb66 2055
8c877a82 2056 } else {
ce9abb66 2057 $errormessage = $Lang::tr{'invalid key'};
8c877a82 2058 }
ce9abb66
AH
2059 }
2060 }
6e13d0a5
MT
2061
2062###
2063### Download OpenVPN client package
2064###
ce9abb66
AH
2065
2066
6e13d0a5
MT
2067} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2068 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2069 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2070 my $file = '';
2071 my $clientovpn = '';
2072 my @fileholder;
2073 my $tempdir = tempdir( CLEANUP => 1 );
2074 my $zippath = "$tempdir/";
ce9abb66
AH
2075
2076###
7c1d9faf
AH
2077# m.a.d net2net
2078###
ce9abb66
AH
2079
2080if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2081
2082 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2083 my $zippathname = "$zippath$zipname";
2084 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2085 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 2086 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 2087 my $tunmtu = '';
7c1d9faf 2088 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 2089 my $n2nfragment = '';
ce9abb66
AH
2090
2091 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2092 flock CLIENTCONF, 2;
2093
2094 my $zip = Archive::Zip->new();
7c1d9faf 2095 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 2096 print CLIENTCONF "# \n";
b278daf3 2097 print CLIENTCONF "# User Security\n";
ce9abb66
AH
2098 print CLIENTCONF "user nobody\n";
2099 print CLIENTCONF "group nobody\n";
2100 print CLIENTCONF "persist-tun\n";
2101 print CLIENTCONF "persist-key\n";
7c1d9faf 2102 print CLIENTCONF "script-security 2\n";
60f396d7 2103 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 2104 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 2105 print CLIENTCONF "float\n";
60f396d7 2106 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 2107 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
b278daf3 2108 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 2109 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
b278daf3 2110 print CLIENTCONF "# tun Device\n";
ce9abb66 2111 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
60f396d7 2112 print CLIENTCONF "# Port and Protokoll\n";
ce9abb66 2113 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
60f396d7
AH
2114
2115 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2116 print CLIENTCONF "proto tcp-client\n";
2117 print CLIENTCONF "# Packet size\n";
d96c89eb 2118 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 2119 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 2120 }
60f396d7
AH
2121
2122 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2123 print CLIENTCONF "proto udp\n";
2124 print CLIENTCONF "# Paketsize\n";
2125 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2126 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 2127 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
60f396d7 2128 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
d96c89eb 2129 }
1647059d
SS
2130 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2131 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2132 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2ee746be
SS
2133 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2134 if ($tunmtu eq '1500' ) {
350f2980 2135 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2ee746be
SS
2136 }
2137 }
2138 }
54fd0535 2139 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
2140 print CLIENTCONF "# Auth. Client\n";
2141 print CLIENTCONF "tls-client\n";
49abe7af 2142 print CLIENTCONF "# Cipher\n";
4c962356 2143 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
ce9abb66
AH
2144 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2145 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2146 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
49abe7af
EK
2147 }
2148 if ($confighash{$cgiparams{'KEY'}}[39] eq '') {
2149 print CLIENTCONF "# HMAC algorithm\n";
2150 print CLIENTCONF "auth SHA1\n";
2151 } else {
2152 print CLIENTCONF "# HMAC algorithm\n";
2153 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2154 }
4c962356 2155 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 2156 print CLIENTCONF "# Enable Compression\n";
66298ef2 2157 print CLIENTCONF "comp-lzo\n";
b278daf3 2158 }
ce9abb66
AH
2159 print CLIENTCONF "# Debug Level\n";
2160 print CLIENTCONF "verb 3\n";
b278daf3 2161 print CLIENTCONF "# Tunnel check\n";
ce9abb66 2162 print CLIENTCONF "keepalive 10 60\n";
b278daf3 2163 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
2164 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2165 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
b278daf3 2166 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
2167 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2168 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 2169 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 2170
ce9abb66
AH
2171
2172 close(CLIENTCONF);
2173
2174 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2175 my $status = $zip->writeToFileNamed($zippathname);
2176
2177 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2178 @fileholder = <DLFILE>;
2179 print "Content-Type:application/x-download\n";
2180 print "Content-Disposition:attachment;filename=$zipname\n\n";
2181 print @fileholder;
2182 exit (0);
2183}
2184else
2185{
2186 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2187 my $zippathname = "$zippath$zipname";
2188 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2189
2190###
7c1d9faf 2191# m.a.d net2net
ce9abb66
AH
2192###
2193
c6c9630e 2194 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT
2195 flock CLIENTCONF, 2;
2196
2197 my $zip = Archive::Zip->new();
2198
8c877a82 2199 print CLIENTCONF "#OpenVPN Client conf\r\n";
6e13d0a5
MT
2200 print CLIENTCONF "tls-client\r\n";
2201 print CLIENTCONF "client\r\n";
4f6e3ae3 2202 print CLIENTCONF "nobind\r\n";
6e13d0a5 2203 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
c6c9630e 2204 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2ee746be
SS
2205
2206 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2207 # or use configured value.
2208 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
4f6e3ae3 2209 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be 2210 elsif ($vpnsettings{MSSFIX} eq 'on')
4f6e3ae3 2211 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
1647059d
SS
2212 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2213 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2214 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
4f6e3ae3 2215 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be
SS
2216 else
2217 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2218
6e13d0a5
MT
2219 if ( $vpnsettings{'ENABLED'} eq 'on'){
2220 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT
2221 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2222 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2223 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2224 }
2225 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2226 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2227 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2228 }
2229 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2230 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2231 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2232 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2233 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2234 }
2235 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2236 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT
2237 }
2238
2239 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
c6c9630e
MT
2240 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2241 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
6e13d0a5 2242 } else {
c6c9630e
MT
2243 print CLIENTCONF "ca cacert.pem\r\n";
2244 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2245 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2246 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2247 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT
2248 }
2249 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
49abe7af
EK
2250 if ($vpnsettings{'DAUTH'} eq '') {
2251 print CLIENTCONF "";
2252 } else {
2253 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2254 }
2255 if ($vpnsettings{'TLSAUTH'} eq 'on') {
4be45949
EK
2256 print CLIENTCONF "tls-auth ta.key\r\n";
2257 $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n";
49abe7af 2258 }
6e13d0a5
MT
2259 if ($vpnsettings{DCOMPLZO} eq 'on') {
2260 print CLIENTCONF "comp-lzo\r\n";
2261 }
2262 print CLIENTCONF "verb 3\r\n";
2263 print CLIENTCONF "ns-cert-type server\r\n";
a79fa1d6
JPT
2264 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2265 if ($vpnsettings{MSSFIX} eq 'on') {
2266 print CLIENTCONF "mssfix\r\n";
2267 }
74225cce 2268 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT
2269 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2270 }
1647059d
SS
2271
2272 # Check if a valid operating mode has been choosen and use it.
2273 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2274 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2275 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be 2276 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
4f6e3ae3 2277 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2ee746be
SS
2278 }
2279 }
ffbe77c8
EK
2280 # Print client.conf.local if entries exist to client.ovpn
2281 if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
2282 open (LCC, "$local_clientconf");
2283 print CLIENTCONF "\n#---------------------------\n";
2284 print CLIENTCONF "# Start of custom directives\n";
2285 print CLIENTCONF "# from client.conf.local\n";
2286 print CLIENTCONF "#---------------------------\n\n";
2287 while (<LCC>) {
2288 print CLIENTCONF $_;
2289 }
2290 print CLIENTCONF "\n#---------------------------\n";
2291 print CLIENTCONF "# End of custom directives\n";
2292 print CLIENTCONF "#---------------------------\n\n";
2293 close (LCC);
2294 }
6e13d0a5 2295 close(CLIENTCONF);
ce9abb66 2296
6e13d0a5
MT
2297 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2298 my $status = $zip->writeToFileNamed($zippathname);
2299
2300 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2301 @fileholder = <DLFILE>;
2302 print "Content-Type:application/x-download\n";
2303 print "Content-Disposition:attachment;filename=$zipname\n\n";
2304 print @fileholder;
2305 exit (0);
ce9abb66
AH
2306 }
2307
2308
2309
6e13d0a5
MT
2310###
2311### Remove connection
2312###
ce9abb66
AH
2313
2314
6e13d0a5
MT
2315} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2316 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2317 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e
MT
2318
2319 if ($confighash{$cgiparams{'KEY'}}) {
2320# if ($vpnsettings{'ENABLED'} eq 'on' ||
2321# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2322# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2323# }
2324#
2325 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
ce9abb66
AH
2326
2327###
7c1d9faf 2328# m.a.d net2net
ce9abb66 2329###
7c1d9faf 2330
8e6a8fd5 2331if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
ce9abb66 2332 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
8e6a8fd5
MT
2333 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2334 unlink ($certfile);
2335 unlink ($conffile);
2336
2337 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2338 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2339 }
ce9abb66 2340}
ce9abb66
AH
2341
2342 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
8c877a82
AM
2343 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2344
2345# A.Marx CCD delete ccd files and routes
2346
2347
2348 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2349 {
2350 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2351 }
e81be1e1 2352
8c877a82
AM
2353 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2354 foreach my $key (keys %ccdroutehash) {
2355 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2356 delete $ccdroutehash{$key};
2357 }
2358 }
2359 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
e81be1e1 2360
8c877a82
AM
2361 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2362 foreach my $key (keys %ccdroute2hash) {
2363 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2364 delete $ccdroute2hash{$key};
2365 }
2366 }
2367 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
52d08bcb 2368 &writeserverconf;
8c877a82
AM
2369
2370
2371# CCD end
2372
e1297cbb 2373 # Delete RRDs
5795fc1b 2374 system ("/usr/local/bin/openvpnctrl -drrd $confighash{$cgiparams{'KEY'}}[1]");
e1297cbb 2375
c6c9630e
MT
2376 delete $confighash{$cgiparams{'KEY'}};
2377 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2378 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
8c877a82 2379
c6c9630e 2380 #&writeserverconf();
6e13d0a5 2381 } else {
c6c9630e 2382 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5 2383 }
b2e75449 2384 &General::firewall_reload();
ce9abb66 2385
6e13d0a5
MT
2386###
2387### Download PKCS12 file
2388###
2389} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2390 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2391
2392 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2393 print "Content-Type: application/octet-stream\r\n\r\n";
2394 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2395 exit (0);
2396
2397###
2398### Display certificate
2399###
2400} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2401 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2402
2403 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e 2404 &Header::showhttpheaders();
4c962356 2405 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
2406 &Header::openbigbox('100%', 'LEFT', '', '');
2407 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2408 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2409 $output = &Header::cleanhtml($output,"y");
2410 print "<pre>$output</pre>\n";
2411 &Header::closebox();
2412 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2413 &Header::closebigbox();
2414 &Header::closepage();
2415 exit(0);
6e13d0a5 2416 }
4c962356
EK
2417
2418###
2419### Display Diffie-Hellman key
2420###
2421} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2422
2423 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
49abe7af 2424 $errormessage = $Lang::tr{'not present'};
4c962356
EK
2425 } else {
2426 &Header::showhttpheaders();
2427 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2428 &Header::openbigbox('100%', 'LEFT', '', '');
2429 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2430 my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
2431 $output = &Header::cleanhtml($output,"y");
2432 print "<pre>$output</pre>\n";
2433 &Header::closebox();
2434 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2435 &Header::closebigbox();
2436 &Header::closepage();
2437 exit(0);
2438 }
2439
fd5ccb2d
EK
2440###
2441### Display tls-auth key
2442###
2443} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2444
2445 if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2446 $errormessage = $Lang::tr{'not present'};
2447 } else {
2448 &Header::showhttpheaders();
2449 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2450 &Header::openbigbox('100%', 'LEFT', '', '');
2451 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2452 my $output = `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
2453 $output = &Header::cleanhtml($output,"y");
2454 print "<pre>$output</pre>\n";
2455 &Header::closebox();
2456 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2457 &Header::closebigbox();
2458 &Header::closepage();
2459 exit(0);
2460 }
2461
6e13d0a5
MT
2462###
2463### Display Certificate Revoke List
2464###
2465} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT
2466# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2467
49abe7af
EK
2468 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2469 $errormessage = $Lang::tr{'not present'};
2470 } else {
b2e75449
MT
2471 &Header::showhttpheaders();
2472 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2473 &Header::openbigbox('100%', 'LEFT', '', '');
2474 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2475 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2476 $output = &Header::cleanhtml($output,"y");
2477 print "<pre>$output</pre>\n";
2478 &Header::closebox();
2479 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2480 &Header::closebigbox();
2481 &Header::closepage();
2482 exit(0);
6e13d0a5
MT
2483 }
2484
2485###
2486### Advanced Server Settings
2487###
2488
2489} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2490 %cgiparams = ();
2491 %cahash = ();
2492 %confighash = ();
8c877a82 2493 my $disabled;
6e13d0a5 2494 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 2495 read_routepushfile;
8c877a82
AM
2496
2497
c6c9630e
MT
2498# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2499# $cgiparams{'CLIENT2CLIENT'} = 'on';
2500# }
6e13d0a5
MT
2501ADV_ERROR:
2502 if ($cgiparams{'MAX_CLIENTS'} eq '') {
4c962356 2503 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 2504 }
6e13d0a5 2505 if ($cgiparams{'KEEPALIVE_1'} eq '') {
4c962356 2506 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT
2507 }
2508 if ($cgiparams{'KEEPALIVE_2'} eq '') {
4c962356 2509 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT
2510 }
2511 if ($cgiparams{'LOG_VERB'} eq '') {
4c962356 2512 $cgiparams{'LOG_VERB'} = '3';
ae9f6139 2513 }
92b87e17 2514 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
4c962356
EK
2515 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2516 }
2517 if ($cgiparams{'DAUTH'} eq '') {
2518 $cgiparams{'DAUTH'} = 'SHA1';
92b87e17 2519 }
f527e53f 2520 if ($cgiparams{'TLSAUTH'} eq '') {
754066e6 2521 $cgiparams{'TLSAUTH'} = 'off';
f527e53f 2522 }
6e13d0a5
MT
2523 $checked{'CLIENT2CLIENT'}{'off'} = '';
2524 $checked{'CLIENT2CLIENT'}{'on'} = '';
2525 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2526 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2527 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2528 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
ffbe77c8
EK
2529 $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
2530 $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
2531 $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
a79fa1d6
JPT
2532 $checked{'MSSFIX'}{'off'} = '';
2533 $checked{'MSSFIX'}{'on'} = '';
2534 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2ee746be 2535 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
49abe7af 2536 $selected{'LOG_VERB'}{'0'} = '';
6e13d0a5
MT
2537 $selected{'LOG_VERB'}{'1'} = '';
2538 $selected{'LOG_VERB'}{'2'} = '';
2539 $selected{'LOG_VERB'}{'3'} = '';
2540 $selected{'LOG_VERB'}{'4'} = '';
2541 $selected{'LOG_VERB'}{'5'} = '';
2542 $selected{'LOG_VERB'}{'6'} = '';
2543 $selected{'LOG_VERB'}{'7'} = '';
2544 $selected{'LOG_VERB'}{'8'} = '';
2545 $selected{'LOG_VERB'}{'9'} = '';
2546 $selected{'LOG_VERB'}{'10'} = '';
2547 $selected{'LOG_VERB'}{'11'} = '';
6e13d0a5 2548 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
4c962356
EK
2549 $selected{'DAUTH'}{'whirlpool'} = '';
2550 $selected{'DAUTH'}{'SHA512'} = '';
2551 $selected{'DAUTH'}{'SHA384'} = '';
2552 $selected{'DAUTH'}{'SHA256'} = '';
4c962356
EK
2553 $selected{'DAUTH'}{'SHA1'} = '';
2554 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
49abe7af
EK
2555 $checked{'TLSAUTH'}{'off'} = '';
2556 $checked{'TLSAUTH'}{'on'} = '';
2557 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
f527e53f 2558
6e13d0a5
MT
2559 &Header::showhttpheaders();
2560 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2561 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2562 if ($errormessage) {
c6c9630e
MT
2563 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2564 print "<class name='base'>$errormessage\n";
2565 print "&nbsp;</class>\n";
2566 &Header::closebox();
6e13d0a5
MT
2567 }
2568 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
4c962356 2569 print <<END;
b376fae4 2570 <form method='post' enctype='multipart/form-data'>
b2e75449 2571<table width='100%' border=0>
4c962356
EK
2572 <tr>
2573 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
6e13d0a5
MT
2574 </tr>
2575 <tr>
4c962356 2576 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT
2577 </tr>
2578 <tr>
4c962356 2579 <td class='base'>Domain</td>
8c877a82 2580 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
6e13d0a5
MT
2581 </tr>
2582 <tr>
4c962356
EK
2583 <td class='base'>DNS</td>
2584 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
6e13d0a5
MT
2585 </tr>
2586 <tr>
4c962356
EK
2587 <td class='base'>WINS</td>
2588 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2589 </tr>
54fd0535 2590 <tr>
4c962356 2591 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
54fd0535
MT
2592 </tr>
2593 <tr>
4c962356
EK
2594 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2595 <td colspan='2'>
2596 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
54fd0535
MT
2597END
2598;
2599
2600if ($cgiparams{'ROUTES_PUSH'} ne '')
2601{
2602 print $cgiparams{'ROUTES_PUSH'};
2603}
2604
8c877a82 2605print <<END;
54fd0535
MT
2606</textarea></td>
2607</tr>
6e13d0a5
MT
2608 </tr>
2609</table>
2610<hr size='1'>
4c962356 2611<table width='100%'>
ffbe77c8 2612 <tr>
4c962356 2613 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
ffbe77c8
EK
2614 </tr>
2615
2616 <tr>
4c962356 2617 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
ffbe77c8
EK
2618 </tr>
2619
2620 <tr>
4c962356
EK
2621 <td class='base'>Client-To-Client</td>
2622 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
ffbe77c8
EK
2623 </tr>
2624
2625 <tr>
4c962356
EK
2626 <td class='base'>Redirect-Gateway def1</td>
2627 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
ffbe77c8
EK
2628 </tr>
2629
4c962356 2630 <tr>
ffbe77c8
EK
2631 <td class='base'>$Lang::tr{'ovpn add conf'}</td>
2632 <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
2633 <td>$Lang::tr{'openvpn default'}: off</td>
2634 </tr>
2635
2636 <tr>
2637 <td class='base'>mssfix</td>
2638 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2639 <td>$Lang::tr{'openvpn default'}: off</td>
2640 </tr>
2641
4c962356 2642 <tr>
ffbe77c8
EK
2643 <td class='base'>fragment <br></td>
2644 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2645 </tr>
2646
2647
2648 <tr>
2649 <td class='base'>Max-Clients</td>
2650 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2651 </tr>
2652 <tr>
2653 <td class='base'>Keepalive <br />
2654 (ping/ping-restart)</td>
2655 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2656 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2657 </tr>
2ee746be
SS
2658
2659 <tr>
2660 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2661 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2662 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2663 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2664 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2665 </tr>
a79fa1d6
JPT
2666</table>
2667
a79fa1d6 2668<hr size='1'>
4c962356 2669<table width='100%'>
a79fa1d6 2670 <tr>
49abe7af 2671 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
a79fa1d6
JPT
2672 </tr>
2673 <tr>
49abe7af 2674 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
4c962356
EK
2675 </tr>
2676
2677 <tr><td class='base'>VERB</td>
2678 <td><select name='LOG_VERB'>
49abe7af
EK
2679 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option>
2680 <option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2681 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2682 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2683 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2684 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2685 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2686 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2687 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2688 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2689 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2690 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2691 </td></select>
2692 </table>
4c962356 2693
6e13d0a5 2694<hr size='1'>
4c962356 2695<table width='100%'>
6e13d0a5 2696 <tr>
4c962356
EK
2697 <td class'base'><b>$Lang::tr{'ovpn crypt options'}</b></td>
2698 </tr>
2699 <tr>
2700 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
6e13d0a5 2701 </tr>
4c962356
EK
2702 <tr><td class='base'>$Lang::tr{'ovpn ha'}</td>
2703 <td><select name='DAUTH'>
b2e75449
MT
2704 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
2705 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
2706 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
2707 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
b2e75449 2708 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'})</option>
4c962356
EK
2709 </select>
2710 </td>
040b8b0c 2711 <td>$Lang::tr{'openvpn default'}: <span class="base">SHA1 (160 $Lang::tr{'bit'})</span></td>
49abe7af 2712 </tr>
6e13d0a5 2713</table>
49abe7af
EK
2714
2715<table width='100%'>
6e13d0a5 2716 <tr>
49abe7af 2717 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
6e13d0a5 2718 </tr>
4c962356 2719
6e13d0a5 2720 <tr>
49abe7af
EK
2721 <td class='base'>HMAC tls-auth</td>
2722 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
2723 </tr>
2724 </table><hr>
8c877a82
AM
2725END
2726
2727if ( -e "/var/run/openvpn.pid"){
2728print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2729 $Lang::tr{'server restart'}<br><br>
2730 <hr>";
49abe7af 2731 print<<END;
52d08bcb
AM
2732<table width='100%'>
2733<tr>
2734 <td>&nbsp;</td>
2735 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2736 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2737 <td>&nbsp;</td>
2738</tr>
2739</table>
2740</form>
2741END
2742;
2743
2744
2745}else{
8c877a82 2746
49abe7af 2747 print<<END;
6e13d0a5
MT
2748<table width='100%'>
2749<tr>
2750 <td>&nbsp;</td>
2751 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2752 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2753 <td>&nbsp;</td>
2754</tr>
2755</table>
2756</form>
2757END
2758;
52d08bcb 2759}
6e13d0a5 2760 &Header::closebox();
c6c9630e 2761# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2762 &Header::closebigbox();
2763 &Header::closepage();
2764 exit(0);
2765
8c877a82
AM
2766
2767# A.Marx CCD Add,delete or edit CCD net
2768
2769} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2770 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2771 $cgiparams{'ACTION'} eq "kill" ||
2772 $cgiparams{'ACTION'} eq "edit" ||
2773 $cgiparams{'ACTION'} eq 'editsave'){
2774 &Header::showhttpheaders();
2775 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2776 &Header::openbigbox('100%', 'LEFT', '', '');
2777
2778 if ($cgiparams{'ACTION'} eq "kill"){
2779 &delccdnet($cgiparams{'net'});
2780 }
2781
2782 if ($cgiparams{'ACTION'} eq 'editsave'){
2783 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2784 if ( $a ne $b){ &modccdnet($a,$b);}
5068ac38
AM
2785 $cgiparams{'ccdname'}='';
2786 $cgiparams{'ccdsubnet'}='';
8c877a82
AM
2787 }
2788
2789 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
e2429e8d 2790 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
8c877a82
AM
2791 }
2792 if ($errormessage) {
2793 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2794 print "<class name='base'>$errormessage";
2795 print "&nbsp;</class>";
2796 &Header::closebox();
2797 }
2798if ($cgiparams{'ACTION'} eq "edit"){
2799
2800 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2801
49abe7af 2802 print <<END;
631b67b7 2803 <table width='100%' border='0'>
8c877a82
AM
2804 <tr><form method='post'>
2805 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
a9fb14d0 2806 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly='readonly' /></td></tr>
8c877a82
AM
2807 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2808 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2809 </td></tr>
2810 </table></form>
2811END
2812;
2813 &Header::closebox();
2814
2815 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
49abe7af 2816 print <<END;
8c877a82
AM
2817 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2818 <tr>
2819 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2820END
2821;
2822}
2823else{
2824 if (! -e "/var/run/openvpn.pid"){
2825 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
49abe7af 2826 print <<END;
8c877a82
AM
2827 <table width='100%' border='0'>
2828 <tr><form method='post'>
2829 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2830 <tr>
2831 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2832 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2833 <tr><td colspan=4><hr /></td></tr><tr>
2834 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2835 </table></form>
2836END
2837
2838 &Header::closebox();
2839}
2840 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
5068ac38
AM
2841 if ( -e "/var/run/openvpn.pid"){
2842 print "<b>$Lang::tr{'attention'}:</b><br>";
2843 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2844 }
2845
4c962356 2846 print <<END;
99bfa85c 2847 <table width='100%' cellpadding='0' cellspacing='1'>
8c877a82
AM
2848 <tr>
2849 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2850END
2851;
2852}
2853 my %ccdconfhash=();
2854 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2855 my @ccdconf=();
2856 my $count=0;
df9b48b7 2857 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM
2858 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2859 $count++;
2860 my $ccdhosts = &hostsinnet($ccdconf[0]);
2861 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2862 else{ print" <tr bgcolor='$color{'color20'}'>";}
2863 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
4c962356 2864 print <<END;
8c877a82 2865 <form method='post' />
1638682b 2866 <input type='image' src='/images/edit.gif' align='middle' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
8c877a82
AM
2867 <input type='hidden' name='ACTION' value='edit'/>
2868 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2869 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2870 </form></td>
2871 <form method='post' />
2872 <td><input type='hidden' name='ACTION' value='kill'/>
2873 <input type='hidden' name='number' value='$count' />
2874 <input type='hidden' name='net' value='$ccdconf[0]' />
1638682b 2875 <input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /></form></td></tr>
8c877a82
AM
2876END
2877;
2878 }
2879 print "</table></form>";
2880 &Header::closebox();
2881 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2882 &Header::closebigbox();
2883 &Header::closepage();
2884 exit(0);
2885
2886#END CCD
2887
6e13d0a5
MT
2888###
2889### Openvpn Connections Statistics
2890###
2891} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2892 &Header::showhttpheaders();
2893 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2894 &Header::openbigbox('100%', 'LEFT', '', '');
2895 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2896
2897#
2898# <td><b>$Lang::tr{'protocol'}</b></td>
2899# protocol temp removed
4c962356 2900 print <<END;
99bfa85c 2901 <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
6e13d0a5 2902 <tr>
99bfa85c
AM
2903 <th><b>$Lang::tr{'common name'}</b></th>
2904 <th><b>$Lang::tr{'real address'}</b></th>
2905 <th><b>$Lang::tr{'virtual address'}</b></th>
2906 <th><b>$Lang::tr{'loged in at'}</b></th>
2907 <th><b>$Lang::tr{'bytes sent'}</b></th>
2908 <th><b>$Lang::tr{'bytes received'}</b></th>
2909 <th><b>$Lang::tr{'last activity'}</b></th>
6e13d0a5
MT
2910 </tr>
2911END
2912;
87fe47e9 2913 my $filename = "/var/run/ovpnserver.log";
6e13d0a5
MT
2914 open(FILE, $filename) or die 'Unable to open config file.';
2915 my @current = <FILE>;
2916 close(FILE);
2917 my @users =();
2918 my $status;
2919 my $uid = 0;
2920 my $cn;
2921 my @match = ();
2922 my $proto = "udp";
2923 my $address;
2924 my %userlookup = ();
2925 foreach my $line (@current)
2926 {
2927 chomp($line);
2928 if ( $line =~ /^Updated,(.+)/){
2929 @match = split( /^Updated,(.+)/, $line);
2930 $status = $match[1];
2931 }
c6c9630e 2932#gian
6e13d0a5
MT
2933 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2934 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2935 if ($match[1] ne "Common Name") {
2936 $cn = $match[1];
2937 $userlookup{$match[2]} = $uid;
2938 $users[$uid]{'CommonName'} = $match[1];
2939 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT
2940 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2941 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT
2942 $users[$uid]{'Since'} = $match[5];
2943 $users[$uid]{'Proto'} = $proto;
2944 $uid++;
2945 }
2946 }
2947 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2948 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2949 if ($match[1] ne "Virtual Address") {
2950 $address = $match[3];
2951 #find the uid in the lookup table
2952 $uid = $userlookup{$address};
2953 $users[$uid]{'VirtualAddress'} = $match[1];
2954 $users[$uid]{'LastRef'} = $match[4];
2955 }
2956 }
2957 }
2958 my $user2 = @users;
2959 if ($user2 >= 1){
99bfa85c 2960 for (my $idx = 1; $idx <= $user2; $idx++){
6e13d0a5 2961 if ($idx % 2) {
99bfa85c
AM
2962 print "<tr>";
2963 $col="bgcolor='$color{'color22'}'";
2964 } else {
2965 print "<tr>";
2966 $col="bgcolor='$color{'color20'}'";
6e13d0a5 2967 }
99bfa85c
AM
2968 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
2969 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
2970 print "<td align='left' $col>$users[$idx-1]{'VirtualAddress'}</td>";
2971 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
2972 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
2973 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
2974 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
2975 }
2976 }
6e13d0a5
MT
2977
2978 print "</table>";
49abe7af 2979 print <<END;
6e13d0a5
MT
2980 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2981 <tr><td></td></tr>
2982 <tr><td></td></tr>
2983 <tr><td></td></tr>
2984 <tr><td></td></tr>
2985 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2986 </table>
2987END
2988;
2989 &Header::closebox();
2990 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2991 &Header::closebigbox();
2992 &Header::closepage();
2993 exit(0);
2994
2995###
2996### Download Certificate
2997###
2998} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2999 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 3000
6e13d0a5 3001 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
3002 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
3003 print "Content-Type: application/octet-stream\r\n\r\n";
3004 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
3005 exit (0);
3006 }
3007
3008###
3009### Enable/Disable connection
3010###
ce9abb66 3011
c6c9630e
MT
3012} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
3013
3014 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3015 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3016
3017 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 3018 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT
3019 $confighash{$cgiparams{'KEY'}}[0] = 'on';
3020 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3021 #&writeserverconf();
3022# if ($vpnsettings{'ENABLED'} eq 'on' ||
3023# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3024# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3025# }
3026 } else {
3027 $confighash{$cgiparams{'KEY'}}[0] = 'off';
3028# if ($vpnsettings{'ENABLED'} eq 'on' ||
3029# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3030# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3031# }
3032 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3033 #&writeserverconf();
3034 }
3035 } else {
3036 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
3037 }
3038
3039###
3040### Restart connection
3041###
3042} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3043 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3044 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3045
3046 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT
3047# if ($vpnsettings{'ENABLED'} eq 'on' ||
3048# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3049# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3050# }
6e13d0a5 3051 } else {
c6c9630e 3052 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
3053 }
3054
3055###
c6c9630e 3056### Remove connection
6e13d0a5 3057###
c6c9630e
MT
3058} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
3059 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3060 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3061
3062 if ($confighash{$cgiparams{'KEY'}}) {
3063# if ($vpnsettings{'ENABLED'} eq 'on' ||
3064# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3065# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3066# }
3067 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3068 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3069 delete $confighash{$cgiparams{'KEY'}};
e1297cbb
MT
3070
3071 # Delete RRD's for collectd
3072 system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]", "&>/dev/null");
3073
c6c9630e
MT
3074 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3075 #&writeserverconf();
3076 } else {
3077 $errormessage = $Lang::tr{'invalid key'};
3078 }
ce9abb66
AH
3079#test33
3080
3081###
3082### Choose between adding a host-net or net-net connection
3083###
3084
3085###
7c1d9faf 3086# m.a.d net2net
ce9abb66
AH
3087###
3088
3089} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3090 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3091 &Header::showhttpheaders();
4c962356 3092 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
ce9abb66
AH
3093 &Header::openbigbox('100%', 'LEFT', '', '');
3094 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH
3095
3096if ( -s "${General::swroot}/ovpn/settings") {
3097
49abe7af 3098 print <<END;
ce9abb66 3099 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3100 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
ce9abb66
AH
3101 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3102 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3103 <tr><td><input type='radio' name='TYPE' value='net' /></td>
3104 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3105 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
3106 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3107 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
54fd0535 3108 <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
040b8b0c 3109 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>$Lang::tr{'openvpn default'}: Client Packagename</td></tr>
54fd0535 3110 <tr><td colspan='3'><hr /></td></tr>
8c877a82 3111 <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
54fd0535 3112 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
ce9abb66
AH
3113 </form></table>
3114END
3115 ;
8c877a82 3116
ce9abb66 3117
b278daf3 3118} else {
49abe7af 3119 print <<END;
b278daf3 3120 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3121 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
b278daf3 3122 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
8c877a82 3123 <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
b278daf3
AH
3124 </form></table>
3125END
3126 ;
3127
3128}
3129
ce9abb66 3130 &Header::closebox();
4c962356 3131 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
ce9abb66
AH
3132 &Header::closebigbox();
3133 &Header::closepage();
3134 exit (0);
3135
3136###
7c1d9faf 3137# m.a.d net2net
ce9abb66
AH
3138###
3139
3140} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3141
3142 my @firen2nconf;
3143 my @confdetails;
3144 my $uplconffilename ='';
54fd0535 3145 my $uplconffilename2 ='';
ce9abb66 3146 my $uplp12name = '';
54fd0535 3147 my $uplp12name2 = '';
ce9abb66
AH
3148 my @rem_subnet;
3149 my @rem_subnet2;
3150 my @tmposupnet3;
3151 my $key;
54fd0535 3152 my @n2nname;
ce9abb66
AH
3153
3154 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3155
3156# Check if a file is uploaded
3157
3158 if (ref ($cgiparams{'FH'}) ne 'Fh') {
3159 $errormessage = $Lang::tr{'there was no file upload'};
3160 goto N2N_ERROR;
3161 }
3162
3163# Move uploaded IPfire n2n package to temporary file
3164
3165 (my $fh, my $filename) = tempfile( );
3166 if (copy ($cgiparams{'FH'}, $fh) != 1) {
3167 $errormessage = $!;
3168 goto N2N_ERROR;
3169 }
3170
3171 my $zip = Archive::Zip->new();
3172 my $zipName = $filename;
3173 my $status = $zip->read( $zipName );
3174 if ($status != AZ_OK) {
3175 $errormessage = "Read of $zipName failed\n";
3176 goto N2N_ERROR;
3177 }
3178
3179 my $tempdir = tempdir( CLEANUP => 1 );
3180 my @files = $zip->memberNames();
3181 for(@files) {
3182 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3183 }
3184 my $countfiles = @files;
3185
3186# Check if we have not more then 2 files
3187
3188 if ( $countfiles == 2){
3189 foreach (@files){
3190 if ( $_ =~ /.conf$/){
3191 $uplconffilename = $_;
3192 }
3193 if ( $_ =~ /.p12$/){
3194 $uplp12name = $_;
3195 }
3196 }
3197 if (($uplconffilename eq '') || ($uplp12name eq '')){
3198 $errormessage = "Either no *.conf or no *.p12 file found\n";
3199 goto N2N_ERROR;
3200 }
3201
3202 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3203 @firen2nconf = <FILE>;
3204 close (FILE);
3205 chomp(@firen2nconf);
3206
3207 } else {
3208
3209 $errormessage = "Filecount does not match only 2 files are allowed\n";
3210 goto N2N_ERROR;
3211 }
3212
7c1d9faf
AH
3213###
3214# m.a.d net2net
ce9abb66 3215###
54fd0535
MT
3216
3217 if ($cgiparams{'n2nname'} ne ''){
3218
3219 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3220 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
3221 $n2nname[0] = $cgiparams{'n2nname'};
3222 my @n2nname2 = split(/\./,$uplconffilename);
3223 $n2nname2[0] =~ s/\n|\r//g;
3224 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3225 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3226 my $input2 = "$n2nname2[0]n2n";
3227 my $output2 = "$n2nname[0]n2n";
3228 my $filename = "$tempdir/$uplconffilename";
3229 open(FILE, "< $filename") or die 'Unable to open config file.';
3230 my @current = <FILE>;
3231 close(FILE);
3232 foreach (@current) {s/$input1/$output1/g;}
3233 foreach (@current) {s/$input2/$output2/g;}
3234 open (OUT, "> $filename") || die 'Unable to open config file.';
3235 print OUT @current;
3236 close OUT;
ce9abb66 3237
54fd0535
MT
3238 }else{
3239 $uplconffilename2 = $uplconffilename;
3240 $uplp12name2 = $uplp12name;
3241 @n2nname = split(/\./,$uplconffilename);
ce9abb66 3242 $n2nname[0] =~ s/\n|\r//g;
54fd0535 3243 }
7c1d9faf
AH
3244 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3245 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
ce9abb66 3246
54fd0535 3247 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
ce9abb66
AH
3248
3249 if ($? ne 0) {
3250 $errormessage = "*.conf move failed: $!";
3251 unlink ($filename);
3252 goto N2N_ERROR;
3253 }
3254
54fd0535 3255 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
b278daf3
AH
3256 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3257
ce9abb66
AH
3258 if ($? ne 0) {
3259 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3260 unlink ($filename);
3261 goto N2N_ERROR;
3262 }
3263
3264my $complzoactive;
d96c89eb 3265my $mssfixactive;
4c962356 3266my $authactive;
d96c89eb 3267my $n2nfragment;
4c962356 3268my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);
60f396d7 3269my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
54fd0535 3270my @n2nproto = split(/-/, $n2nproto2[1]);
ce9abb66
AH
3271my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3272my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3273my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3274if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH
3275my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
3276if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
54fd0535 3277#my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
d96c89eb 3278my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH
3279my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3280my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);