| | 1 | #!/usr/bin/perl |
| | 2 | ############################################################################### |
| | 3 | # # |
| | 4 | # IPFire.org - A linux based firewall # |
| | 5 | # Copyright (C) 2007-2013 IPFire Team info@ipfire.org # |
| | 6 | # # |
| | 7 | # This program is free software: you can redistribute it and/or modify # |
| | 8 | # it under the terms of the GNU General Public License as published by # |
| | 9 | # the Free Software Foundation, either version 3 of the License, or # |
| | 10 | # (at your option) any later version. # |
| | 11 | # # |
| | 12 | # This program is distributed in the hope that it will be useful, # |
| | 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # |
| | 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # |
| | 15 | # GNU General Public License for more details. # |
| | 16 | # # |
| | 17 | # You should have received a copy of the GNU General Public License # |
| | 18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # |
| | 19 | # # |
| | 20 | ############################################################################### |
| | 21 | |
| | 22 | use Net::DNS; |
| | 23 | use File::Copy; |
| | 24 | use File::Temp qw/ tempfile tempdir /; |
| | 25 | use strict; |
| | 26 | use Sort::Naturally; |
| | 27 | # enable only the following on debugging purpose |
| | 28 | #use warnings; |
| | 29 | #use CGI::Carp 'fatalsToBrowser'; |
| | 30 | |
| | 31 | require '/var/ipfire/general-functions.pl'; |
| | 32 | require "${General::swroot}/lang.pl"; |
| | 33 | require "${General::swroot}/header.pl"; |
| | 34 | require "${General::swroot}/countries.pl"; |
| | 35 | |
| | 36 | #workaround to suppress a warning when a variable is used only once |
| | 37 | my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} ); |
| | 38 | undef (@dummy); |
| | 39 | |
| | 40 | ### |
| | 41 | ### Initialize variables |
| | 42 | ### |
| | 43 | my $sleepDelay = 4; # after a call to ipsecctrl S or R, wait this delay (seconds) before reading status (let the ipsec do its job) |
| | 44 | my %netsettings=(); |
| | 45 | our %cgiparams=(); |
| | 46 | our %vpnsettings=(); |
| | 47 | my %checked=(); |
| | 48 | my %confighash=(); |
| | 49 | my %cahash=(); |
| | 50 | my %selected=(); |
| | 51 | my $warnmessage = ''; |
| | 52 | my $errormessage = ''; |
| | 53 | |
| | 54 | my %color = (); |
| | 55 | my %mainsettings = (); |
| | 56 | &General::readhash("${General::swroot}/main/settings", \%mainsettings); |
| | 57 | &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color); |
| | 58 | |
| | 59 | &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); |
| | 60 | |
| | 61 | my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"); |
| | 62 | my $blue_cidr = "# Blue not defined"; |
| | 63 | if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) { |
| | 64 | $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}"); |
| | 65 | } |
| | 66 | my $orange_cidr = "# Orange not defined"; |
| | 67 | if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) { |
| | 68 | $orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}"); |
| | 69 | } |
| | 70 | |
| | 71 | my $col=""; |
| | 72 | |
| | 73 | $cgiparams{'ENABLED'} = 'off'; |
| | 74 | $cgiparams{'EDIT_ADVANCED'} = 'off'; |
| | 75 | $cgiparams{'ACTION'} = ''; |
| | 76 | $cgiparams{'CA_NAME'} = ''; |
| | 77 | $cgiparams{'KEY'} = ''; |
| | 78 | $cgiparams{'TYPE'} = ''; |
| | 79 | $cgiparams{'ADVANCED'} = ''; |
| | 80 | $cgiparams{'NAME'} = ''; |
| | 81 | $cgiparams{'LOCAL_SUBNET'} = ''; |
| | 82 | $cgiparams{'REMOTE_SUBNET'} = ''; |
| | 83 | $cgiparams{'REMOTE'} = ''; |
| | 84 | $cgiparams{'LOCAL_ID'} = ''; |
| | 85 | $cgiparams{'REMOTE_ID'} = ''; |
| | 86 | $cgiparams{'REMARK'} = ''; |
| | 87 | $cgiparams{'PSK'} = ''; |
| | 88 | $cgiparams{'CERT_NAME'} = ''; |
| | 89 | $cgiparams{'CERT_EMAIL'} = ''; |
| | 90 | $cgiparams{'CERT_OU'} = ''; |
| | 91 | $cgiparams{'CERT_ORGANIZATION'} = ''; |
| | 92 | $cgiparams{'CERT_CITY'} = ''; |
| | 93 | $cgiparams{'CERT_STATE'} = ''; |
| | 94 | $cgiparams{'CERT_COUNTRY'} = ''; |
| | 95 | $cgiparams{'SUBJECTALTNAME'} = ''; |
| | 96 | $cgiparams{'CERT_PASS1'} = ''; |
| | 97 | $cgiparams{'CERT_PASS2'} = ''; |
| | 98 | $cgiparams{'ROOTCERT_HOSTNAME'} = ''; |
| | 99 | $cgiparams{'ROOTCERT_COUNTRY'} = ''; |
| | 100 | $cgiparams{'P12_PASS'} = ''; |
| | 101 | $cgiparams{'ROOTCERT_ORGANIZATION'} = ''; |
| | 102 | $cgiparams{'ROOTCERT_HOSTNAME'} = ''; |
| | 103 | $cgiparams{'ROOTCERT_EMAIL'} = ''; |
| | 104 | $cgiparams{'ROOTCERT_OU'} = ''; |
| | 105 | $cgiparams{'ROOTCERT_CITY'} = ''; |
| | 106 | $cgiparams{'ROOTCERT_STATE'} = ''; |
| | 107 | $cgiparams{'RW_NET'} = ''; |
| | 108 | $cgiparams{'DPD_DELAY'} = '30'; |
| | 109 | $cgiparams{'DPD_TIMEOUT'} = '120'; |
| | 110 | $cgiparams{'FORCE_MOBIKE'} = 'off'; |
| | 111 | $cgiparams{'START_ACTION'} = 'start'; |
| | 112 | &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'}); |
| | 113 | |
| | 114 | ### |
| | 115 | ### Useful functions |
| | 116 | ### |
| | 117 | sub valid_dns_host { |
| | 118 | my $hostname = $_[0]; |
| | 119 | unless ($hostname) { return "No hostname"}; |
| | 120 | my $res = new Net::DNS::Resolver; |
| | 121 | my $query = $res->search("$hostname"); |
| | 122 | if ($query) { |
| | 123 | foreach my $rr ($query->answer) { |
| | 124 | ## Potential bug - we are only looking at A records: |
| | 125 | return 0 if $rr->type eq "A"; |
| | 126 | } |
| | 127 | } else { |
| | 128 | return $res->errorstring; |
| | 129 | } |
| | 130 | } |
| | 131 | ### |
| | 132 | ### Just return true is one interface is vpn enabled |
| | 133 | ### |
| | 134 | sub vpnenabled { |
| | 135 | return ($vpnsettings{'ENABLED'} eq 'on'); |
| | 136 | } |
| | 137 | ### |
| | 138 | ### old version: maintain serial number to one, without explication. |
| | 139 | ### this: let the counter go, so that each cert is numbered. |
| | 140 | ### |
| | 141 | sub cleanssldatabase { |
| | 142 | if (open(FILE, ">${General::swroot}/certs/serial")) { |
| | 143 | print FILE "01"; |
| | 144 | close FILE; |
| | 145 | } |
| | 146 | if (open(FILE, ">${General::swroot}/certs/index.txt")) { |
| | 147 | print FILE ""; |
| | 148 | close FILE; |
| | 149 | } |
| | 150 | unlink ("${General::swroot}/certs/index.txt.old"); |
| | 151 | unlink ("${General::swroot}/certs/serial.old"); |
| | 152 | unlink ("${General::swroot}/certs/01.pem"); |
| | 153 | } |
| | 154 | sub newcleanssldatabase { |
| | 155 | if (! -s "${General::swroot}/certs/serial" ) { |
| | 156 | open(FILE, ">${General::swroot}/certs/serial"); |
| | 157 | print FILE "01"; |
| | 158 | close FILE; |
| | 159 | } |
| | 160 | if (! -s ">${General::swroot}/certs/index.txt") { |
| | 161 | system ("touch ${General::swroot}/certs/index.txt"); |
| | 162 | } |
| | 163 | unlink ("${General::swroot}/certs/index.txt.old"); |
| | 164 | unlink ("${General::swroot}/certs/serial.old"); |
| | 165 | # unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete |
| | 166 | } |
| | 167 | |
| | 168 | ### |
| | 169 | ### Call openssl and return errormessage if any |
| | 170 | ### |
| | 171 | sub callssl ($) { |
| | 172 | my $opt = shift; |
| | 173 | my $retssl = `/usr/bin/openssl $opt 2>&1`; #redirect stderr |
| | 174 | my $ret = ''; |
| | 175 | foreach my $line (split (/\n/, $retssl)) { |
| | 176 | &General::log("ipsec", "$line") if (0); # 1 for verbose logging |
| | 177 | $ret .= '<br>'.$line if ( $line =~ /error|unknown/ ); |
| | 178 | } |
| | 179 | if ($ret) { |
| | 180 | $ret= &Header::cleanhtml($ret); |
| | 181 | } |
| | 182 | return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ; |
| | 183 | } |
| | 184 | ### |
| | 185 | ### Obtain a CN from given cert |
| | 186 | ### |
| | 187 | sub getCNfromcert ($) { |
| | 188 | #&General::log("ipsec", "Extracting name from $_[0]..."); |
| | 189 | my $temp = `/usr/bin/openssl x509 -text -in $_[0]`; |
| | 190 | $temp =~ /Subject:.*CN=(.*)[\n]/; |
| | 191 | $temp = $1; |
| | 192 | $temp =~ s+/Email+, E+; |
| | 193 | $temp =~ s/ ST=/ S=/; |
| | 194 | $temp =~ s/,//g; |
| | 195 | $temp =~ s/\'//g; |
| | 196 | return $temp; |
| | 197 | } |
| | 198 | ### |
| | 199 | ### Obtain Subject from given cert |
| | 200 | ### |
| | 201 | sub getsubjectfromcert ($) { |
| | 202 | #&General::log("ipsec", "Extracting subject from $_[0]..."); |
| | 203 | my $temp = `/usr/bin/openssl x509 -text -in $_[0]`; |
| | 204 | $temp =~ /Subject: (.*)[\n]/; |
| | 205 | $temp = $1; |
| | 206 | $temp =~ s+/Email+, E+; |
| | 207 | $temp =~ s/ ST=/ S=/; |
| | 208 | return $temp; |
| | 209 | } |
| | 210 | ### |
| | 211 | ### Combine local subnet and connection name to make a unique name for each connection section |
| | 212 | ### (this sub is not used now) |
| | 213 | ### |
| | 214 | sub makeconnname ($) { |
| | 215 | my $conn = shift; |
| | 216 | my $subnet = shift; |
| | 217 | |
| | 218 | $subnet =~ /^(.*?)\/(.*?)$/; # $1=IP $2=mask |
| | 219 | my $ip = unpack('N', &Socket::inet_aton($1)); |
| | 220 | if (length ($2) > 2) { |
| | 221 | my $mm = unpack('N', &Socket::inet_aton($2)); |
| | 222 | while ( ($mm & 1)==0 ) { |
| | 223 | $ip >>= 1; |
| | 224 | $mm >>= 1; |
| | 225 | }; |
| | 226 | } else { |
| | 227 | $ip >>= (32 - $2); |
| | 228 | } |
| | 229 | return sprintf ("%s-%X", $conn, $ip); |
| | 230 | } |
| | 231 | ### |
| | 232 | ### Write a config file. |
| | 233 | ### |
| | 234 | ###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and |
| | 235 | ### the side is always defined as 'left'. |
| | 236 | ### |
| | 237 | |
| | 238 | sub writeipsecfiles { |
| | 239 | my %lconfighash = (); |
| | 240 | my %lvpnsettings = (); |
| | 241 | &General::readhasharray("${General::swroot}/vpn/config", \%lconfighash); |
| | 242 | &General::readhash("${General::swroot}/vpn/settings", \%lvpnsettings); |
| | 243 | |
| | 244 | open(CONF, ">${General::swroot}/vpn/ipsec.conf") or die "Unable to open ${General::swroot}/vpn/ipsec.conf: $!"; |
| | 245 | open(SECRETS, ">${General::swroot}/vpn/ipsec.secrets") or die "Unable to open ${General::swroot}/vpn/ipsec.secrets: $!"; |
| | 246 | flock CONF, 2; |
| | 247 | flock SECRETS, 2; |
| | 248 | print CONF "version 2\n\n"; |
| | 249 | print CONF "conn %default\n"; |
| | 250 | print CONF "\tkeyingtries=%forever\n"; |
| | 251 | print CONF "\n"; |
| | 252 | |
| | 253 | # Add user includes to config file |
| | 254 | if (-e "/etc/ipsec.user.conf") { |
| | 255 | print CONF "include /etc/ipsec.user.conf\n"; |
| | 256 | print CONF "\n"; |
| | 257 | } |
| | 258 | |
| | 259 | print SECRETS "include /etc/ipsec.user.secrets\n"; |
| | 260 | |
| | 261 | if (-f "${General::swroot}/certs/hostkey.pem") { |
| | 262 | print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n" |
| | 263 | } |
| | 264 | my $last_secrets = ''; # old the less specifics connections |
| | 265 | |
| | 266 | foreach my $key (keys %lconfighash) { |
| | 267 | next if ($lconfighash{$key}[0] ne 'on'); |
| | 268 | |
| | 269 | #remote peer is not set? => use '%any' |
| | 270 | $lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq ''); |
| | 271 | |
| | 272 | my $localside; |
| | 273 | if ($lconfighash{$key}[26] eq 'BLUE') { |
| | 274 | $localside = $netsettings{'BLUE_ADDRESS'}; |
| | 275 | } elsif ($lconfighash{$key}[26] eq 'GREEN') { |
| | 276 | $localside = $netsettings{'GREEN_ADDRESS'}; |
| | 277 | } elsif ($lconfighash{$key}[26] eq 'ORANGE') { |
| | 278 | $localside = $netsettings{'ORANGE_ADDRESS'}; |
| | 279 | } else { # it is RED |
| | 280 | $localside = $lvpnsettings{'VPN_IP'}; |
| | 281 | } |
| | 282 | |
| | 283 | print CONF "conn $lconfighash{$key}[1]\n"; |
| | 284 | print CONF "\tleft=$localside\n"; |
| | 285 | print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n"; |
| | 286 | print CONF "\tleftfirewall=yes\n"; |
| | 287 | print CONF "\tlefthostaccess=yes\n"; |
| | 288 | print CONF "\tright=$lconfighash{$key}[10]\n"; |
| | 289 | |
| | 290 | if ($lconfighash{$key}[3] eq 'net') { |
| | 291 | print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n"; |
| | 292 | } |
| | 293 | |
| | 294 | # Local Cert and Remote Cert (unless auth is DN dn-auth) |
| | 295 | if ($lconfighash{$key}[4] eq 'cert') { |
| | 296 | print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n"; |
| | 297 | print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn'); |
| | 298 | } |
| | 299 | |
| | 300 | # Local and Remote IDs |
| | 301 | print CONF "\tleftid=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]); |
| | 302 | print CONF "\trightid=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]); |
| | 303 | |
| | 304 | # Is PFS enabled? |
| | 305 | my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off'; |
| | 306 | |
| | 307 | # Algorithms |
| | 308 | if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) { |
| | 309 | my @encs = split('\|', $lconfighash{$key}[18]); |
| | 310 | my @ints = split('\|', $lconfighash{$key}[19]); |
| | 311 | my @groups = split('\|', $lconfighash{$key}[20]); |
| | 312 | |
| | 313 | my @algos = &make_algos("ike", \@encs, \@ints, \@groups, 1); |
| | 314 | print CONF "\tike=" . join(",", @algos); |
| | 315 | |
| | 316 | if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms? |
| | 317 | print CONF "!\n"; |
| | 318 | } else { |
| | 319 | print CONF "\n"; |
| | 320 | } |
| | 321 | } |
| | 322 | |
| | 323 | if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) { |
| | 324 | my @encs = split('\|', $lconfighash{$key}[21]); |
| | 325 | my @ints = split('\|', $lconfighash{$key}[22]); |
| | 326 | my @groups = split('\|', $lconfighash{$key}[23]); |
| | 327 | |
| | 328 | # Use IKE grouptype if no ESP group type has been selected |
| | 329 | # (for backwards compatibility) |
| | 330 | if ($lconfighash{$key}[23] eq "") { |
| | 331 | @groups = split('\|', $lconfighash{$key}[20]); |
| | 332 | } |
| | 333 | |
| | 334 | my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on")); |
| | 335 | print CONF "\tesp=" . join(",", @algos); |
| | 336 | |
| | 337 | if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms? |
| | 338 | print CONF "!\n"; |
| | 339 | } else { |
| | 340 | print CONF "\n"; |
| | 341 | } |
| | 342 | } |
| | 343 | |
| | 344 | # IKE V1 or V2 |
| | 345 | if (! $lconfighash{$key}[29]) { |
| | 346 | $lconfighash{$key}[29] = "ikev1"; |
| | 347 | } |
| | 348 | |
| | 349 | print CONF "\tkeyexchange=$lconfighash{$key}[29]\n"; |
| | 350 | |
| | 351 | # Lifetimes |
| | 352 | print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]); |
| | 353 | print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]); |
| | 354 | |
| | 355 | # Compression |
| | 356 | print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on'); |
| | 357 | |
| | 358 | # Force MOBIKE? |
| | 359 | if (($lconfighash{$key}[29] eq "ikev2") && ($lconfighash{$key}[32] eq 'on')) { |
| | 360 | print CONF "\tmobike=yes\n"; |
| | 361 | } |
| | 362 | |
| | 363 | # Dead Peer Detection |
| | 364 | my $dpdaction = $lconfighash{$key}[27]; |
| | 365 | print CONF "\tdpdaction=$dpdaction\n"; |
| | 366 | |
| | 367 | # If the dead peer detection is disabled and IKEv2 is used, |
| | 368 | # dpddelay must be set to zero, too. |
| | 369 | if ($dpdaction eq "none") { |
| | 370 | if ($lconfighash{$key}[29] eq "ikev2") { |
| | 371 | print CONF "\tdpddelay=0\n"; |
| | 372 | } |
| | 373 | } else { |
| | 374 | my $dpddelay = $lconfighash{$key}[31]; |
| | 375 | if (!$dpddelay) { |
| | 376 | $dpddelay = 30; |
| | 377 | } |
| | 378 | print CONF "\tdpddelay=$dpddelay\n"; |
| | 379 | my $dpdtimeout = $lconfighash{$key}[30]; |
| | 380 | if (!$dpdtimeout) { |
| | 381 | $dpdtimeout = 120; |
| | 382 | } |
| | 383 | print CONF "\tdpdtimeout=$dpdtimeout\n"; |
| | 384 | } |
| | 385 | |
| | 386 | # Build Authentication details: LEFTid RIGHTid : PSK psk |
| | 387 | my $psk_line; |
| | 388 | if ($lconfighash{$key}[4] eq 'psk') { |
| | 389 | $psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ; |
| | 390 | $psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; #remoteid or remote address? |
| | 391 | $psk_line .= " : PSK '$lconfighash{$key}[5]'\n"; |
| | 392 | # if the line contains %any, it is less specific than two IP or ID, so move it at end of file. |
| | 393 | if ($psk_line =~ /%any/) { |
| | 394 | $last_secrets .= $psk_line; |
| | 395 | } else { |
| | 396 | print SECRETS $psk_line; |
| | 397 | } |
| | 398 | print CONF "\tauthby=secret\n"; |
| | 399 | } else { |
| | 400 | print CONF "\tauthby=rsasig\n"; |
| | 401 | print CONF "\tleftrsasigkey=%cert\n"; |
| | 402 | print CONF "\trightrsasigkey=%cert\n"; |
| | 403 | } |
| | 404 | |
| | 405 | my $start_action = $lconfighash{$key}[33]; |
| | 406 | if (!$start_action) { |
| | 407 | $start_action = "start"; |
| | 408 | } |
| | 409 | |
| | 410 | # Automatically start only if a net-to-net connection |
| | 411 | if ($lconfighash{$key}[3] eq 'host') { |
| | 412 | print CONF "\tauto=add\n"; |
| | 413 | print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n"; |
| | 414 | } else { |
| | 415 | print CONF "\tauto=$start_action\n"; |
| | 416 | |
| | 417 | # If in on-demand mode, we terminate the tunnel |
| | 418 | # after 15 min of no traffic |
| | 419 | if ($start_action eq 'route') { |
| | 420 | print CONF "\tinactivity=900\n"; |
| | 421 | } |
| | 422 | } |
| | 423 | |
| | 424 | # Fragmentation |
| | 425 | print CONF "\tfragmentation=yes\n"; |
| | 426 | |
| | 427 | print CONF "\n"; |
| | 428 | } #foreach key |
| | 429 | |
| | 430 | # Add post user includes to config file |
| | 431 | # After the GUI-connections allows to patch connections. |
| | 432 | if (-e "/etc/ipsec.user-post.conf") { |
| | 433 | print CONF "include /etc/ipsec.user-post.conf\n"; |
| | 434 | print CONF "\n"; |
| | 435 | } |
| | 436 | |
| | 437 | print SECRETS $last_secrets if ($last_secrets); |
| | 438 | close(CONF); |
| | 439 | close(SECRETS); |
| | 440 | } |
| | 441 | |
| | 442 | # Hook to regenerate the configuration files. |
| | 443 | if ($ENV{"REMOTE_ADDR"} eq "") { |
| | 444 | writeipsecfiles(); |
| | 445 | exit(0); |
| | 446 | } |
| | 447 | |
| | 448 | ### |
| | 449 | ### Save main settings |
| | 450 | ### |
| | 451 | if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') { |
| | 452 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 453 | |
| | 454 | unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'}) |
| | 455 | || $cgiparams{'VPN_IP'} eq '%defaultroute' ) { |
| | 456 | $errormessage = $Lang::tr{'invalid input for hostname'}; |
| | 457 | goto SAVE_ERROR; |
| | 458 | } |
| | 459 | |
| | 460 | unless ($cgiparams{'VPN_DELAYED_START'} =~ /^[0-9]{1,3}$/ ) { #allow 0-999 seconds ! |
| | 461 | $errormessage = $Lang::tr{'invalid time period'}; |
| | 462 | goto SAVE_ERROR; |
| | 463 | } |
| | 464 | |
| | 465 | if ( $cgiparams{'RW_NET'} ne '' and !&General::validipandmask($cgiparams{'RW_NET'}) ) { |
| | 466 | $errormessage = $Lang::tr{'urlfilter invalid ip or mask error'}; |
| | 467 | goto SAVE_ERROR; |
| | 468 | } |
| | 469 | |
| | 470 | $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'}; |
| | 471 | $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'}; |
| | 472 | $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'}; |
| | 473 | $vpnsettings{'RW_NET'} = $cgiparams{'RW_NET'}; |
| | 474 | &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 475 | &writeipsecfiles(); |
| | 476 | if (&vpnenabled) { |
| | 477 | system('/usr/local/bin/ipsecctrl', 'S'); |
| | 478 | } else { |
| | 479 | system('/usr/local/bin/ipsecctrl', 'D'); |
| | 480 | } |
| | 481 | sleep $sleepDelay; |
| | 482 | SAVE_ERROR: |
| | 483 | ### |
| | 484 | ### Reset all step 2 |
| | 485 | ### |
| | 486 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') { |
| | 487 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 488 | |
| | 489 | foreach my $key (keys %confighash) { |
| | 490 | if ($confighash{$key}[4] eq 'cert') { |
| | 491 | delete $confighash{$key}; |
| | 492 | } |
| | 493 | } |
| | 494 | while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) { |
| | 495 | unlink $file |
| | 496 | } |
| | 497 | &cleanssldatabase(); |
| | 498 | if (open(FILE, ">${General::swroot}/vpn/caconfig")) { |
| | 499 | print FILE ""; |
| | 500 | close FILE; |
| | 501 | } |
| | 502 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 503 | &writeipsecfiles(); |
| | 504 | system('/usr/local/bin/ipsecctrl', 'R'); |
| | 505 | sleep $sleepDelay; |
| | 506 | |
| | 507 | ### |
| | 508 | ### Reset all step 1 |
| | 509 | ### |
| | 510 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) { |
| | 511 | &Header::showhttpheaders(); |
| | 512 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 513 | &Header::openbigbox('100%', 'left', '', ''); |
| | 514 | &Header::openbox('100%', 'left', $Lang::tr{'are you sure'}); |
| | 515 | print <<END |
| | 516 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 517 | <table width='100%'> |
| | 518 | <tr> |
| | 519 | <td align='center'> |
| | 520 | <input type='hidden' name='AREUSURE' value='yes' /> |
| | 521 | <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'} |
| | 522 | </td> |
| | 523 | </tr><tr> |
| | 524 | <td align='center'> |
| | 525 | <input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /> |
| | 526 | <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td> |
| | 527 | </tr> |
| | 528 | </table> |
| | 529 | </form> |
| | 530 | END |
| | 531 | ; |
| | 532 | &Header::closebox(); |
| | 533 | &Header::closebigbox(); |
| | 534 | &Header::closepage(); |
| | 535 | exit (0); |
| | 536 | |
| | 537 | ### |
| | 538 | ### Upload CA Certificate |
| | 539 | ### |
| | 540 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) { |
| | 541 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 542 | |
| | 543 | if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) { |
| | 544 | $errormessage = $Lang::tr{'name must only contain characters'}; |
| | 545 | goto UPLOADCA_ERROR; |
| | 546 | } |
| | 547 | |
| | 548 | if (length($cgiparams{'CA_NAME'}) >60) { |
| | 549 | $errormessage = $Lang::tr{'name too long'}; |
| | 550 | goto VPNCONF_ERROR; |
| | 551 | } |
| | 552 | |
| | 553 | if ($cgiparams{'CA_NAME'} eq 'ca') { |
| | 554 | $errormessage = $Lang::tr{'name is invalid'}; |
| | 555 | goto UPLOAD_CA_ERROR; |
| | 556 | } |
| | 557 | |
| | 558 | # Check if there is no other entry with this name |
| | 559 | foreach my $key (keys %cahash) { |
| | 560 | if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) { |
| | 561 | $errormessage = $Lang::tr{'a ca certificate with this name already exists'}; |
| | 562 | goto UPLOADCA_ERROR; |
| | 563 | } |
| | 564 | } |
| | 565 | |
| | 566 | if (ref ($cgiparams{'FH'}) ne 'Fh') { |
| | 567 | $errormessage = $Lang::tr{'there was no file upload'}; |
| | 568 | goto UPLOADCA_ERROR; |
| | 569 | } |
| | 570 | # Move uploaded ca to a temporary file |
| | 571 | (my $fh, my $filename) = tempfile( ); |
| | 572 | if (copy ($cgiparams{'FH'}, $fh) != 1) { |
| | 573 | $errormessage = $!; |
| | 574 | goto UPLOADCA_ERROR; |
| | 575 | } |
| | 576 | my $temp = `/usr/bin/openssl x509 -text -in $filename`; |
| | 577 | if ($temp !~ /CA:TRUE/i) { |
| | 578 | $errormessage = $Lang::tr{'not a valid ca certificate'}; |
| | 579 | unlink ($filename); |
| | 580 | goto UPLOADCA_ERROR; |
| | 581 | } else { |
| | 582 | move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"); |
| | 583 | if ($? ne 0) { |
| | 584 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; |
| | 585 | unlink ($filename); |
| | 586 | goto UPLOADCA_ERROR; |
| | 587 | } |
| | 588 | } |
| | 589 | |
| | 590 | my $key = &General::findhasharraykey (\%cahash); |
| | 591 | $cahash{$key}[0] = $cgiparams{'CA_NAME'}; |
| | 592 | $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem")); |
| | 593 | &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 594 | |
| | 595 | system('/usr/local/bin/ipsecctrl', 'R'); |
| | 596 | sleep $sleepDelay; |
| | 597 | |
| | 598 | UPLOADCA_ERROR: |
| | 599 | |
| | 600 | ### |
| | 601 | ### Display ca certificate |
| | 602 | ### |
| | 603 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) { |
| | 604 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 605 | |
| | 606 | if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") { |
| | 607 | &Header::showhttpheaders(); |
| | 608 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 609 | &Header::openbigbox('100%', 'left', '', ''); |
| | 610 | &Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:"); |
| | 611 | my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`; |
| | 612 | $output = &Header::cleanhtml($output,"y"); |
| | 613 | print "<pre>$output</pre>\n"; |
| | 614 | &Header::closebox(); |
| | 615 | print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>"; |
| | 616 | &Header::closebigbox(); |
| | 617 | &Header::closepage(); |
| | 618 | exit(0); |
| | 619 | } else { |
| | 620 | $errormessage = $Lang::tr{'invalid key'}; |
| | 621 | } |
| | 622 | |
| | 623 | ### |
| | 624 | ### Export ca certificate to browser |
| | 625 | ### |
| | 626 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) { |
| | 627 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 628 | |
| | 629 | if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) { |
| | 630 | print "Content-Type: application/force-download\n"; |
| | 631 | print "Content-Type: application/octet-stream\r\n"; |
| | 632 | print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n"; |
| | 633 | print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`; |
| | 634 | exit(0); |
| | 635 | } else { |
| | 636 | $errormessage = $Lang::tr{'invalid key'}; |
| | 637 | } |
| | 638 | |
| | 639 | ### |
| | 640 | ### Remove ca certificate (step 2) |
| | 641 | ### |
| | 642 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') { |
| | 643 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 644 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 645 | |
| | 646 | if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) { |
| | 647 | foreach my $key (keys %confighash) { |
| | 648 | my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`; |
| | 649 | if ($test =~ /: OK/) { |
| | 650 | # Delete connection |
| | 651 | system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled); |
| | 652 | unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem"); |
| | 653 | unlink ("${General::swroot}/certs/$confighash{$key}[1].p12"); |
| | 654 | delete $confighash{$key}; |
| | 655 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 656 | &writeipsecfiles(); |
| | 657 | } |
| | 658 | } |
| | 659 | unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem"); |
| | 660 | delete $cahash{$cgiparams{'KEY'}}; |
| | 661 | &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 662 | system('/usr/local/bin/ipsecctrl', 'R'); |
| | 663 | sleep $sleepDelay; |
| | 664 | } else { |
| | 665 | $errormessage = $Lang::tr{'invalid key'}; |
| | 666 | } |
| | 667 | ### |
| | 668 | ### Remove ca certificate (step 1) |
| | 669 | ### |
| | 670 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) { |
| | 671 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 672 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 673 | |
| | 674 | my $assignedcerts = 0; |
| | 675 | if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) { |
| | 676 | foreach my $key (keys %confighash) { |
| | 677 | my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`; |
| | 678 | if ($test =~ /: OK/) { |
| | 679 | $assignedcerts++; |
| | 680 | } |
| | 681 | } |
| | 682 | if ($assignedcerts) { |
| | 683 | &Header::showhttpheaders(); |
| | 684 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 685 | &Header::openbigbox('100%', 'left', '', ''); |
| | 686 | &Header::openbox('100%', 'left', $Lang::tr{'are you sure'}); |
| | 687 | print <<END |
| | 688 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 689 | <table width='100%'> |
| | 690 | <tr> |
| | 691 | <td align='center'> |
| | 692 | <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' /> |
| | 693 | <input type='hidden' name='AREUSURE' value='yes' /></td> |
| | 694 | </tr><tr> |
| | 695 | <td align='center'> |
| | 696 | <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b> $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}</td> |
| | 697 | </tr><tr> |
| | 698 | <td align='center'> |
| | 699 | <input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' /> |
| | 700 | <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td> |
| | 701 | </tr> |
| | 702 | </table> |
| | 703 | </form> |
| | 704 | END |
| | 705 | ; |
| | 706 | &Header::closebox(); |
| | 707 | &Header::closebigbox(); |
| | 708 | &Header::closepage(); |
| | 709 | exit (0); |
| | 710 | } else { |
| | 711 | unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem"); |
| | 712 | delete $cahash{$cgiparams{'KEY'}}; |
| | 713 | &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 714 | system('/usr/local/bin/ipsecctrl', 'R'); |
| | 715 | sleep $sleepDelay; |
| | 716 | } |
| | 717 | } else { |
| | 718 | $errormessage = $Lang::tr{'invalid key'}; |
| | 719 | } |
| | 720 | |
| | 721 | ### |
| | 722 | ### Display root certificate |
| | 723 | ### |
| | 724 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} || |
| | 725 | $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) { |
| | 726 | my $output; |
| | 727 | &Header::showhttpheaders(); |
| | 728 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 729 | &Header::openbigbox('100%', 'left', '', ''); |
| | 730 | if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) { |
| | 731 | &Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:"); |
| | 732 | $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`; |
| | 733 | } else { |
| | 734 | &Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:"); |
| | 735 | $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`; |
| | 736 | } |
| | 737 | $output = &Header::cleanhtml($output,"y"); |
| | 738 | print "<pre>$output</pre>\n"; |
| | 739 | &Header::closebox(); |
| | 740 | print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>"; |
| | 741 | &Header::closebigbox(); |
| | 742 | &Header::closepage(); |
| | 743 | exit(0); |
| | 744 | |
| | 745 | ### |
| | 746 | ### Export root certificate to browser |
| | 747 | ### |
| | 748 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) { |
| | 749 | if ( -f "${General::swroot}/ca/cacert.pem" ) { |
| | 750 | print "Content-Type: application/force-download\n"; |
| | 751 | print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n"; |
| | 752 | print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`; |
| | 753 | exit(0); |
| | 754 | } |
| | 755 | ### |
| | 756 | ### Export host certificate to browser |
| | 757 | ### |
| | 758 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) { |
| | 759 | if ( -f "${General::swroot}/certs/hostcert.pem" ) { |
| | 760 | print "Content-Type: application/force-download\n"; |
| | 761 | print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n"; |
| | 762 | print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`; |
| | 763 | exit(0); |
| | 764 | } |
| | 765 | ### |
| | 766 | ### Form for generating/importing the caroot+host certificate |
| | 767 | ### |
| | 768 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} || |
| | 769 | $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) { |
| | 770 | |
| | 771 | if (-f "${General::swroot}/ca/cacert.pem") { |
| | 772 | $errormessage = $Lang::tr{'valid root certificate already exists'}; |
| | 773 | goto ROOTCERT_SKIP; |
| | 774 | } |
| | 775 | |
| | 776 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 777 | # fill in initial values |
| | 778 | if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') { |
| | 779 | if (-e "${General::swroot}/red/active" && open(IPADDR, "${General::swroot}/red/local-ipaddress")) { |
| | 780 | my $ipaddr = <IPADDR>; |
| | 781 | close IPADDR; |
| | 782 | chomp ($ipaddr); |
| | 783 | $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0]; |
| | 784 | if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') { |
| | 785 | $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr; |
| | 786 | } |
| | 787 | } |
| | 788 | $cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'}); |
| | 789 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) { |
| | 790 | &General::log("ipsec", "Importing from p12..."); |
| | 791 | |
| | 792 | if (ref ($cgiparams{'FH'}) ne 'Fh') { |
| | 793 | $errormessage = $Lang::tr{'there was no file upload'}; |
| | 794 | goto ROOTCERT_ERROR; |
| | 795 | } |
| | 796 | |
| | 797 | # Move uploaded certificate request to a temporary file |
| | 798 | (my $fh, my $filename) = tempfile( ); |
| | 799 | if (copy ($cgiparams{'FH'}, $fh) != 1) { |
| | 800 | $errormessage = $!; |
| | 801 | goto ROOTCERT_ERROR; |
| | 802 | } |
| | 803 | |
| | 804 | # Extract the CA certificate from the file |
| | 805 | &General::log("ipsec", "Extracting caroot from p12..."); |
| | 806 | if (open(STDIN, "-|")) { |
| | 807 | my $opt = " pkcs12 -cacerts -nokeys"; |
| | 808 | $opt .= " -in $filename"; |
| | 809 | $opt .= " -out /tmp/newcacert"; |
| | 810 | $errormessage = &callssl ($opt); |
| | 811 | } else { #child |
| | 812 | print "$cgiparams{'P12_PASS'}\n"; |
| | 813 | exit (0); |
| | 814 | } |
| | 815 | |
| | 816 | # Extract the Host certificate from the file |
| | 817 | if (!$errormessage) { |
| | 818 | &General::log("ipsec", "Extracting host cert from p12..."); |
| | 819 | if (open(STDIN, "-|")) { |
| | 820 | my $opt = " pkcs12 -clcerts -nokeys"; |
| | 821 | $opt .= " -in $filename"; |
| | 822 | $opt .= " -out /tmp/newhostcert"; |
| | 823 | $errormessage = &callssl ($opt); |
| | 824 | } else { #child |
| | 825 | print "$cgiparams{'P12_PASS'}\n"; |
| | 826 | exit (0); |
| | 827 | } |
| | 828 | } |
| | 829 | |
| | 830 | # Extract the Host key from the file |
| | 831 | if (!$errormessage) { |
| | 832 | &General::log("ipsec", "Extracting private key from p12..."); |
| | 833 | if (open(STDIN, "-|")) { |
| | 834 | my $opt = " pkcs12 -nocerts -nodes"; |
| | 835 | $opt .= " -in $filename"; |
| | 836 | $opt .= " -out /tmp/newhostkey"; |
| | 837 | $errormessage = &callssl ($opt); |
| | 838 | } else { #child |
| | 839 | print "$cgiparams{'P12_PASS'}\n"; |
| | 840 | exit (0); |
| | 841 | } |
| | 842 | } |
| | 843 | |
| | 844 | if (!$errormessage) { |
| | 845 | &General::log("ipsec", "Moving cacert..."); |
| | 846 | move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem"); |
| | 847 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); |
| | 848 | } |
| | 849 | |
| | 850 | if (!$errormessage) { |
| | 851 | &General::log("ipsec", "Moving host cert..."); |
| | 852 | move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem"); |
| | 853 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); |
| | 854 | } |
| | 855 | |
| | 856 | if (!$errormessage) { |
| | 857 | &General::log("ipsec", "Moving private key..."); |
| | 858 | move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem"); |
| | 859 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); |
| | 860 | } |
| | 861 | |
| | 862 | #cleanup temp files |
| | 863 | unlink ($filename); |
| | 864 | unlink ('/tmp/newcacert'); |
| | 865 | unlink ('/tmp/newhostcert'); |
| | 866 | unlink ('/tmp/newhostkey'); |
| | 867 | if ($errormessage) { |
| | 868 | unlink ("${General::swroot}/ca/cacert.pem"); |
| | 869 | unlink ("${General::swroot}/certs/hostcert.pem"); |
| | 870 | unlink ("${General::swroot}/certs/hostkey.pem"); |
| | 871 | goto ROOTCERT_ERROR; |
| | 872 | } |
| | 873 | |
| | 874 | # Create empty CRL cannot be done because we don't have |
| | 875 | # the private key for this CAROOT |
| | 876 | # IPFire can only import certificates |
| | 877 | |
| | 878 | &General::log("ipsec", "p12 import completed!"); |
| | 879 | &cleanssldatabase(); |
| | 880 | goto ROOTCERT_SUCCESS; |
| | 881 | |
| | 882 | } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') { |
| | 883 | |
| | 884 | # Validate input since the form was submitted |
| | 885 | if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){ |
| | 886 | $errormessage = $Lang::tr{'organization cant be empty'}; |
| | 887 | goto ROOTCERT_ERROR; |
| | 888 | } |
| | 889 | if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) { |
| | 890 | $errormessage = $Lang::tr{'organization too long'}; |
| | 891 | goto ROOTCERT_ERROR; |
| | 892 | } |
| | 893 | if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 894 | $errormessage = $Lang::tr{'invalid input for organization'}; |
| | 895 | goto ROOTCERT_ERROR; |
| | 896 | } |
| | 897 | if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){ |
| | 898 | $errormessage = $Lang::tr{'hostname cant be empty'}; |
| | 899 | goto ROOTCERT_ERROR; |
| | 900 | } |
| | 901 | unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) { |
| | 902 | $errormessage = $Lang::tr{'invalid input for hostname'}; |
| | 903 | goto ROOTCERT_ERROR; |
| | 904 | } |
| | 905 | if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) { |
| | 906 | $errormessage = $Lang::tr{'invalid input for e-mail address'}; |
| | 907 | goto ROOTCERT_ERROR; |
| | 908 | } |
| | 909 | if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) { |
| | 910 | $errormessage = $Lang::tr{'e-mail address too long'}; |
| | 911 | goto ROOTCERT_ERROR; |
| | 912 | } |
| | 913 | if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 914 | $errormessage = $Lang::tr{'invalid input for department'}; |
| | 915 | goto ROOTCERT_ERROR; |
| | 916 | } |
| | 917 | if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 918 | $errormessage = $Lang::tr{'invalid input for city'}; |
| | 919 | goto ROOTCERT_ERROR; |
| | 920 | } |
| | 921 | if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 922 | $errormessage = $Lang::tr{'invalid input for state or province'}; |
| | 923 | goto ROOTCERT_ERROR; |
| | 924 | } |
| | 925 | if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) { |
| | 926 | $errormessage = $Lang::tr{'invalid input for country'}; |
| | 927 | goto ROOTCERT_ERROR; |
| | 928 | } |
| | 929 | #the exact syntax is a list comma separated of |
| | 930 | # email:any-validemail |
| | 931 | # URI: a uniform resource indicator |
| | 932 | # DNS: a DNS domain name |
| | 933 | # RID: a registered OBJECT IDENTIFIER |
| | 934 | # IP: an IP address |
| | 935 | # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com |
| | 936 | |
| | 937 | if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) { |
| | 938 | $errormessage = $Lang::tr{'vpn altname syntax'}; |
| | 939 | goto VPNCONF_ERROR; |
| | 940 | } |
| | 941 | |
| | 942 | # Copy the cgisettings to vpnsettings and save the configfile |
| | 943 | $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'}; |
| | 944 | $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'}; |
| | 945 | $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'}; |
| | 946 | $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'}; |
| | 947 | $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'}; |
| | 948 | $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'}; |
| | 949 | $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'}; |
| | 950 | &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 951 | |
| | 952 | # Replace empty strings with a . |
| | 953 | (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./; |
| | 954 | (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./; |
| | 955 | (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./; |
| | 956 | |
| | 957 | # Create the CA certificate |
| | 958 | if (!$errormessage) { |
| | 959 | &General::log("ipsec", "Creating cacert..."); |
| | 960 | if (open(STDIN, "-|")) { |
| | 961 | my $opt = " req -x509 -sha256 -nodes"; |
| | 962 | $opt .= " -days 999999"; |
| | 963 | $opt .= " -newkey rsa:4096"; |
| | 964 | $opt .= " -keyout ${General::swroot}/private/cakey.pem"; |
| | 965 | $opt .= " -out ${General::swroot}/ca/cacert.pem"; |
| | 966 | |
| | 967 | $errormessage = &callssl ($opt); |
| | 968 | } else { #child |
| | 969 | print "$cgiparams{'ROOTCERT_COUNTRY'}\n"; |
| | 970 | print "$state\n"; |
| | 971 | print "$city\n"; |
| | 972 | print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n"; |
| | 973 | print "$ou\n"; |
| | 974 | print "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n"; |
| | 975 | print "$cgiparams{'ROOTCERT_EMAIL'}\n"; |
| | 976 | exit (0); |
| | 977 | } |
| | 978 | } |
| | 979 | |
| | 980 | # Create the Host certificate request |
| | 981 | if (!$errormessage) { |
| | 982 | &General::log("ipsec", "Creating host cert..."); |
| | 983 | if (open(STDIN, "-|")) { |
| | 984 | my $opt = " req -sha256 -nodes"; |
| | 985 | $opt .= " -newkey rsa:2048"; |
| | 986 | $opt .= " -keyout ${General::swroot}/certs/hostkey.pem"; |
| | 987 | $opt .= " -out ${General::swroot}/certs/hostreq.pem"; |
| | 988 | $errormessage = &callssl ($opt); |
| | 989 | } else { #child |
| | 990 | print "$cgiparams{'ROOTCERT_COUNTRY'}\n"; |
| | 991 | print "$state\n"; |
| | 992 | print "$city\n"; |
| | 993 | print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n"; |
| | 994 | print "$ou\n"; |
| | 995 | print "$cgiparams{'ROOTCERT_HOSTNAME'}\n"; |
| | 996 | print "$cgiparams{'ROOTCERT_EMAIL'}\n"; |
| | 997 | print ".\n"; |
| | 998 | print ".\n"; |
| | 999 | exit (0); |
| | 1000 | } |
| | 1001 | } |
| | 1002 | |
| | 1003 | # Sign the host certificate request |
| | 1004 | if (!$errormessage) { |
| | 1005 | &General::log("ipsec", "Self signing host cert..."); |
| | 1006 | |
| | 1007 | #No easy way for specifying the contain of subjectAltName without writing a config file... |
| | 1008 | my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX'); |
| | 1009 | print $fh <<END |
| | 1010 | basicConstraints=CA:FALSE |
| | 1011 | nsComment="OpenSSL Generated Certificate" |
| | 1012 | subjectKeyIdentifier=hash |
| | 1013 | authorityKeyIdentifier=keyid,issuer:always |
| | 1014 | extendedKeyUsage = serverAuth |
| | 1015 | END |
| | 1016 | ; |
| | 1017 | print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'}); |
| | 1018 | close ($fh); |
| | 1019 | |
| | 1020 | my $opt = " ca -md sha256 -days 999999"; |
| | 1021 | $opt .= " -batch -notext"; |
| | 1022 | $opt .= " -in ${General::swroot}/certs/hostreq.pem"; |
| | 1023 | $opt .= " -out ${General::swroot}/certs/hostcert.pem"; |
| | 1024 | $opt .= " -extfile $v3extname"; |
| | 1025 | $errormessage = &callssl ($opt); |
| | 1026 | unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed |
| | 1027 | unlink ($v3extname); |
| | 1028 | } |
| | 1029 | |
| | 1030 | # Create an empty CRL |
| | 1031 | if (!$errormessage) { |
| | 1032 | &General::log("ipsec", "Creating emptycrl..."); |
| | 1033 | my $opt = " ca -gencrl"; |
| | 1034 | $opt .= " -out ${General::swroot}/crls/cacrl.pem"; |
| | 1035 | $errormessage = &callssl ($opt); |
| | 1036 | } |
| | 1037 | |
| | 1038 | # Successfully build CA / CERT! |
| | 1039 | if (!$errormessage) { |
| | 1040 | &cleanssldatabase(); |
| | 1041 | goto ROOTCERT_SUCCESS; |
| | 1042 | } |
| | 1043 | |
| | 1044 | #Cleanup |
| | 1045 | unlink ("${General::swroot}/ca/cacert.pem"); |
| | 1046 | unlink ("${General::swroot}/certs/hostkey.pem"); |
| | 1047 | unlink ("${General::swroot}/certs/hostcert.pem"); |
| | 1048 | unlink ("${General::swroot}/crls/cacrl.pem"); |
| | 1049 | &cleanssldatabase(); |
| | 1050 | } |
| | 1051 | |
| | 1052 | ROOTCERT_ERROR: |
| | 1053 | &Header::showhttpheaders(); |
| | 1054 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 1055 | &Header::openbigbox('100%', 'left', '', $errormessage); |
| | 1056 | if ($errormessage) { |
| | 1057 | &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); |
| | 1058 | print "<class name='base'>$errormessage"; |
| | 1059 | print " </class>"; |
| | 1060 | &Header::closebox(); |
| | 1061 | } |
| | 1062 | &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:"); |
| | 1063 | print <<END |
| | 1064 | <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'> |
| | 1065 | <table width='100%' border='0' cellspacing='1' cellpadding='0'> |
| | 1066 | <tr><td width='40%' class='base'>$Lang::tr{'organization name'}: <img src='/blob.gif' alt='*' /></td> |
| | 1067 | <td width='60%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td></tr> |
| | 1068 | <tr><td class='base'>$Lang::tr{'ipfires hostname'}: <img src='/blob.gif' alt='*' /></td> |
| | 1069 | <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td></tr> |
| | 1070 | <tr><td class='base'>$Lang::tr{'your e-mail'}:</td> |
| | 1071 | <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td></tr> |
| | 1072 | <tr><td class='base'>$Lang::tr{'your department'}:</td> |
| | 1073 | <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td></tr> |
| | 1074 | <tr><td class='base'>$Lang::tr{'city'}:</td> |
| | 1075 | <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td></tr> |
| | 1076 | <tr><td class='base'>$Lang::tr{'state or province'}:</td> |
| | 1077 | <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td></tr> |
| | 1078 | <tr><td class='base'>$Lang::tr{'country'}:</td> |
| | 1079 | <td class='base'><select name='ROOTCERT_COUNTRY'> |
| | 1080 | END |
| | 1081 | ; |
| | 1082 | foreach my $country (sort keys %{Countries::countries}) { |
| | 1083 | print "<option value='$Countries::countries{$country}'"; |
| | 1084 | if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) { |
| | 1085 | print " selected='selected'"; |
| | 1086 | } |
| | 1087 | print ">$country</option>"; |
| | 1088 | } |
| | 1089 | print <<END |
| | 1090 | </select></td></tr> |
| | 1091 | <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)</td> |
| | 1092 | <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr> |
| | 1093 | <tr><td> </td> |
| | 1094 | <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr> |
| | 1095 | <tr><td class='base' colspan='2' align='left'> |
| | 1096 | <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: |
| | 1097 | $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'} |
| | 1098 | </td></tr> |
| | 1099 | <tr><td colspan='2'><hr></td></tr> |
| | 1100 | <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td> |
| | 1101 | <td nowrap='nowrap'><input type='file' name='FH' size='32' /></td></tr> |
| | 1102 | <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td> |
| | 1103 | <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td></tr> |
| | 1104 | <tr><td> </td> |
| | 1105 | <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td></tr> |
| | 1106 | <tr><td class='base' colspan='2' align='left'> |
| | 1107 | <img src='/blob.gif' alt='*' /> $Lang::tr{'required field'}</td></tr> |
| | 1108 | </table></form> |
| | 1109 | END |
| | 1110 | ; |
| | 1111 | &Header::closebox(); |
| | 1112 | &Header::closebigbox(); |
| | 1113 | &Header::closepage(); |
| | 1114 | exit(0); |
| | 1115 | |
| | 1116 | ROOTCERT_SUCCESS: |
| | 1117 | if (&vpnenabled) { |
| | 1118 | system('/usr/local/bin/ipsecctrl', 'S'); |
| | 1119 | sleep $sleepDelay; |
| | 1120 | } |
| | 1121 | ROOTCERT_SKIP: |
| | 1122 | ### |
| | 1123 | ### Export PKCS12 file to browser |
| | 1124 | ### |
| | 1125 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) { |
| | 1126 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1127 | print "Content-Type: application/force-download\n"; |
| | 1128 | print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n"; |
| | 1129 | print "Content-Type: application/octet-stream\r\n\r\n"; |
| | 1130 | print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`; |
| | 1131 | exit (0); |
| | 1132 | |
| | 1133 | ### |
| | 1134 | ### Display certificate |
| | 1135 | ### |
| | 1136 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) { |
| | 1137 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1138 | |
| | 1139 | if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") { |
| | 1140 | &Header::showhttpheaders(); |
| | 1141 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 1142 | &Header::openbigbox('100%', 'left', '', ''); |
| | 1143 | &Header::openbox('100%', 'left', "$Lang::tr{'cert'}:"); |
| | 1144 | my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`; |
| | 1145 | $output = &Header::cleanhtml($output,"y"); |
| | 1146 | print "<pre>$output</pre>\n"; |
| | 1147 | &Header::closebox(); |
| | 1148 | print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>"; |
| | 1149 | &Header::closebigbox(); |
| | 1150 | &Header::closepage(); |
| | 1151 | exit(0); |
| | 1152 | } |
| | 1153 | |
| | 1154 | ### |
| | 1155 | ### Export Certificate to browser |
| | 1156 | ### |
| | 1157 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) { |
| | 1158 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1159 | |
| | 1160 | if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") { |
| | 1161 | print "Content-Type: application/force-download\n"; |
| | 1162 | print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n"; |
| | 1163 | print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`; |
| | 1164 | exit (0); |
| | 1165 | } |
| | 1166 | |
| | 1167 | ### |
| | 1168 | ### Enable/Disable connection |
| | 1169 | ### |
| | 1170 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) { |
| | 1171 | |
| | 1172 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 1173 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1174 | |
| | 1175 | if ($confighash{$cgiparams{'KEY'}}) { |
| | 1176 | if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') { |
| | 1177 | $confighash{$cgiparams{'KEY'}}[0] = 'on'; |
| | 1178 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1179 | &writeipsecfiles(); |
| | 1180 | system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled); |
| | 1181 | } else { |
| | 1182 | system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled); |
| | 1183 | $confighash{$cgiparams{'KEY'}}[0] = 'off'; |
| | 1184 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1185 | &writeipsecfiles(); |
| | 1186 | } |
| | 1187 | sleep $sleepDelay; |
| | 1188 | } else { |
| | 1189 | $errormessage = $Lang::tr{'invalid key'}; |
| | 1190 | } |
| | 1191 | |
| | 1192 | ### |
| | 1193 | ### Restart connection |
| | 1194 | ### |
| | 1195 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) { |
| | 1196 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 1197 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1198 | |
| | 1199 | if ($confighash{$cgiparams{'KEY'}}) { |
| | 1200 | if (&vpnenabled) { |
| | 1201 | system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}); |
| | 1202 | sleep $sleepDelay; |
| | 1203 | } |
| | 1204 | } else { |
| | 1205 | $errormessage = $Lang::tr{'invalid key'}; |
| | 1206 | } |
| | 1207 | |
| | 1208 | ### |
| | 1209 | ### Remove connection |
| | 1210 | ### |
| | 1211 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) { |
| | 1212 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 1213 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1214 | |
| | 1215 | if ($confighash{$cgiparams{'KEY'}}) { |
| | 1216 | system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled); |
| | 1217 | unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); |
| | 1218 | unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); |
| | 1219 | delete $confighash{$cgiparams{'KEY'}}; |
| | 1220 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1221 | &writeipsecfiles(); |
| | 1222 | } else { |
| | 1223 | $errormessage = $Lang::tr{'invalid key'}; |
| | 1224 | } |
| | 1225 | &General::firewall_reload(); |
| | 1226 | ### |
| | 1227 | ### Choose between adding a host-net or net-net connection |
| | 1228 | ### |
| | 1229 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') { |
| | 1230 | &Header::showhttpheaders(); |
| | 1231 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 1232 | &Header::openbigbox('100%', 'left', '', ''); |
| | 1233 | &Header::openbox('100%', 'left', $Lang::tr{'connection type'}); |
| | 1234 | print <<END |
| | 1235 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 1236 | <b>$Lang::tr{'connection type'}:</b><br /> |
| | 1237 | <table> |
| | 1238 | <tr><td><input type='radio' name='TYPE' value='host' checked='checked' /></td> |
| | 1239 | <td class='base'>$Lang::tr{'host to net vpn'}</td> |
| | 1240 | </tr><tr> |
| | 1241 | <td><input type='radio' name='TYPE' value='net' /></td> |
| | 1242 | <td class='base'>$Lang::tr{'net to net vpn'}</td> |
| | 1243 | </tr><tr> |
| | 1244 | <td align='center' colspan='2'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td> |
| | 1245 | </tr> |
| | 1246 | </table></form> |
| | 1247 | END |
| | 1248 | ; |
| | 1249 | &Header::closebox(); |
| | 1250 | &Header::closebigbox(); |
| | 1251 | &Header::closepage(); |
| | 1252 | exit (0); |
| | 1253 | ### |
| | 1254 | ### Adding/Editing/Saving a connection |
| | 1255 | ### |
| | 1256 | } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) || |
| | 1257 | ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) || |
| | 1258 | ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) { |
| | 1259 | |
| | 1260 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 1261 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 1262 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1263 | |
| | 1264 | if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) { |
| | 1265 | if (! $confighash{$cgiparams{'KEY'}}[0]) { |
| | 1266 | $errormessage = $Lang::tr{'invalid key'}; |
| | 1267 | goto VPNCONF_END; |
| | 1268 | } |
| | 1269 | $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0]; |
| | 1270 | $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1]; |
| | 1271 | $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3]; |
| | 1272 | $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4]; |
| | 1273 | $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5]; |
| | 1274 | #$cgiparams{'free'} = $confighash{$cgiparams{'KEY'}}[6]; |
| | 1275 | $cgiparams{'LOCAL_ID'} = $confighash{$cgiparams{'KEY'}}[7]; |
| | 1276 | my @local_subnets = split(",", $confighash{$cgiparams{'KEY'}}[8]); |
| | 1277 | $cgiparams{'LOCAL_SUBNET'} = join(/\|/, @local_subnets); |
| | 1278 | $cgiparams{'REMOTE_ID'} = $confighash{$cgiparams{'KEY'}}[9]; |
| | 1279 | $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10]; |
| | 1280 | my @remote_subnets = split(",", $confighash{$cgiparams{'KEY'}}[11]); |
| | 1281 | $cgiparams{'REMOTE_SUBNET'} = join(/\|/, @remote_subnets); |
| | 1282 | $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25]; |
| | 1283 | $cgiparams{'DPD_ACTION'} = $confighash{$cgiparams{'KEY'}}[27]; |
| | 1284 | $cgiparams{'IKE_VERSION'} = $confighash{$cgiparams{'KEY'}}[29]; |
| | 1285 | $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18]; |
| | 1286 | $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19]; |
| | 1287 | $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20]; |
| | 1288 | $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16]; |
| | 1289 | $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21]; |
| | 1290 | $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22]; |
| | 1291 | $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23]; |
| | 1292 | if ($cgiparams{'ESP_GROUPTYPE'} eq "") { |
| | 1293 | $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'}; |
| | 1294 | } |
| | 1295 | $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17]; |
| | 1296 | $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13]; |
| | 1297 | $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24]; |
| | 1298 | $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28]; |
| | 1299 | $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30]; |
| | 1300 | $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31]; |
| | 1301 | $cgiparams{'FORCE_MOBIKE'} = $confighash{$cgiparams{'KEY'}}[32]; |
| | 1302 | |
| | 1303 | if (!$cgiparams{'DPD_DELAY'}) { |
| | 1304 | $cgiparams{'DPD_DELAY'} = 30; |
| | 1305 | } |
| | 1306 | |
| | 1307 | if (!$cgiparams{'DPD_TIMEOUT'}) { |
| | 1308 | $cgiparams{'DPD_TIMEOUT'} = 120; |
| | 1309 | } |
| | 1310 | |
| | 1311 | } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { |
| | 1312 | $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); |
| | 1313 | if ($cgiparams{'TYPE'} !~ /^(host|net)$/) { |
| | 1314 | $errormessage = $Lang::tr{'connection type is invalid'}; |
| | 1315 | goto VPNCONF_ERROR; |
| | 1316 | } |
| | 1317 | |
| | 1318 | if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) { |
| | 1319 | $errormessage = $Lang::tr{'name must only contain characters'}; |
| | 1320 | goto VPNCONF_ERROR; |
| | 1321 | } |
| | 1322 | |
| | 1323 | if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) { |
| | 1324 | $errormessage = $Lang::tr{'name is invalid'}; |
| | 1325 | goto VPNCONF_ERROR; |
| | 1326 | } |
| | 1327 | |
| | 1328 | if (length($cgiparams{'NAME'}) >60) { |
| | 1329 | $errormessage = $Lang::tr{'name too long'}; |
| | 1330 | goto VPNCONF_ERROR; |
| | 1331 | } |
| | 1332 | |
| | 1333 | # Check if there is no other entry with this name |
| | 1334 | if (! $cgiparams{'KEY'}) { #only for add |
| | 1335 | foreach my $key (keys %confighash) { |
| | 1336 | if ($confighash{$key}[1] eq $cgiparams{'NAME'}) { |
| | 1337 | $errormessage = $Lang::tr{'a connection with this name already exists'}; |
| | 1338 | goto VPNCONF_ERROR; |
| | 1339 | } |
| | 1340 | } |
| | 1341 | } |
| | 1342 | |
| | 1343 | if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) { |
| | 1344 | $errormessage = $Lang::tr{'invalid input for remote host/ip'}; |
| | 1345 | goto VPNCONF_ERROR; |
| | 1346 | } |
| | 1347 | |
| | 1348 | if ($cgiparams{'REMOTE'}) { |
| | 1349 | if (($cgiparams{'REMOTE'} ne '%any') && (! &General::validip($cgiparams{'REMOTE'}))) { |
| | 1350 | if (! &General::validfqdn ($cgiparams{'REMOTE'})) { |
| | 1351 | $errormessage = $Lang::tr{'invalid input for remote host/ip'}; |
| | 1352 | goto VPNCONF_ERROR; |
| | 1353 | } else { |
| | 1354 | if (&valid_dns_host($cgiparams{'REMOTE'})) { |
| | 1355 | $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}"; |
| | 1356 | } |
| | 1357 | } |
| | 1358 | } |
| | 1359 | } |
| | 1360 | |
| | 1361 | my @local_subnets = split(",", $cgiparams{'LOCAL_SUBNET'}); |
| | 1362 | foreach my $subnet (@local_subnets) { |
| | 1363 | unless (&Network::check_subnet($subnet)) { |
| | 1364 | $errormessage = $Lang::tr{'local subnet is invalid'}; |
| | 1365 | goto VPNCONF_ERROR; |
| | 1366 | } |
| | 1367 | } |
| | 1368 | |
| | 1369 | # Allow only one roadwarrior/psk without remote IP-address |
| | 1370 | if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') { |
| | 1371 | foreach my $key (keys %confighash) { |
| | 1372 | if ( ($cgiparams{'KEY'} ne $key) && |
| | 1373 | ($confighash{$key}[4] eq 'psk') && |
| | 1374 | ($confighash{$key}[10] eq '') ) { |
| | 1375 | $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'}; |
| | 1376 | goto VPNCONF_ERROR; |
| | 1377 | } |
| | 1378 | } |
| | 1379 | } |
| | 1380 | |
| | 1381 | if ($cgiparams{'TYPE'} eq 'net') { |
| | 1382 | my @remote_subnets = split(",", $cgiparams{'REMOTE_SUBNET'}); |
| | 1383 | foreach my $subnet (@remote_subnets) { |
| | 1384 | unless (&Network::check_subnet($subnet)) { |
| | 1385 | $errormessage = $Lang::tr{'remote subnet is invalid'}; |
| | 1386 | goto VPNCONF_ERROR; |
| | 1387 | } |
| | 1388 | } |
| | 1389 | } |
| | 1390 | |
| | 1391 | if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) { |
| | 1392 | $errormessage = $Lang::tr{'invalid input'}; |
| | 1393 | goto VPNCONF_ERROR; |
| | 1394 | } |
| | 1395 | if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) { |
| | 1396 | $errormessage = $Lang::tr{'invalid input'}; |
| | 1397 | goto VPNCONF_ERROR; |
| | 1398 | } |
| | 1399 | |
| | 1400 | # Allow nothing or a string (DN,FDQN,) beginning with @ |
| | 1401 | # with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck |
| | 1402 | if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) || |
| | 1403 | ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) || |
| | 1404 | (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne '')) |
| | 1405 | ) { |
| | 1406 | $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' . |
| | 1407 | 'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' . |
| | 1408 | 'FQDN: @ipfire.org<br />' . |
| | 1409 | 'USER_FQDN: info@ipfire.org<br />' . |
| | 1410 | 'IPV4_ADDR: 123.123.123.123'; |
| | 1411 | goto VPNCONF_ERROR; |
| | 1412 | } |
| | 1413 | # If Auth is DN, verify existance of Remote ID. |
| | 1414 | if ( $cgiparams{'REMOTE_ID'} eq '' && ( |
| | 1415 | $cgiparams{'AUTH'} eq 'auth-dn'|| # while creation |
| | 1416 | $confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing |
| | 1417 | $errormessage = $Lang::tr{'vpn missing remote id'}; |
| | 1418 | goto VPNCONF_ERROR; |
| | 1419 | } |
| | 1420 | |
| | 1421 | if ($cgiparams{'TYPE'} eq 'net'){ |
| | 1422 | $warnmessage=&General::checksubnets('',$cgiparams{'REMOTE_SUBNET'},'ipsec'); |
| | 1423 | if ($warnmessage ne ''){ |
| | 1424 | $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage; |
| | 1425 | } |
| | 1426 | } |
| | 1427 | |
| | 1428 | if ($cgiparams{'AUTH'} eq 'psk') { |
| | 1429 | if (! length($cgiparams{'PSK'}) ) { |
| | 1430 | $errormessage = $Lang::tr{'pre-shared key is too short'}; |
| | 1431 | goto VPNCONF_ERROR; |
| | 1432 | } |
| | 1433 | if ($cgiparams{'PSK'} =~ /'/) { |
| | 1434 | $cgiparams{'PSK'} =~ tr/'/ /; |
| | 1435 | $errormessage = $Lang::tr{'invalid characters found in pre-shared key'}; |
| | 1436 | goto VPNCONF_ERROR; |
| | 1437 | } |
| | 1438 | } elsif ($cgiparams{'AUTH'} eq 'certreq') { |
| | 1439 | if ($cgiparams{'KEY'}) { |
| | 1440 | $errormessage = $Lang::tr{'cant change certificates'}; |
| | 1441 | goto VPNCONF_ERROR; |
| | 1442 | } |
| | 1443 | if (ref ($cgiparams{'FH'}) ne 'Fh') { |
| | 1444 | $errormessage = $Lang::tr{'there was no file upload'}; |
| | 1445 | goto VPNCONF_ERROR; |
| | 1446 | } |
| | 1447 | |
| | 1448 | # Move uploaded certificate request to a temporary file |
| | 1449 | (my $fh, my $filename) = tempfile( ); |
| | 1450 | if (copy ($cgiparams{'FH'}, $fh) != 1) { |
| | 1451 | $errormessage = $!; |
| | 1452 | goto VPNCONF_ERROR; |
| | 1453 | } |
| | 1454 | |
| | 1455 | # Sign the certificate request |
| | 1456 | &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}..."); |
| | 1457 | my $opt = " ca -md sha256 -days 999999"; |
| | 1458 | $opt .= " -batch -notext"; |
| | 1459 | $opt .= " -in $filename"; |
| | 1460 | $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"; |
| | 1461 | |
| | 1462 | if ( $errormessage = &callssl ($opt) ) { |
| | 1463 | unlink ($filename); |
| | 1464 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1465 | &cleanssldatabase(); |
| | 1466 | goto VPNCONF_ERROR; |
| | 1467 | } else { |
| | 1468 | unlink ($filename); |
| | 1469 | &cleanssldatabase(); |
| | 1470 | } |
| | 1471 | |
| | 1472 | $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1473 | if ($cgiparams{'CERT_NAME'} eq '') { |
| | 1474 | $errormessage = $Lang::tr{'could not retrieve common name from certificate'}; |
| | 1475 | goto VPNCONF_ERROR; |
| | 1476 | } |
| | 1477 | } elsif ($cgiparams{'AUTH'} eq 'pkcs12') { |
| | 1478 | &General::log("ipsec", "Importing from p12..."); |
| | 1479 | |
| | 1480 | if (ref ($cgiparams{'FH'}) ne 'Fh') { |
| | 1481 | $errormessage = $Lang::tr{'there was no file upload'}; |
| | 1482 | goto ROOTCERT_ERROR; |
| | 1483 | } |
| | 1484 | |
| | 1485 | # Move uploaded certificate request to a temporary file |
| | 1486 | (my $fh, my $filename) = tempfile( ); |
| | 1487 | if (copy ($cgiparams{'FH'}, $fh) != 1) { |
| | 1488 | $errormessage = $!; |
| | 1489 | goto ROOTCERT_ERROR; |
| | 1490 | } |
| | 1491 | |
| | 1492 | # Extract the CA certificate from the file |
| | 1493 | &General::log("ipsec", "Extracting caroot from p12..."); |
| | 1494 | if (open(STDIN, "-|")) { |
| | 1495 | my $opt = " pkcs12 -cacerts -nokeys"; |
| | 1496 | $opt .= " -in $filename"; |
| | 1497 | $opt .= " -out /tmp/newcacert"; |
| | 1498 | $errormessage = &callssl ($opt); |
| | 1499 | } else { #child |
| | 1500 | print "$cgiparams{'P12_PASS'}\n"; |
| | 1501 | exit (0); |
| | 1502 | } |
| | 1503 | |
| | 1504 | # Extract the Host certificate from the file |
| | 1505 | if (!$errormessage) { |
| | 1506 | &General::log("ipsec", "Extracting host cert from p12..."); |
| | 1507 | if (open(STDIN, "-|")) { |
| | 1508 | my $opt = " pkcs12 -clcerts -nokeys"; |
| | 1509 | $opt .= " -in $filename"; |
| | 1510 | $opt .= " -out /tmp/newhostcert"; |
| | 1511 | $errormessage = &callssl ($opt); |
| | 1512 | } else { #child |
| | 1513 | print "$cgiparams{'P12_PASS'}\n"; |
| | 1514 | exit (0); |
| | 1515 | } |
| | 1516 | } |
| | 1517 | |
| | 1518 | if (!$errormessage) { |
| | 1519 | &General::log("ipsec", "Moving cacert..."); |
| | 1520 | #If CA have new subject, add it to our list of CA |
| | 1521 | my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert')); |
| | 1522 | my @names; |
| | 1523 | foreach my $x (keys %cahash) { |
| | 1524 | $casubject='' if ($cahash{$x}[1] eq $casubject); |
| | 1525 | unshift (@names,$cahash{$x}[0]); |
| | 1526 | } |
| | 1527 | if ($casubject) { # a new one! |
| | 1528 | my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`; |
| | 1529 | if ($temp !~ /CA:TRUE/i) { |
| | 1530 | $errormessage = $Lang::tr{'not a valid ca certificate'}; |
| | 1531 | } else { |
| | 1532 | #compute a name for it |
| | 1533 | my $idx=0; |
| | 1534 | while (grep(/Imported-$idx/, @names) ) {$idx++}; |
| | 1535 | $cgiparams{'CA_NAME'}="Imported-$idx"; |
| | 1536 | $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert')); |
| | 1537 | move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"); |
| | 1538 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); |
| | 1539 | if (!$errormessage) { |
| | 1540 | my $key = &General::findhasharraykey (\%cahash); |
| | 1541 | $cahash{$key}[0] = $cgiparams{'CA_NAME'}; |
| | 1542 | $cahash{$key}[1] = $casubject; |
| | 1543 | &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 1544 | system('/usr/local/bin/ipsecctrl', 'R'); |
| | 1545 | } |
| | 1546 | } |
| | 1547 | } |
| | 1548 | } |
| | 1549 | if (!$errormessage) { |
| | 1550 | &General::log("ipsec", "Moving host cert..."); |
| | 1551 | move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1552 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); |
| | 1553 | } |
| | 1554 | |
| | 1555 | #cleanup temp files |
| | 1556 | unlink ($filename); |
| | 1557 | unlink ('/tmp/newcacert'); |
| | 1558 | unlink ('/tmp/newhostcert'); |
| | 1559 | if ($errormessage) { |
| | 1560 | unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"); |
| | 1561 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1562 | goto VPNCONF_ERROR; |
| | 1563 | } |
| | 1564 | &General::log("ipsec", "p12 import completed!"); |
| | 1565 | } elsif ($cgiparams{'AUTH'} eq 'certfile') { |
| | 1566 | if ($cgiparams{'KEY'}) { |
| | 1567 | $errormessage = $Lang::tr{'cant change certificates'}; |
| | 1568 | goto VPNCONF_ERROR; |
| | 1569 | } |
| | 1570 | if (ref ($cgiparams{'FH'}) ne 'Fh') { |
| | 1571 | $errormessage = $Lang::tr{'there was no file upload'}; |
| | 1572 | goto VPNCONF_ERROR; |
| | 1573 | } |
| | 1574 | # Move uploaded certificate to a temporary file |
| | 1575 | (my $fh, my $filename) = tempfile( ); |
| | 1576 | if (copy ($cgiparams{'FH'}, $fh) != 1) { |
| | 1577 | $errormessage = $!; |
| | 1578 | goto VPNCONF_ERROR; |
| | 1579 | } |
| | 1580 | |
| | 1581 | # Verify the certificate has a valid CA and move it |
| | 1582 | &General::log("ipsec", "Validating imported cert against our known CA..."); |
| | 1583 | my $validca = 1; #assume ok |
| | 1584 | my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`; |
| | 1585 | if ($test !~ /: OK/) { |
| | 1586 | my $validca = 0; |
| | 1587 | foreach my $key (keys %cahash) { |
| | 1588 | $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`; |
| | 1589 | if ($test =~ /: OK/) { |
| | 1590 | $validca = 1; |
| | 1591 | last; |
| | 1592 | } |
| | 1593 | } |
| | 1594 | } |
| | 1595 | if (! $validca) { |
| | 1596 | $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'}; |
| | 1597 | unlink ($filename); |
| | 1598 | goto VPNCONF_ERROR; |
| | 1599 | } else { |
| | 1600 | move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1601 | if ($? ne 0) { |
| | 1602 | $errormessage = "$Lang::tr{'certificate file move failed'}: $!"; |
| | 1603 | unlink ($filename); |
| | 1604 | goto VPNCONF_ERROR; |
| | 1605 | } |
| | 1606 | } |
| | 1607 | |
| | 1608 | $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1609 | if ($cgiparams{'CERT_NAME'} eq '') { |
| | 1610 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1611 | $errormessage = $Lang::tr{'could not retrieve common name from certificate'}; |
| | 1612 | goto VPNCONF_ERROR; |
| | 1613 | } |
| | 1614 | } elsif ($cgiparams{'AUTH'} eq 'certgen') { |
| | 1615 | if ($cgiparams{'KEY'}) { |
| | 1616 | $errormessage = $Lang::tr{'cant change certificates'}; |
| | 1617 | goto VPNCONF_ERROR; |
| | 1618 | } |
| | 1619 | # Validate input since the form was submitted |
| | 1620 | if (length($cgiparams{'CERT_NAME'}) >60) { |
| | 1621 | $errormessage = $Lang::tr{'name too long'}; |
| | 1622 | goto VPNCONF_ERROR; |
| | 1623 | } |
| | 1624 | if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) { |
| | 1625 | $errormessage = $Lang::tr{'invalid input for name'}; |
| | 1626 | goto VPNCONF_ERROR; |
| | 1627 | } |
| | 1628 | if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) { |
| | 1629 | $errormessage = $Lang::tr{'invalid input for e-mail address'}; |
| | 1630 | goto VPNCONF_ERROR; |
| | 1631 | } |
| | 1632 | if (length($cgiparams{'CERT_EMAIL'}) > 40) { |
| | 1633 | $errormessage = $Lang::tr{'e-mail address too long'}; |
| | 1634 | goto VPNCONF_ERROR; |
| | 1635 | } |
| | 1636 | if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 1637 | $errormessage = $Lang::tr{'invalid input for department'}; |
| | 1638 | goto VPNCONF_ERROR; |
| | 1639 | } |
| | 1640 | if (length($cgiparams{'CERT_ORGANIZATION'}) >60) { |
| | 1641 | $errormessage = $Lang::tr{'organization too long'}; |
| | 1642 | goto VPNCONF_ERROR; |
| | 1643 | } |
| | 1644 | if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) { |
| | 1645 | $errormessage = $Lang::tr{'invalid input for organization'}; |
| | 1646 | goto VPNCONF_ERROR; |
| | 1647 | } |
| | 1648 | if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 1649 | $errormessage = $Lang::tr{'invalid input for city'}; |
| | 1650 | goto VPNCONF_ERROR; |
| | 1651 | } |
| | 1652 | if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) { |
| | 1653 | $errormessage = $Lang::tr{'invalid input for state or province'}; |
| | 1654 | goto VPNCONF_ERROR; |
| | 1655 | } |
| | 1656 | if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) { |
| | 1657 | $errormessage = $Lang::tr{'invalid input for country'}; |
| | 1658 | goto VPNCONF_ERROR; |
| | 1659 | } |
| | 1660 | #the exact syntax is a list comma separated of |
| | 1661 | # email:any-validemail |
| | 1662 | # URI: a uniform resource indicator |
| | 1663 | # DNS: a DNS domain name |
| | 1664 | # RID: a registered OBJECT IDENTIFIER |
| | 1665 | # IP: an IP address |
| | 1666 | # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com |
| | 1667 | |
| | 1668 | if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) { |
| | 1669 | $errormessage = $Lang::tr{'vpn altname syntax'}; |
| | 1670 | goto VPNCONF_ERROR; |
| | 1671 | } |
| | 1672 | |
| | 1673 | if (length($cgiparams{'CERT_PASS1'}) < 5) { |
| | 1674 | $errormessage = $Lang::tr{'password too short'}; |
| | 1675 | goto VPNCONF_ERROR; |
| | 1676 | } |
| | 1677 | if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) { |
| | 1678 | $errormessage = $Lang::tr{'passwords do not match'}; |
| | 1679 | goto VPNCONF_ERROR; |
| | 1680 | } |
| | 1681 | |
| | 1682 | # Replace empty strings with a . |
| | 1683 | (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./; |
| | 1684 | (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./; |
| | 1685 | (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./; |
| | 1686 | |
| | 1687 | # Create the Client certificate request |
| | 1688 | &General::log("ipsec", "Creating a cert..."); |
| | 1689 | |
| | 1690 | if (open(STDIN, "-|")) { |
| | 1691 | my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache"; |
| | 1692 | $opt .= " -newkey rsa:2048"; |
| | 1693 | $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem"; |
| | 1694 | $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem"; |
| | 1695 | |
| | 1696 | if ( $errormessage = &callssl ($opt) ) { |
| | 1697 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem"); |
| | 1698 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem"); |
| | 1699 | goto VPNCONF_ERROR; |
| | 1700 | } |
| | 1701 | } else { #child |
| | 1702 | print "$cgiparams{'CERT_COUNTRY'}\n"; |
| | 1703 | print "$state\n"; |
| | 1704 | print "$city\n"; |
| | 1705 | print "$cgiparams{'CERT_ORGANIZATION'}\n"; |
| | 1706 | print "$ou\n"; |
| | 1707 | print "$cgiparams{'CERT_NAME'}\n"; |
| | 1708 | print "$cgiparams{'CERT_EMAIL'}\n"; |
| | 1709 | print ".\n"; |
| | 1710 | print ".\n"; |
| | 1711 | exit (0); |
| | 1712 | } |
| | 1713 | |
| | 1714 | # Sign the client certificate request |
| | 1715 | &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}..."); |
| | 1716 | |
| | 1717 | #No easy way for specifying the contain of subjectAltName without writing a config file... |
| | 1718 | my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX'); |
| | 1719 | print $fh <<END |
| | 1720 | basicConstraints=CA:FALSE |
| | 1721 | nsComment="OpenSSL Generated Certificate" |
| | 1722 | subjectKeyIdentifier=hash |
| | 1723 | extendedKeyUsage=clientAuth |
| | 1724 | authorityKeyIdentifier=keyid,issuer:always |
| | 1725 | END |
| | 1726 | ; |
| | 1727 | print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'}); |
| | 1728 | close ($fh); |
| | 1729 | |
| | 1730 | my $opt = " ca -md sha256 -days 999999 -batch -notext"; |
| | 1731 | $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem"; |
| | 1732 | $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"; |
| | 1733 | $opt .= " -extfile $v3extname"; |
| | 1734 | |
| | 1735 | if ( $errormessage = &callssl ($opt) ) { |
| | 1736 | unlink ($v3extname); |
| | 1737 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem"); |
| | 1738 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem"); |
| | 1739 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1740 | &cleanssldatabase(); |
| | 1741 | goto VPNCONF_ERROR; |
| | 1742 | } else { |
| | 1743 | unlink ($v3extname); |
| | 1744 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem"); |
| | 1745 | &cleanssldatabase(); |
| | 1746 | } |
| | 1747 | |
| | 1748 | # Create the pkcs12 file |
| | 1749 | &General::log("ipsec", "Packing a pkcs12 file..."); |
| | 1750 | $opt = " pkcs12 -export"; |
| | 1751 | $opt .= " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem"; |
| | 1752 | $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"; |
| | 1753 | $opt .= " -name \"$cgiparams{'NAME'}\""; |
| | 1754 | $opt .= " -passout pass:$cgiparams{'CERT_PASS1'}"; |
| | 1755 | $opt .= " -certfile ${General::swroot}/ca/cacert.pem"; |
| | 1756 | $opt .= " -caname \"$vpnsettings{'ROOTCERT_ORGANIZATION'} CA\""; |
| | 1757 | $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}.p12"; |
| | 1758 | |
| | 1759 | if ( $errormessage = &callssl ($opt) ) { |
| | 1760 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem"); |
| | 1761 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); |
| | 1762 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}.p12"); |
| | 1763 | goto VPNCONF_ERROR; |
| | 1764 | } else { |
| | 1765 | unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem"); |
| | 1766 | } |
| | 1767 | } elsif ($cgiparams{'AUTH'} eq 'cert') { |
| | 1768 | ;# Nothing, just editing |
| | 1769 | } elsif ($cgiparams{'AUTH'} eq 'auth-dn') { |
| | 1770 | $cgiparams{'CERT_NAME'} = '%auth-dn'; # a special value saying 'no cert file' |
| | 1771 | } else { |
| | 1772 | $errormessage = $Lang::tr{'invalid input for authentication method'}; |
| | 1773 | goto VPNCONF_ERROR; |
| | 1774 | } |
| | 1775 | |
| | 1776 | # 1)Error message here is not accurate. |
| | 1777 | # 2)Test is superfluous, openswan can reference same cert multiple times |
| | 1778 | # 3)Present since initial version (1.3.2.11), it isn't a bug correction |
| | 1779 | # Check if there is no other entry with this certificate name |
| | 1780 | #if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk') && ($cgiparams{'AUTH'} ne 'auth-dn')) { |
| | 1781 | # foreach my $key (keys %confighash) { |
| | 1782 | # if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) { |
| | 1783 | # $errormessage = $Lang::tr{'a connection with this common name already exists'}; |
| | 1784 | # goto VPNCONF_ERROR; |
| | 1785 | # } |
| | 1786 | # } |
| | 1787 | #} |
| | 1788 | # Save the config |
| | 1789 | |
| | 1790 | my $key = $cgiparams{'KEY'}; |
| | 1791 | if (! $key) { |
| | 1792 | $key = &General::findhasharraykey (\%confighash); |
| | 1793 | foreach my $i (0 .. 33) { $confighash{$key}[$i] = "";} |
| | 1794 | } |
| | 1795 | $confighash{$key}[0] = $cgiparams{'ENABLED'}; |
| | 1796 | $confighash{$key}[1] = $cgiparams{'NAME'}; |
| | 1797 | if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') { |
| | 1798 | $confighash{$key}[2] = $cgiparams{'CERT_NAME'}; |
| | 1799 | } |
| | 1800 | $confighash{$key}[3] = $cgiparams{'TYPE'}; |
| | 1801 | if ($cgiparams{'AUTH'} eq 'psk') { |
| | 1802 | $confighash{$key}[4] = 'psk'; |
| | 1803 | $confighash{$key}[5] = $cgiparams{'PSK'}; |
| | 1804 | } else { |
| | 1805 | $confighash{$key}[4] = 'cert'; |
| | 1806 | } |
| | 1807 | if ($cgiparams{'TYPE'} eq 'net') { |
| | 1808 | my @remote_subnets = split(",", $cgiparams{'REMOTE_SUBNET'}); |
| | 1809 | $confighash{$key}[11] = join('|', @remote_subnets); |
| | 1810 | } |
| | 1811 | $confighash{$key}[7] = $cgiparams{'LOCAL_ID'}; |
| | 1812 | my @local_subnets = split(",", $cgiparams{'LOCAL_SUBNET'}); |
| | 1813 | $confighash{$key}[8] = join('|', @local_subnets); |
| | 1814 | $confighash{$key}[9] = $cgiparams{'REMOTE_ID'}; |
| | 1815 | $confighash{$key}[10] = $cgiparams{'REMOTE'}; |
| | 1816 | $confighash{$key}[25] = $cgiparams{'REMARK'}; |
| | 1817 | $confighash{$key}[26] = ""; # Formerly INTERFACE |
| | 1818 | $confighash{$key}[27] = $cgiparams{'DPD_ACTION'}; |
| | 1819 | $confighash{$key}[29] = $cgiparams{'IKE_VERSION'}; |
| | 1820 | |
| | 1821 | # don't forget advanced value |
| | 1822 | $confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'}; |
| | 1823 | $confighash{$key}[19] = $cgiparams{'IKE_INTEGRITY'}; |
| | 1824 | $confighash{$key}[20] = $cgiparams{'IKE_GROUPTYPE'}; |
| | 1825 | $confighash{$key}[16] = $cgiparams{'IKE_LIFETIME'}; |
| | 1826 | $confighash{$key}[21] = $cgiparams{'ESP_ENCRYPTION'}; |
| | 1827 | $confighash{$key}[22] = $cgiparams{'ESP_INTEGRITY'}; |
| | 1828 | $confighash{$key}[23] = $cgiparams{'ESP_GROUPTYPE'}; |
| | 1829 | $confighash{$key}[17] = $cgiparams{'ESP_KEYLIFE'}; |
| | 1830 | $confighash{$key}[12] = 'off'; # $cgiparams{'AGGRMODE'}; |
| | 1831 | $confighash{$key}[13] = $cgiparams{'COMPRESSION'}; |
| | 1832 | $confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'}; |
| | 1833 | $confighash{$key}[28] = $cgiparams{'PFS'}; |
| | 1834 | $confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'}; |
| | 1835 | $confighash{$key}[31] = $cgiparams{'DPD_DELAY'}; |
| | 1836 | $confighash{$key}[32] = $cgiparams{'FORCE_MOBIKE'}; |
| | 1837 | |
| | 1838 | # free unused fields! |
| | 1839 | $confighash{$key}[6] = 'off'; |
| | 1840 | $confighash{$key}[15] = 'off'; |
| | 1841 | |
| | 1842 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 1843 | &writeipsecfiles(); |
| | 1844 | if (&vpnenabled) { |
| | 1845 | system('/usr/local/bin/ipsecctrl', 'S', $key); |
| | 1846 | sleep $sleepDelay; |
| | 1847 | } |
| | 1848 | if ($cgiparams{'EDIT_ADVANCED'} eq 'on') { |
| | 1849 | $cgiparams{'KEY'} = $key; |
| | 1850 | $cgiparams{'ACTION'} = $Lang::tr{'advanced'}; |
| | 1851 | } |
| | 1852 | goto VPNCONF_END; |
| | 1853 | } else { # add new connection |
| | 1854 | $cgiparams{'ENABLED'} = 'on'; |
| | 1855 | if ( ! -f "${General::swroot}/private/cakey.pem" ) { |
| | 1856 | $cgiparams{'AUTH'} = 'psk'; |
| | 1857 | } elsif ( ! -f "${General::swroot}/ca/cacert.pem") { |
| | 1858 | $cgiparams{'AUTH'} = 'certfile'; |
| | 1859 | } else { |
| | 1860 | $cgiparams{'AUTH'} = 'certgen'; |
| | 1861 | } |
| | 1862 | $cgiparams{'LOCAL_SUBNET'} = "$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"; |
| | 1863 | $cgiparams{'CERT_EMAIL'} = $vpnsettings{'ROOTCERT_EMAIL'}; |
| | 1864 | $cgiparams{'CERT_OU'} = $vpnsettings{'ROOTCERT_OU'}; |
| | 1865 | $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'}; |
| | 1866 | $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'}; |
| | 1867 | $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'}; |
| | 1868 | $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'}; |
| | 1869 | |
| | 1870 | # choose appropriate dpd action |
| | 1871 | if ($cgiparams{'TYPE'} eq 'host') { |
| | 1872 | $cgiparams{'DPD_ACTION'} = 'clear'; |
| | 1873 | } else { |
| | 1874 | $cgiparams{'DPD_ACTION'} = 'restart'; |
| | 1875 | } |
| | 1876 | |
| | 1877 | if (!$cgiparams{'DPD_DELAY'}) { |
| | 1878 | $cgiparams{'DPD_DELAY'} = 30; |
| | 1879 | } |
| | 1880 | |
| | 1881 | if (!$cgiparams{'DPD_TIMEOUT'}) { |
| | 1882 | $cgiparams{'DPD_TIMEOUT'} = 120; |
| | 1883 | } |
| | 1884 | |
| | 1885 | if (!$cgiparams{'FORCE_MOBIKE'}) { |
| | 1886 | $cgiparams{'FORCE_MOBIKE'} = 'no'; |
| | 1887 | } |
| | 1888 | |
| | 1889 | # Default IKE Version to v2 |
| | 1890 | if (!$cgiparams{'IKE_VERSION'}) { |
| | 1891 | $cgiparams{'IKE_VERSION'} = 'ikev2'; |
| | 1892 | } |
| | 1893 | |
| | 1894 | # ID are empty |
| | 1895 | $cgiparams{'LOCAL_ID'} = ''; |
| | 1896 | $cgiparams{'REMOTE_ID'} = ''; |
| | 1897 | |
| | 1898 | #use default advanced value |
| | 1899 | $cgiparams{'IKE_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18]; |
| | 1900 | $cgiparams{'IKE_INTEGRITY'} = 'sha2_512|sha2_256'; #[19]; |
| | 1901 | $cgiparams{'IKE_GROUPTYPE'} = 'curve25519|4096|3072|2048'; #[20]; |
| | 1902 | $cgiparams{'IKE_LIFETIME'} = '3'; #[16]; |
| | 1903 | $cgiparams{'ESP_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21]; |
| | 1904 | $cgiparams{'ESP_INTEGRITY'} = 'sha2_512|sha2_256'; #[22]; |
| | 1905 | $cgiparams{'ESP_GROUPTYPE'} = 'curve25519|4096|3072|2048'; #[23]; |
| | 1906 | $cgiparams{'ESP_KEYLIFE'} = '1'; #[17]; |
| | 1907 | $cgiparams{'COMPRESSION'} = 'off'; #[13]; |
| | 1908 | $cgiparams{'ONLY_PROPOSED'} = 'on'; #[24]; |
| | 1909 | $cgiparams{'PFS'} = 'on'; #[28]; |
| | 1910 | } |
| | 1911 | |
| | 1912 | VPNCONF_ERROR: |
| | 1913 | $checked{'ENABLED'}{'off'} = ''; |
| | 1914 | $checked{'ENABLED'}{'on'} = ''; |
| | 1915 | $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'"; |
| | 1916 | |
| | 1917 | $checked{'EDIT_ADVANCED'}{'off'} = ''; |
| | 1918 | $checked{'EDIT_ADVANCED'}{'on'} = ''; |
| | 1919 | $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = "checked='checked'"; |
| | 1920 | |
| | 1921 | $checked{'AUTH'}{'psk'} = ''; |
| | 1922 | $checked{'AUTH'}{'certreq'} = ''; |
| | 1923 | $checked{'AUTH'}{'certgen'} = ''; |
| | 1924 | $checked{'AUTH'}{'certfile'} = ''; |
| | 1925 | $checked{'AUTH'}{'pkcs12'} = ''; |
| | 1926 | $checked{'AUTH'}{'auth-dn'} = ''; |
| | 1927 | $checked{'AUTH'}{$cgiparams{'AUTH'}} = "checked='checked'"; |
| | 1928 | |
| | 1929 | &Header::showhttpheaders(); |
| | 1930 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 1931 | &Header::openbigbox('100%', 'left', '', $errormessage); |
| | 1932 | if ($errormessage) { |
| | 1933 | &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); |
| | 1934 | print "<class name='base'>$errormessage"; |
| | 1935 | print " </class>"; |
| | 1936 | &Header::closebox(); |
| | 1937 | } |
| | 1938 | |
| | 1939 | if ($warnmessage) { |
| | 1940 | &Header::openbox('100%', 'left', "$Lang::tr{'warning messages'}:"); |
| | 1941 | print "<class name='base'>$warnmessage"; |
| | 1942 | print " </class>"; |
| | 1943 | &Header::closebox(); |
| | 1944 | } |
| | 1945 | |
| | 1946 | print "<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>"; |
| | 1947 | print<<END |
| | 1948 | <input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' /> |
| | 1949 | <input type='hidden' name='IKE_VERSION' value='$cgiparams{'IKE_VERSION'}' /> |
| | 1950 | <input type='hidden' name='IKE_ENCRYPTION' value='$cgiparams{'IKE_ENCRYPTION'}' /> |
| | 1951 | <input type='hidden' name='IKE_INTEGRITY' value='$cgiparams{'IKE_INTEGRITY'}' /> |
| | 1952 | <input type='hidden' name='IKE_GROUPTYPE' value='$cgiparams{'IKE_GROUPTYPE'}' /> |
| | 1953 | <input type='hidden' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' /> |
| | 1954 | <input type='hidden' name='ESP_ENCRYPTION' value='$cgiparams{'ESP_ENCRYPTION'}' /> |
| | 1955 | <input type='hidden' name='ESP_INTEGRITY' value='$cgiparams{'ESP_INTEGRITY'}' /> |
| | 1956 | <input type='hidden' name='ESP_GROUPTYPE' value='$cgiparams{'ESP_GROUPTYPE'}' /> |
| | 1957 | <input type='hidden' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' /> |
| | 1958 | <input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' /> |
| | 1959 | <input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' /> |
| | 1960 | <input type='hidden' name='PFS' value='$cgiparams{'PFS'}' /> |
| | 1961 | <input type='hidden' name='DPD_ACTION' value='$cgiparams{'DPD_ACTION'}' /> |
| | 1962 | <input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' /> |
| | 1963 | <input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' /> |
| | 1964 | <input type='hidden' name='FORCE_MOBIKE' value='$cgiparams{'FORCE_MOBIKE'}' /> |
| | 1965 | END |
| | 1966 | ; |
| | 1967 | if ($cgiparams{'KEY'}) { |
| | 1968 | print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />"; |
| | 1969 | print "<input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />"; |
| | 1970 | print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />"; |
| | 1971 | } |
| | 1972 | |
| | 1973 | &Header::openbox('100%', 'left', "$Lang::tr{'connection'}: $cgiparams{'NAME'}"); |
| | 1974 | print "<table width='100%'>"; |
| | 1975 | if (!$cgiparams{'KEY'}) { |
| | 1976 | print <<EOF; |
| | 1977 | <tr> |
| | 1978 | <td width='20%'>$Lang::tr{'name'}: <img src='/blob.gif' alt='*' /></td> |
| | 1979 | <td width='30%'> |
| | 1980 | <input type='text' name='NAME' value='$cgiparams{'NAME'}' size='25' /> |
| | 1981 | </td> |
| | 1982 | <td colspan="2"></td> |
| | 1983 | </tr> |
| | 1984 | EOF |
| | 1985 | } |
| | 1986 | |
| | 1987 | my $disabled; |
| | 1988 | my $blob; |
| | 1989 | if ($cgiparams{'TYPE'} eq 'host') { |
| | 1990 | $disabled = "disabled='disabled'"; |
| | 1991 | } elsif ($cgiparams{'TYPE'} eq 'net') { |
| | 1992 | $blob = "<img src='/blob.gif' alt='*' />"; |
| | 1993 | }; |
| | 1994 | |
| | 1995 | my @local_subnets = split(/\|/, $cgiparams{'LOCAL_SUBNET'}); |
| | 1996 | my $local_subnets = join(",", @local_subnets); |
| | 1997 | |
| | 1998 | my @remote_subnets = split(/\|/, $cgiparams{'REMOTE_SUBNET'}); |
| | 1999 | my $remote_subnets = join(",", @remote_subnets); |
| | 2000 | |
| | 2001 | print <<END |
| | 2002 | <tr> |
| | 2003 | <td width='20%'>$Lang::tr{'enabled'}</td> |
| | 2004 | <td width='30%'> |
| | 2005 | <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /> |
| | 2006 | </td> |
| | 2007 | <td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'local subnet'} <img src='/blob.gif' alt='*' /></td> |
| | 2008 | <td width='30%'> |
| | 2009 | <input type='text' name='LOCAL_SUBNET' value='$local_subnets' /> |
| | 2010 | </td> |
| | 2011 | </tr> |
| | 2012 | <tr> |
| | 2013 | <td class='boldbase' width='20%'>$Lang::tr{'remote host/ip'}: $blob</td> |
| | 2014 | <td width='30%'> |
| | 2015 | <input type='text' name='REMOTE' value='$cgiparams{'REMOTE'}' size="25" /> |
| | 2016 | </td> |
| | 2017 | <td class='boldbase' nowrap='nowrap' width='20%'>$Lang::tr{'remote subnet'} $blob</td> |
| | 2018 | <td width='30%'> |
| | 2019 | <input $disabled type='text' name='REMOTE_SUBNET' value='$remote_subnets' /> |
| | 2020 | </td> |
| | 2021 | </tr> |
| | 2022 | <tr> |
| | 2023 | <td class='boldbase' width='20%'>$Lang::tr{'vpn local id'}:</td> |
| | 2024 | <td width='30%'> |
| | 2025 | <input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' size="25" /> |
| | 2026 | </td> |
| | 2027 | <td class='boldbase' width='20%'>$Lang::tr{'vpn remote id'}:</td> |
| | 2028 | <td width='30%'> |
| | 2029 | <input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' size="25" /> |
| | 2030 | </td> |
| | 2031 | </tr> |
| | 2032 | <tr><td colspan="4"><br /></td></tr> |
| | 2033 | <tr> |
| | 2034 | <td class='boldbase' width='20%'>$Lang::tr{'remark title'}</td> |
| | 2035 | <td colspan='3'> |
| | 2036 | <input type='text' name='REMARK' value='$cgiparams{'REMARK'}' maxlength='50' size="73" /> |
| | 2037 | </td> |
| | 2038 | </tr> |
| | 2039 | END |
| | 2040 | ; |
| | 2041 | if (!$cgiparams{'KEY'}) { |
| | 2042 | print "<tr><td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</td></tr>"; |
| | 2043 | } |
| | 2044 | print "</table>"; |
| | 2045 | &Header::closebox(); |
| | 2046 | |
| | 2047 | if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') { |
| | 2048 | &Header::openbox('100%', 'left', $Lang::tr{'authentication'}); |
| | 2049 | print <<END |
| | 2050 | <table width='100%' cellpadding='0' cellspacing='5' border='0'> |
| | 2051 | <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td> |
| | 2052 | <td class='base' width='50%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td> |
| | 2053 | </tr> |
| | 2054 | </table> |
| | 2055 | END |
| | 2056 | ; |
| | 2057 | &Header::closebox(); |
| | 2058 | } elsif (! $cgiparams{'KEY'}) { |
| | 2059 | my $cakeydisabled = ( ! -f "${General::swroot}/private/cakey.pem" ) ? "disabled='disabled'" : ''; |
| | 2060 | $cgiparams{'CERT_NAME'} = $Lang::tr{'vpn no full pki'} if ($cakeydisabled); |
| | 2061 | my $cacrtdisabled = ( ! -f "${General::swroot}/ca/cacert.pem" ) ? "disabled='disabled'" : ''; |
| | 2062 | |
| | 2063 | &Header::openbox('100%', 'left', $Lang::tr{'authentication'}); |
| | 2064 | print <<END |
| | 2065 | <table width='100%' cellpadding='0' cellspacing='5' border='0'> |
| | 2066 | <tr><td width='5%'><input type='radio' name='AUTH' value='psk' $checked{'AUTH'}{'psk'} /></td> |
| | 2067 | <td class='base' width='55%'>$Lang::tr{'use a pre-shared key'}</td> |
| | 2068 | <td class='base' width='40%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr> |
| | 2069 | <tr><td colspan='3' bgcolor='#000000'></td></tr> |
| | 2070 | <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td> |
| | 2071 | <td class='base'><hr />$Lang::tr{'upload a certificate request'}</td> |
| | 2072 | <td class='base' rowspan='3' valign='middle'><input type='file' name='FH' size='30' $cacrtdisabled /></td></tr> |
| | 2073 | <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td> |
| | 2074 | <td class='base'>$Lang::tr{'upload a certificate'}</td></tr> |
| | 2075 | <tr><td><input type='radio' name='AUTH' value='pkcs12' $cacrtdisabled /></td> |
| | 2076 | <td class='base'>$Lang::tr{'upload p12 file'} $Lang::tr{'pkcs12 file password'}:<input type='password' name='P12_PASS'/></td></tr> |
| | 2077 | <tr><td><input type='radio' name='AUTH' value='auth-dn' $checked{'AUTH'}{'auth-dn'} $cacrtdisabled /></td> |
| | 2078 | <td class='base'><hr />$Lang::tr{'vpn auth-dn'}</td></tr> |
| | 2079 | <tr><td colspan='3' bgcolor='#000000'></td></tr> |
| | 2080 | <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td> |
| | 2081 | <td class='base'><hr />$Lang::tr{'generate a certificate'}</td><td> </td></tr> |
| | 2082 | <tr><td> </td> |
| | 2083 | <td class='base'>$Lang::tr{'users fullname or system hostname'}: <img src='/blob.gif' alt='*' /></td> |
| | 2084 | <td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' size='32' $cakeydisabled /></td></tr> |
| | 2085 | <tr><td> </td> |
| | 2086 | <td class='base'>$Lang::tr{'users email'}:</td> |
| | 2087 | <td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' size='32' $cakeydisabled /></td></tr> |
| | 2088 | <tr><td> </td> |
| | 2089 | <td class='base'>$Lang::tr{'users department'}:</td> |
| | 2090 | <td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr> |
| | 2091 | <tr><td> </td> |
| | 2092 | <td class='base'>$Lang::tr{'organization name'}: <img src='/blob.gif' alt='*' /></td> |
| | 2093 | <td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr> |
| | 2094 | <tr><td> </td> |
| | 2095 | <td class='base'>$Lang::tr{'city'}:</td> |
| | 2096 | <td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' size='32' $cakeydisabled /></td></tr> |
| | 2097 | <tr><td> </td> |
| | 2098 | <td class='base'>$Lang::tr{'state or province'}:</td> |
| | 2099 | <td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' size='32' $cakeydisabled /></td></tr> |
| | 2100 | <tr><td> </td> |
| | 2101 | <td class='base'>$Lang::tr{'country'}:</td> |
| | 2102 | <td class='base'><select name='CERT_COUNTRY' $cakeydisabled> |
| | 2103 | END |
| | 2104 | ; |
| | 2105 | foreach my $country (sort keys %{Countries::countries}) { |
| | 2106 | print "\t\t\t<option value='$Countries::countries{$country}'"; |
| | 2107 | if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) { |
| | 2108 | print " selected='selected'"; |
| | 2109 | } |
| | 2110 | print ">$country</option>\n"; |
| | 2111 | } |
| | 2112 | print <<END |
| | 2113 | </select></td></tr> |
| | 2114 | |
| | 2115 | <tr><td> </td><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)</td> |
| | 2116 | <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' $cakeydisabled /></td></tr> |
| | 2117 | <tr><td> </td> |
| | 2118 | <td class='base'>$Lang::tr{'pkcs12 file password'}: <img src='/blob.gif' alt='*' /></td> |
| | 2119 | <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr> |
| | 2120 | <tr><td> </td><td class='base'>$Lang::tr{'pkcs12 file password'} ($Lang::tr{'confirmation'}): <img src='/blob.gif' alt='*' /></td> |
| | 2121 | <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr> |
| | 2122 | </table> |
| | 2123 | END |
| | 2124 | ; |
| | 2125 | &Header::closebox(); |
| | 2126 | } |
| | 2127 | |
| | 2128 | print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />"; |
| | 2129 | if ($cgiparams{'KEY'}) { |
| | 2130 | print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />"; |
| | 2131 | } |
| | 2132 | print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>"; |
| | 2133 | &Header::closebigbox(); |
| | 2134 | &Header::closepage(); |
| | 2135 | exit (0); |
| | 2136 | |
| | 2137 | VPNCONF_END: |
| | 2138 | } |
| | 2139 | |
| | 2140 | ### |
| | 2141 | ### Advanced settings |
| | 2142 | ### |
| | 2143 | if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || |
| | 2144 | ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq 'yes')) { |
| | 2145 | &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); |
| | 2146 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 2147 | if (! $confighash{$cgiparams{'KEY'}}) { |
| | 2148 | $errormessage = $Lang::tr{'invalid key'}; |
| | 2149 | goto ADVANCED_END; |
| | 2150 | } |
| | 2151 | |
| | 2152 | if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { |
| | 2153 | my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'}); |
| | 2154 | if ($#temp < 0) { |
| | 2155 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2156 | goto ADVANCED_ERROR; |
| | 2157 | } |
| | 2158 | foreach my $val (@temp) { |
| | 2159 | if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) { |
| | 2160 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2161 | goto ADVANCED_ERROR; |
| | 2162 | } |
| | 2163 | } |
| | 2164 | @temp = split('\|', $cgiparams{'IKE_INTEGRITY'}); |
| | 2165 | if ($#temp < 0) { |
| | 2166 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2167 | goto ADVANCED_ERROR; |
| | 2168 | } |
| | 2169 | foreach my $val (@temp) { |
| | 2170 | if ($val !~ /^(sha2_(512|384|256)|sha|md5|aesxcbc)$/) { |
| | 2171 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2172 | goto ADVANCED_ERROR; |
| | 2173 | } |
| | 2174 | } |
| | 2175 | @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'}); |
| | 2176 | if ($#temp < 0) { |
| | 2177 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2178 | goto ADVANCED_ERROR; |
| | 2179 | } |
| | 2180 | foreach my $val (@temp) { |
| | 2181 | if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) { |
| | 2182 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2183 | goto ADVANCED_ERROR; |
| | 2184 | } |
| | 2185 | } |
| | 2186 | if ($cgiparams{'IKE_LIFETIME'} !~ /^\d+$/) { |
| | 2187 | $errormessage = $Lang::tr{'invalid input for ike lifetime'}; |
| | 2188 | goto ADVANCED_ERROR; |
| | 2189 | } |
| | 2190 | if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) { |
| | 2191 | $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'}; |
| | 2192 | goto ADVANCED_ERROR; |
| | 2193 | } |
| | 2194 | @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'}); |
| | 2195 | if ($#temp < 0) { |
| | 2196 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2197 | goto ADVANCED_ERROR; |
| | 2198 | } |
| | 2199 | foreach my $val (@temp) { |
| | 2200 | if ($val !~ /^(aes(256|192|128)(gcm(128|96|64))?|3des|camellia(256|192|128))$/) { |
| | 2201 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2202 | goto ADVANCED_ERROR; |
| | 2203 | } |
| | 2204 | } |
| | 2205 | @temp = split('\|', $cgiparams{'ESP_INTEGRITY'}); |
| | 2206 | if ($#temp < 0) { |
| | 2207 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2208 | goto ADVANCED_ERROR; |
| | 2209 | } |
| | 2210 | foreach my $val (@temp) { |
| | 2211 | if ($val !~ /^(sha2_(512|384|256)|sha1|md5|aesxcbc)$/) { |
| | 2212 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2213 | goto ADVANCED_ERROR; |
| | 2214 | } |
| | 2215 | } |
| | 2216 | @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'}); |
| | 2217 | if ($#temp < 0) { |
| | 2218 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2219 | goto ADVANCED_ERROR; |
| | 2220 | } |
| | 2221 | foreach my $val (@temp) { |
| | 2222 | if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) { |
| | 2223 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2224 | goto ADVANCED_ERROR; |
| | 2225 | } |
| | 2226 | } |
| | 2227 | if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) { |
| | 2228 | $errormessage = $Lang::tr{'invalid input for esp keylife'}; |
| | 2229 | goto ADVANCED_ERROR; |
| | 2230 | } |
| | 2231 | if ($cgiparams{'ESP_KEYLIFE'} < 1 || $cgiparams{'ESP_KEYLIFE'} > 24) { |
| | 2232 | $errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'}; |
| | 2233 | goto ADVANCED_ERROR; |
| | 2234 | } |
| | 2235 | |
| | 2236 | if (($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) || |
| | 2237 | ($cgiparams{'FORCE_MOBIKE'} !~ /^(|on|off)$/) || |
| | 2238 | ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) || |
| | 2239 | ($cgiparams{'PFS'} !~ /^(|on|off)$/)) { |
| | 2240 | $errormessage = $Lang::tr{'invalid input'}; |
| | 2241 | goto ADVANCED_ERROR; |
| | 2242 | } |
| | 2243 | |
| | 2244 | if ($cgiparams{'DPD_DELAY'} !~ /^\d+$/) { |
| | 2245 | $errormessage = $Lang::tr{'invalid input for dpd delay'}; |
| | 2246 | goto ADVANCED_ERROR; |
| | 2247 | } |
| | 2248 | |
| | 2249 | if ($cgiparams{'DPD_TIMEOUT'} !~ /^\d+$/) { |
| | 2250 | $errormessage = $Lang::tr{'invalid input for dpd timeout'}; |
| | 2251 | goto ADVANCED_ERROR; |
| | 2252 | } |
| | 2253 | |
| | 2254 | $confighash{$cgiparams{'KEY'}}[29] = $cgiparams{'IKE_VERSION'}; |
| | 2255 | $confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'}; |
| | 2256 | $confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'}; |
| | 2257 | $confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'}; |
| | 2258 | $confighash{$cgiparams{'KEY'}}[16] = $cgiparams{'IKE_LIFETIME'}; |
| | 2259 | $confighash{$cgiparams{'KEY'}}[21] = $cgiparams{'ESP_ENCRYPTION'}; |
| | 2260 | $confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'}; |
| | 2261 | $confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'}; |
| | 2262 | $confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'}; |
| | 2263 | $confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'}; |
| | 2264 | $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'}; |
| | 2265 | $confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'}; |
| | 2266 | $confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'}; |
| | 2267 | $confighash{$cgiparams{'KEY'}}[27] = $cgiparams{'DPD_ACTION'}; |
| | 2268 | $confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'}; |
| | 2269 | $confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'}; |
| | 2270 | $confighash{$cgiparams{'KEY'}}[32] = $cgiparams{'FORCE_MOBIKE'}; |
| | 2271 | $confighash{$cgiparams{'KEY'}}[33] = $cgiparams{'START_ACTION'}; |
| | 2272 | &General::writehasharray("${General::swroot}/vpn/config", \%confighash); |
| | 2273 | &writeipsecfiles(); |
| | 2274 | if (&vpnenabled) { |
| | 2275 | system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}); |
| | 2276 | sleep $sleepDelay; |
| | 2277 | } |
| | 2278 | goto ADVANCED_END; |
| | 2279 | } else { |
| | 2280 | $cgiparams{'IKE_VERSION'} = $confighash{$cgiparams{'KEY'}}[29]; |
| | 2281 | $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18]; |
| | 2282 | $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19]; |
| | 2283 | $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20]; |
| | 2284 | $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16]; |
| | 2285 | $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21]; |
| | 2286 | $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22]; |
| | 2287 | $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23]; |
| | 2288 | if ($cgiparams{'ESP_GROUPTYPE'} eq "") { |
| | 2289 | $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'}; |
| | 2290 | } |
| | 2291 | $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17]; |
| | 2292 | $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13]; |
| | 2293 | $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24]; |
| | 2294 | $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28]; |
| | 2295 | $cgiparams{'DPD_ACTION'} = $confighash{$cgiparams{'KEY'}}[27]; |
| | 2296 | $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30]; |
| | 2297 | $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31]; |
| | 2298 | $cgiparams{'FORCE_MOBIKE'} = $confighash{$cgiparams{'KEY'}}[32]; |
| | 2299 | $cgiparams{'START_ACTION'} = $confighash{$cgiparams{'KEY'}}[33]; |
| | 2300 | |
| | 2301 | if (!$cgiparams{'DPD_DELAY'}) { |
| | 2302 | $cgiparams{'DPD_DELAY'} = 30; |
| | 2303 | } |
| | 2304 | |
| | 2305 | if (!$cgiparams{'DPD_TIMEOUT'}) { |
| | 2306 | $cgiparams{'DPD_TIMEOUT'} = 120; |
| | 2307 | } |
| | 2308 | |
| | 2309 | if (!$cgiparams{'START_ACTION'}) { |
| | 2310 | $cgiparams{'START_ACTION'} = "start"; |
| | 2311 | } |
| | 2312 | } |
| | 2313 | |
| | 2314 | ADVANCED_ERROR: |
| | 2315 | $checked{'IKE_ENCRYPTION'}{'aes256'} = ''; |
| | 2316 | $checked{'IKE_ENCRYPTION'}{'aes192'} = ''; |
| | 2317 | $checked{'IKE_ENCRYPTION'}{'aes128'} = ''; |
| | 2318 | $checked{'IKE_ENCRYPTION'}{'aes256gcm128'} = ''; |
| | 2319 | $checked{'IKE_ENCRYPTION'}{'aes192gcm128'} = ''; |
| | 2320 | $checked{'IKE_ENCRYPTION'}{'aes128gcm128'} = ''; |
| | 2321 | $checked{'IKE_ENCRYPTION'}{'aes256gcm96'} = ''; |
| | 2322 | $checked{'IKE_ENCRYPTION'}{'aes192gcm96'} = ''; |
| | 2323 | $checked{'IKE_ENCRYPTION'}{'aes128gcm96'} = ''; |
| | 2324 | $checked{'IKE_ENCRYPTION'}{'aes256gcm64'} = ''; |
| | 2325 | $checked{'IKE_ENCRYPTION'}{'aes192gcm64'} = ''; |
| | 2326 | $checked{'IKE_ENCRYPTION'}{'aes128gcm64'} = ''; |
| | 2327 | $checked{'IKE_ENCRYPTION'}{'3des'} = ''; |
| | 2328 | $checked{'IKE_ENCRYPTION'}{'camellia256'} = ''; |
| | 2329 | $checked{'IKE_ENCRYPTION'}{'camellia192'} = ''; |
| | 2330 | $checked{'IKE_ENCRYPTION'}{'camellia128'} = ''; |
| | 2331 | my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'}); |
| | 2332 | foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; } |
| | 2333 | $checked{'IKE_INTEGRITY'}{'sha2_512'} = ''; |
| | 2334 | $checked{'IKE_INTEGRITY'}{'sha2_384'} = ''; |
| | 2335 | $checked{'IKE_INTEGRITY'}{'sha2_256'} = ''; |
| | 2336 | $checked{'IKE_INTEGRITY'}{'sha'} = ''; |
| | 2337 | $checked{'IKE_INTEGRITY'}{'md5'} = ''; |
| | 2338 | $checked{'IKE_INTEGRITY'}{'aesxcbc'} = ''; |
| | 2339 | @temp = split('\|', $cgiparams{'IKE_INTEGRITY'}); |
| | 2340 | foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; } |
| | 2341 | $checked{'IKE_GROUPTYPE'}{'curve25519'} = ''; |
| | 2342 | $checked{'IKE_GROUPTYPE'}{'768'} = ''; |
| | 2343 | $checked{'IKE_GROUPTYPE'}{'1024'} = ''; |
| | 2344 | $checked{'IKE_GROUPTYPE'}{'1536'} = ''; |
| | 2345 | $checked{'IKE_GROUPTYPE'}{'2048'} = ''; |
| | 2346 | $checked{'IKE_GROUPTYPE'}{'3072'} = ''; |
| | 2347 | $checked{'IKE_GROUPTYPE'}{'4096'} = ''; |
| | 2348 | $checked{'IKE_GROUPTYPE'}{'6144'} = ''; |
| | 2349 | $checked{'IKE_GROUPTYPE'}{'8192'} = ''; |
| | 2350 | @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'}); |
| | 2351 | foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; } |
| | 2352 | |
| | 2353 | $checked{'ESP_ENCRYPTION'}{'aes256'} = ''; |
| | 2354 | $checked{'ESP_ENCRYPTION'}{'aes192'} = ''; |
| | 2355 | $checked{'ESP_ENCRYPTION'}{'aes128'} = ''; |
| | 2356 | $checked{'ESP_ENCRYPTION'}{'aes256gcm128'} = ''; |
| | 2357 | $checked{'ESP_ENCRYPTION'}{'aes192gcm128'} = ''; |
| | 2358 | $checked{'ESP_ENCRYPTION'}{'aes128gcm128'} = ''; |
| | 2359 | $checked{'ESP_ENCRYPTION'}{'aes256gcm96'} = ''; |
| | 2360 | $checked{'ESP_ENCRYPTION'}{'aes192gcm96'} = ''; |
| | 2361 | $checked{'ESP_ENCRYPTION'}{'aes128gcm96'} = ''; |
| | 2362 | $checked{'ESP_ENCRYPTION'}{'aes256gcm64'} = ''; |
| | 2363 | $checked{'ESP_ENCRYPTION'}{'aes192gcm64'} = ''; |
| | 2364 | $checked{'ESP_ENCRYPTION'}{'aes128gcm64'} = ''; |
| | 2365 | $checked{'ESP_ENCRYPTION'}{'3des'} = ''; |
| | 2366 | $checked{'ESP_ENCRYPTION'}{'camellia256'} = ''; |
| | 2367 | $checked{'ESP_ENCRYPTION'}{'camellia192'} = ''; |
| | 2368 | $checked{'ESP_ENCRYPTION'}{'camellia128'} = ''; |
| | 2369 | @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'}); |
| | 2370 | foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; } |
| | 2371 | $checked{'ESP_INTEGRITY'}{'sha2_512'} = ''; |
| | 2372 | $checked{'ESP_INTEGRITY'}{'sha2_384'} = ''; |
| | 2373 | $checked{'ESP_INTEGRITY'}{'sha2_256'} = ''; |
| | 2374 | $checked{'ESP_INTEGRITY'}{'sha1'} = ''; |
| | 2375 | $checked{'ESP_INTEGRITY'}{'md5'} = ''; |
| | 2376 | $checked{'ESP_INTEGRITY'}{'aesxcbc'} = ''; |
| | 2377 | @temp = split('\|', $cgiparams{'ESP_INTEGRITY'}); |
| | 2378 | foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; } |
| | 2379 | $checked{'ESP_GROUPTYPE'}{'curve25519'} = ''; |
| | 2380 | $checked{'ESP_GROUPTYPE'}{'768'} = ''; |
| | 2381 | $checked{'ESP_GROUPTYPE'}{'1024'} = ''; |
| | 2382 | $checked{'ESP_GROUPTYPE'}{'1536'} = ''; |
| | 2383 | $checked{'ESP_GROUPTYPE'}{'2048'} = ''; |
| | 2384 | $checked{'ESP_GROUPTYPE'}{'3072'} = ''; |
| | 2385 | $checked{'ESP_GROUPTYPE'}{'4096'} = ''; |
| | 2386 | $checked{'ESP_GROUPTYPE'}{'6144'} = ''; |
| | 2387 | $checked{'ESP_GROUPTYPE'}{'8192'} = ''; |
| | 2388 | $checked{'ESP_GROUPTYPE'}{'none'} = ''; |
| | 2389 | @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'}); |
| | 2390 | foreach my $key (@temp) {$checked{'ESP_GROUPTYPE'}{$key} = "selected='selected'"; } |
| | 2391 | |
| | 2392 | $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ; |
| | 2393 | $checked{'FORCE_MOBIKE'} = $cgiparams{'FORCE_MOBIKE'} eq 'on' ? "checked='checked'" : '' ; |
| | 2394 | $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ; |
| | 2395 | $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ; |
| | 2396 | |
| | 2397 | $selected{'IKE_VERSION'}{'ikev1'} = ''; |
| | 2398 | $selected{'IKE_VERSION'}{'ikev2'} = ''; |
| | 2399 | $selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'"; |
| | 2400 | |
| | 2401 | $selected{'DPD_ACTION'}{'clear'} = ''; |
| | 2402 | $selected{'DPD_ACTION'}{'hold'} = ''; |
| | 2403 | $selected{'DPD_ACTION'}{'restart'} = ''; |
| | 2404 | $selected{'DPD_ACTION'}{'none'} = ''; |
| | 2405 | $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'"; |
| | 2406 | |
| | 2407 | $selected{'START_ACTION'}{'route'} = ''; |
| | 2408 | $selected{'START_ACTION'}{'start'} = ''; |
| | 2409 | $selected{'START_ACTION'}{$cgiparams{'START_ACTION'}} = "selected='selected'"; |
| | 2410 | |
| | 2411 | &Header::showhttpheaders(); |
| | 2412 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 2413 | &Header::openbigbox('100%', 'left', '', $errormessage); |
| | 2414 | |
| | 2415 | if ($errormessage) { |
| | 2416 | &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); |
| | 2417 | print "<class name='base'>$errormessage"; |
| | 2418 | print " </class>"; |
| | 2419 | &Header::closebox(); |
| | 2420 | } |
| | 2421 | |
| | 2422 | if ($warnmessage) { |
| | 2423 | &Header::openbox('100%', 'left', $Lang::tr{'warning messages'}); |
| | 2424 | print "<class name='base'>$warnmessage"; |
| | 2425 | print " </class>"; |
| | 2426 | &Header::closebox(); |
| | 2427 | } |
| | 2428 | |
| | 2429 | &Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:"); |
| | 2430 | print <<EOF; |
| | 2431 | <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'> |
| | 2432 | <input type='hidden' name='ADVANCED' value='yes' /> |
| | 2433 | <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' /> |
| | 2434 | |
| | 2435 | <table width='100%'> |
| | 2436 | <thead> |
| | 2437 | <tr> |
| | 2438 | <th width="15%"></th> |
| | 2439 | <th>IKE</th> |
| | 2440 | <th>ESP</th> |
| | 2441 | </tr> |
| | 2442 | </thead> |
| | 2443 | <tbody> |
| | 2444 | <tr> |
| | 2445 | <td>$Lang::tr{'vpn keyexchange'}:</td> |
| | 2446 | <td> |
| | 2447 | <select name='IKE_VERSION'> |
| | 2448 | <option value='ikev2' $selected{'IKE_VERSION'}{'ikev2'}>IKEv2</option> |
| | 2449 | <option value='ikev1' $selected{'IKE_VERSION'}{'ikev1'}>IKEv1</option> |
| | 2450 | </select> |
| | 2451 | </td> |
| | 2452 | <td></td> |
| | 2453 | </tr> |
| | 2454 | <tr> |
| | 2455 | <td class='boldbase' width="15%">$Lang::tr{'encryption'}</td> |
| | 2456 | <td class='boldbase'> |
| | 2457 | <select name='IKE_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'> |
| | 2458 | <option value='aes256gcm128' $checked{'IKE_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option> |
| | 2459 | <option value='aes256gcm96' $checked{'IKE_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option> |
| | 2460 | <option value='aes256gcm64' $checked{'IKE_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option> |
| | 2461 | <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option> |
| | 2462 | <option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option> |
| | 2463 | <option value='aes192gcm128' $checked{'IKE_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option> |
| | 2464 | <option value='aes192gcm96' $checked{'IKE_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option> |
| | 2465 | <option value='aes192gcm64' $checked{'IKE_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option> |
| | 2466 | <option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option> |
| | 2467 | <option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option> |
| | 2468 | <option value='aes128gcm128' $checked{'IKE_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option> |
| | 2469 | <option value='aes128gcm96' $checked{'IKE_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option> |
| | 2470 | <option value='aes128gcm64' $checked{'IKE_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option> |
| | 2471 | <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option> |
| | 2472 | <option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option> |
| | 2473 | <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option> |
| | 2474 | </select> |
| | 2475 | </td> |
| | 2476 | <td class='boldbase'> |
| | 2477 | <select name='ESP_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'> |
| | 2478 | <option value='aes256gcm128' $checked{'ESP_ENCRYPTION'}{'aes256gcm128'}>256 bit AES-GCM/128 bit ICV</option> |
| | 2479 | <option value='aes256gcm96' $checked{'ESP_ENCRYPTION'}{'aes256gcm96'}>256 bit AES-GCM/96 bit ICV</option> |
| | 2480 | <option value='aes256gcm64' $checked{'ESP_ENCRYPTION'}{'aes256gcm64'}>256 bit AES-GCM/64 bit ICV</option> |
| | 2481 | <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>256 bit AES-CBC</option> |
| | 2482 | <option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>256 bit Camellia-CBC</option> |
| | 2483 | <option value='aes192gcm128' $checked{'ESP_ENCRYPTION'}{'aes192gcm128'}>192 bit AES-GCM/128 bit ICV</option> |
| | 2484 | <option value='aes192gcm96' $checked{'ESP_ENCRYPTION'}{'aes192gcm96'}>192 bit AES-GCM/96 bit ICV</option> |
| | 2485 | <option value='aes192gcm64' $checked{'ESP_ENCRYPTION'}{'aes192gcm64'}>192 bit AES-GCM/64 bit ICV</option> |
| | 2486 | <option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>192 bit AES-CBC</option> |
| | 2487 | <option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>192 bit Camellia-CBC</option> |
| | 2488 | <option value='aes128gcm128' $checked{'ESP_ENCRYPTION'}{'aes128gcm128'}>128 bit AES-GCM/128 bit ICV</option> |
| | 2489 | <option value='aes128gcm96' $checked{'ESP_ENCRYPTION'}{'aes128gcm96'}>128 bit AES-GCM/96 bit ICV</option> |
| | 2490 | <option value='aes128gcm64' $checked{'ESP_ENCRYPTION'}{'aes128gcm64'}>128 bit AES-GCM/64 bit ICV</option> |
| | 2491 | <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>128 bit AES-CBC</option> |
| | 2492 | <option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>128 bit Camellia-CBC</option> |
| | 2493 | <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>168 bit 3DES-EDE-CBC</option> |
| | 2494 | </select> |
| | 2495 | </td> |
| | 2496 | </tr> |
| | 2497 | |
| | 2498 | <tr> |
| | 2499 | <td class='boldbase' width="15%">$Lang::tr{'integrity'}</td> |
| | 2500 | <td class='boldbase'> |
| | 2501 | <select name='IKE_INTEGRITY' multiple='multiple' size='6' style='width: 100%'> |
| | 2502 | <option value='sha2_512' $checked{'IKE_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option> |
| | 2503 | <option value='sha2_384' $checked{'IKE_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option> |
| | 2504 | <option value='sha2_256' $checked{'IKE_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option> |
| | 2505 | <option value='aesxcbc' $checked{'IKE_INTEGRITY'}{'aesxcbc'}>AES XCBC</option> |
| | 2506 | <option value='sha' $checked{'IKE_INTEGRITY'}{'sha'}>SHA1 ($Lang::tr{'vpn weak'})</option> |
| | 2507 | <option value='md5' $checked{'IKE_INTEGRITY'}{'md5'}>MD5 ($Lang::tr{'vpn broken'})</option> |
| | 2508 | </select> |
| | 2509 | </td> |
| | 2510 | <td class='boldbase'> |
| | 2511 | <select name='ESP_INTEGRITY' multiple='multiple' size='6' style='width: 100%'> |
| | 2512 | <option value='sha2_512' $checked{'ESP_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option> |
| | 2513 | <option value='sha2_384' $checked{'ESP_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option> |
| | 2514 | <option value='sha2_256' $checked{'ESP_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option> |
| | 2515 | <option value='aesxcbc' $checked{'ESP_INTEGRITY'}{'aesxcbc'}>AES XCBC</option> |
| | 2516 | <option value='sha1' $checked{'ESP_INTEGRITY'}{'sha1'}>SHA1 ($Lang::tr{'vpn weak'})</option> |
| | 2517 | <option value='md5' $checked{'ESP_INTEGRITY'}{'md5'}>MD5 ($Lang::tr{'vpn broken'})</option> |
| | 2518 | </select> |
| | 2519 | </td> |
| | 2520 | </tr> |
| | 2521 | <tr> |
| | 2522 | <td class='boldbase' width="15%">$Lang::tr{'lifetime'} <img src='/blob.gif' alt='*' /></td> |
| | 2523 | <td class='boldbase'> |
| | 2524 | <input type='text' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' size='5' /> $Lang::tr{'hours'} |
| | 2525 | </td> |
| | 2526 | <td class='boldbase'> |
| | 2527 | <input type='text' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' size='5' /> $Lang::tr{'hours'} |
| | 2528 | </td> |
| | 2529 | </tr> |
| | 2530 | <tr> |
| | 2531 | <td class='boldbase' width="15%">$Lang::tr{'grouptype'}</td> |
| | 2532 | <td class='boldbase'> |
| | 2533 | <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'> |
| | 2534 | <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option> |
| | 2535 | <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option> |
| | 2536 | <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option> |
| | 2537 | <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option> |
| | 2538 | <option value='e384bp' $checked{'IKE_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option> |
| | 2539 | <option value='e256' $checked{'IKE_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option> |
| | 2540 | <option value='e256bp' $checked{'IKE_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option> |
| | 2541 | <option value='e224' $checked{'IKE_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option> |
| | 2542 | <option value='e224bp' $checked{'IKE_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option> |
| | 2543 | <option value='e192' $checked{'IKE_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option> |
| | 2544 | <option value='8192' $checked{'IKE_GROUPTYPE'}{'8192'}>MODP-8192</option> |
| | 2545 | <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option> |
| | 2546 | <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option> |
| | 2547 | <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option> |
| | 2548 | <option value='2048s256' $checked{'IKE_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option> |
| | 2549 | <option value='2048s224' $checked{'IKE_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option> |
| | 2550 | <option value='2048s160' $checked{'IKE_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option> |
| | 2551 | <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option> |
| | 2552 | <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option> |
| | 2553 | <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option> |
| | 2554 | <option value='768' $checked{'IKE_GROUPTYPE'}{'768'}>MODP-768 ($Lang::tr{'vpn broken'})</option> |
| | 2555 | </select> |
| | 2556 | </td> |
| | 2557 | <td class='boldbase'> |
| | 2558 | <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'> |
| | 2559 | <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option> |
| | 2560 | <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option> |
| | 2561 | <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option> |
| | 2562 | <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option> |
| | 2563 | <option value='e384bp' $checked{'ESP_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option> |
| | 2564 | <option value='e256' $checked{'ESP_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option> |
| | 2565 | <option value='e256bp' $checked{'ESP_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option> |
| | 2566 | <option value='e224' $checked{'ESP_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option> |
| | 2567 | <option value='e224bp' $checked{'ESP_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option> |
| | 2568 | <option value='e192' $checked{'ESP_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option> |
| | 2569 | <option value='8192' $checked{'ESP_GROUPTYPE'}{'8192'}>MODP-8192</option> |
| | 2570 | <option value='6144' $checked{'ESP_GROUPTYPE'}{'6144'}>MODP-6144</option> |
| | 2571 | <option value='4096' $checked{'ESP_GROUPTYPE'}{'4096'}>MODP-4096</option> |
| | 2572 | <option value='3072' $checked{'ESP_GROUPTYPE'}{'3072'}>MODP-3072</option> |
| | 2573 | <option value='2048s256' $checked{'ESP_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option> |
| | 2574 | <option value='2048s224' $checked{'ESP_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option> |
| | 2575 | <option value='2048s160' $checked{'ESP_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option> |
| | 2576 | <option value='2048' $checked{'ESP_GROUPTYPE'}{'2048'}>MODP-2048</option> |
| | 2577 | <option value='1536' $checked{'ESP_GROUPTYPE'}{'1536'}>MODP-1536</option> |
| | 2578 | <option value='1024' $checked{'ESP_GROUPTYPE'}{'1024'}>MODP-1024 ($Lang::tr{'vpn broken'})</option> |
| | 2579 | <option value='768' $checked{'ESP_GROUPTYPE'}{'768'}>MODP-768 ($Lang::tr{'vpn broken'})</option> |
| | 2580 | <option value='none' $checked{'ESP_GROUPTYPE'}{'none'}>- $Lang::tr{'none'} -</option> |
| | 2581 | </select> |
| | 2582 | </td> |
| | 2583 | </tr> |
| | 2584 | </tbody> |
| | 2585 | </table> |
| | 2586 | |
| | 2587 | <br><br> |
| | 2588 | |
| | 2589 | <h2>$Lang::tr{'dead peer detection'}</h2> |
| | 2590 | |
| | 2591 | <table width="100%"> |
| | 2592 | <tr> |
| | 2593 | <td width="15%">$Lang::tr{'dpd action'}:</td> |
| | 2594 | <td> |
| | 2595 | <select name='DPD_ACTION'> |
| | 2596 | <option value='none' $selected{'DPD_ACTION'}{'none'}>- $Lang::tr{'disabled'} -</option> |
| | 2597 | <option value='clear' $selected{'DPD_ACTION'}{'clear'}>clear</option> |
| | 2598 | <option value='hold' $selected{'DPD_ACTION'}{'hold'}>hold</option> |
| | 2599 | <option value='restart' $selected{'DPD_ACTION'}{'restart'}>restart</option> |
| | 2600 | </select> |
| | 2601 | </td> |
| | 2602 | </tr> |
| | 2603 | <tr> |
| | 2604 | <td width="15%">$Lang::tr{'dpd timeout'}: <img src='/blob.gif' alt='*' /></td> |
| | 2605 | <td> |
| | 2606 | <input type='text' name='DPD_TIMEOUT' size='5' value='$cgiparams{'DPD_TIMEOUT'}' /> |
| | 2607 | </td> |
| | 2608 | </tr> |
| | 2609 | <tr> |
| | 2610 | <td width="15%">$Lang::tr{'dpd delay'}: <img src='/blob.gif' alt='*' /></td> |
| | 2611 | <td> |
| | 2612 | <input type='text' name='DPD_DELAY' size='5' value='$cgiparams{'DPD_DELAY'}' /> |
| | 2613 | </td> |
| | 2614 | </tr> |
| | 2615 | </table> |
| | 2616 | |
| | 2617 | <hr> |
| | 2618 | |
| | 2619 | <table width="100%"> |
| | 2620 | <tr> |
| | 2621 | <td> |
| | 2622 | <label> |
| | 2623 | <input type='checkbox' name='ONLY_PROPOSED' $checked{'ONLY_PROPOSED'} /> |
| | 2624 | IKE+ESP: $Lang::tr{'use only proposed settings'} |
| | 2625 | </label> |
| | 2626 | </td> |
| | 2627 | <td> |
| | 2628 | <label>$Lang::tr{'vpn start action'}</label> |
| | 2629 | <select name="START_ACTION"> |
| | 2630 | <option value="route" $selected{'START_ACTION'}{'route'}>$Lang::tr{'vpn start action route'}</option> |
| | 2631 | <option value="start" $selected{'START_ACTION'}{'start'}>$Lang::tr{'vpn start action start'}</option> |
| | 2632 | </select> |
| | 2633 | </td> |
| | 2634 | </tr> |
| | 2635 | <tr> |
| | 2636 | <td colspan="2"> |
| | 2637 | <label> |
| | 2638 | <input type='checkbox' name='PFS' $checked{'PFS'} /> |
| | 2639 | $Lang::tr{'pfs yes no'} |
| | 2640 | </label> |
| | 2641 | </td> |
| | 2642 | </tr> |
| | 2643 | <tr> |
| | 2644 | <td colspan="2"> |
| | 2645 | <label> |
| | 2646 | <input type='checkbox' name='COMPRESSION' $checked{'COMPRESSION'} /> |
| | 2647 | $Lang::tr{'vpn payload compression'} |
| | 2648 | </label> |
| | 2649 | </td> |
| | 2650 | </tr> |
| | 2651 | <tr> |
| | 2652 | <td colspan="2"> |
| | 2653 | <label> |
| | 2654 | <input type='checkbox' name='FORCE_MOBIKE' $checked{'FORCE_MOBIKE'} /> |
| | 2655 | $Lang::tr{'vpn force mobike'} |
| | 2656 | </label> |
| | 2657 | </td> |
| | 2658 | </tr> |
| | 2659 | <tr> |
| | 2660 | <td align='left'><img src='/blob.gif' align='top' alt='*' /> $Lang::tr{'required field'}</td> |
| | 2661 | <td align='right'> |
| | 2662 | <input type='submit' name='ACTION' value='$Lang::tr{'save'}' /> |
| | 2663 | <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /> |
| | 2664 | </td> |
| | 2665 | </tr> |
| | 2666 | </table></form> |
| | 2667 | EOF |
| | 2668 | |
| | 2669 | &Header::closebox(); |
| | 2670 | &Header::closebigbox(); |
| | 2671 | &Header::closepage(); |
| | 2672 | exit(0); |
| | 2673 | |
| | 2674 | ADVANCED_END: |
| | 2675 | } |
| | 2676 | |
| | 2677 | ### |
| | 2678 | ### Default status page |
| | 2679 | ### |
| | 2680 | %cgiparams = (); |
| | 2681 | %cahash = (); |
| | 2682 | %confighash = (); |
| | 2683 | &General::readhash("${General::swroot}/vpn/settings", \%cgiparams); |
| | 2684 | &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); |
| | 2685 | &General::readhasharray("${General::swroot}/vpn/config", \%confighash); |
| | 2686 | $cgiparams{'CA_NAME'} = ''; |
| | 2687 | |
| | 2688 | my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`; |
| | 2689 | |
| | 2690 | # suggest a default name for this side |
| | 2691 | if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") { |
| | 2692 | if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) { |
| | 2693 | my $ipaddr = <IPADDR>; |
| | 2694 | close IPADDR; |
| | 2695 | chomp ($ipaddr); |
| | 2696 | $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0]; |
| | 2697 | if ($cgiparams{'VPN_IP'} eq '') { |
| | 2698 | $cgiparams{'VPN_IP'} = $ipaddr; |
| | 2699 | } |
| | 2700 | } |
| | 2701 | } |
| | 2702 | # no IP found, use %defaultroute |
| | 2703 | $cgiparams{'VPN_IP'} ='%defaultroute' if ($cgiparams{'VPN_IP'} eq ''); |
| | 2704 | |
| | 2705 | $cgiparams{'VPN_DELAYED_START'} = 0 if (! defined ($cgiparams{'VPN_DELAYED_START'})); |
| | 2706 | $checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : ''; |
| | 2707 | |
| | 2708 | &Header::showhttpheaders(); |
| | 2709 | &Header::openpage($Lang::tr{'ipsec'}, 1, ''); |
| | 2710 | &Header::openbigbox('100%', 'left', '', $errormessage); |
| | 2711 | |
| | 2712 | if ($errormessage) { |
| | 2713 | &Header::openbox('100%', 'left', $Lang::tr{'error messages'}); |
| | 2714 | print "<class name='base'>$errormessage\n"; |
| | 2715 | print " </class>\n"; |
| | 2716 | &Header::closebox(); |
| | 2717 | } |
| | 2718 | |
| | 2719 | if ($warnmessage) { |
| | 2720 | &Header::openbox('100%', 'left', $Lang::tr{'warning messages'}); |
| | 2721 | print "$warnmessage<br>"; |
| | 2722 | print "$Lang::tr{'fwdfw warn1'}<br>"; |
| | 2723 | &Header::closebox(); |
| | 2724 | print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>"; |
| | 2725 | &Header::closepage(); |
| | 2726 | exit 0; |
| | 2727 | } |
| | 2728 | |
| | 2729 | &Header::openbox('100%', 'left', $Lang::tr{'global settings'}); |
| | 2730 | print <<END |
| | 2731 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2732 | <table width='100%'> |
| | 2733 | <tr> |
| | 2734 | <td width='20%' class='base' nowrap='nowrap'>$Lang::tr{'vpn red name'}: <img src='/blob.gif' alt='*' /></td> |
| | 2735 | <td width='20%'><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' /></td> |
| | 2736 | <td width='20%' class='base'>$Lang::tr{'enabled'}<input type='checkbox' name='ENABLED' $checked{'ENABLED'} /></td> |
| | 2737 | </tr> |
| | 2738 | END |
| | 2739 | ; |
| | 2740 | print <<END |
| | 2741 | <tr> |
| | 2742 | <td class='base' nowrap='nowrap'>$Lang::tr{'vpn delayed start'}: <img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /></td> |
| | 2743 | <td ><input type='text' name='VPN_DELAYED_START' value='$cgiparams{'VPN_DELAYED_START'}' /></td> |
| | 2744 | </tr> |
| | 2745 | <tr> |
| | 2746 | <td class='base' nowrap='nowrap'>$Lang::tr{'host to net vpn'}:</td> |
| | 2747 | <td ><input type='text' name='RW_NET' value='$cgiparams{'RW_NET'}' /></td> |
| | 2748 | </tr> |
| | 2749 | </table> |
| | 2750 | <br> |
| | 2751 | <hr /> |
| | 2752 | <table width='100%'> |
| | 2753 | <tr> |
| | 2754 | <td class='base' valign='top'><img src='/blob.gif' alt='*' /></td> |
| | 2755 | <td width='70%' class='base' valign='top'>$Lang::tr{'required field'}</td><td width='30%' align='right' class='base'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td> |
| | 2756 | </tr> |
| | 2757 | <tr> |
| | 2758 | <td class='base' valign='top' nowrap='nowrap'><img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /> </td> |
| | 2759 | <td class='base'> <font class='base'>$Lang::tr{'vpn delayed start help'}</font></td> |
| | 2760 | <td></td> |
| | 2761 | </tr> |
| | 2762 | </table> |
| | 2763 | END |
| | 2764 | ; |
| | 2765 | print "</form>"; |
| | 2766 | &Header::closebox(); |
| | 2767 | |
| | 2768 | &Header::openbox('100%', 'left', $Lang::tr{'connection status and controlc'}); |
| | 2769 | print <<END |
| | 2770 | <table width='100%' cellspacing='1' cellpadding='0' class='tbl'> |
| | 2771 | <tr> |
| | 2772 | <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th> |
| | 2773 | <th width='22%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th> |
| | 2774 | <th width='23%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></th> |
| | 2775 | <th width='30%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th> |
| | 2776 | <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th> |
| | 2777 | <th class='boldbase' align='center' colspan='6'><b>$Lang::tr{'action'}</b></th> |
| | 2778 | </tr> |
| | 2779 | END |
| | 2780 | ; |
| | 2781 | my $id = 0; |
| | 2782 | my $gif; |
| | 2783 | foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) { |
| | 2784 | if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; } |
| | 2785 | |
| | 2786 | if ($id % 2) { |
| | 2787 | print "<tr>"; |
| | 2788 | $col="bgcolor='$color{'color20'}'"; |
| | 2789 | } else { |
| | 2790 | print "<tr>"; |
| | 2791 | $col="bgcolor='$color{'color22'}'"; |
| | 2792 | } |
| | 2793 | print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>"; |
| | 2794 | print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ") $confighash{$key}[29]</td>"; |
| | 2795 | if ($confighash{$key}[2] eq '%auth-dn') { |
| | 2796 | print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[9]</td>"; |
| | 2797 | } elsif ($confighash{$key}[4] eq 'cert') { |
| | 2798 | print "<td align='left' nowrap='nowrap' $col>$confighash{$key}[2]</td>"; |
| | 2799 | } else { |
| | 2800 | print "<td align='left' $col> </td>"; |
| | 2801 | } |
| | 2802 | print "<td align='center' $col>$confighash{$key}[25]</td>"; |
| | 2803 | my $col1="bgcolor='${Header::colourred}'"; |
| | 2804 | # get real state |
| | 2805 | my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>"; |
| | 2806 | foreach my $line (@status) { |
| | 2807 | if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) || |
| | 2808 | ($line =~ /$confighash{$key}[1]\{.*INSTALLED/)) { |
| | 2809 | $col1="bgcolor='${Header::colourgreen}'"; |
| | 2810 | $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>"; |
| | 2811 | } elsif ($line =~ /$confighash{$key}[1]\[.*CONNECTING/) { |
| | 2812 | $col1="bgcolor='${Header::colourorange}'"; |
| | 2813 | $active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn connecting'}</font></b>"; |
| | 2814 | } elsif ($line =~ /$confighash{$key}[1]\{.*ROUTED/) { |
| | 2815 | $col1="bgcolor='${Header::colourorange}'"; |
| | 2816 | $active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn on-demand'}</font></b>"; |
| | 2817 | } |
| | 2818 | } |
| | 2819 | # move to blue if really down |
| | 2820 | if ($confighash{$key}[0] eq 'off' && $col1 =~ /${Header::colourred}/ ) { |
| | 2821 | $col1="bgcolor='${Header::colourblue}'"; |
| | 2822 | $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>"; |
| | 2823 | } |
| | 2824 | print <<END |
| | 2825 | <td align='center' $col1>$active</td> |
| | 2826 | <td align='center' $col> |
| | 2827 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2828 | <input type='image' name='$Lang::tr{'restart'}' src='/images/reload.gif' alt='$Lang::tr{'restart'}' title='$Lang::tr{'restart'}' /> |
| | 2829 | <input type='hidden' name='ACTION' value='$Lang::tr{'restart'}' /> |
| | 2830 | <input type='hidden' name='KEY' value='$key' /> |
| | 2831 | </form> |
| | 2832 | </td> |
| | 2833 | END |
| | 2834 | ; |
| | 2835 | if (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) { |
| | 2836 | print <<END |
| | 2837 | <td align='center' $col> |
| | 2838 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2839 | <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' /> |
| | 2840 | <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' /> |
| | 2841 | <input type='hidden' name='KEY' value='$key' /> |
| | 2842 | </form> |
| | 2843 | </td> |
| | 2844 | END |
| | 2845 | ; |
| | 2846 | } else { |
| | 2847 | print "<td width='2%' $col> </td>"; |
| | 2848 | } |
| | 2849 | if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") { |
| | 2850 | print <<END |
| | 2851 | <td align='center' $col> |
| | 2852 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2853 | <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/floppy.gif' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' /> |
| | 2854 | <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' /> |
| | 2855 | <input type='hidden' name='KEY' value='$key' /> |
| | 2856 | </form> |
| | 2857 | </td> |
| | 2858 | END |
| | 2859 | ; |
| | 2860 | } elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) { |
| | 2861 | print <<END |
| | 2862 | <td align='center' $col> |
| | 2863 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2864 | <input type='image' name='$Lang::tr{'download certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' /> |
| | 2865 | <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' /> |
| | 2866 | <input type='hidden' name='KEY' value='$key' /> |
| | 2867 | </form> |
| | 2868 | </td> |
| | 2869 | END |
| | 2870 | ; |
| | 2871 | } else { |
| | 2872 | print "<td width='2%' $col> </td>"; |
| | 2873 | } |
| | 2874 | print <<END |
| | 2875 | <td align='center' $col> |
| | 2876 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2877 | <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' /> |
| | 2878 | <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' /> |
| | 2879 | <input type='hidden' name='KEY' value='$key' /> |
| | 2880 | </form> |
| | 2881 | </td> |
| | 2882 | |
| | 2883 | <td align='center' $col> |
| | 2884 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2885 | <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' /> |
| | 2886 | <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' /> |
| | 2887 | <input type='hidden' name='KEY' value='$key' /> |
| | 2888 | </form> |
| | 2889 | </td> |
| | 2890 | <td align='center' $col> |
| | 2891 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2892 | <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' /> |
| | 2893 | <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /> |
| | 2894 | <input type='hidden' name='KEY' value='$key' /> |
| | 2895 | </form> |
| | 2896 | </td> |
| | 2897 | </tr> |
| | 2898 | END |
| | 2899 | ; |
| | 2900 | $id++; |
| | 2901 | } |
| | 2902 | print "</table>"; |
| | 2903 | |
| | 2904 | # If the config file contains entries, print Key to action icons |
| | 2905 | if ( $id ) { |
| | 2906 | print <<END |
| | 2907 | <table> |
| | 2908 | <tr> |
| | 2909 | <td class='boldbase'> <b>$Lang::tr{'legend'}:</b></td> |
| | 2910 | <td> <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td> |
| | 2911 | <td class='base'>$Lang::tr{'click to disable'}</td> |
| | 2912 | <td> <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td> |
| | 2913 | <td class='base'>$Lang::tr{'show certificate'}</td> |
| | 2914 | <td> <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td> |
| | 2915 | <td class='base'>$Lang::tr{'edit'}</td> |
| | 2916 | <td> <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td> |
| | 2917 | <td class='base'>$Lang::tr{'remove'}</td> |
| | 2918 | </tr> |
| | 2919 | <tr> |
| | 2920 | <td> </td> |
| | 2921 | <td> <img src='/images/off.gif' alt='?OFF' /></td> |
| | 2922 | <td class='base'>$Lang::tr{'click to enable'}</td> |
| | 2923 | <td> <img src='/images/floppy.gif' alt='?FLOPPY' /></td> |
| | 2924 | <td class='base'>$Lang::tr{'download certificate'}</td> |
| | 2925 | <td> <img src='/images/reload.gif' alt='?RELOAD'/></td> |
| | 2926 | <td class='base'>$Lang::tr{'restart'}</td> |
| | 2927 | </tr> |
| | 2928 | </table> |
| | 2929 | END |
| | 2930 | ; |
| | 2931 | } |
| | 2932 | |
| | 2933 | print <<END |
| | 2934 | <table width='100%'> |
| | 2935 | <tr><td align='right' colspan='9'> |
| | 2936 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2937 | <input type='submit' name='ACTION' value='$Lang::tr{'add'}' /> |
| | 2938 | </form> |
| | 2939 | </td></tr> |
| | 2940 | </table> |
| | 2941 | END |
| | 2942 | ; |
| | 2943 | &Header::closebox(); |
| | 2944 | |
| | 2945 | &Header::openbox('100%', 'left', "$Lang::tr{'certificate authorities'}"); |
| | 2946 | print <<EOF |
| | 2947 | <table width='100%' cellspacing='1' cellpadding='0' class='tbl'> |
| | 2948 | <tr> |
| | 2949 | <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th> |
| | 2950 | <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th> |
| | 2951 | <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th> |
| | 2952 | </tr> |
| | 2953 | EOF |
| | 2954 | ; |
| | 2955 | my $col1="bgcolor='$color{'color22'}'"; |
| | 2956 | my $col2="bgcolor='$color{'color20'}'"; |
| | 2957 | if (-f "${General::swroot}/ca/cacert.pem") { |
| | 2958 | my $casubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/cacert.pem")); |
| | 2959 | print <<END |
| | 2960 | <tr> |
| | 2961 | <td class='base' $col1>$Lang::tr{'root certificate'}</td> |
| | 2962 | <td class='base' $col1>$casubject</td> |
| | 2963 | <td width='3%' align='center' $col1> |
| | 2964 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2965 | <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' /> |
| | 2966 | <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' /> |
| | 2967 | </form> |
| | 2968 | </td> |
| | 2969 | <td width='3%' align='center' $col1> |
| | 2970 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2971 | <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' /> |
| | 2972 | <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' /> |
| | 2973 | </form> |
| | 2974 | </td> |
| | 2975 | <td width='4%' $col1> </td></tr> |
| | 2976 | END |
| | 2977 | ; |
| | 2978 | } else { |
| | 2979 | # display rootcert generation buttons |
| | 2980 | print <<END |
| | 2981 | <tr> |
| | 2982 | <td class='base' $col1>$Lang::tr{'root certificate'}:</td> |
| | 2983 | <td class='base' $col1>$Lang::tr{'not present'}</td> |
| | 2984 | <td colspan='3' $col1> </td></tr> |
| | 2985 | END |
| | 2986 | ; |
| | 2987 | } |
| | 2988 | |
| | 2989 | if (-f "${General::swroot}/certs/hostcert.pem") { |
| | 2990 | my $hostsubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/certs/hostcert.pem")); |
| | 2991 | |
| | 2992 | print <<END |
| | 2993 | <tr> |
| | 2994 | <td class='base' $col2>$Lang::tr{'host certificate'}</td> |
| | 2995 | <td class='base' $col2>$hostsubject</td> |
| | 2996 | <td width='3%' align='center' $col2> |
| | 2997 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 2998 | <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' /> |
| | 2999 | <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' /> |
| | 3000 | </form> |
| | 3001 | </td> |
| | 3002 | <td width='3%' align='center' $col2> |
| | 3003 | <form method='post' action='$ENV{'SCRIPT_NAME'}'> |
| | 3004 | <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/floppy.gif' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" /> |
| | 3005 | <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" /> |
| | 3006 | </form> |
| | 3007 | </td> |
| | 3008 | <td width='4%' $col2> </td></tr> |
| | 3009 | END |
| | 3010 | ; |
| | 3011 | } else { |
| | 3012 | # Nothing |
| | 3013 | print <<END |
| | 3014 | <tr> |
| | 3015 | <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td> |
| | 3016 | <td class='base' $col2>$Lang::tr{'not present'}</td> |
| | 3017 | <td colspan='3' $col2> </td></tr> |
| | 3018 | END |
| | 3019 | ; |
| | 3020 | } |
| | 3021 | |
| | 3022 | my $rowcolor = 0; |
| | 3023 | if (keys %cahash > 0) { |
| | 3024 | foreach my $key (keys %cahash) { |
| | 3025 | if ($rowcolor++ % 2) { |
| | 3026 | print "<tr>"; |
| | 3027 | $col="bgcolor='$color{'color20'}'"; |
| | 3028 | } else { |
| | 3029 | print "<tr>"; |
| | 3030 | $col="bgcolor='$color{'color22'}'"; |
| | 3031 | } |
| | 3032 | print "<td class='base' $col>$cahash{$key}[0]</td>\n"; |
| | 3033 | print "<td class='base' $col>$cahash{$key}[1]</td>\n"; |
| | 3034 | print <<END |
| | 3035 | <td align='center' $col> |
| | 3036 | <form method='post' name='cafrm${key}a' action='$ENV{'SCRIPT_NAME'}'> |
| | 3037 | <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' /> |
| | 3038 | <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' /> |
| | 3039 | <input type='hidden' name='KEY' value='$key' /> |
| | 3040 | </form> |
| | 3041 | </td> |
| | 3042 | <td align='center' $col> |
| | 3043 | <form method='post' name='cafrm${key}b' action='$ENV{'SCRIPT_NAME'}'> |
| | 3044 | <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' /> |
| | 3045 | <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' /> |
| | 3046 | <input type='hidden' name='KEY' value='$key' /> |
| | 3047 | </form> |
| | 3048 | </td> |
| | 3049 | <td align='center' $col> |
| | 3050 | <form method='post' name='cafrm${key}c' action='$ENV{'SCRIPT_NAME'}'> |
| | 3051 | <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' /> |
| | 3052 | <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' /> |
| | 3053 | <input type='hidden' name='KEY' value='$key' /> |
| | 3054 | </form> |
| | 3055 | </td> |
| | 3056 | </tr> |
| | 3057 | END |
| | 3058 | ; |
| | 3059 | } |
| | 3060 | } |
| | 3061 | print "</table>"; |
| | 3062 | |
| | 3063 | # If the file contains entries, print Key to action icons |
| | 3064 | if ( -f "${General::swroot}/ca/cacert.pem") { |
| | 3065 | print <<END |
| | 3066 | <table><tr> |
| | 3067 | <td class='boldbase'> <b>$Lang::tr{'legend'}:</b></td> |
| | 3068 | <td> <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td> |
| | 3069 | <td class='base'>$Lang::tr{'show certificate'}</td> |
| | 3070 | <td> <img src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' /></td> |
| | 3071 | <td class='base'>$Lang::tr{'download certificate'}</td> |
| | 3072 | </tr></table> |
| | 3073 | END |
| | 3074 | ; |
| | 3075 | } |
| | 3076 | my $createCA = -f "${General::swroot}/ca/cacert.pem" ? '' : "<tr><td colspan='3'></td><td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td></tr>"; |
| | 3077 | print <<END |
| | 3078 | <br> |
| | 3079 | <hr /> |
| | 3080 | <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'> |
| | 3081 | <table width='100%' border='0' cellspacing='1' cellpadding='0'> |
| | 3082 | $createCA |
| | 3083 | <tr> |
| | 3084 | <td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}: <img src='/blob.gif' alt='*' /></td> |
| | 3085 | <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' /> </td> |
| | 3086 | <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td> |
| | 3087 | <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td> |
| | 3088 | </tr> |
| | 3089 | <tr> |
| | 3090 | <td colspan='3'>$Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}:</td> |
| | 3091 | <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></td> |
| | 3092 | </tr> |
| | 3093 | </table> |
| | 3094 | </form> |
| | 3095 | END |
| | 3096 | ; |
| | 3097 | &Header::closebox(); |
| | 3098 | &Header::closebigbox(); |
| | 3099 | &Header::closepage(); |
| | 3100 | |
| | 3101 | sub array_unique($) { |
| | 3102 | my $array = shift; |
| | 3103 | my @unique = (); |
| | 3104 | |
| | 3105 | my %seen = (); |
| | 3106 | foreach my $e (@$array) { |
| | 3107 | next if $seen{$e}++; |
| | 3108 | push(@unique, $e); |
| | 3109 | } |
| | 3110 | |
| | 3111 | return @unique; |
| | 3112 | } |
| | 3113 | |
| | 3114 | sub make_algos($$$$$) { |
| | 3115 | my ($mode, $encs, $ints, $grps, $pfs) = @_; |
| | 3116 | my @algos = (); |
| | 3117 | |
| | 3118 | foreach my $enc (@$encs) { |
| | 3119 | foreach my $int (@$ints) { |
| | 3120 | foreach my $grp (@$grps) { |
| | 3121 | my @algo = ($enc); |
| | 3122 | |
| | 3123 | if ($mode eq "ike") { |
| | 3124 | push(@algo, $int); |
| | 3125 | |
| | 3126 | if ($grp =~ m/^e(.*)$/) { |
| | 3127 | push(@algo, "ecp$1"); |
| | 3128 | } elsif ($grp =~ m/curve25519/) { |
| | 3129 | push(@algo, "$grp"); |
| | 3130 | } else { |
| | 3131 | push(@algo, "modp$grp"); |
| | 3132 | } |
| | 3133 | |
| | 3134 | } elsif ($mode eq "esp" && $pfs) { |
| | 3135 | my $is_aead = ($enc =~ m/[cg]cm/); |
| | 3136 | |
| | 3137 | if (!$is_aead) { |
| | 3138 | push(@algo, $int); |
| | 3139 | } |
| | 3140 | |
| | 3141 | if ($grp eq "none") { |
| | 3142 | # noop |
| | 3143 | } elsif ($grp =~ m/^e(.*)$/) { |
| | 3144 | push(@algo, "ecp$1"); |
| | 3145 | } elsif ($grp =~ m/curve25519/) { |
| | 3146 | push(@algo, "$grp"); |
| | 3147 | } else { |
| | 3148 | push(@algo, "modp$grp"); |
| | 3149 | } |
| | 3150 | } |
| | 3151 | |
| | 3152 | push(@algos, join("-", @algo)); |
| | 3153 | } |
| | 3154 | } |
| | 3155 | } |
| | 3156 | |
| | 3157 | return &array_unique(\@algos); |
| | 3158 | } |
| | 3159 | |
| | 3160 | sub make_subnets($) { |
| | 3161 | my $subnets = shift; |
| | 3162 | |
| | 3163 | my @nets = split(/\|/, $subnets); |
| | 3164 | my @cidr_nets = (); |
| | 3165 | foreach my $net (@nets) { |
| | 3166 | my $cidr_net = &General::ipcidr($net); |
| | 3167 | push(@cidr_nets, $cidr_net); |
| | 3168 | } |
| | 3169 | |
| | 3170 | return join(",", @cidr_nets); |
| | 3171 | } |
projects / ipfire-2.x.git / blame_incremental