webaccess.cgi: Fix loading language
[ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi
CommitLineData
ac1cfefa 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
4a29f854 5# Copyright (C) 2007-2013 IPFire Team info@ipfire.org #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
ac1cfefa
MT
21
22use Net::DNS;
23use File::Copy;
24use File::Temp qw/ tempfile tempdir /;
25use strict;
eff2dbf8 26use Sort::Naturally;
ac1cfefa 27# enable only the following on debugging purpose
cb5e9c6c
CS
28#use warnings;
29#use CGI::Carp 'fatalsToBrowser';
ac1cfefa 30
986e08d9 31require '/var/ipfire/general-functions.pl';
ac1cfefa
MT
32require "${General::swroot}/lang.pl";
33require "${General::swroot}/header.pl";
ac1cfefa
MT
34require "${General::swroot}/countries.pl";
35
36#workaround to suppress a warning when a variable is used only once
ed84e8b8 37my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
ac1cfefa
MT
38undef (@dummy);
39
40###
41### Initialize variables
42###
ed84e8b8 43my $sleepDelay = 4; # after a call to ipsecctrl S or R, wait this delay (seconds) before reading status
ac1cfefa
MT
44 # (let the ipsec do its job)
45my %netsettings=();
ed84e8b8
MT
46our %cgiparams=();
47our %vpnsettings=();
ac1cfefa
MT
48my %checked=();
49my %confighash=();
50my %cahash=();
51my %selected=();
52my $warnmessage = '';
53my $errormessage = '';
ed84e8b8 54
f2fdd0c1
CS
55my %color = ();
56my %mainsettings = ();
57&General::readhash("${General::swroot}/main/settings", \%mainsettings);
58&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
59
ac1cfefa 60&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
e897bfeb
AF
61
62my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}");
63my $blue_cidr = "# Blue not defined";
095cbf43 64if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
e897bfeb
AF
65 $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}");
66}
67my $orange_cidr = "# Orange not defined";
095cbf43 68if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
e897bfeb
AF
69 $orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}");
70}
71
e9850821
AM
72my $col="";
73
ac1cfefa 74$cgiparams{'ENABLED'} = 'off';
ac1cfefa 75$cgiparams{'EDIT_ADVANCED'} = 'off';
ac1cfefa
MT
76$cgiparams{'ACTION'} = '';
77$cgiparams{'CA_NAME'} = '';
ed84e8b8
MT
78$cgiparams{'KEY'} = '';
79$cgiparams{'TYPE'} = '';
80$cgiparams{'ADVANCED'} = '';
ed84e8b8
MT
81$cgiparams{'NAME'} = '';
82$cgiparams{'LOCAL_SUBNET'} = '';
83$cgiparams{'REMOTE_SUBNET'} = '';
84$cgiparams{'REMOTE'} = '';
85$cgiparams{'LOCAL_ID'} = '';
86$cgiparams{'REMOTE_ID'} = '';
87$cgiparams{'REMARK'} = '';
88$cgiparams{'PSK'} = '';
89$cgiparams{'CERT_NAME'} = '';
90$cgiparams{'CERT_EMAIL'} = '';
91$cgiparams{'CERT_OU'} = '';
92$cgiparams{'CERT_ORGANIZATION'} = '';
93$cgiparams{'CERT_CITY'} = '';
94$cgiparams{'CERT_STATE'} = '';
95$cgiparams{'CERT_COUNTRY'} = '';
96$cgiparams{'SUBJECTALTNAME'} = '';
97$cgiparams{'CERT_PASS1'} = '';
98$cgiparams{'CERT_PASS2'} = '';
99$cgiparams{'ROOTCERT_HOSTNAME'} = '';
100$cgiparams{'ROOTCERT_COUNTRY'} = '';
101$cgiparams{'P12_PASS'} = '';
102$cgiparams{'ROOTCERT_ORGANIZATION'} = '';
103$cgiparams{'ROOTCERT_HOSTNAME'} = '';
104$cgiparams{'ROOTCERT_EMAIL'} = '';
105$cgiparams{'ROOTCERT_OU'} = '';
106$cgiparams{'ROOTCERT_CITY'} = '';
107$cgiparams{'ROOTCERT_STATE'} = '';
9d85ac3b 108$cgiparams{'RW_NET'} = '';
4e156911
AM
109$cgiparams{'DPD_DELAY'} = '30';
110$cgiparams{'DPD_TIMEOUT'} = '120';
ac1cfefa
MT
111&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
112
113###
114### Useful functions
115###
116sub valid_dns_host {
117 my $hostname = $_[0];
118 unless ($hostname) { return "No hostname"};
119 my $res = new Net::DNS::Resolver;
120 my $query = $res->search("$hostname");
121 if ($query) {
122 foreach my $rr ($query->answer) {
123 ## Potential bug - we are only looking at A records:
124 return 0 if $rr->type eq "A";
125 }
126 } else {
127 return $res->errorstring;
128 }
129}
ed84e8b8
MT
130###
131### Just return true is one interface is vpn enabled
132###
133sub vpnenabled {
5fd30232 134 return ($vpnsettings{'ENABLED'} eq 'on');
ed84e8b8
MT
135}
136###
137### old version: maintain serial number to one, without explication.
138### this : let the counter go, so that each cert is numbered.
139###
ac1cfefa
MT
140sub cleanssldatabase
141{
142 if (open(FILE, ">${General::swroot}/certs/serial")) {
143 print FILE "01";
144 close FILE;
145 }
146 if (open(FILE, ">${General::swroot}/certs/index.txt")) {
147 print FILE "";
148 close FILE;
149 }
150 unlink ("${General::swroot}/certs/index.txt.old");
151 unlink ("${General::swroot}/certs/serial.old");
152 unlink ("${General::swroot}/certs/01.pem");
153}
154sub newcleanssldatabase
155{
156 if (! -s "${General::swroot}/certs/serial" ) {
157 open(FILE, ">${General::swroot}/certs/serial");
158 print FILE "01";
159 close FILE;
160 }
161 if (! -s ">${General::swroot}/certs/index.txt") {
162 system ("touch ${General::swroot}/certs/index.txt");
163 }
164 unlink ("${General::swroot}/certs/index.txt.old");
165 unlink ("${General::swroot}/certs/serial.old");
166# unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete
167}
ed84e8b8
MT
168
169###
170### Call openssl and return errormessage if any
171###
172sub callssl ($) {
173 my $opt = shift;
174 my $retssl = `/usr/bin/openssl $opt 2>&1`; #redirect stderr
175 my $ret = '';
176 foreach my $line (split (/\n/, $retssl)) {
177 &General::log("ipsec", "$line") if (0); # 1 for verbose logging
178 $ret .= '<br>'.$line if ( $line =~ /error|unknown/ );
179 }
180 if ($ret) {
181 $ret= &Header::cleanhtml($ret);
182 }
183 return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ;
184}
185###
186### Obtain a CN from given cert
187###
188sub getCNfromcert ($) {
189 #&General::log("ipsec", "Extracting name from $_[0]...");
190 my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
191 $temp =~ /Subject:.*CN=(.*)[\n]/;
192 $temp = $1;
193 $temp =~ s+/Email+, E+;
194 $temp =~ s/ ST=/ S=/;
195 $temp =~ s/,//g;
196 $temp =~ s/\'//g;
197 return $temp;
198}
199###
200### Obtain Subject from given cert
201###
202sub getsubjectfromcert ($) {
203 #&General::log("ipsec", "Extracting subject from $_[0]...");
204 my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
205 $temp =~ /Subject: (.*)[\n]/;
206 $temp = $1;
207 $temp =~ s+/Email+, E+;
208 $temp =~ s/ ST=/ S=/;
209 return $temp;
210}
211###
212### Combine local subnet and connection name to make a unique name for each connection section
213### (this sub is not used now)
214###
215sub makeconnname ($) {
216 my $conn = shift;
217 my $subnet = shift;
218
219 $subnet =~ /^(.*?)\/(.*?)$/; # $1=IP $2=mask
220 my $ip = unpack('N', &Socket::inet_aton($1));
221 if (length ($2) > 2) {
222 my $mm = unpack('N', &Socket::inet_aton($2));
223 while ( ($mm & 1)==0 ) {
224 $ip >>= 1;
225 $mm >>= 1;
226 };
227 } else {
228 $ip >>= (32 - $2);
229 }
230 return sprintf ("%s-%X", $conn, $ip);
231}
232###
233### Write a config file.
234###
235###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and
236### the side is always defined as 'left'.
237### configihash[14]: 'VHOST' is allowed
238###
ed84e8b8 239
ac1cfefa
MT
240sub writeipsecfiles {
241 my %lconfighash = ();
242 my %lvpnsettings = ();
243 &General::readhasharray("${General::swroot}/vpn/config", \%lconfighash);
244 &General::readhash("${General::swroot}/vpn/settings", \%lvpnsettings);
245
246 open(CONF, ">${General::swroot}/vpn/ipsec.conf") or die "Unable to open ${General::swroot}/vpn/ipsec.conf: $!";
247 open(SECRETS, ">${General::swroot}/vpn/ipsec.secrets") or die "Unable to open ${General::swroot}/vpn/ipsec.secrets: $!";
248 flock CONF, 2;
249 flock SECRETS, 2;
05207d69 250 print CONF "version 2\n\n";
ac1cfefa 251 print CONF "conn %default\n";
7916a3be 252 print CONF "\tkeyingtries=%forever\n";
ac1cfefa
MT
253 print CONF "\n";
254
63043a1b 255 # Add user includes to config file
bd767b27
LS
256 if (-e "/etc/ipsec.user.conf") {
257 print CONF "include /etc/ipsec.user.conf\n";
258 print CONF "\n";
259 }
63043a1b 260
2827f4af 261 print SECRETS "include /etc/ipsec.user.secrets\n";
63043a1b 262
ac1cfefa
MT
263 if (-f "${General::swroot}/certs/hostkey.pem") {
264 print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n"
265 }
ed84e8b8
MT
266 my $last_secrets = ''; # old the less specifics connections
267
ac1cfefa 268 foreach my $key (keys %lconfighash) {
ed84e8b8 269 next if ($lconfighash{$key}[0] ne 'on');
ac1cfefa 270
ed84e8b8
MT
271 #remote peer is not set? => use '%any'
272 $lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq '');
ac1cfefa 273
5fd30232 274 my $localside;
ed84e8b8 275 if ($lconfighash{$key}[26] eq 'BLUE') {
5fd30232 276 $localside = $netsettings{'BLUE_ADDRESS'};
ed84e8b8 277 } elsif ($lconfighash{$key}[26] eq 'GREEN') {
5fd30232
MT
278 $localside = $netsettings{'GREEN_ADDRESS'};
279 } elsif ($lconfighash{$key}[26] eq 'ORANGE') {
280 $localside = $netsettings{'ORANGE_ADDRESS'};
281 } else { # it is RED
282 $localside = $lvpnsettings{'VPN_IP'};
ed84e8b8 283 }
ac1cfefa 284
341ff36c 285 print CONF "conn $lconfighash{$key}[1]\n";
5fd30232 286 print CONF "\tleft=$localside\n";
e897bfeb
AF
287 my $cidr_net=&General::ipcidr($lconfighash{$key}[8]);
288 print CONF "\tleftsubnet=$cidr_net\n";
6652626c 289 print CONF "\tleftfirewall=yes\n";
b2d5dd6d 290 print CONF "\tlefthostaccess=yes\n";
5fd30232
MT
291
292 print CONF "\tright=$lconfighash{$key}[10]\n";
ed84e8b8 293 if ($lconfighash{$key}[3] eq 'net') {
e897bfeb
AF
294 my $cidr_net=&General::ipcidr($lconfighash{$key}[11]);
295 print CONF "\trightsubnet=$cidr_net\n";
5fd30232 296 } elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed for roadwarriors?
ed84e8b8
MT
297 print CONF "\trightsubnet=vhost:%no,%priv\n";
298 }
299
300 # Local Cert and Remote Cert (unless auth is DN dn-auth)
301 if ($lconfighash{$key}[4] eq 'cert') {
5fd30232
MT
302 print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n";
303 print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn');
ed84e8b8
MT
304 }
305
306 # Local and Remote IDs
5fd30232
MT
307 print CONF "\tleftid=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]);
308 print CONF "\trightid=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]);
ed84e8b8 309
ae2782ba
MT
310 # Is PFS enabled?
311 my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
312
ed84e8b8
MT
313 # Algorithms
314 if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) {
e8b3bb0e
MT
315 my @encs = split('\|', $lconfighash{$key}[18]);
316 my @ints = split('\|', $lconfighash{$key}[19]);
317 my @groups = split('\|', $lconfighash{$key}[20]);
318
319 my @algos = &make_algos("ike", \@encs, \@ints, \@groups, 1);
320 print CONF "\tike=" . join(",", @algos);
321
322 if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
323 print CONF "!\n";
324 } else {
325 print CONF "\n";
326 }
ed84e8b8 327 }
e8b3bb0e 328
ed84e8b8 329 if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
e8b3bb0e
MT
330 my @encs = split('\|', $lconfighash{$key}[21]);
331 my @ints = split('\|', $lconfighash{$key}[22]);
332 my @groups = split('\|', $lconfighash{$key}[20]);
333
334 my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on"));
335 print CONF "\tesp=" . join(",", @algos);
336
337 if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
338 print CONF "!\n";
339 } else {
340 print CONF "\n";
ed84e8b8 341 }
ed84e8b8 342 }
ed84e8b8 343
e2e4ed01
AF
344 # IKE V1 or V2
345 if (! $lconfighash{$key}[29]) {
346 $lconfighash{$key}[29] = "ikev1";
347 }
348 print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
126246a8 349
ed84e8b8
MT
350 # Lifetimes
351 print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
352 print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
353
ed84e8b8
MT
354 # Compression
355 print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on');
356
357 # Dead Peer Detection
afd5d8f7
MT
358 my $dpdaction = $lconfighash{$key}[27];
359 print CONF "\tdpdaction=$dpdaction\n";
360
361 # If the dead peer detection is disabled and IKEv2 is used,
362 # dpddelay must be set to zero, too.
363 if ($dpdaction eq "none") {
364 if ($lconfighash{$key}[29] eq "ikev2") {
365 print CONF "\tdpddelay=0\n";
366 }
367 } else {
a24062d1 368 my $dpddelay = $lconfighash{$key}[31];
afd5d8f7
MT
369 if (!$dpddelay) {
370 $dpddelay = 30;
371 }
372 print CONF "\tdpddelay=$dpddelay\n";
a24062d1 373 my $dpdtimeout = $lconfighash{$key}[30];
afd5d8f7
MT
374 if (!$dpdtimeout) {
375 $dpdtimeout = 120;
376 }
377 print CONF "\tdpdtimeout=$dpdtimeout\n";
cbb3a8f9 378 }
cbb3a8f9 379
ed84e8b8
MT
380 # Build Authentication details: LEFTid RIGHTid : PSK psk
381 my $psk_line;
382 if ($lconfighash{$key}[4] eq 'psk') {
ed84e8b8
MT
383 $psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ;
384 $psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; #remoteid or remote address?
385 $psk_line .= " : PSK '$lconfighash{$key}[5]'\n";
386 # if the line contains %any, it is less specific than two IP or ID, so move it at end of file.
387 if ($psk_line =~ /%any/) {
388 $last_secrets .= $psk_line;
ac1cfefa 389 } else {
ed84e8b8 390 print SECRETS $psk_line;
ac1cfefa 391 }
ed84e8b8
MT
392 print CONF "\tauthby=secret\n";
393 } else {
394 print CONF "\tauthby=rsasig\n";
395 print CONF "\tleftrsasigkey=%cert\n";
396 print CONF "\trightrsasigkey=%cert\n";
397 }
ac1cfefa 398
ed84e8b8
MT
399 # Automatically start only if a net-to-net connection
400 if ($lconfighash{$key}[3] eq 'host') {
401 print CONF "\tauto=add\n";
86525dfc 402 print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n";
ed84e8b8
MT
403 } else {
404 print CONF "\tauto=start\n";
405 }
a4737620
MT
406
407 # Fragmentation
408 print CONF "\tfragmentation=yes\n";
409
ed84e8b8
MT
410 print CONF "\n";
411 }#foreach key
bd767b27
LS
412
413 # Add post user includes to config file
414 # After the GUI-connections allows to patch connections.
415 if (-e "/etc/ipsec.user-post.conf") {
416 print CONF "include /etc/ipsec.user-post.conf\n";
417 print CONF "\n";
418 }
419
ed84e8b8 420 print SECRETS $last_secrets if ($last_secrets);
ac1cfefa
MT
421 close(CONF);
422 close(SECRETS);
423}
424
ae2782ba
MT
425# Hook to regenerate the configuration files.
426if ($ENV{"REMOTE_ADDR"} eq "") {
26dfc86a 427 writeipsecfiles();
ae2782ba
MT
428 exit(0);
429}
430
ac1cfefa
MT
431###
432### Save main settings
433###
434if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
435 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
436 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})
437 || $cgiparams{'VPN_IP'} eq '%defaultroute' ) {
438 $errormessage = $Lang::tr{'invalid input for hostname'};
439 goto SAVE_ERROR;
440 }
441
442 unless ($cgiparams{'VPN_DELAYED_START'} =~ /^[0-9]{1,3}$/ ) { #allow 0-999 seconds !
443 $errormessage = $Lang::tr{'invalid time period'};
444 goto SAVE_ERROR;
445 }
446
2444cc97 447 if ( $cgiparams{'RW_NET'} ne '' and !&General::validipandmask($cgiparams{'RW_NET'}) ) {
9d85ac3b
CS
448 $errormessage = $Lang::tr{'urlfilter invalid ip or mask error'};
449 goto SAVE_ERROR;
450 }
451
35b5392a 452 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
ac1cfefa
MT
453 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
454 $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'};
9d85ac3b 455 $vpnsettings{'RW_NET'} = $cgiparams{'RW_NET'};
ac1cfefa
MT
456 &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
457 &writeipsecfiles();
ed84e8b8 458 if (&vpnenabled) {
ac1cfefa
MT
459 system('/usr/local/bin/ipsecctrl', 'S');
460 } else {
461 system('/usr/local/bin/ipsecctrl', 'D');
462 }
463 sleep $sleepDelay;
464 SAVE_ERROR:
465###
466### Reset all step 2
467###
ed84e8b8 468} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
ac1cfefa
MT
469 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
470
471 foreach my $key (keys %confighash) {
472 if ($confighash{$key}[4] eq 'cert') {
473 delete $confighash{$key};
474 }
475 }
ed84e8b8 476 while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) {
ac1cfefa
MT
477 unlink $file
478 }
479 &cleanssldatabase();
480 if (open(FILE, ">${General::swroot}/vpn/caconfig")) {
481 print FILE "";
482 close FILE;
483 }
484 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
485 &writeipsecfiles();
486 system('/usr/local/bin/ipsecctrl', 'R');
487 sleep $sleepDelay;
488
489###
490### Reset all step 1
491###
ed84e8b8 492} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
ac1cfefa 493 &Header::showhttpheaders();
7d44bfee 494 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
495 &Header::openbigbox('100%', 'left', '', '');
496 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
ac1cfefa 497 print <<END
ed84e8b8
MT
498 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
499 <table width='100%'>
500 <tr>
501 <td align='center'>
502 <input type='hidden' name='AREUSURE' value='yes' />
503 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
504 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
505 </tr><tr>
506 <td align='center'>
507 <input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
508 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
509 </tr>
510 </table>
511 </form>
ac1cfefa
MT
512END
513 ;
514 &Header::closebox();
515 &Header::closebigbox();
516 &Header::closepage();
517 exit (0);
518
519###
520### Upload CA Certificate
521###
522} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
523 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
524
525 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
526 $errormessage = $Lang::tr{'name must only contain characters'};
527 goto UPLOADCA_ERROR;
528 }
529
530 if (length($cgiparams{'CA_NAME'}) >60) {
531 $errormessage = $Lang::tr{'name too long'};
532 goto VPNCONF_ERROR;
533 }
534
535 if ($cgiparams{'CA_NAME'} eq 'ca') {
536 $errormessage = $Lang::tr{'name is invalid'};
537 goto UPLOAD_CA_ERROR;
538 }
539
540 # Check if there is no other entry with this name
541 foreach my $key (keys %cahash) {
542 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
543 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
544 goto UPLOADCA_ERROR;
545 }
546 }
547
548 if (ref ($cgiparams{'FH'}) ne 'Fh') {
549 $errormessage = $Lang::tr{'there was no file upload'};
550 goto UPLOADCA_ERROR;
551 }
552 # Move uploaded ca to a temporary file
553 (my $fh, my $filename) = tempfile( );
554 if (copy ($cgiparams{'FH'}, $fh) != 1) {
555 $errormessage = $!;
556 goto UPLOADCA_ERROR;
557 }
558 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
559 if ($temp !~ /CA:TRUE/i) {
560 $errormessage = $Lang::tr{'not a valid ca certificate'};
561 unlink ($filename);
562 goto UPLOADCA_ERROR;
563 } else {
564 move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
565 if ($? ne 0) {
566 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
567 unlink ($filename);
568 goto UPLOADCA_ERROR;
569 }
570 }
571
ac1cfefa
MT
572 my $key = &General::findhasharraykey (\%cahash);
573 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
ed84e8b8 574 $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
ac1cfefa 575 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
b4f6d698 576
64dc6c92 577 system('/usr/local/bin/ipsecctrl', 'R');
ac1cfefa
MT
578 sleep $sleepDelay;
579
580 UPLOADCA_ERROR:
581
582###
583### Display ca certificate
584###
585} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
586 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
587
588 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
589 &Header::showhttpheaders();
7d44bfee 590 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
591 &Header::openbigbox('100%', 'left', '', '');
592 &Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
ac1cfefa
MT
593 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
594 $output = &Header::cleanhtml($output,"y");
595 print "<pre>$output</pre>\n";
596 &Header::closebox();
597 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
598 &Header::closebigbox();
599 &Header::closepage();
600 exit(0);
601 } else {
602 $errormessage = $Lang::tr{'invalid key'};
603 }
604
605###
ed84e8b8 606### Export ca certificate to browser
ac1cfefa
MT
607###
608} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
609 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
610
611 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
ed84e8b8 612 print "Content-Type: application/force-download\n";
ac1cfefa 613 print "Content-Type: application/octet-stream\r\n";
ed84e8b8 614 print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
ac1cfefa
MT
615 print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
616 exit(0);
617 } else {
618 $errormessage = $Lang::tr{'invalid key'};
619 }
620
621###
622### Remove ca certificate (step 2)
623###
624} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
625 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
626 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
627
628 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
629 foreach my $key (keys %confighash) {
630 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
631 if ($test =~ /: OK/) {
632 # Delete connection
ed84e8b8 633 system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
ac1cfefa
MT
634 unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
635 unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
636 delete $confighash{$key};
637 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
638 &writeipsecfiles();
639 }
640 }
641 unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
642 delete $cahash{$cgiparams{'KEY'}};
643 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
644 system('/usr/local/bin/ipsecctrl', 'R');
645 sleep $sleepDelay;
646 } else {
647 $errormessage = $Lang::tr{'invalid key'};
648 }
649###
650### Remove ca certificate (step 1)
651###
652} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
653 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
654 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
655
656 my $assignedcerts = 0;
657 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
658 foreach my $key (keys %confighash) {
659 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
660 if ($test =~ /: OK/) {
661 $assignedcerts++;
662 }
663 }
664 if ($assignedcerts) {
665 &Header::showhttpheaders();
7d44bfee 666 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
667 &Header::openbigbox('100%', 'left', '', '');
668 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
ac1cfefa 669 print <<END
ed84e8b8
MT
670 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
671 <table width='100%'>
672 <tr>
673 <td align='center'>
674 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
675 <input type='hidden' name='AREUSURE' value='yes' /></td>
676 </tr><tr>
677 <td align='center'>
678 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>
679 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}</td>
680 </tr><tr>
681 <td align='center'>
682 <input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
683 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
684 </tr>
685 </table>
686 </form>
ac1cfefa
MT
687END
688 ;
689 &Header::closebox();
690 &Header::closebigbox();
691 &Header::closepage();
692 exit (0);
693 } else {
694 unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
695 delete $cahash{$cgiparams{'KEY'}};
696 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
697 system('/usr/local/bin/ipsecctrl', 'R');
698 sleep $sleepDelay;
699 }
700 } else {
701 $errormessage = $Lang::tr{'invalid key'};
702 }
703
704###
705### Display root certificate
706###
707} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
708 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
709 my $output;
710 &Header::showhttpheaders();
7d44bfee 711 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8 712 &Header::openbigbox('100%', 'left', '', '');
ac1cfefa 713 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
ed84e8b8 714 &Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
ac1cfefa
MT
715 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
716 } else {
ed84e8b8 717 &Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
ac1cfefa
MT
718 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
719 }
720 $output = &Header::cleanhtml($output,"y");
721 print "<pre>$output</pre>\n";
722 &Header::closebox();
723 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
724 &Header::closebigbox();
725 &Header::closepage();
726 exit(0);
727
728###
ed84e8b8 729### Export root certificate to browser
ac1cfefa
MT
730###
731} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
732 if ( -f "${General::swroot}/ca/cacert.pem" ) {
ed84e8b8
MT
733 print "Content-Type: application/force-download\n";
734 print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
ac1cfefa
MT
735 print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
736 exit(0);
737 }
738###
ed84e8b8 739### Export host certificate to browser
ac1cfefa
MT
740###
741} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
742 if ( -f "${General::swroot}/certs/hostcert.pem" ) {
ed84e8b8
MT
743 print "Content-Type: application/force-download\n";
744 print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
ac1cfefa
MT
745 print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
746 exit(0);
747 }
748###
ed84e8b8 749### Form for generating/importing the caroot+host certificate
ac1cfefa
MT
750###
751} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
752 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
753
ac1cfefa
MT
754 if (-f "${General::swroot}/ca/cacert.pem") {
755 $errormessage = $Lang::tr{'valid root certificate already exists'};
ed84e8b8 756 goto ROOTCERT_SKIP;
ac1cfefa
MT
757 }
758
ed84e8b8
MT
759 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
760 # fill in initial values
761 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
762 if (-e "${General::swroot}/red/active" && open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
ac1cfefa
MT
763 my $ipaddr = <IPADDR>;
764 close IPADDR;
765 chomp ($ipaddr);
766 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
767 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
768 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
769 }
770 }
ed84e8b8 771 $cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
ac1cfefa 772 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
ed84e8b8 773 &General::log("ipsec", "Importing from p12...");
ac1cfefa
MT
774
775 if (ref ($cgiparams{'FH'}) ne 'Fh') {
776 $errormessage = $Lang::tr{'there was no file upload'};
777 goto ROOTCERT_ERROR;
778 }
779
780 # Move uploaded certificate request to a temporary file
781 (my $fh, my $filename) = tempfile( );
782 if (copy ($cgiparams{'FH'}, $fh) != 1) {
783 $errormessage = $!;
784 goto ROOTCERT_ERROR;
785 }
786
ac1cfefa 787 # Extract the CA certificate from the file
ed84e8b8
MT
788 &General::log("ipsec", "Extracting caroot from p12...");
789 if (open(STDIN, "-|")) {
790 my $opt = " pkcs12 -cacerts -nokeys";
791 $opt .= " -in $filename";
792 $opt .= " -out /tmp/newcacert";
793 $errormessage = &callssl ($opt);
794 } else { #child
795 print "$cgiparams{'P12_PASS'}\n";
796 exit (0);
ac1cfefa
MT
797 }
798
ed84e8b8
MT
799 # Extract the Host certificate from the file
800 if (!$errormessage) {
801 &General::log("ipsec", "Extracting host cert from p12...");
802 if (open(STDIN, "-|")) {
803 my $opt = " pkcs12 -clcerts -nokeys";
804 $opt .= " -in $filename";
805 $opt .= " -out /tmp/newhostcert";
806 $errormessage = &callssl ($opt);
807 } else { #child
808 print "$cgiparams{'P12_PASS'}\n";
809 exit (0);
ac1cfefa
MT
810 }
811 }
812
813 # Extract the Host key from the file
ed84e8b8
MT
814 if (!$errormessage) {
815 &General::log("ipsec", "Extracting private key from p12...");
816 if (open(STDIN, "-|")) {
817 my $opt = " pkcs12 -nocerts -nodes";
818 $opt .= " -in $filename";
819 $opt .= " -out /tmp/newhostkey";
820 $errormessage = &callssl ($opt);
821 } else { #child
822 print "$cgiparams{'P12_PASS'}\n";
823 exit (0);
824 }
825 }
826
827 if (!$errormessage) {
828 &General::log("ipsec", "Moving cacert...");
829 move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem");
830 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
831 }
832
833 if (!$errormessage) {
834 &General::log("ipsec", "Moving host cert...");
835 move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem");
836 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
ac1cfefa
MT
837 }
838
ed84e8b8
MT
839 if (!$errormessage) {
840 &General::log("ipsec", "Moving private key...");
841 move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem");
842 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
ac1cfefa 843 }
ed84e8b8
MT
844
845 #cleanup temp files
846 unlink ($filename);
847 unlink ('/tmp/newcacert');
848 unlink ('/tmp/newhostcert');
849 unlink ('/tmp/newhostkey');
850 if ($errormessage) {
ac1cfefa
MT
851 unlink ("${General::swroot}/ca/cacert.pem");
852 unlink ("${General::swroot}/certs/hostcert.pem");
853 unlink ("${General::swroot}/certs/hostkey.pem");
854 goto ROOTCERT_ERROR;
ac1cfefa
MT
855 }
856
ed84e8b8
MT
857 # Create empty CRL cannot be done because we don't have
858 # the private key for this CAROOT
5fd30232 859 # IPFire can only import certificates
ed84e8b8
MT
860
861 &General::log("ipsec", "p12 import completed!");
862 &cleanssldatabase();
ac1cfefa
MT
863 goto ROOTCERT_SUCCESS;
864
865 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
866
867 # Validate input since the form was submitted
868 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
869 $errormessage = $Lang::tr{'organization cant be empty'};
870 goto ROOTCERT_ERROR;
871 }
872 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
873 $errormessage = $Lang::tr{'organization too long'};
874 goto ROOTCERT_ERROR;
875 }
876 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
877 $errormessage = $Lang::tr{'invalid input for organization'};
878 goto ROOTCERT_ERROR;
879 }
880 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
881 $errormessage = $Lang::tr{'hostname cant be empty'};
882 goto ROOTCERT_ERROR;
883 }
884 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
885 $errormessage = $Lang::tr{'invalid input for hostname'};
886 goto ROOTCERT_ERROR;
887 }
888 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
889 $errormessage = $Lang::tr{'invalid input for e-mail address'};
890 goto ROOTCERT_ERROR;
891 }
892 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
893 $errormessage = $Lang::tr{'e-mail address too long'};
894 goto ROOTCERT_ERROR;
895 }
896 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
897 $errormessage = $Lang::tr{'invalid input for department'};
898 goto ROOTCERT_ERROR;
899 }
900 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
901 $errormessage = $Lang::tr{'invalid input for city'};
902 goto ROOTCERT_ERROR;
903 }
904 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
905 $errormessage = $Lang::tr{'invalid input for state or province'};
906 goto ROOTCERT_ERROR;
907 }
908 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
909 $errormessage = $Lang::tr{'invalid input for country'};
910 goto ROOTCERT_ERROR;
911 }
ed84e8b8
MT
912 #the exact syntax is a list comma separated of
913 # email:any-validemail
914 # URI: a uniform resource indicator
915 # DNS: a DNS domain name
916 # RID: a registered OBJECT IDENTIFIER
917 # IP: an IP address
918 # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
919
920 if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
921 $errormessage = $Lang::tr{'vpn altname syntax'};
922 goto VPNCONF_ERROR;
923 }
ac1cfefa
MT
924
925 # Copy the cgisettings to vpnsettings and save the configfile
926 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
927 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
928 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
929 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
930 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
931 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
932 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
933 &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
934
935 # Replace empty strings with a .
936 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
937 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
938 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
939
940 # Create the CA certificate
ed84e8b8
MT
941 if (!$errormessage) {
942 &General::log("ipsec", "Creating cacert...");
943 if (open(STDIN, "-|")) {
3847730c 944 my $opt = " req -x509 -sha256 -nodes";
ed84e8b8 945 $opt .= " -days 999999";
3847730c 946 $opt .= " -newkey rsa:4096";
ed84e8b8
MT
947 $opt .= " -keyout ${General::swroot}/private/cakey.pem";
948 $opt .= " -out ${General::swroot}/ca/cacert.pem";
949
950 $errormessage = &callssl ($opt);
951 } else { #child
952 print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
953 print "$state\n";
954 print "$city\n";
955 print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
956 print "$ou\n";
957 print "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
958 print "$cgiparams{'ROOTCERT_EMAIL'}\n";
959 exit (0);
ac1cfefa
MT
960 }
961 }
962
963 # Create the Host certificate request
ed84e8b8
MT
964 if (!$errormessage) {
965 &General::log("ipsec", "Creating host cert...");
966 if (open(STDIN, "-|")) {
3847730c
WA
967 my $opt = " req -sha256 -nodes";
968 $opt .= " -newkey rsa:2048";
ed84e8b8
MT
969 $opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
970 $opt .= " -out ${General::swroot}/certs/hostreq.pem";
971 $errormessage = &callssl ($opt);
972 } else { #child
973 print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
974 print "$state\n";
975 print "$city\n";
976 print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
977 print "$ou\n";
978 print "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
979 print "$cgiparams{'ROOTCERT_EMAIL'}\n";
980 print ".\n";
981 print ".\n";
982 exit (0);
ac1cfefa
MT
983 }
984 }
ed84e8b8 985
ac1cfefa 986 # Sign the host certificate request
ed84e8b8
MT
987 if (!$errormessage) {
988 &General::log("ipsec", "Self signing host cert...");
989
990 #No easy way for specifying the contain of subjectAltName without writing a config file...
991 my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
992 print $fh <<END
993 basicConstraints=CA:FALSE
994 nsComment="OpenSSL Generated Certificate"
995 subjectKeyIdentifier=hash
996 authorityKeyIdentifier=keyid,issuer:always
d06f6e7c 997 extendedKeyUsage = serverAuth
ed84e8b8
MT
998END
999;
1000 print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
1001 close ($fh);
1002
3847730c 1003 my $opt = " ca -md sha256 -days 999999";
ed84e8b8
MT
1004 $opt .= " -batch -notext";
1005 $opt .= " -in ${General::swroot}/certs/hostreq.pem";
1006 $opt .= " -out ${General::swroot}/certs/hostcert.pem";
1007 $opt .= " -extfile $v3extname";
1008 $errormessage = &callssl ($opt);
1009 unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed
1010 unlink ($v3extname);
ac1cfefa
MT
1011 }
1012
1013 # Create an empty CRL
ed84e8b8
MT
1014 if (!$errormessage) {
1015 &General::log("ipsec", "Creating emptycrl...");
1016 my $opt = " ca -gencrl";
1017 $opt .= " -out ${General::swroot}/crls/cacrl.pem";
1018 $errormessage = &callssl ($opt);
1019 }
1020
1021 # Successfully build CA / CERT!
1022 if (!$errormessage) {
ac1cfefa 1023 &cleanssldatabase();
ed84e8b8 1024 goto ROOTCERT_SUCCESS;
ac1cfefa 1025 }
ed84e8b8
MT
1026
1027 #Cleanup
1028 unlink ("${General::swroot}/ca/cacert.pem");
1029 unlink ("${General::swroot}/certs/hostkey.pem");
1030 unlink ("${General::swroot}/certs/hostcert.pem");
1031 unlink ("${General::swroot}/crls/cacrl.pem");
1032 &cleanssldatabase();
ac1cfefa 1033 }
ed84e8b8 1034
ac1cfefa 1035 ROOTCERT_ERROR:
ed84e8b8 1036 &Header::showhttpheaders();
7d44bfee 1037 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
1038 &Header::openbigbox('100%', 'left', '', $errormessage);
1039 if ($errormessage) {
1040 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
1041 print "<class name='base'>$errormessage";
1042 print "&nbsp;</class>";
1043 &Header::closebox();
1044 }
1045 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
1046 print <<END
1047 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
1048 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1049 <tr><td width='40%' class='base'>$Lang::tr{'organization name'}:</td>
1050 <td width='60%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td></tr>
15f635cc 1051 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
ed84e8b8
MT
1052 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td></tr>
1053 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1054 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td></tr>
1055 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1056 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td></tr>
1057 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1058 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td></tr>
1059 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1060 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td></tr>
1061 <tr><td class='base'>$Lang::tr{'country'}:</td>
1062 <td class='base'><select name='ROOTCERT_COUNTRY'>
ac1cfefa 1063END
ed84e8b8
MT
1064 ;
1065 foreach my $country (sort keys %{Countries::countries}) {
1066 print "<option value='$Countries::countries{$country}'";
1067 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1068 print " selected='selected'";
1069 }
1070 print ">$country</option>";
ac1cfefa 1071 }
ed84e8b8
MT
1072 print <<END
1073 </select></td></tr>
1074 <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*) <img src='/blob.gif' alt='*' /></td>
1075 <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr>
1076 <tr><td>&nbsp;</td>
1077 <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
1078 <tr><td class='base' colspan='2' align='left'>
1079 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1080 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1081 </td></tr>
0afd8493 1082 <tr><td colspan='2'><hr></td></tr>
ed84e8b8
MT
1083 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1084 <td nowrap='nowrap'><input type='file' name='FH' size='32' /></td></tr>
1085 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1086 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td></tr>
1087 <tr><td>&nbsp;</td>
1088 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td></tr>
1089 <tr><td class='base' colspan='2' align='left'>
1090 <img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1091 </table></form>
1092END
1093 ;
1094 &Header::closebox();
1095 &Header::closebigbox();
1096 &Header::closepage();
1097 exit(0);
ac1cfefa
MT
1098
1099 ROOTCERT_SUCCESS:
ed84e8b8 1100 if (&vpnenabled) {
ac1cfefa
MT
1101 system('/usr/local/bin/ipsecctrl', 'S');
1102 sleep $sleepDelay;
1103 }
ed84e8b8 1104 ROOTCERT_SKIP:
ac1cfefa 1105###
ed84e8b8 1106### Export PKCS12 file to browser
ac1cfefa
MT
1107###
1108} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1109 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
ed84e8b8
MT
1110 print "Content-Type: application/force-download\n";
1111 print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
ac1cfefa
MT
1112 print "Content-Type: application/octet-stream\r\n\r\n";
1113 print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1114 exit (0);
1115
1116###
1117### Display certificate
1118###
1119} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1120 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1121
1122 if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1123 &Header::showhttpheaders();
7d44bfee 1124 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
1125 &Header::openbigbox('100%', 'left', '', '');
1126 &Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
ac1cfefa
MT
1127 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1128 $output = &Header::cleanhtml($output,"y");
1129 print "<pre>$output</pre>\n";
1130 &Header::closebox();
1131 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1132 &Header::closebigbox();
1133 &Header::closepage();
1134 exit(0);
1135 }
1136
1137###
ed84e8b8 1138### Export Certificate to browser
ac1cfefa
MT
1139###
1140} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
1141 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1142
1143 if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
ed84e8b8
MT
1144 print "Content-Type: application/force-download\n";
1145 print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
ac1cfefa
MT
1146 print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1147 exit (0);
1148 }
1149
1150###
1151### Enable/Disable connection
1152###
1153} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1154
1155 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1156 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1157
1158 if ($confighash{$cgiparams{'KEY'}}) {
1159 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1160 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1161 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1162 &writeipsecfiles();
ed84e8b8 1163 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
ac1cfefa 1164 } else {
5fd30232 1165 system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
ac1cfefa 1166 $confighash{$cgiparams{'KEY'}}[0] = 'off';
ac1cfefa
MT
1167 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1168 &writeipsecfiles();
1169 }
ed84e8b8 1170 sleep $sleepDelay;
ac1cfefa
MT
1171 } else {
1172 $errormessage = $Lang::tr{'invalid key'};
1173 }
1174
1175###
1176### Restart connection
1177###
1178} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
1179 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1180 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1181
1182 if ($confighash{$cgiparams{'KEY'}}) {
ed84e8b8 1183 if (&vpnenabled) {
ac1cfefa
MT
1184 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
1185 sleep $sleepDelay;
1186 }
1187 } else {
1188 $errormessage = $Lang::tr{'invalid key'};
1189 }
1190
1191###
1192### Remove connection
1193###
1194} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1195 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1196 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1197
1198 if ($confighash{$cgiparams{'KEY'}}) {
ed84e8b8 1199 system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
ac1cfefa
MT
1200 unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1201 unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1202 delete $confighash{$cgiparams{'KEY'}};
1203 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1204 &writeipsecfiles();
1205 } else {
1206 $errormessage = $Lang::tr{'invalid key'};
1207 }
c6df357f 1208 &General::firewall_reload();
ac1cfefa
MT
1209###
1210### Choose between adding a host-net or net-net connection
1211###
1212} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
ac1cfefa 1213 &Header::showhttpheaders();
7d44bfee 1214 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
1215 &Header::openbigbox('100%', 'left', '', '');
1216 &Header::openbox('100%', 'left', $Lang::tr{'connection type'});
ac1cfefa 1217 print <<END
ed84e8b8 1218 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 1219 <b>$Lang::tr{'connection type'}:</b><br />
ed84e8b8
MT
1220 <table>
1221 <tr><td><input type='radio' name='TYPE' value='host' checked='checked' /></td>
1222 <td class='base'>$Lang::tr{'host to net vpn'}</td>
1223 </tr><tr>
1224 <td><input type='radio' name='TYPE' value='net' /></td>
1225 <td class='base'>$Lang::tr{'net to net vpn'}</td>
1226 </tr><tr>
1227 <td align='center' colspan='2'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
1228 </tr>
1229 </table></form>
ac1cfefa
MT
1230END
1231 ;
1232 &Header::closebox();
1233 &Header::closebigbox();
1234 &Header::closepage();
1235 exit (0);
1236###
ed84e8b8 1237### Adding/Editing/Saving a connection
ac1cfefa
MT
1238###
1239} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
1240 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
1241 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
1242
1243 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1244 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
1245 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1246
1247 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
1248 if (! $confighash{$cgiparams{'KEY'}}[0]) {
1249 $errormessage = $Lang::tr{'invalid key'};
1250 goto VPNCONF_END;
1251 }
ed84e8b8
MT
1252 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
1253 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
1254 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
1255 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
1256 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
5fd30232 1257 #$cgiparams{'free'} = $confighash{$cgiparams{'KEY'}}[6];
ed84e8b8
MT
1258 $cgiparams{'LOCAL_ID'} = $confighash{$cgiparams{'KEY'}}[7];
1259 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
1260 $cgiparams{'REMOTE_ID'} = $confighash{$cgiparams{'KEY'}}[9];
1261 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
1262 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
1263 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
ed84e8b8 1264 $cgiparams{'DPD_ACTION'} = $confighash{$cgiparams{'KEY'}}[27];
e2e4ed01 1265 $cgiparams{'IKE_VERSION'} = $confighash{$cgiparams{'KEY'}}[29];
ed84e8b8
MT
1266 $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
1267 $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
1268 $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
1269 $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16];
1270 $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
1271 $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
1272 $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
1273 $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
ed84e8b8
MT
1274 $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
1275 $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
1276 $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
1277 $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
4e156911
AM
1278 $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30];
1279 $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31];
ac1cfefa 1280
cbb3a8f9
MT
1281 if (!$cgiparams{'DPD_DELAY'}) {
1282 $cgiparams{'DPD_DELAY'} = 30;
1283 }
1284
1285 if (!$cgiparams{'DPD_TIMEOUT'}) {
1286 $cgiparams{'DPD_TIMEOUT'} = 120;
1287 }
1288
ac1cfefa
MT
1289 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
1290 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
1291 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
1292 $errormessage = $Lang::tr{'connection type is invalid'};
1293 goto VPNCONF_ERROR;
1294 }
1295
1296 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
1297 $errormessage = $Lang::tr{'name must only contain characters'};
1298 goto VPNCONF_ERROR;
1299 }
1300
1301 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
1302 $errormessage = $Lang::tr{'name is invalid'};
1303 goto VPNCONF_ERROR;
1304 }
1305
1306 if (length($cgiparams{'NAME'}) >60) {
1307 $errormessage = $Lang::tr{'name too long'};
1308 goto VPNCONF_ERROR;
1309 }
1310
ac1cfefa 1311 # Check if there is no other entry with this name
ed84e8b8 1312 if (! $cgiparams{'KEY'}) { #only for add
ac1cfefa
MT
1313 foreach my $key (keys %confighash) {
1314 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
1315 $errormessage = $Lang::tr{'a connection with this name already exists'};
1316 goto VPNCONF_ERROR;
1317 }
1318 }
1319 }
1320
1321 if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
1322 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
1323 goto VPNCONF_ERROR;
1324 }
1325
1326 if ($cgiparams{'REMOTE'}) {
528cb9a7 1327 if (($cgiparams{'REMOTE'} ne '%any') && (! &General::validip($cgiparams{'REMOTE'}))) {
ac1cfefa
MT
1328 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
1329 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
1330 goto VPNCONF_ERROR;
1331 } else {
1332 if (&valid_dns_host($cgiparams{'REMOTE'})) {
1333 $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
1334 }
1335 }
1336 }
1337 }
1338
1339 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
1340 $errormessage = $Lang::tr{'local subnet is invalid'};
1341 goto VPNCONF_ERROR;
1342 }
1343
ed84e8b8
MT
1344 # Allow only one roadwarrior/psk without remote IP-address
1345 if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') {
ac1cfefa 1346 foreach my $key (keys %confighash) {
ed84e8b8
MT
1347 if ( ($cgiparams{'KEY'} ne $key) &&
1348 ($confighash{$key}[4] eq 'psk') &&
1349 ($confighash{$key}[10] eq '') ) {
ac1cfefa
MT
1350 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
1351 goto VPNCONF_ERROR;
1352 }
1353 }
1354 }
1355 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
1356 $errormessage = $Lang::tr{'remote subnet is invalid'};
1357 goto VPNCONF_ERROR;
1358 }
1359
1360 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1361 $errormessage = $Lang::tr{'invalid input'};
1362 goto VPNCONF_ERROR;
1363 }
1364 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
1365 $errormessage = $Lang::tr{'invalid input'};
1366 goto VPNCONF_ERROR;
1367 }
1368
ed84e8b8
MT
1369 # Allow nothing or a string (DN,FDQN,) beginning with @
1370 # with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
83371d5f
MT
1371 if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
1372 ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
ac1cfefa
MT
1373 (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
1374 ) {
ed84e8b8
MT
1375 $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
1376 'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
5fd30232
MT
1377 'FQDN: @ipfire.org<br />' .
1378 'USER_FQDN: info@ipfire.org<br />' .
83371d5f 1379 'IPV4_ADDR: 123.123.123.123';
ac1cfefa
MT
1380 goto VPNCONF_ERROR;
1381 }
ed84e8b8
MT
1382 # If Auth is DN, verify existance of Remote ID.
1383 if ( $cgiparams{'REMOTE_ID'} eq '' && (
1384 $cgiparams{'AUTH'} eq 'auth-dn'|| # while creation
1385 $confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing
1386 $errormessage = $Lang::tr{'vpn missing remote id'};
1387 goto VPNCONF_ERROR;
1388 }
1389
4d81e0f3
AM
1390 if ($cgiparams{'TYPE'} eq 'net'){
1391 $warnmessage=&General::checksubnets('',$cgiparams{'REMOTE_SUBNET'},'ipsec');
1392 if ($warnmessage ne ''){
03b08c08 1393 $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
4d81e0f3
AM
1394 }
1395 }
1396
ed84e8b8 1397 if ($cgiparams{'AUTH'} eq 'psk') {
ac1cfefa
MT
1398 if (! length($cgiparams{'PSK'}) ) {
1399 $errormessage = $Lang::tr{'pre-shared key is too short'};
1400 goto VPNCONF_ERROR;
1401 }
ed84e8b8
MT
1402 if ($cgiparams{'PSK'} =~ /'/) {
1403 $cgiparams{'PSK'} =~ tr/'/ /;
ac1cfefa
MT
1404 $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
1405 goto VPNCONF_ERROR;
1406 }
1407 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
1408 if ($cgiparams{'KEY'}) {
1409 $errormessage = $Lang::tr{'cant change certificates'};
1410 goto VPNCONF_ERROR;
1411 }
1412 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1413 $errormessage = $Lang::tr{'there was no file upload'};
1414 goto VPNCONF_ERROR;
1415 }
1416
1417 # Move uploaded certificate request to a temporary file
1418 (my $fh, my $filename) = tempfile( );
1419 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1420 $errormessage = $!;
1421 goto VPNCONF_ERROR;
1422 }
1423
ed84e8b8
MT
1424 # Sign the certificate request
1425 &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
3847730c 1426 my $opt = " ca -md sha256 -days 999999";
ed84e8b8
MT
1427 $opt .= " -batch -notext";
1428 $opt .= " -in $filename";
1429 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1430
1431 if ( $errormessage = &callssl ($opt) ) {
ac1cfefa
MT
1432 unlink ($filename);
1433 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1434 &cleanssldatabase();
1435 goto VPNCONF_ERROR;
1436 } else {
ed84e8b8
MT
1437 unlink ($filename);
1438 &cleanssldatabase();
ac1cfefa
MT
1439 }
1440
ed84e8b8 1441 $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
ac1cfefa
MT
1442 if ($cgiparams{'CERT_NAME'} eq '') {
1443 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
1444 goto VPNCONF_ERROR;
1445 }
ed84e8b8
MT
1446 } elsif ($cgiparams{'AUTH'} eq 'pkcs12') {
1447 &General::log("ipsec", "Importing from p12...");
1448
1449 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1450 $errormessage = $Lang::tr{'there was no file upload'};
1451 goto ROOTCERT_ERROR;
1452 }
1453
1454 # Move uploaded certificate request to a temporary file
1455 (my $fh, my $filename) = tempfile( );
1456 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1457 $errormessage = $!;
1458 goto ROOTCERT_ERROR;
1459 }
1460
1461 # Extract the CA certificate from the file
1462 &General::log("ipsec", "Extracting caroot from p12...");
1463 if (open(STDIN, "-|")) {
1464 my $opt = " pkcs12 -cacerts -nokeys";
1465 $opt .= " -in $filename";
1466 $opt .= " -out /tmp/newcacert";
1467 $errormessage = &callssl ($opt);
1468 } else { #child
1469 print "$cgiparams{'P12_PASS'}\n";
1470 exit (0);
1471 }
1472
1473 # Extract the Host certificate from the file
1474 if (!$errormessage) {
1475 &General::log("ipsec", "Extracting host cert from p12...");
1476 if (open(STDIN, "-|")) {
1477 my $opt = " pkcs12 -clcerts -nokeys";
1478 $opt .= " -in $filename";
1479 $opt .= " -out /tmp/newhostcert";
1480 $errormessage = &callssl ($opt);
1481 } else { #child
1482 print "$cgiparams{'P12_PASS'}\n";
1483 exit (0);
1484 }
1485 }
1486
1487 if (!$errormessage) {
1488 &General::log("ipsec", "Moving cacert...");
1489 #If CA have new subject, add it to our list of CA
1490 my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert'));
1491 my @names;
1492 foreach my $x (keys %cahash) {
1493 $casubject='' if ($cahash{$x}[1] eq $casubject);
1494 unshift (@names,$cahash{$x}[0]);
1495 }
1496 if ($casubject) { # a new one!
1497 my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
1498 if ($temp !~ /CA:TRUE/i) {
1499 $errormessage = $Lang::tr{'not a valid ca certificate'};
1500 } else {
1501 #compute a name for it
1502 my $idx=0;
1503 while (grep(/Imported-$idx/, @names) ) {$idx++};
1504 $cgiparams{'CA_NAME'}="Imported-$idx";
1505 $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert'));
1506 move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
1507 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
1508 if (!$errormessage) {
1509 my $key = &General::findhasharraykey (\%cahash);
1510 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1511 $cahash{$key}[1] = $casubject;
1512 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
1513 system('/usr/local/bin/ipsecctrl', 'R');
1514 }
1515 }
1516 }
1517 }
1518 if (!$errormessage) {
1519 &General::log("ipsec", "Moving host cert...");
1520 move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1521 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
1522 }
1523
1524 #cleanup temp files
1525 unlink ($filename);
1526 unlink ('/tmp/newcacert');
1527 unlink ('/tmp/newhostcert');
1528 if ($errormessage) {
1529 unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
1530 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1531 goto VPNCONF_ERROR;
1532 }
1533 &General::log("ipsec", "p12 import completed!");
ac1cfefa
MT
1534 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
1535 if ($cgiparams{'KEY'}) {
1536 $errormessage = $Lang::tr{'cant change certificates'};
1537 goto VPNCONF_ERROR;
1538 }
1539 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1540 $errormessage = $Lang::tr{'there was no file upload'};
1541 goto VPNCONF_ERROR;
1542 }
1543 # Move uploaded certificate to a temporary file
1544 (my $fh, my $filename) = tempfile( );
1545 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1546 $errormessage = $!;
1547 goto VPNCONF_ERROR;
1548 }
1549
1550 # Verify the certificate has a valid CA and move it
ed84e8b8
MT
1551 &General::log("ipsec", "Validating imported cert against our known CA...");
1552 my $validca = 1; #assume ok
ac1cfefa 1553 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
ed84e8b8
MT
1554 if ($test !~ /: OK/) {
1555 my $validca = 0;
ac1cfefa
MT
1556 foreach my $key (keys %cahash) {
1557 $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
1558 if ($test =~ /: OK/) {
1559 $validca = 1;
ed84e8b8 1560 last;
ac1cfefa
MT
1561 }
1562 }
1563 }
1564 if (! $validca) {
1565 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
1566 unlink ($filename);
1567 goto VPNCONF_ERROR;
1568 } else {
1569 move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1570 if ($? ne 0) {
1571 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1572 unlink ($filename);
1573 goto VPNCONF_ERROR;
1574 }
1575 }
1576
ed84e8b8 1577 $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
ac1cfefa
MT
1578 if ($cgiparams{'CERT_NAME'} eq '') {
1579 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1580 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
1581 goto VPNCONF_ERROR;
1582 }
1583 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
1584 if ($cgiparams{'KEY'}) {
1585 $errormessage = $Lang::tr{'cant change certificates'};
1586 goto VPNCONF_ERROR;
1587 }
1588 # Validate input since the form was submitted
1589 if (length($cgiparams{'CERT_NAME'}) >60) {
1590 $errormessage = $Lang::tr{'name too long'};
1591 goto VPNCONF_ERROR;
1592 }
1593 if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
1594 $errormessage = $Lang::tr{'invalid input for name'};
1595 goto VPNCONF_ERROR;
1596 }
1597 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
1598 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1599 goto VPNCONF_ERROR;
1600 }
1601 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
1602 $errormessage = $Lang::tr{'e-mail address too long'};
1603 goto VPNCONF_ERROR;
1604 }
1605 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1606 $errormessage = $Lang::tr{'invalid input for department'};
1607 goto VPNCONF_ERROR;
1608 }
1609 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
1610 $errormessage = $Lang::tr{'organization too long'};
1611 goto VPNCONF_ERROR;
1612 }
1613 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
1614 $errormessage = $Lang::tr{'invalid input for organization'};
1615 goto VPNCONF_ERROR;
1616 }
1617 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1618 $errormessage = $Lang::tr{'invalid input for city'};
1619 goto VPNCONF_ERROR;
1620 }
1621 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1622 $errormessage = $Lang::tr{'invalid input for state or province'};
1623 goto VPNCONF_ERROR;
1624 }
1625 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
1626 $errormessage = $Lang::tr{'invalid input for country'};
1627 goto VPNCONF_ERROR;
1628 }
ed84e8b8
MT
1629 #the exact syntax is a list comma separated of
1630 # email:any-validemail
1631 # URI: a uniform resource indicator
1632 # DNS: a DNS domain name
1633 # RID: a registered OBJECT IDENTIFIER
1634 # IP: an IP address
1635 # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
1636
1637 if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
1638 $errormessage = $Lang::tr{'vpn altname syntax'};
1639 goto VPNCONF_ERROR;
1640 }
1641
ac1cfefa
MT
1642 if (length($cgiparams{'CERT_PASS1'}) < 5) {
1643 $errormessage = $Lang::tr{'password too short'};
1644 goto VPNCONF_ERROR;
1645 }
1646 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
1647 $errormessage = $Lang::tr{'passwords do not match'};
1648 goto VPNCONF_ERROR;
1649 }
1650
1651 # Replace empty strings with a .
1652 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
1653 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
1654 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
1655
ab2d1548 1656 # Create the Client certificate request
ed84e8b8
MT
1657 &General::log("ipsec", "Creating a cert...");
1658
1659 if (open(STDIN, "-|")) {
1660 my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
3847730c 1661 $opt .= " -newkey rsa:2048";
ed84e8b8
MT
1662 $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
1663 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
1664
1665 if ( $errormessage = &callssl ($opt) ) {
ac1cfefa
MT
1666 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1667 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1668 goto VPNCONF_ERROR;
ed84e8b8
MT
1669 }
1670 } else { #child
1671 print "$cgiparams{'CERT_COUNTRY'}\n";
1672 print "$state\n";
1673 print "$city\n";
1674 print "$cgiparams{'CERT_ORGANIZATION'}\n";
1675 print "$ou\n";
1676 print "$cgiparams{'CERT_NAME'}\n";
1677 print "$cgiparams{'CERT_EMAIL'}\n";
1678 print ".\n";
1679 print ".\n";
1680 exit (0);
ac1cfefa 1681 }
ed84e8b8 1682
ab2d1548 1683 # Sign the client certificate request
ed84e8b8
MT
1684 &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
1685
1686 #No easy way for specifying the contain of subjectAltName without writing a config file...
1687 my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
1688 print $fh <<END
1689 basicConstraints=CA:FALSE
1690 nsComment="OpenSSL Generated Certificate"
1691 subjectKeyIdentifier=hash
ab2d1548 1692 extendedKeyUsage=clientAuth
ed84e8b8
MT
1693 authorityKeyIdentifier=keyid,issuer:always
1694END
1695;
1696 print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
1697 close ($fh);
1698
3847730c 1699 my $opt = " ca -md sha256 -days 999999 -batch -notext";
ed84e8b8
MT
1700 $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
1701 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1702 $opt .= " -extfile $v3extname";
1703
1704 if ( $errormessage = &callssl ($opt) ) {
1705 unlink ($v3extname);
ac1cfefa
MT
1706 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1707 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1708 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1709 &cleanssldatabase();
1710 goto VPNCONF_ERROR;
1711 } else {
ed84e8b8 1712 unlink ($v3extname);
ac1cfefa
MT
1713 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1714 &cleanssldatabase();
1715 }
1716
1717 # Create the pkcs12 file
ed84e8b8
MT
1718 &General::log("ipsec", "Packing a pkcs12 file...");
1719 $opt = " pkcs12 -export";
1720 $opt .= " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
1721 $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1722 $opt .= " -name \"$cgiparams{'NAME'}\"";
1723 $opt .= " -passout pass:$cgiparams{'CERT_PASS1'}";
1724 $opt .= " -certfile ${General::swroot}/ca/cacert.pem";
1725 $opt .= " -caname \"$vpnsettings{'ROOTCERT_ORGANIZATION'} CA\"";
1726 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}.p12";
1727
1728 if ( $errormessage = &callssl ($opt) ) {
ac1cfefa
MT
1729 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1730 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1731 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}.p12");
1732 goto VPNCONF_ERROR;
1733 } else {
1734 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1735 }
1736 } elsif ($cgiparams{'AUTH'} eq 'cert') {
1737 ;# Nothing, just editing
ed84e8b8
MT
1738 } elsif ($cgiparams{'AUTH'} eq 'auth-dn') {
1739 $cgiparams{'CERT_NAME'} = '%auth-dn'; # a special value saying 'no cert file'
ac1cfefa
MT
1740 } else {
1741 $errormessage = $Lang::tr{'invalid input for authentication method'};
1742 goto VPNCONF_ERROR;
1743 }
1744
ed84e8b8
MT
1745 # 1)Error message here is not accurate.
1746 # 2)Test is superfluous, openswan can reference same cert multiple times
1747 # 3)Present since initial version (1.3.2.11), it isn't a bug correction
1748 # Check if there is no other entry with this certificate name
1749 #if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk') && ($cgiparams{'AUTH'} ne 'auth-dn')) {
1750 # foreach my $key (keys %confighash) {
1751 # if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
1752 # $errormessage = $Lang::tr{'a connection with this common name already exists'};
1753 # goto VPNCONF_ERROR;
1754 # }
1755 # }
1756 #}
ac1cfefa 1757 # Save the config
ed84e8b8 1758
ac1cfefa
MT
1759 my $key = $cgiparams{'KEY'};
1760 if (! $key) {
1761 $key = &General::findhasharraykey (\%confighash);
4e156911 1762 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
ac1cfefa
MT
1763 }
1764 $confighash{$key}[0] = $cgiparams{'ENABLED'};
1765 $confighash{$key}[1] = $cgiparams{'NAME'};
1766 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
1767 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
1768 }
1769 $confighash{$key}[3] = $cgiparams{'TYPE'};
1770 if ($cgiparams{'AUTH'} eq 'psk') {
1771 $confighash{$key}[4] = 'psk';
1772 $confighash{$key}[5] = $cgiparams{'PSK'};
1773 } else {
1774 $confighash{$key}[4] = 'cert';
1775 }
1776 if ($cgiparams{'TYPE'} eq 'net') {
ac1cfefa
MT
1777 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
1778 }
1779 $confighash{$key}[7] = $cgiparams{'LOCAL_ID'};
1780 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
1781 $confighash{$key}[9] = $cgiparams{'REMOTE_ID'};
1782 $confighash{$key}[10] = $cgiparams{'REMOTE'};
1783 $confighash{$key}[25] = $cgiparams{'REMARK'};
ae2782ba 1784 $confighash{$key}[26] = ""; # Formerly INTERFACE
ac1cfefa 1785 $confighash{$key}[27] = $cgiparams{'DPD_ACTION'};
e2e4ed01 1786 $confighash{$key}[29] = $cgiparams{'IKE_VERSION'};
ac1cfefa 1787
ed84e8b8
MT
1788 #dont forget advanced value
1789 $confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'};
1790 $confighash{$key}[19] = $cgiparams{'IKE_INTEGRITY'};
1791 $confighash{$key}[20] = $cgiparams{'IKE_GROUPTYPE'};
1792 $confighash{$key}[16] = $cgiparams{'IKE_LIFETIME'};
1793 $confighash{$key}[21] = $cgiparams{'ESP_ENCRYPTION'};
1794 $confighash{$key}[22] = $cgiparams{'ESP_INTEGRITY'};
1795 $confighash{$key}[23] = $cgiparams{'ESP_GROUPTYPE'};
1796 $confighash{$key}[17] = $cgiparams{'ESP_KEYLIFE'};
451a2f68 1797 $confighash{$key}[12] = 'off'; # $cgiparams{'AGGRMODE'};
ed84e8b8
MT
1798 $confighash{$key}[13] = $cgiparams{'COMPRESSION'};
1799 $confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'};
1800 $confighash{$key}[28] = $cgiparams{'PFS'};
1801 $confighash{$key}[14] = $cgiparams{'VHOST'};
4e156911
AM
1802 $confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'};
1803 $confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
ac1cfefa
MT
1804
1805 #free unused fields!
5fd30232 1806 $confighash{$key}[6] = 'off';
ed84e8b8 1807 $confighash{$key}[15] = 'off';
ac1cfefa
MT
1808
1809 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1810 &writeipsecfiles();
ed84e8b8 1811 if (&vpnenabled) {
ac1cfefa
MT
1812 system('/usr/local/bin/ipsecctrl', 'S', $key);
1813 sleep $sleepDelay;
1814 }
1815 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
1816 $cgiparams{'KEY'} = $key;
1817 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
1818 }
1819 goto VPNCONF_END;
1820 } else { # add new connection
1821 $cgiparams{'ENABLED'} = 'on';
ac1cfefa
MT
1822 if ( ! -f "${General::swroot}/private/cakey.pem" ) {
1823 $cgiparams{'AUTH'} = 'psk';
1824 } elsif ( ! -f "${General::swroot}/ca/cacert.pem") {
1825 $cgiparams{'AUTH'} = 'certfile';
1826 } else {
1827 $cgiparams{'AUTH'} = 'certgen';
1828 }
1829 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
ed84e8b8
MT
1830 $cgiparams{'CERT_EMAIL'} = $vpnsettings{'ROOTCERT_EMAIL'};
1831 $cgiparams{'CERT_OU'} = $vpnsettings{'ROOTCERT_OU'};
ac1cfefa
MT
1832 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
1833 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
1834 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
1835 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
1836
1837 # choose appropriate dpd action
1838 if ($cgiparams{'TYPE'} eq 'host') {
afd5d8f7 1839 $cgiparams{'DPD_ACTION'} = 'clear';
ac1cfefa 1840 } else {
afd5d8f7 1841 $cgiparams{'DPD_ACTION'} = 'restart';
ac1cfefa
MT
1842 }
1843
cbb3a8f9
MT
1844 if (!$cgiparams{'DPD_DELAY'}) {
1845 $cgiparams{'DPD_DELAY'} = 30;
1846 }
1847
1848 if (!$cgiparams{'DPD_TIMEOUT'}) {
1849 $cgiparams{'DPD_TIMEOUT'} = 120;
1850 }
1851
ae2782ba
MT
1852 # Default IKE Version to v2
1853 if (!$cgiparams{'IKE_VERSION'}) {
1854 $cgiparams{'IKE_VERSION'} = 'ikev2';
e2e4ed01
AF
1855 }
1856
ac1cfefa
MT
1857 # ID are empty
1858 $cgiparams{'LOCAL_ID'} = '';
1859 $cgiparams{'REMOTE_ID'} = '';
ed84e8b8
MT
1860
1861 #use default advanced value
a4d24f90 1862 $cgiparams{'IKE_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18];
dfea4f86 1863 $cgiparams{'IKE_INTEGRITY'} = 'sha2_512|sha2_256|sha'; #[19];
aea35c5a 1864 $cgiparams{'IKE_GROUPTYPE'} = '4096|3072|2048|1536|1024'; #[20];
0cf124ab 1865 $cgiparams{'IKE_LIFETIME'} = '3'; #[16];
a4d24f90 1866 $cgiparams{'ESP_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21];
dfea4f86 1867 $cgiparams{'ESP_INTEGRITY'} = 'sha2_512|sha2_256|sha1'; #[22];
ed84e8b8 1868 $cgiparams{'ESP_GROUPTYPE'} = ''; #[23];
0cf124ab 1869 $cgiparams{'ESP_KEYLIFE'} = '1'; #[17];
ae2782ba 1870 $cgiparams{'COMPRESSION'} = 'on'; #[13];
ed84e8b8
MT
1871 $cgiparams{'ONLY_PROPOSED'} = 'off'; #[24];
1872 $cgiparams{'PFS'} = 'on'; #[28];
1873 $cgiparams{'VHOST'} = 'on'; #[14];
ac1cfefa
MT
1874 }
1875
1876 VPNCONF_ERROR:
1877 $checked{'ENABLED'}{'off'} = '';
1878 $checked{'ENABLED'}{'on'} = '';
1879 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
ac1cfefa
MT
1880
1881 $checked{'EDIT_ADVANCED'}{'off'} = '';
1882 $checked{'EDIT_ADVANCED'}{'on'} = '';
1883 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = "checked='checked'";
1884
ac1cfefa
MT
1885 $checked{'AUTH'}{'psk'} = '';
1886 $checked{'AUTH'}{'certreq'} = '';
1887 $checked{'AUTH'}{'certgen'} = '';
1888 $checked{'AUTH'}{'certfile'} = '';
ed84e8b8
MT
1889 $checked{'AUTH'}{'pkcs12'} = '';
1890 $checked{'AUTH'}{'auth-dn'} = '';
ac1cfefa
MT
1891 $checked{'AUTH'}{$cgiparams{'AUTH'}} = "checked='checked'";
1892
ed84e8b8 1893 &Header::showhttpheaders();
7d44bfee 1894 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8
MT
1895 &Header::openbigbox('100%', 'left', '', $errormessage);
1896 if ($errormessage) {
1897 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
1898 print "<class name='base'>$errormessage";
1899 print "&nbsp;</class>";
1900 &Header::closebox();
1901 }
ac1cfefa 1902
ed84e8b8
MT
1903 if ($warnmessage) {
1904 &Header::openbox('100%', 'left', "$Lang::tr{'warning messages'}:");
1905 print "<class name='base'>$warnmessage";
1906 print "&nbsp;</class>";
1907 &Header::closebox();
1908 }
ac1cfefa 1909
ed84e8b8
MT
1910 print "<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>";
1911 print<<END
1912 <input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />
4ad0b5b6 1913 <input type='hidden' name='IKE_VERSION' value='$cgiparams{'IKE_VERSION'}' />
ed84e8b8
MT
1914 <input type='hidden' name='IKE_ENCRYPTION' value='$cgiparams{'IKE_ENCRYPTION'}' />
1915 <input type='hidden' name='IKE_INTEGRITY' value='$cgiparams{'IKE_INTEGRITY'}' />
1916 <input type='hidden' name='IKE_GROUPTYPE' value='$cgiparams{'IKE_GROUPTYPE'}' />
1917 <input type='hidden' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' />
1918 <input type='hidden' name='ESP_ENCRYPTION' value='$cgiparams{'ESP_ENCRYPTION'}' />
1919 <input type='hidden' name='ESP_INTEGRITY' value='$cgiparams{'ESP_INTEGRITY'}' />
1920 <input type='hidden' name='ESP_GROUPTYPE' value='$cgiparams{'ESP_GROUPTYPE'}' />
1921 <input type='hidden' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' />
ed84e8b8
MT
1922 <input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' />
1923 <input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' />
1924 <input type='hidden' name='PFS' value='$cgiparams{'PFS'}' />
1925 <input type='hidden' name='VHOST' value='$cgiparams{'VHOST'}' />
cbb3a8f9
MT
1926 <input type='hidden' name='DPD_ACTION' value='$cgiparams{'DPD_ACTION'}' />
1927 <input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' />
1928 <input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' />
ed84e8b8
MT
1929END
1930 ;
1931 if ($cgiparams{'KEY'}) {
1932 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
d2d87f2c 1933 print "<input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />";
ed84e8b8
MT
1934 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
1935 }
ac1cfefa 1936
d2d87f2c 1937 &Header::openbox('100%', 'left', "$Lang::tr{'connection'}: $cgiparams{'NAME'}");
ed84e8b8 1938 print "<table width='100%'>";
d2d87f2c
MT
1939 if (!$cgiparams{'KEY'}) {
1940 print <<EOF;
1941 <tr>
1942 <td width='20%'>$Lang::tr{'name'}:</td>
1943 <td width='30%'>
1944 <input type='text' name='NAME' value='$cgiparams{'NAME'}' size='25' />
1945 </td>
1946 <td colspan="2"></td>
1947 </tr>
1948EOF
ed84e8b8 1949 }
ac1cfefa 1950
5fd30232
MT
1951 my $disabled;
1952 my $blob;
ed84e8b8 1953 if ($cgiparams{'TYPE'} eq 'host') {
5fd30232
MT
1954 $disabled = "disabled='disabled'";
1955 $blob = "<img src='/blob.gif' alt='*' />";
1956 };
1957
5fd30232 1958 print <<END
ae2782ba 1959 <tr>
d2d87f2c
MT
1960 <td width='20%'>$Lang::tr{'enabled'}</td>
1961 <td width='30%'>
1962 <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} />
1963 </td>
1964 <td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'local subnet'}</td>
1965 <td width='30%'>
1966 <input type='text' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' size="25" />
1967 </td>
1968 </tr>
1969 <tr>
1970 <td class='boldbase' width='20%'>$Lang::tr{'remote host/ip'}:&nbsp;$blob</td>
1971 <td width='30%'>
1972 <input type='text' name='REMOTE' value='$cgiparams{'REMOTE'}' size="25" />
ae2782ba 1973 </td>
d2d87f2c
MT
1974 <td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'remote subnet'}</td>
1975 <td width='30%'>
1976 <input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size="25" />
ae2782ba
MT
1977 </td>
1978 </tr>
1979 <tr>
d2d87f2c
MT
1980 <td class='boldbase' width='20%'>$Lang::tr{'vpn local id'}:</td>
1981 <td width='30%'>
1982 <input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' size="25" />
1983 </td>
1984 <td class='boldbase' width='20%'>$Lang::tr{'vpn remote id'}:</td>
1985 <td width='30%'>
1986 <input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' size="25" />
ae2782ba
MT
1987 </td>
1988 </tr>
d2d87f2c 1989 <tr><td colspan="4"><br /></td></tr>
ae2782ba 1990 <tr>
d2d87f2c
MT
1991 <td class='boldbase' width='20%'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' alt='*' /></td>
1992 <td colspan='3'>
1993 <input type='text' name='REMARK' value='$cgiparams{'REMARK'}' maxlength='50' size="73" />
1994 </td>
5fd30232 1995 </tr>
ac1cfefa 1996END
ed84e8b8
MT
1997 ;
1998 if (!$cgiparams{'KEY'}) {
1999 print "<tr><td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</td></tr>";
2000 }
2001 print "</table>";
2002 &Header::closebox();
ac1cfefa 2003
ed84e8b8
MT
2004 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
2005 &Header::openbox('100%', 'left', $Lang::tr{'authentication'});
2006 print <<END
2007 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
2008 <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
a2ee8140 2009 <td class='base' width='50%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td>
ed84e8b8
MT
2010 </tr>
2011 </table>
ac1cfefa 2012END
ed84e8b8
MT
2013 ;
2014 &Header::closebox();
2015 } elsif (! $cgiparams{'KEY'}) {
ed84e8b8
MT
2016 my $cakeydisabled = ( ! -f "${General::swroot}/private/cakey.pem" ) ? "disabled='disabled'" : '';
2017 $cgiparams{'CERT_NAME'} = $Lang::tr{'vpn no full pki'} if ($cakeydisabled);
2018 my $cacrtdisabled = ( ! -f "${General::swroot}/ca/cacert.pem" ) ? "disabled='disabled'" : '';
2019
2020 &Header::openbox('100%', 'left', $Lang::tr{'authentication'});
2021 print <<END
2022 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
b2531cb0 2023 <tr><td width='5%'><input type='radio' name='AUTH' value='psk' $checked{'AUTH'}{'psk'} /></td>
ed84e8b8 2024 <td class='base' width='55%'>$Lang::tr{'use a pre-shared key'}</td>
b2531cb0 2025 <td class='base' width='40%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
ed84e8b8
MT
2026 <tr><td colspan='3' bgcolor='#000000'></td></tr>
2027 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td>
2028 <td class='base'><hr />$Lang::tr{'upload a certificate request'}</td>
2029 <td class='base' rowspan='3' valign='middle'><input type='file' name='FH' size='30' $cacrtdisabled /></td></tr>
2030 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td>
2031 <td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
2032 <tr><td><input type='radio' name='AUTH' value='pkcs12' $cacrtdisabled /></td>
2033 <td class='base'>$Lang::tr{'upload p12 file'} $Lang::tr{'pkcs12 file password'}:<input type='password' name='P12_PASS'/></td></tr>
2034 <tr><td><input type='radio' name='AUTH' value='auth-dn' $checked{'AUTH'}{'auth-dn'} $cacrtdisabled /></td>
2035 <td class='base'><hr />$Lang::tr{'vpn auth-dn'}</td></tr>
2036 <tr><td colspan='3' bgcolor='#000000'></td></tr>
2037 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td>
2038 <td class='base'><hr />$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
2039 <tr><td>&nbsp;</td>
2040 <td class='base'>$Lang::tr{'users fullname or system hostname'}:</td>
2041 <td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' size='32' $cakeydisabled /></td></tr>
2042 <tr><td>&nbsp;</td>
2043 <td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2044 <td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' size='32' $cakeydisabled /></td></tr>
2045 <tr><td>&nbsp;</td>
2046 <td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2047 <td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr>
2048 <tr><td>&nbsp;</td>
2049 <td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2050 <td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr>
2051 <tr><td>&nbsp;</td>
2052 <td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2053 <td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' size='32' $cakeydisabled /></td></tr>
2054 <tr><td>&nbsp;</td>
2055 <td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2056 <td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' size='32' $cakeydisabled /></td></tr>
2057 <tr><td>&nbsp;</td>
2058 <td class='base'>$Lang::tr{'country'}:</td>
2059 <td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
ac1cfefa 2060END
ed84e8b8
MT
2061 ;
2062 foreach my $country (sort keys %{Countries::countries}) {
2063 print "\t\t\t<option value='$Countries::countries{$country}'";
2064 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
2065 print " selected='selected'";
ac1cfefa 2066 }
ed84e8b8 2067 print ">$country</option>\n";
ac1cfefa 2068 }
ed84e8b8
MT
2069 print <<END
2070 </select></td></tr>
ac1cfefa 2071
ed84e8b8
MT
2072 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)<img src='/blob.gif' alt='*' /></td>
2073 <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' $cakeydisabled /></td></tr>
2074 <tr><td>&nbsp;</td>
2075 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
2076 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
2077 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:($Lang::tr{'confirmation'})</td>
2078 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
2079 </table>
2080END
2081 ;
2082 &Header::closebox();
2083 }
2084
2085 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
2086 if ($cgiparams{'KEY'}) {
2087 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
ac1cfefa 2088 }
ed84e8b8
MT
2089 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2090 &Header::closebigbox();
2091 &Header::closepage();
2092 exit (0);
2093
ac1cfefa
MT
2094 VPNCONF_END:
2095}
2096
2097###
2098### Advanced settings
2099###
2100if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
2101 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq 'yes')) {
2102 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
2103 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
2104 if (! $confighash{$cgiparams{'KEY'}}) {
2105 $errormessage = $Lang::tr{'invalid key'};
2106 goto ADVANCED_END;
2107 }
2108
2109 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
ed84e8b8
MT
2110 # I didn't read any incompatibilities here....
2111 #if ($cgiparams{'VHOST'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
2112 # $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
2113 # goto ADVANCED_ERROR;
2114 #}
ac1cfefa
MT
2115 my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
2116 if ($#temp < 0) {
2117 $errormessage = $Lang::tr{'invalid input'};
2118 goto ADVANCED_ERROR;
2119 }
2120 foreach my $val (@temp) {
dfea4f86 2121 if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) {
ac1cfefa
MT
2122 $errormessage = $Lang::tr{'invalid input'};
2123 goto ADVANCED_ERROR;
2124 }
2125 }
2126 @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
2127 if ($#temp < 0) {
2128 $errormessage = $Lang::tr{'invalid input'};
2129 goto ADVANCED_ERROR;
2130 }
2131 foreach my $val (@temp) {
3847730c 2132 if ($val !~ /^(sha2_(512|384|256)|sha|md5|aesxcbc)$/) {
ac1cfefa
MT
2133 $errormessage = $Lang::tr{'invalid input'};
2134 goto ADVANCED_ERROR;
2135 }
2136 }
2137 @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
2138 if ($#temp < 0) {
2139 $errormessage = $Lang::tr{'invalid input'};
2140 goto ADVANCED_ERROR;
2141 }
2142 foreach my $val (@temp) {
22fc183e 2143 if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) {
ac1cfefa
MT
2144 $errormessage = $Lang::tr{'invalid input'};
2145 goto ADVANCED_ERROR;
2146 }
2147 }
2148 if ($cgiparams{'IKE_LIFETIME'} !~ /^\d+$/) {
2149 $errormessage = $Lang::tr{'invalid input for ike lifetime'};
2150 goto ADVANCED_ERROR;
2151 }
dfea4f86
MT
2152 if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
2153 $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
ac1cfefa
MT
2154 goto ADVANCED_ERROR;
2155 }
2156 @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
2157 if ($#temp < 0) {
2158 $errormessage = $Lang::tr{'invalid input'};
2159 goto ADVANCED_ERROR;
2160 }
2161 foreach my $val (@temp) {
dfea4f86 2162 if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) {
ac1cfefa
MT
2163 $errormessage = $Lang::tr{'invalid input'};
2164 goto ADVANCED_ERROR;
2165 }
2166 }
2167 @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
2168 if ($#temp < 0) {
2169 $errormessage = $Lang::tr{'invalid input'};
2170 goto ADVANCED_ERROR;
2171 }
2172 foreach my $val (@temp) {
3847730c 2173 if ($val !~ /^(sha2_(512|384|256)|sha1|md5|aesxcbc)$/) {
ac1cfefa
MT
2174 $errormessage = $Lang::tr{'invalid input'};
2175 goto ADVANCED_ERROR;
2176 }
2177 }
2178 if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
651d442e 2179 $cgiparams{'ESP_GROUPTYPE'} !~ /^ecp(192|224|256|384|512)(bp)?$/ &&
22fc183e 2180 $cgiparams{'ESP_GROUPTYPE'} !~ /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) {
ac1cfefa
MT
2181 $errormessage = $Lang::tr{'invalid input'};
2182 goto ADVANCED_ERROR;
2183 }
2184
2185 if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
2186 $errormessage = $Lang::tr{'invalid input for esp keylife'};
2187 goto ADVANCED_ERROR;
2188 }
2189 if ($cgiparams{'ESP_KEYLIFE'} < 1 || $cgiparams{'ESP_KEYLIFE'} > 24) {
2190 $errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'};
2191 goto ADVANCED_ERROR;
2192 }
ed84e8b8
MT
2193
2194 if (
ed84e8b8
MT
2195 ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
2196 ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
2197 ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
2198 ($cgiparams{'VHOST'} !~ /^(|on|off)$/)
2199 ){
ac1cfefa
MT
2200 $errormessage = $Lang::tr{'invalid input'};
2201 goto ADVANCED_ERROR;
2202 }
ed84e8b8 2203
cbb3a8f9
MT
2204 if ($cgiparams{'DPD_DELAY'} !~ /^\d+$/) {
2205 $errormessage = $Lang::tr{'invalid input for dpd delay'};
2206 goto ADVANCED_ERROR;
2207 }
2208
2209 if ($cgiparams{'DPD_TIMEOUT'} !~ /^\d+$/) {
2210 $errormessage = $Lang::tr{'invalid input for dpd timeout'};
2211 goto ADVANCED_ERROR;
2212 }
2213
4ad0b5b6 2214 $confighash{$cgiparams{'KEY'}}[29] = $cgiparams{'IKE_VERSION'};
ac1cfefa
MT
2215 $confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
2216 $confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
2217 $confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'};
2218 $confighash{$cgiparams{'KEY'}}[16] = $cgiparams{'IKE_LIFETIME'};
2219 $confighash{$cgiparams{'KEY'}}[21] = $cgiparams{'ESP_ENCRYPTION'};
2220 $confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
2221 $confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
2222 $confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
451a2f68 2223 $confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'};
ed84e8b8 2224 $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
ac1cfefa 2225 $confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
ed84e8b8
MT
2226 $confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
2227 $confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'VHOST'};
afd5d8f7 2228 $confighash{$cgiparams{'KEY'}}[27] = $cgiparams{'DPD_ACTION'};
4e156911
AM
2229 $confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
2230 $confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
ac1cfefa
MT
2231 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
2232 &writeipsecfiles();
ed84e8b8 2233 if (&vpnenabled) {
ac1cfefa
MT
2234 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2235 sleep $sleepDelay;
2236 }
2237 goto ADVANCED_END;
2238 } else {
4ad0b5b6 2239 $cgiparams{'IKE_VERSION'} = $confighash{$cgiparams{'KEY'}}[29];
ac1cfefa
MT
2240 $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
2241 $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
2242 $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
2243 $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16];
2244 $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
2245 $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
2246 $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
2247 $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
ed84e8b8 2248 $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
ac1cfefa 2249 $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
ed84e8b8
MT
2250 $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
2251 $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
afd5d8f7 2252 $cgiparams{'DPD_ACTION'} = $confighash{$cgiparams{'KEY'}}[27];
4e156911
AM
2253 $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30];
2254 $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31];
ed84e8b8 2255
cbb3a8f9
MT
2256 if (!$cgiparams{'DPD_DELAY'}) {
2257 $cgiparams{'DPD_DELAY'} = 30;
2258 }
2259
2260 if (!$cgiparams{'DPD_TIMEOUT'}) {
2261 $cgiparams{'DPD_TIMEOUT'} = 120;
2262 }
2263
ac1cfefa 2264 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net' || $confighash{$cgiparams{'KEY'}}[10]) {
ed84e8b8 2265 $cgiparams{'VHOST'} = 'off';
ac1cfefa
MT
2266 }
2267 }
2268
2269 ADVANCED_ERROR:
ac1cfefa 2270 $checked{'IKE_ENCRYPTION'}{'aes256'} = '';
01b5bc91 2271 $checked{'IKE_ENCRYPTION'}{'aes192'} = '';
ac1cfefa 2272 $checked{'IKE_ENCRYPTION'}{'aes128'} = '';
dfea4f86
MT
2273 $checked{'IKE_ENCRYPTION'}{'aes256gcm128'} = '';
2274 $checked{'IKE_ENCRYPTION'}{'aes192gcm128'} = '';
2275 $checked{'IKE_ENCRYPTION'}{'aes128gcm128'} = '';
2276 $checked{'IKE_ENCRYPTION'}{'aes256gcm96'} = '';
2277 $checked{'IKE_ENCRYPTION'}{'aes192gcm96'} = '';
2278 $checked{'IKE_ENCRYPTION'}{'aes128gcm96'} = '';
2279 $checked{'IKE_ENCRYPTION'}{'aes256gcm64'} = '';
2280 $checked{'IKE_ENCRYPTION'}{'aes192gcm64'} = '';
2281 $checked{'IKE_ENCRYPTION'}{'aes128gcm64'} = '';
ac1cfefa 2282 $checked{'IKE_ENCRYPTION'}{'3des'} = '';
d72a8204
MT
2283 $checked{'IKE_ENCRYPTION'}{'camellia256'} = '';
2284 $checked{'IKE_ENCRYPTION'}{'camellia192'} = '';
2285 $checked{'IKE_ENCRYPTION'}{'camellia128'} = '';
ac1cfefa
MT
2286 my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
2287 foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; }
2288 $checked{'IKE_INTEGRITY'}{'sha2_512'} = '';
01b5bc91 2289 $checked{'IKE_INTEGRITY'}{'sha2_384'} = '';
ac1cfefa
MT
2290 $checked{'IKE_INTEGRITY'}{'sha2_256'} = '';
2291 $checked{'IKE_INTEGRITY'}{'sha'} = '';
2292 $checked{'IKE_INTEGRITY'}{'md5'} = '';
01b5bc91 2293 $checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
ac1cfefa
MT
2294 @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
2295 foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
2296 $checked{'IKE_GROUPTYPE'}{'768'} = '';
2297 $checked{'IKE_GROUPTYPE'}{'1024'} = '';
2298 $checked{'IKE_GROUPTYPE'}{'1536'} = '';
2299 $checked{'IKE_GROUPTYPE'}{'2048'} = '';
2300 $checked{'IKE_GROUPTYPE'}{'3072'} = '';
2301 $checked{'IKE_GROUPTYPE'}{'4096'} = '';
2302 $checked{'IKE_GROUPTYPE'}{'6144'} = '';
2303 $checked{'IKE_GROUPTYPE'}{'8192'} = '';
2304 @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
2305 foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; }
63249c67
AF
2306
2307 # 768 is not supported by strongswan
2308 $checked{'IKE_GROUPTYPE'}{'768'} = '';
2309
ac1cfefa 2310 $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
01b5bc91 2311 $checked{'ESP_ENCRYPTION'}{'aes192'} = '';
ac1cfefa 2312 $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
dfea4f86
MT
2313 $checked{'ESP_ENCRYPTION'}{'aes256gcm128'} = '';
2314 $checked{'ESP_ENCRYPTION'}{'aes192gcm128'} = '';
2315 $checked{'ESP_ENCRYPTION'}{'aes128gcm128'} = '';
2316 $checked{'ESP_ENCRYPTION'}{'aes256gcm96'} = '';
2317 $checked{'ESP_ENCRYPTION'}{'aes192gcm96'} = '';
2318 $checked{'ESP_ENCRYPTION'}{'aes128gcm96'} = '';
2319 $checked{'ESP_ENCRYPTION'}{'aes256gcm64'} = '';
2320 $checked{'ESP_ENCRYPTION'}{'aes192gcm64'} = '';
2321 $checked{'ESP_ENCRYPTION'}{'aes128gcm64'} = '';
ac1cfefa 2322 $checked{'ESP_ENCRYPTION'}{'3des'} = '';
d72a8204
MT
2323 $checked{'ESP_ENCRYPTION'}{'camellia256'} = '';
2324 $checked{'ESP_ENCRYPTION'}{'camellia192'} = '';
2325 $checked{'ESP_ENCRYPTION'}{'camellia128'} = '';
ac1cfefa
MT
2326 @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
2327 foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; }
2328 $checked{'ESP_INTEGRITY'}{'sha2_512'} = '';
01b5bc91 2329 $checked{'ESP_INTEGRITY'}{'sha2_384'} = '';
ac1cfefa
MT
2330 $checked{'ESP_INTEGRITY'}{'sha2_256'} = '';
2331 $checked{'ESP_INTEGRITY'}{'sha1'} = '';
2332 $checked{'ESP_INTEGRITY'}{'md5'} = '';
01b5bc91 2333 $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
ac1cfefa
MT
2334 @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
2335 foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
ac1cfefa 2336 $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
ed84e8b8 2337
ed84e8b8
MT
2338 $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
2339 $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
2340 $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
2341 $checked{'VHOST'} = $cgiparams{'VHOST'} eq 'on' ? "checked='checked'" : '' ;
ac1cfefa 2342
4ad0b5b6
MT
2343 $selected{'IKE_VERSION'}{'ikev1'} = '';
2344 $selected{'IKE_VERSION'}{'ikev2'} = '';
2345 $selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'";
2346
cbb3a8f9
MT
2347 $selected{'DPD_ACTION'}{'clear'} = '';
2348 $selected{'DPD_ACTION'}{'hold'} = '';
2349 $selected{'DPD_ACTION'}{'restart'} = '';
afd5d8f7 2350 $selected{'DPD_ACTION'}{'none'} = '';
cbb3a8f9
MT
2351 $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
2352
ac1cfefa 2353 &Header::showhttpheaders();
7d44bfee 2354 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8 2355 &Header::openbigbox('100%', 'left', '', $errormessage);
ac1cfefa
MT
2356
2357 if ($errormessage) {
ed84e8b8 2358 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
ac1cfefa
MT
2359 print "<class name='base'>$errormessage";
2360 print "&nbsp;</class>";
2361 &Header::closebox();
2362 }
2363
2364 if ($warnmessage) {
ed84e8b8 2365 &Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
ac1cfefa
MT
2366 print "<class name='base'>$warnmessage";
2367 print "&nbsp;</class>";
2368 &Header::closebox();
2369 }
2370
ed84e8b8
MT
2371 &Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:");
2372 print <<EOF
2373 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
2374 <input type='hidden' name='ADVANCED' value='yes' />
2375 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
ac1cfefa 2376
ed84e8b8 2377 <table width='100%'>
63e3da59
MT
2378 <thead>
2379 <tr>
cbb3a8f9 2380 <th width="15%"></th>
63e3da59
MT
2381 <th>IKE</th>
2382 <th>ESP</th>
2383 </tr>
2384 </thead>
2385 <tbody>
4ad0b5b6
MT
2386 <tr>
2387 <td>$Lang::tr{'vpn keyexchange'}:</td>
2388 <td>
2389 <select name='IKE_VERSION'>
2390 <option value='ikev2' $selected{'IKE_VERSION'}{'ikev2'}>IKEv2</option>
2391 <option value='ikev1' $selected{'IKE_VERSION'}{'ikev1'}>IKEv1</option>
2392 </select>
2393 </td>
2394 <td></td>
2395 </tr>
63e3da59 2396 <tr>
cbb3a8f9 2397 <td class='boldbase' width="15%">$Lang::tr{'encryption'}</td>
63e3da59
MT
2398 <td class='boldbase'>
2399 <select name='IKE_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
dfea4f86 2400 <option value='aes256gcm128' $checked{'IKE_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option>
dfea4f86 2401 <option value='aes256gcm96' $checked{'IKE_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option>
dfea4f86 2402 <option value='aes256gcm64' $checked{'IKE_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option>
a4d24f90 2403 <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option>
dfea4f86 2404 <option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option>
a4d24f90
MT
2405 <option value='aes192gcm128' $checked{'IKE_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option>
2406 <option value='aes192gcm96' $checked{'IKE_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option>
2407 <option value='aes192gcm64' $checked{'IKE_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option>
2408 <option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option>
dfea4f86 2409 <option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option>
a4d24f90
MT
2410 <option value='aes128gcm128' $checked{'IKE_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option>
2411 <option value='aes128gcm96' $checked{'IKE_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option>
2412 <option value='aes128gcm64' $checked{'IKE_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option>
2413 <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option>
dfea4f86 2414 <option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option>
a4d24f90 2415 <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option>
63e3da59
MT
2416 </select>
2417 </td>
2418 <td class='boldbase'>
2419 <select name='ESP_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
dfea4f86 2420 <option value='aes256gcm128' $checked{'ESP_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option>
dfea4f86 2421 <option value='aes256gcm96' $checked{'ESP_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option>
dfea4f86 2422 <option value='aes256gcm64' $checked{'ESP_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option>
a4d24f90 2423 <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option>
dfea4f86 2424 <option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option>
a4d24f90
MT
2425 <option value='aes192gcm128' $checked{'ESP_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option>
2426 <option value='aes192gcm96' $checked{'ESP_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option>
2427 <option value='aes192gcm64' $checked{'ESP_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option>
2428 <option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option>
dfea4f86 2429 <option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option>
a4d24f90
MT
2430 <option value='aes128gcm128' $checked{'ESP_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option>
2431 <option value='aes128gcm96' $checked{'ESP_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option>
2432 <option value='aes128gcm64' $checked{'ESP_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option>
2433 <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option>
dfea4f86 2434 <option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option>
a4d24f90 2435 <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option>
63e3da59
MT
2436 </select>
2437 </td>
2438 </tr>
ed84e8b8 2439
63e3da59 2440 <tr>
cbb3a8f9 2441 <td class='boldbase' width="15%">$Lang::tr{'integrity'}</td>
63e3da59
MT
2442 <td class='boldbase'>
2443 <select name='IKE_INTEGRITY' multiple='multiple' size='6' style='width: 100%'>
2444 <option value='sha2_512' $checked{'IKE_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
2445 <option value='sha2_384' $checked{'IKE_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
2446 <option value='sha2_256' $checked{'IKE_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
a4d24f90 2447 <option value='aesxcbc' $checked{'IKE_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
63e3da59
MT
2448 <option value='sha' $checked{'IKE_INTEGRITY'}{'sha'}>SHA1</option>
2449 <option value='md5' $checked{'IKE_INTEGRITY'}{'md5'}>MD5</option>
63e3da59
MT
2450 </select>
2451 </td>
2452 <td class='boldbase'>
2453 <select name='ESP_INTEGRITY' multiple='multiple' size='6' style='width: 100%'>
2454 <option value='sha2_512' $checked{'ESP_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
2455 <option value='sha2_384' $checked{'ESP_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
2456 <option value='sha2_256' $checked{'ESP_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
a4d24f90 2457 <option value='aesxcbc' $checked{'ESP_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
63e3da59
MT
2458 <option value='sha1' $checked{'ESP_INTEGRITY'}{'sha1'}>SHA1</option>
2459 <option value='md5' $checked{'ESP_INTEGRITY'}{'md5'}>MD5</option>
63e3da59
MT
2460 </select>
2461 </td>
2462 </tr>
2463 <tr>
cbb3a8f9 2464 <td class='boldbase' width="15%">$Lang::tr{'lifetime'}</td>
63e3da59
MT
2465 <td class='boldbase'>
2466 <input type='text' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' size='5' /> $Lang::tr{'hours'}
2467 </td>
2468 <td class='boldbase'>
2469 <input type='text' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' size='5' /> $Lang::tr{'hours'}
2470 </td>
2471 </tr>
2472 <tr>
cbb3a8f9 2473 <td class='boldbase' width="15%">$Lang::tr{'grouptype'}</td>
63e3da59
MT
2474 <td class='boldbase'>
2475 <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
2476 <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
63e3da59 2477 <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
a4d24f90 2478 <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
63e3da59 2479 <option value='e384bp' $checked{'IKE_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option>
a4d24f90 2480 <option value='e256' $checked{'IKE_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
63e3da59 2481 <option value='e256bp' $checked{'IKE_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option>
a4d24f90 2482 <option value='e224' $checked{'IKE_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
63e3da59 2483 <option value='e224bp' $checked{'IKE_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option>
a4d24f90 2484 <option value='e192' $checked{'IKE_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
63e3da59
MT
2485 <option value='8192' $checked{'IKE_GROUPTYPE'}{'8192'}>MODP-8192</option>
2486 <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option>
2487 <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option>
2488 <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option>
2489 <option value='2048s256' $checked{'IKE_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
2490 <option value='2048s224' $checked{'IKE_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
2491 <option value='2048s160' $checked{'IKE_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>
2492 <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option>
2493 <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option>
2494 <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option>
2495 </select>
2496 </td>
2497 <td></td>
2498 </tr>
2499 </tbody>
2500 </table>
2501
cbb3a8f9
MT
2502 <br><br>
2503
2504 <h2>$Lang::tr{'dead peer detection'}</h2>
2505
2506 <table width="100%">
2507 <tr>
2508 <td width="15%">$Lang::tr{'dpd action'}:</td>
2509 <td>
2510 <select name='DPD_ACTION'>
afd5d8f7 2511 <option value='none' $selected{'DPD_ACTION'}{'none'}>- $Lang::tr{'disabled'} -</option>
cbb3a8f9
MT
2512 <option value='clear' $selected{'DPD_ACTION'}{'clear'}>clear</option>
2513 <option value='hold' $selected{'DPD_ACTION'}{'hold'}>hold</option>
2514 <option value='restart' $selected{'DPD_ACTION'}{'restart'}>restart</option>
2515 </select>
2516 </td>
2517 </tr>
2518 <tr>
2519 <td width="15%">$Lang::tr{'dpd timeout'}:</td>
2520 <td>
2521 <input type='text' name='DPD_TIMEOUT' size='5' value='$cgiparams{'DPD_TIMEOUT'}' />
2522 </td>
2523 </tr>
2524 <tr>
2525 <td width="15%">$Lang::tr{'dpd delay'}:</td>
2526 <td>
2527 <input type='text' name='DPD_DELAY' size='5' value='$cgiparams{'DPD_DELAY'}' />
2528 </td>
2529 </tr>
2530 </table>
2531
63e3da59
MT
2532 <hr>
2533
2534 <table width="100%">
2535 <tr>
cbb3a8f9 2536 <td>
63e3da59
MT
2537 <label>
2538 <input type='checkbox' name='ONLY_PROPOSED' $checked{'ONLY_PROPOSED'} />
cbb88df1 2539 IKE+ESP: $Lang::tr{'use only proposed settings'}
63e3da59
MT
2540 </label>
2541 </td>
2542 </tr>
2543 <tr>
cbb3a8f9 2544 <td>
63e3da59
MT
2545 <label>
2546 <input type='checkbox' name='PFS' $checked{'PFS'} />
2547 $Lang::tr{'pfs yes no'}
2548 </label>
2549 </td>
2550 </tr>
2551 <tr>
cbb3a8f9 2552 <td>
63e3da59
MT
2553 <label>
2554 <input type='checkbox' name='COMPRESSION' $checked{'COMPRESSION'} />
2555 $Lang::tr{'vpn payload compression'}
2556 </label>
2557 </td>
ed84e8b8
MT
2558 </tr>
2559EOF
2560 ;
ac1cfefa 2561 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
ed84e8b8 2562 print "<tr><td><input type='hidden' name='VHOST' value='off' /></td></tr>";
ac1cfefa 2563 } elsif ($confighash{$cgiparams{'KEY'}}[10]) {
63e3da59
MT
2564 print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} disabled='disabled' />";
2565 print " $Lang::tr{'vpn vhost'}</label></td></tr>";
ac1cfefa 2566 } else {
63e3da59
MT
2567 print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} />";
2568 print " $Lang::tr{'vpn vhost'}</label></td></tr>";
ac1cfefa 2569 }
ed84e8b8 2570
63e3da59
MT
2571 print <<EOF;
2572 <tr>
4e156911 2573 <td align='right' colspan='2'>
63e3da59
MT
2574 <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
2575 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' />
2576 </td>
2577 </tr>
2578 </table></form>
2579EOF
2580
ac1cfefa 2581 &Header::closebox();
ac1cfefa
MT
2582 &Header::closebigbox();
2583 &Header::closepage();
2584 exit(0);
2585
2586 ADVANCED_END:
2587}
2588
2589###
2590### Default status page
2591###
2592 %cgiparams = ();
2593 %cahash = ();
2594 %confighash = ();
2595 &General::readhash("${General::swroot}/vpn/settings", \%cgiparams);
2596 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
2597 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
ed84e8b8 2598 $cgiparams{'CA_NAME'} = '';
ac1cfefa 2599
73c7eff8 2600 my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
ac1cfefa
MT
2601
2602 # suggest a default name for this side
2603 if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
2604 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
2605 my $ipaddr = <IPADDR>;
2606 close IPADDR;
2607 chomp ($ipaddr);
2608 $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
2609 if ($cgiparams{'VPN_IP'} eq '') {
2610 $cgiparams{'VPN_IP'} = $ipaddr;
2611 }
2612 }
2613 }
2614 # no IP found, use %defaultroute
2615 $cgiparams{'VPN_IP'} ='%defaultroute' if ($cgiparams{'VPN_IP'} eq '');
2616
2617 $cgiparams{'VPN_DELAYED_START'} = 0 if (! defined ($cgiparams{'VPN_DELAYED_START'}));
ae2782ba 2618 $checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : '';
ac1cfefa
MT
2619
2620 &Header::showhttpheaders();
7d44bfee 2621 &Header::openpage($Lang::tr{'ipsec'}, 1, '');
ed84e8b8 2622 &Header::openbigbox('100%', 'left', '', $errormessage);
ac1cfefa
MT
2623
2624 if ($errormessage) {
ed84e8b8 2625 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
ac1cfefa
MT
2626 print "<class name='base'>$errormessage\n";
2627 print "&nbsp;</class>\n";
2628 &Header::closebox();
2629 }
2630
4d81e0f3
AM
2631 if ($warnmessage) {
2632 &Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
2633 print "$warnmessage<br>";
2634 print "$Lang::tr{'fwdfw warn1'}<br>";
2635 &Header::closebox();
03b08c08 2636 print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>";
4d81e0f3
AM
2637 &Header::closepage();
2638 exit 0;
2639 }
2640
ed84e8b8 2641 &Header::openbox('100%', 'left', $Lang::tr{'global settings'});
ac1cfefa 2642 print <<END
ed84e8b8 2643 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa
MT
2644 <table width='100%'>
2645 <tr>
5fd30232 2646 <td width='20%' class='base' nowrap='nowrap'>$Lang::tr{'vpn red name'}:</td>
ed84e8b8
MT
2647 <td width='20%'><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' /></td>
2648 <td width='20%' class='base'>$Lang::tr{'enabled'}<input type='checkbox' name='ENABLED' $checked{'ENABLED'} /></td>
ac1cfefa 2649 </tr>
ac1cfefa
MT
2650END
2651 ;
ac1cfefa 2652print <<END
ed84e8b8
MT
2653 <tr>
2654 <td class='base' nowrap='nowrap'>$Lang::tr{'vpn delayed start'}:&nbsp;<img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /></td>
2655 <td ><input type='text' name='VPN_DELAYED_START' value='$cgiparams{'VPN_DELAYED_START'}' /></td>
ed84e8b8 2656 </tr>
9d85ac3b
CS
2657 <tr>
2658 <td class='base' nowrap='nowrap'>$Lang::tr{'host to net vpn'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2659 <td ><input type='text' name='RW_NET' value='$cgiparams{'RW_NET'}' /></td>
2660 </tr>
0afd8493
AM
2661</table>
2662<br>
ac1cfefa
MT
2663<hr />
2664<table width='100%'>
2665<tr>
2666 <td class='base' valign='top'><img src='/blob.gif' alt='*' /></td>
0afd8493 2667 <td width='70%' class='base' valign='top'>$Lang::tr{'this field may be blank'}</td><td width='30%' align='right' class='base'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
ed84e8b8
MT
2668</tr>
2669<tr>
2670 <td class='base' valign='top' nowrap='nowrap'><img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' />&nbsp;</td>
2671 <td class='base'> <font class='base'>$Lang::tr{'vpn delayed start help'}</font></td>
0afd8493 2672 <td></td>
ac1cfefa
MT
2673</tr>
2674</table>
2675END
2676;
2677 print "</form>";
2678 &Header::closebox();
2679
ed84e8b8 2680 &Header::openbox('100%', 'left', $Lang::tr{'connection status and controlc'});
ac1cfefa 2681 print <<END
e9850821 2682 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
ac1cfefa 2683 <tr>
e9850821
AM
2684 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
2685 <th width='22%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
2686 <th width='23%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></th>
2687 <th width='30%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
2688 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
2689 <th class='boldbase' align='center' colspan='6'><b>$Lang::tr{'action'}</b></th>
ac1cfefa
MT
2690 </tr>
2691END
2692 ;
2693 my $id = 0;
2694 my $gif;
eff2dbf8 2695 foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
ac1cfefa
MT
2696 if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
2697
2698 if ($id % 2) {
e9850821
AM
2699 print "<tr>";
2700 $col="bgcolor='$color{'color20'}'";
ac1cfefa 2701 } else {
e9850821
AM
2702 print "<tr>";
2703 $col="bgcolor='$color{'color22'}'";
ac1cfefa 2704 }
e9850821
AM
2705 print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
2706 print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ") $confighash{$key}[29]</td>";
ed84e8b8 2707 if ($confighash{$key}[2] eq '%auth-dn') {
e9850821 2708 print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[9]</td>";
ed84e8b8 2709 } elsif ($confighash{$key}[4] eq 'cert') {
e9850821 2710 print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[2]</td>";
ac1cfefa 2711 } else {
e9850821 2712 print "<td align='left' $col>&nbsp;</td>";
ac1cfefa 2713 }
e9850821 2714 print "<td align='center' $col>$confighash{$key}[25]</td>";
0afd8493 2715 my $col1="bgcolor='${Header::colourred}'";
5fd30232 2716 # get real state
0afd8493 2717 my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
5fd30232 2718 foreach my $line (@status) {
a3323b6f 2719 if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
264c0195 2720 ($line =~ /$confighash{$key}[1]\{.*INSTALLED/))
4b4b8959 2721 {
0afd8493
AM
2722 $col1="bgcolor='${Header::colourgreen}'";
2723 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
ac1cfefa
MT
2724 }
2725 }
5fd30232 2726 # move to blueif really down
0afd8493
AM
2727 if ($confighash{$key}[0] eq 'off' && $col1 =~ /${Header::colourred}/ ) {
2728 $col1="bgcolor='${Header::colourblue}'";
2729 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
5fd30232 2730 }
ac1cfefa 2731 print <<END
0afd8493 2732 <td align='center' $col1>$active</td>
e9850821 2733 <td align='center' $col>
ed84e8b8
MT
2734 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2735 <input type='image' name='$Lang::tr{'restart'}' src='/images/reload.gif' alt='$Lang::tr{'restart'}' title='$Lang::tr{'restart'}' />
ac1cfefa
MT
2736 <input type='hidden' name='ACTION' value='$Lang::tr{'restart'}' />
2737 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2738 </form>
2739 </td>
ac1cfefa
MT
2740END
2741 ;
ed84e8b8 2742 if (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
ac1cfefa 2743 print <<END
e9850821 2744 <td align='center' $col>
ed84e8b8
MT
2745 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2746 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' />
ac1cfefa
MT
2747 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
2748 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2749 </form>
2750 </td>
ac1cfefa
MT
2751END
2752 ; } else {
e9850821 2753 print "<td width='2%' $col>&nbsp;</td>";
ac1cfefa
MT
2754 }
2755 if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") {
2756 print <<END
e9850821 2757 <td align='center' $col>
ed84e8b8
MT
2758 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2759 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/floppy.gif' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' />
ac1cfefa
MT
2760 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
2761 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2762 </form>
2763 </td>
ac1cfefa 2764END
ed84e8b8 2765 ; } elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
ac1cfefa 2766 print <<END
e9850821 2767 <td align='center' $col>
ed84e8b8
MT
2768 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2769 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' />
ac1cfefa
MT
2770 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
2771 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2772 </form>
2773 </td>
ac1cfefa
MT
2774END
2775 ; } else {
e9850821 2776 print "<td width='2%' $col>&nbsp;</td>";
ac1cfefa
MT
2777 }
2778 print <<END
e9850821 2779 <td align='center' $col>
ed84e8b8
MT
2780 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2781 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' />
ac1cfefa
MT
2782 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
2783 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2784 </form>
2785 </td>
ac1cfefa 2786
e9850821 2787 <td align='center' $col>
ed84e8b8 2788 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 2789 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
ed84e8b8 2790 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
ac1cfefa 2791 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2792 </form>
2793 </td>
e9850821 2794 <td align='center' $col>
ed84e8b8 2795 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 2796 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
ed84e8b8 2797 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' />
ac1cfefa 2798 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2799 </form>
2800 </td>
ac1cfefa
MT
2801 </tr>
2802END
2803 ;
2804 $id++;
2805 }
ed84e8b8 2806 print "</table>";
ac1cfefa
MT
2807
2808 # If the config file contains entries, print Key to action icons
2809 if ( $id ) {
2810 print <<END
2811 <table>
2812 <tr>
2813 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
2814 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
2815 <td class='base'>$Lang::tr{'click to disable'}</td>
2816 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
2817 <td class='base'>$Lang::tr{'show certificate'}</td>
2818 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
2819 <td class='base'>$Lang::tr{'edit'}</td>
2820 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
2821 <td class='base'>$Lang::tr{'remove'}</td>
2822 </tr>
2823 <tr>
2824 <td>&nbsp; </td>
2825 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
2826 <td class='base'>$Lang::tr{'click to enable'}</td>
2827 <td>&nbsp; &nbsp; <img src='/images/floppy.gif' alt='?FLOPPY' /></td>
2828 <td class='base'>$Lang::tr{'download certificate'}</td>
2829 <td>&nbsp; &nbsp; <img src='/images/reload.gif' alt='?RELOAD'/></td>
2830 <td class='base'>$Lang::tr{'restart'}</td>
2831 </tr>
2832 </table>
2833END
2834 ;
2835 }
2836
2837 print <<END
2838 <table width='100%'>
0afd8493 2839 <tr><td align='right' colspan='9'>
ed84e8b8
MT
2840 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2841 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
2842 </form>
2843 </td></tr>
ac1cfefa
MT
2844 </table>
2845END
2846 ;
2847 &Header::closebox();
2848
0afd8493 2849 &Header::openbox('100%', 'left', "$Lang::tr{'certificate authorities'}");
ac1cfefa 2850 print <<EOF
e9850821 2851 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
ac1cfefa 2852 <tr>
e9850821
AM
2853 <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
2854 <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
2855 <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
ac1cfefa
MT
2856 </tr>
2857EOF
2858 ;
e9850821
AM
2859 my $col1="bgcolor='$color{'color22'}'";
2860 my $col2="bgcolor='$color{'color20'}'";
ac1cfefa 2861 if (-f "${General::swroot}/ca/cacert.pem") {
ed84e8b8 2862 my $casubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/cacert.pem"));
ac1cfefa 2863 print <<END
e9850821
AM
2864 <tr>
2865 <td class='base' $col1>$Lang::tr{'root certificate'}</td>
2866 <td class='base' $col1>$casubject</td>
2867 <td width='3%' align='center' $col1>
ed84e8b8 2868 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 2869 <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
ed84e8b8
MT
2870 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' />
2871 </form>
2872 </td>
e9850821 2873 <td width='3%' align='center' $col1>
ed84e8b8
MT
2874 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2875 <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' />
ac1cfefa 2876 <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
ed84e8b8
MT
2877 </form>
2878 </td>
e9850821 2879 <td width='4%' $col1>&nbsp;</td></tr>
ac1cfefa
MT
2880END
2881 ;
2882 } else {
2883 # display rootcert generation buttons
2884 print <<END
e9850821
AM
2885 <tr>
2886 <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
2887 <td class='base' $col1>$Lang::tr{'not present'}</td>
2888 <td colspan='3' $col1>&nbsp;</td></tr>
ac1cfefa
MT
2889END
2890 ;
2891 }
2892
2893 if (-f "${General::swroot}/certs/hostcert.pem") {
ed84e8b8 2894 my $hostsubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/certs/hostcert.pem"));
ac1cfefa
MT
2895
2896 print <<END
e9850821
AM
2897 <tr>
2898 <td class='base' $col2>$Lang::tr{'host certificate'}</td>
2899 <td class='base' $col2>$hostsubject</td>
2900 <td width='3%' align='center' $col2>
ed84e8b8 2901 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 2902 <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
ed84e8b8
MT
2903 <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' />
2904 </form>
2905 </td>
e9850821 2906 <td width='3%' align='center' $col2>
ed84e8b8 2907 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
e602416f
SS
2908 <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/floppy.gif' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" />
2909 <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
ed84e8b8
MT
2910 </form>
2911 </td>
e9850821 2912 <td width='4%' $col2>&nbsp;</td></tr>
ac1cfefa
MT
2913END
2914 ;
2915 } else {
2916 # Nothing
2917 print <<END
e9850821
AM
2918 <tr>
2919 <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
2920 <td class='base' $col2>$Lang::tr{'not present'}</td>
2921 <td colspan='3' $col2>&nbsp;</td></tr>
ac1cfefa
MT
2922END
2923 ;
2924 }
5fd30232 2925
e9850821
AM
2926 my $rowcolor = 0;
2927 if (keys %cahash > 0) {
2928 foreach my $key (keys %cahash) {
2929 if ($rowcolor++ % 2) {
2930 print "<tr>";
2931 $col="bgcolor='$color{'color20'}'";
2932 } else {
2933 print "<tr>";
2934 $col="bgcolor='$color{'color22'}'";
2935 }
2936 print "<td class='base' $col>$cahash{$key}[0]</td>\n";
2937 print "<td class='base' $col>$cahash{$key}[1]</td>\n";
ac1cfefa 2938 print <<END
e9850821 2939 <td align='center' $col>
ed84e8b8
MT
2940 <form method='post' name='cafrm${key}a' action='$ENV{'SCRIPT_NAME'}'>
2941 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' />
ac1cfefa
MT
2942 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
2943 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2944 </form>
2945 </td>
e9850821 2946 <td align='center' $col>
ed84e8b8
MT
2947 <form method='post' name='cafrm${key}b' action='$ENV{'SCRIPT_NAME'}'>
2948 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' />
ac1cfefa
MT
2949 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
2950 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2951 </form>
2952 </td>
e9850821 2953 <td align='center' $col>
ed84e8b8 2954 <form method='post' name='cafrm${key}c' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 2955 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
ed84e8b8 2956 <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' />
ac1cfefa 2957 <input type='hidden' name='KEY' value='$key' />
ed84e8b8
MT
2958 </form>
2959 </td>
2960 </tr>
ac1cfefa
MT
2961END
2962 ;
2963 }
2964 }
ac1cfefa
MT
2965 print "</table>";
2966
2967 # If the file contains entries, print Key to action icons
2968 if ( -f "${General::swroot}/ca/cacert.pem") {
ed84e8b8
MT
2969 print <<END
2970 <table><tr>
ac1cfefa
MT
2971 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
2972 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
2973 <td class='base'>$Lang::tr{'show certificate'}</td>
2974 <td>&nbsp; &nbsp; <img src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' /></td>
2975 <td class='base'>$Lang::tr{'download certificate'}</td>
ed84e8b8 2976 </tr></table>
ac1cfefa 2977END
ed84e8b8 2978 ;
ac1cfefa 2979 }
ed84e8b8 2980 my $createCA = -f "${General::swroot}/ca/cacert.pem" ? '' : "<tr><td colspan='3'></td><td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td></tr>";
ac1cfefa 2981 print <<END
0afd8493 2982 <br>
ed84e8b8
MT
2983 <hr />
2984 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
ac1cfefa 2985 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
ed84e8b8
MT
2986 $createCA
2987 <tr>
2988 <td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td>
2989 <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' /> </td>
2990 <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td>
2991 <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td>
2992 </tr>
2993 <tr>
2994 <td colspan='3'>$Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}:</td>
0afd8493 2995 <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></td>
ed84e8b8
MT
2996 </tr>
2997 </table>
2998 </form>
ac1cfefa
MT
2999END
3000 ;
3001 &Header::closebox();
ac1cfefa
MT
3002 &Header::closebigbox();
3003 &Header::closepage();
e8b3bb0e
MT
3004
3005sub array_unique($) {
3006 my $array = shift;
3007 my @unique = ();
3008
3009 my %seen = ();
3010 foreach my $e (@$array) {
3011 next if $seen{$e}++;
3012 push(@unique, $e);
3013 }
3014
3015 return @unique;
3016}
3017
3018sub make_algos($$$$$) {
3019 my ($mode, $encs, $ints, $grps, $pfs) = @_;
3020 my @algos = ();
3021
3022 foreach my $enc (@$encs) {
3023 foreach my $int (@$ints) {
3024 foreach my $grp (@$grps) {
3025 my @algo = ($enc);
3026
78039c15 3027 if ($mode eq "ike") {
e8b3bb0e 3028 push(@algo, $int);
e8b3bb0e 3029
2c531c21 3030 if ($grp =~ m/^e(.*)$/) {
e8b3bb0e
MT
3031 push(@algo, "ecp$1");
3032 } else {
3033 push(@algo, "modp$grp");
3034 }
e8b3bb0e 3035
78039c15
MT
3036 } elsif ($mode eq "esp" && $pfs) {
3037 my $is_aead = ($enc =~ m/[cg]cm/);
3038
3039 if (!$is_aead) {
3040 push(@algo, $int);
3041 }
e8b3bb0e
MT
3042 }
3043
3044 push(@algos, join("-", @algo));
3045 }
3046 }
3047 }
3048
3049 return &array_unique(\@algos);
3050}