]> git.ipfire.org Git - ipfire-2.x.git/blob - html/cgi-bin/ovpnmain.cgi
92a72d7539bfaab2dc65a2c791a0db23f757c7c5
[ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2023 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21
22 use CGI;
23 use CGI qw/:standard/;
24 use Imager::QRCode;
25 use MIME::Base32;
26 use MIME::Base64;
27 use URI::Encode qw(uri_encode uri_decode);;
28 use Net::DNS;
29 use Net::Ping;
30 use Net::Telnet;
31 use File::Copy;
32 use File::Temp qw/ tempfile tempdir /;
33 use strict;
34 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
35 use Sort::Naturally;
36 use Date::Parse;
37 require '/var/ipfire/general-functions.pl';
38 require "${General::swroot}/lang.pl";
39 require "${General::swroot}/header.pl";
40 require "${General::swroot}/countries.pl";
41 require "${General::swroot}/location-functions.pl";
42
43 # enable only the following on debugging purpose
44 #use warnings;
45 #use CGI::Carp 'fatalsToBrowser';
46
47 #workaround to suppress a warning when a variable is used only once
48 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
49 undef (@dummy);
50
51 my %color = ();
52 my %mainsettings = ();
53 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
54 &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
55
56 ###
57 ### Initialize variables
58 ###
59 my %ccdconfhash=();
60 my %ccdroutehash=();
61 my %ccdroute2hash=();
62 my %netsettings=();
63 my %cgiparams=();
64 my %vpnsettings=();
65 my %checked=();
66 my %confighash=();
67 my %cahash=();
68 my %selected=();
69 my $warnmessage = '';
70 my $errormessage = '';
71 my $cryptoerror = '';
72 my $cryptowarning = '';
73 my %settings=();
74 my $routes_push_file = '';
75 my $confighost="${General::swroot}/fwhosts/customhosts";
76 my $configgrp="${General::swroot}/fwhosts/customgroups";
77 my $customnet="${General::swroot}/fwhosts/customnetworks";
78 my $name;
79 my $col="";
80 my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local";
81 my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local";
82 my $dhparameter = "/etc/ssl/ffdhe4096.pem";
83
84 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
85 $cgiparams{'ENABLED'} = 'off';
86 $cgiparams{'ENABLED_BLUE'} = 'off';
87 $cgiparams{'ENABLED_ORANGE'} = 'off';
88 $cgiparams{'EDIT_ADVANCED'} = 'off';
89 $cgiparams{'NAT'} = 'off';
90 $cgiparams{'COMPRESSION'} = 'off';
91 $cgiparams{'ONLY_PROPOSED'} = 'off';
92 $cgiparams{'ACTION'} = '';
93 $cgiparams{'CA_NAME'} = '';
94 $cgiparams{'DHCP_DOMAIN'} = '';
95 $cgiparams{'DHCP_DNS'} = '';
96 $cgiparams{'DHCP_WINS'} = '';
97 $cgiparams{'ROUTES_PUSH'} = '';
98 $cgiparams{'DCOMPLZO'} = 'off';
99 $cgiparams{'MSSFIX'} = '';
100 $cgiparams{'number'} = '';
101 $cgiparams{'DCIPHER'} = '';
102 $cgiparams{'DAUTH'} = '';
103 $cgiparams{'TLSAUTH'} = '';
104 $routes_push_file = "${General::swroot}/ovpn/routes_push";
105 # Perform crypto and configration test
106 &pkiconfigcheck;
107
108 # Add CCD files if not already presant
109 unless (-e $routes_push_file) {
110 open(RPF, ">$routes_push_file");
111 close(RPF);
112 }
113 unless (-e "${General::swroot}/ovpn/ccd.conf") {
114 open(CCDC, ">${General::swroot}/ovpn/ccd.conf");
115 close (CCDC);
116 }
117 unless (-e "${General::swroot}/ovpn/ccdroute") {
118 open(CCDR, ">${General::swroot}/ovpn/ccdroute");
119 close (CCDR);
120 }
121 unless (-e "${General::swroot}/ovpn/ccdroute2") {
122 open(CCDRT, ">${General::swroot}/ovpn/ccdroute2");
123 close (CCDRT);
124 }
125 # Add additional configs if not already presant
126 unless (-e "$local_serverconf") {
127 open(LSC, ">$local_serverconf");
128 close (LSC);
129 }
130 unless (-e "$local_clientconf") {
131 open(LCC, ">$local_clientconf");
132 close (LCC);
133 }
134
135 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
136
137 # prepare openvpn config file
138 ###
139 ### Useful functions
140 ###
141 sub iscertlegacy
142 {
143 my $file=$_[0];
144 my @certinfo = &General::system_output("/usr/bin/openssl", "pkcs12", "-info", "-nodes",
145 "-in", "$file.p12", "-noout", "-passin", "pass:''");
146 if (index ($certinfo[0], "MAC: sha1") != -1) {
147 return 1;
148 }
149 return 0;
150 }
151
152 sub haveOrangeNet
153 {
154 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
155 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
156 return 0;
157 }
158
159 sub haveBlueNet
160 {
161 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
162 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
163 return 0;
164 }
165
166 sub sizeformat{
167 my $bytesize = shift;
168 my $i = 0;
169
170 while(abs($bytesize) >= 1024){
171 $bytesize=$bytesize/1024;
172 $i++;
173 last if($i==6);
174 }
175
176 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
177 my $newsize=(int($bytesize*100 +0.5))/100;
178 return("$newsize $units[$i]");
179 }
180
181 sub cleanssldatabase
182 {
183 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
184 print FILE "01";
185 close FILE;
186 }
187 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
188 print FILE "";
189 close FILE;
190 }
191 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
192 print FILE "";
193 close FILE;
194 }
195 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
196 unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
197 unlink ("${General::swroot}/ovpn/certs/serial.old");
198 unlink ("${General::swroot}/ovpn/certs/01.pem");
199 }
200
201 sub newcleanssldatabase
202 {
203 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
204 open(FILE, ">${General::swroot}(ovpn/certs/serial");
205 print FILE "01";
206 close FILE;
207 }
208 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
209 &General::system("touch", "${General::swroot}/ovpn/certs/index.txt");
210 }
211 if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
212 &General::system("touch", "${General::swroot}/ovpn/certs/index.txt.attr");
213 }
214 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
215 unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
216 unlink ("${General::swroot}/ovpn/certs/serial.old");
217 }
218
219 sub deletebackupcert
220 {
221 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
222 my $hexvalue = <FILE>;
223 chomp $hexvalue;
224 close FILE;
225 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
226 }
227 }
228
229 ###
230 ### Check for PKI and configure problems
231 ###
232
233 sub pkiconfigcheck
234 {
235 # Warning if md5 is in usage
236 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
237 my @signature = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
238 if (grep(/md5WithRSAEncryption/, @signature) ) {
239 $cryptoerror = "$Lang::tr{'ovpn error md5'}";
240 goto CRYPTO_ERROR;
241 }
242 }
243
244 CRYPTO_ERROR:
245
246 # Warning if certificate is not compliant to RFC3280 TLS rules
247 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
248 my @extendkeyusage = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
249 if ( ! grep(/TLS Web Server Authentication/, @extendkeyusage)) {
250 $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
251 goto CRYPTO_WARNING;
252 }
253 }
254
255 CRYPTO_WARNING:
256 }
257
258 sub writeserverconf {
259 my %sovpnsettings = ();
260 my @temp = ();
261 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
262 &read_routepushfile;
263
264 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
265 flock CONF, 2;
266 print CONF "#OpenVPN Server conf\n";
267 print CONF "\n";
268 print CONF "daemon openvpnserver\n";
269 print CONF "writepid /var/run/openvpn.pid\n";
270 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
271 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
272 print CONF "dev tun\n";
273 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
274 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
275 print CONF "script-security 3\n";
276 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
277 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
278 print CONF "tls-server\n";
279 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
280 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
281 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
282 print CONF "dh $dhparameter\n";
283 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
284 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
285 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
286
287 print CONF "tun-mtu $sovpnsettings{'DMTU'}\n";
288
289 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
290 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
291 foreach (@temp)
292 {
293 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
294 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
295 }
296 }
297 # a.marx ccd
298 my %ccdconfhash=();
299 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
300 foreach my $key (keys %ccdconfhash) {
301 my $a=$ccdconfhash{$key}[1];
302 my ($b,$c) = split (/\//, $a);
303 print CONF "route $b ".&General::cidrtosub($c)."\n";
304 }
305 my %ccdroutehash=();
306 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
307 foreach my $key (keys %ccdroutehash) {
308 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
309 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
310 print CONF "route $a $b\n";
311 }
312 }
313 # ccd end
314
315 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
316 print CONF "client-to-client\n";
317 }
318 if ($sovpnsettings{MSSFIX} eq 'on') {
319 print CONF "mssfix\n";
320 } else {
321 print CONF "mssfix 0\n";
322 }
323 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
324 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
325 }
326
327 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
328 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
329 }
330 print CONF "status-version 1\n";
331 print CONF "status /var/run/ovpnserver.log 30\n";
332 print CONF "ncp-disable\n";
333 print CONF "cipher $sovpnsettings{DCIPHER}\n";
334 print CONF "auth $sovpnsettings{'DAUTH'}\n";
335 # Set TLSv2 as minimum
336 print CONF "tls-version-min 1.2\n";
337
338 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
339 print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
340 }
341 if ($sovpnsettings{DCOMPLZO} eq 'on') {
342 print CONF "comp-lzo\n";
343 }
344 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
345 print CONF "push \"redirect-gateway def1\"\n";
346 }
347 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
348 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
349 }
350
351 if ($sovpnsettings{DHCP_DNS} ne '') {
352 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
353 }
354
355 if ($sovpnsettings{DHCP_WINS} ne '') {
356 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
357 }
358
359 if ($sovpnsettings{MAX_CLIENTS} eq '') {
360 print CONF "max-clients 100\n";
361 }
362 if ($sovpnsettings{MAX_CLIENTS} ne '') {
363 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
364 }
365 print CONF "tls-verify /usr/lib/openvpn/verify\n";
366 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
367 print CONF "auth-user-pass-optional\n";
368 print CONF "reneg-sec 86400\n";
369 print CONF "user nobody\n";
370 print CONF "group nobody\n";
371 print CONF "persist-key\n";
372 print CONF "persist-tun\n";
373 if ($sovpnsettings{LOG_VERB} ne '') {
374 print CONF "verb $sovpnsettings{LOG_VERB}\n";
375 } else {
376 print CONF "verb 3\n";
377 }
378
379 print CONF "# Log clients connecting/disconnecting\n";
380 print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n";
381 print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n";
382 print CONF "\n";
383
384 print CONF "# Enable Management Socket\n";
385 print CONF "management /var/run/openvpn.sock unix\n";
386 print CONF "management-client-auth\n";
387
388 # Print server.conf.local if entries exist to server.conf
389 if ( !-z $local_serverconf && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
390 open (LSC, "$local_serverconf");
391 print CONF "\n#---------------------------\n";
392 print CONF "# Start of custom directives\n";
393 print CONF "# from server.conf.local\n";
394 print CONF "#---------------------------\n\n";
395 while (<LSC>) {
396 print CONF $_;
397 }
398 print CONF "\n#-----------------------------\n";
399 print CONF "# End of custom directives\n";
400 print CONF "#-----------------------------\n";
401 close (LSC);
402 }
403 print CONF "\n";
404
405 close(CONF);
406 }
407
408 sub emptyserverlog{
409 if (open(FILE, ">/var/run/ovpnserver.log")) {
410 flock FILE, 2;
411 print FILE "";
412 close FILE;
413 }
414
415 }
416
417 sub delccdnet
418 {
419 my %ccdconfhash = ();
420 my %ccdhash = ();
421 my $ccdnetname=$_[0];
422 if (-f "${General::swroot}/ovpn/ovpnconfig"){
423 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
424 foreach my $key (keys %ccdhash) {
425 if ($ccdhash{$key}[32] eq $ccdnetname) {
426 $errormessage=$Lang::tr{'ccd err hostinnet'};
427 return;
428 }
429 }
430 }
431 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
432 foreach my $key (keys %ccdconfhash) {
433 if ($ccdconfhash{$key}[0] eq $ccdnetname){
434 delete $ccdconfhash{$key};
435 }
436 }
437 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
438
439 &writeserverconf;
440 return 0;
441 }
442
443 sub addccdnet
444 {
445 my %ccdconfhash=();
446 my @ccdconf=();
447 my $ccdname=$_[0];
448 my $ccdnet=$_[1];
449 my $subcidr;
450 my @ip2=();
451 my $checkup;
452 my $ccdip;
453 my $baseaddress;
454
455
456 #check name
457 if ($ccdname eq '')
458 {
459 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
460 return
461 }
462
463 if(!&General::validccdname($ccdname))
464 {
465 $errormessage=$Lang::tr{'ccd err invalidname'};
466 return;
467 }
468
469 ($ccdip,$subcidr) = split (/\//,$ccdnet);
470 $subcidr=&General::iporsubtocidr($subcidr);
471 #check subnet
472 if ($subcidr > 30)
473 {
474 $errormessage=$Lang::tr{'ccd err invalidnet'};
475 return;
476 }
477 #check ip
478 if (!&General::validipandmask($ccdnet)){
479 $errormessage=$Lang::tr{'ccd err invalidnet'};
480 return;
481 }
482
483 if (!$errormessage) {
484 my %ccdconfhash=();
485 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
486 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
487 my $key = &General::findhasharraykey (\%ccdconfhash);
488 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
489 $ccdconfhash{$key}[0] = $ccdname;
490 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
491 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
492 &writeserverconf;
493 $cgiparams{'ccdname'}='';
494 $cgiparams{'ccdsubnet'}='';
495 return 1;
496 }
497 }
498
499 sub modccdnet
500 {
501
502 my $newname=$_[0];
503 my $oldname=$_[1];
504 my %ccdconfhash=();
505 my %ccdhash=();
506
507 # Check if the new name is valid.
508 if(!&General::validccdname($newname)) {
509 $errormessage=$Lang::tr{'ccd err invalidname'};
510 return;
511 }
512
513 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
514 foreach my $key (keys %ccdconfhash) {
515 if ($ccdconfhash{$key}[0] eq $oldname) {
516 foreach my $key1 (keys %ccdconfhash) {
517 if ($ccdconfhash{$key1}[0] eq $newname){
518 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
519 return;
520 }else{
521 $ccdconfhash{$key}[0]= $newname;
522 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
523 last;
524 }
525 }
526 }
527 }
528
529 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
530 foreach my $key (keys %ccdhash) {
531 if ($ccdhash{$key}[32] eq $oldname) {
532 $ccdhash{$key}[32]=$newname;
533 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
534 last;
535 }
536 }
537
538 return 0;
539 }
540 sub ccdmaxclients
541 {
542 my $ccdnetwork=$_[0];
543 my @octets=();
544 my @subnet=();
545 @octets=split("\/",$ccdnetwork);
546 @subnet= split /\./, &General::cidrtosub($octets[1]);
547 my ($a,$b,$c,$d,$e);
548 $a=256-$subnet[0];
549 $b=256-$subnet[1];
550 $c=256-$subnet[2];
551 $d=256-$subnet[3];
552 $e=($a*$b*$c*$d)/4;
553 return $e-1;
554 }
555
556 sub getccdadresses
557 {
558 my $ipin=$_[0];
559 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
560 my $cidr=$_[1];
561 chomp($cidr);
562 my $count=$_[2];
563 my $hasip=$_[3];
564 chomp($hasip);
565 my @iprange=();
566 my %ccdhash=();
567 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
568 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
569 for (my $i=1;$i<=$count;$i++) {
570 my $tmpip=$iprange[$i-1];
571 my $stepper=$i*4;
572 $iprange[$i]= &Network::bin2ip(&Network::ip2bin($tmpip) + 4);
573 }
574 my $r=0;
575 foreach my $key (keys %ccdhash) {
576 $r=0;
577 foreach my $tmp (@iprange){
578 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
579 if ($net eq $tmp) {
580 if ( $hasip ne $ccdhash{$key}[33] ){
581 splice (@iprange,$r,1);
582 }
583 }
584 $r++;
585 }
586 }
587 return @iprange;
588 }
589
590 sub fillselectbox
591 {
592 my $boxname=$_[1];
593 my ($ccdip,$subcidr) = split("/",$_[0]);
594 my $tz=$_[2];
595 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
596 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
597 foreach (@allccdips) {
598 my $ip=$_."/30";
599 chomp($ip);
600 print "<option value='$ip' ";
601 if ( $ip eq $cgiparams{$boxname} ){
602 print"selected";
603 }
604 print ">$ip</option>";
605 }
606 print "</select>";
607 }
608
609 sub hostsinnet
610 {
611 my $name=$_[0];
612 my %ccdhash=();
613 my $i=0;
614 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
615 foreach my $key (keys %ccdhash) {
616 if ($ccdhash{$key}[32] eq $name){ $i++;}
617 }
618 return $i;
619 }
620
621 sub check_routes_push
622 {
623 my $val=$_[0];
624 my ($ip,$cidr) = split (/\//, $val);
625 ##check for existing routes in routes_push
626 if (-e "${General::swroot}/ovpn/routes_push") {
627 open(FILE,"${General::swroot}/ovpn/routes_push");
628 while (<FILE>) {
629 $_=~s/\s*$//g;
630
631 my ($ip2,$cidr2) = split (/\//,"$_");
632 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
633
634 if($val eq $val2){
635 return 0;
636 }
637 #subnetcheck
638 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
639 return 0;
640 }
641 };
642 close(FILE);
643 }
644 return 1;
645 }
646
647 sub check_ccdroute
648 {
649 my %ccdroutehash=();
650 my $val=$_[0];
651 my ($ip,$cidr) = split (/\//, $val);
652 #check for existing routes in ccdroute
653 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
654 foreach my $key (keys %ccdroutehash) {
655 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
656 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
657 return 0;
658 }
659 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
660 #subnetcheck
661 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
662 return 0;
663 }
664 }
665 }
666 return 1;
667 }
668 sub check_ccdconf
669 {
670 my %ccdconfhash=();
671 my $val=$_[0];
672 my ($ip,$cidr) = split (/\//, $val);
673 #check for existing routes in ccdroute
674 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
675 foreach my $key (keys %ccdconfhash) {
676 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
677 return 0;
678 }
679 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
680 #subnetcheck
681 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
682 return 0;
683 }
684
685 }
686 return 1;
687 }
688
689 ###
690 # m.a.d net2net
691 ###
692
693 sub validdotmask
694 {
695 my $ipdotmask = $_[0];
696 if (&General::validip($ipdotmask)) { return 0; }
697 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
698 my $mask = $2;
699 if (($mask =~ /\./ )) { return 0; }
700 return 1;
701 }
702
703 # -------------------------------------------------------------------
704
705 sub write_routepushfile
706 {
707 open(FILE, ">$routes_push_file");
708 flock(FILE, 2);
709 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
710 print FILE $vpnsettings{'ROUTES_PUSH'};
711 }
712 close(FILE);
713 }
714
715 sub read_routepushfile
716 {
717 if (-e "$routes_push_file") {
718 open(FILE,"$routes_push_file");
719 delete $vpnsettings{'ROUTES_PUSH'};
720 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
721 close(FILE);
722 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
723
724 }
725 }
726
727 sub writecollectdconf {
728 my $vpncollectd;
729 my %ccdhash=();
730
731 open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!";
732 print COLLECTDVPN "Loadplugin openvpn\n";
733 print COLLECTDVPN "\n";
734 print COLLECTDVPN "<Plugin openvpn>\n";
735 print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n";
736
737 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
738 foreach my $key (keys %ccdhash) {
739 if ($ccdhash{$key}[0] eq 'on' && $ccdhash{$key}[3] eq 'net') {
740 print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ccdhash{$key}[1]-n2n\"\n";
741 }
742 }
743
744 print COLLECTDVPN "</Plugin>\n";
745 close(COLLECTDVPN);
746
747 # Reload collectd afterwards
748 &General::system("/usr/local/bin/collectdctrl", "restart");
749 }
750
751 #hier die refresh page
752 if ( -e "${General::swroot}/ovpn/gencanow") {
753 my $refresh = '';
754 $refresh = "<meta http-equiv='refresh' content='15;' />";
755 &Header::showhttpheaders();
756 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
757 &Header::openbigbox('100%', 'center');
758 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
759 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
760 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
761 &Header::closebox();
762 &Header::closebigbox();
763 &Header::closepage();
764 exit (0);
765 }
766 ##hier die refresh page
767
768
769 ###
770 ### OpenVPN Server Control
771 ###
772 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
773 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
774 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
775 #start openvpn server
776 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
777 &emptyserverlog();
778 &General::system("/usr/local/bin/openvpnctrl", "-s");
779 }
780 #stop openvpn server
781 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
782 &General::system("/usr/local/bin/openvpnctrl", "-k");
783 &emptyserverlog();
784 }
785 # #restart openvpn server
786 # if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
787 #workarund, till SIGHUP also works when running as nobody
788 # system('/usr/local/bin/openvpnctrl', '-r');
789 # &emptyserverlog();
790 # }
791 }
792
793 ###
794 ### Save Advanced options
795 ###
796
797 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
798 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
799 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
800 #DAN this value has to leave.
801 #new settings for daemon
802 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
803 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
804 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
805 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
806 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
807 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
808 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
809 $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
810 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
811 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
812 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
813 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
814 my @temp=();
815
816 if ($cgiparams{'FRAGMENT'} eq '') {
817 delete $vpnsettings{'FRAGMENT'};
818 } else {
819 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
820 $errormessage = "Incorrect value, please insert only numbers.";
821 goto ADV_ERROR;
822 } else {
823 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
824 }
825 }
826
827 if ($cgiparams{'MSSFIX'} ne 'on') {
828 delete $vpnsettings{'MSSFIX'};
829 } else {
830 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
831 }
832
833 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
834 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
835 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
836 goto ADV_ERROR;
837 }
838 }
839 if ($cgiparams{'DHCP_DNS'} ne ''){
840 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
841 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
842 goto ADV_ERROR;
843 }
844 }
845 if ($cgiparams{'DHCP_WINS'} ne ''){
846 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
847 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
848 goto ADV_ERROR;
849 }
850 }
851 if ($cgiparams{'ROUTES_PUSH'} ne ''){
852 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
853 undef $vpnsettings{'ROUTES_PUSH'};
854
855 foreach my $tmpip (@temp)
856 {
857 s/^\s+//g; s/\s+$//g;
858
859 if ($tmpip)
860 {
861 $tmpip=~s/\s*$//g;
862 unless (&General::validipandmask($tmpip)) {
863 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
864 goto ADV_ERROR;
865 }
866 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
867
868 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
869 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
870 goto ADV_ERROR;
871 }
872 # a.marx ccd
873 my %ccdroutehash=();
874 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
875 foreach my $key (keys %ccdroutehash) {
876 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
877 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
878 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
879 goto ADV_ERROR;
880 }
881 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
882 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
883 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
884 goto ADV_ERROR;
885 }
886 }
887 }
888
889 # ccd end
890
891 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
892 }
893 }
894 &write_routepushfile;
895 undef $vpnsettings{'ROUTES_PUSH'};
896 }
897 else {
898 undef $vpnsettings{'ROUTES_PUSH'};
899 &write_routepushfile;
900 }
901 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
902 $errormessage = $Lang::tr{'invalid input for max clients'};
903 goto ADV_ERROR;
904 }
905 if ($cgiparams{'KEEPALIVE_1'} ne '') {
906 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
907 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
908 goto ADV_ERROR;
909 }
910 }
911 if ($cgiparams{'KEEPALIVE_2'} ne ''){
912 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
913 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
914 goto ADV_ERROR;
915 }
916 }
917 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
918 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
919 goto ADV_ERROR;
920 }
921 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
922 &writeserverconf();#hier ok
923 }
924
925 ###
926 # m.a.d net2net
927 ###
928
929 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
930 {
931
932 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
933 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
934 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
935 my $tunmtu = '';
936
937 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
938 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
939
940 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
941
942 flock SERVERCONF, 2;
943 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
944 print SERVERCONF "\n";
945 print SERVERCONF "# User Security\n";
946 print SERVERCONF "user nobody\n";
947 print SERVERCONF "group nobody\n";
948 print SERVERCONF "persist-tun\n";
949 print SERVERCONF "persist-key\n";
950 print SERVERCONF "script-security 2\n";
951 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
952
953 if ($cgiparams{'REMOTE'} ne '') {
954 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
955 }
956
957 print SERVERCONF "float\n";
958 print SERVERCONF "# IP adresses of the VPN Subnet\n";
959 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
960 print SERVERCONF "# Client Gateway Network\n";
961 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
962 print SERVERCONF "up \"/etc/init.d/static-routes start\"\n";
963 print SERVERCONF "# tun Device\n";
964 print SERVERCONF "dev tun\n";
965 print SERVERCONF "#Logfile for statistics\n";
966 print SERVERCONF "status-version 1\n";
967 print SERVERCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
968 print SERVERCONF "# Port and Protokol\n";
969 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
970
971 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
972 print SERVERCONF "proto tcp4-server\n";
973 print SERVERCONF "# Packet size\n";
974 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
975 print SERVERCONF "tun-mtu $tunmtu\n";
976 }
977
978 if ($cgiparams{'PROTOCOL'} eq 'udp') {
979 print SERVERCONF "proto udp4\n";
980 print SERVERCONF "# Paketsize\n";
981 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
982 print SERVERCONF "tun-mtu $tunmtu\n";
983 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
984 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; } else { print SERVERCONF "mssfix 0\n" };
985 }
986
987 print SERVERCONF "# Auth. Server\n";
988 print SERVERCONF "tls-server\n";
989 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
990 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
991 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
992 print SERVERCONF "dh $dhparameter\n";
993 print SERVERCONF "# Cipher\n";
994 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
995
996 # If GCM cipher is used, do not use --auth
997 if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
998 ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
999 ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1000 print SERVERCONF unless "# HMAC algorithm\n";
1001 print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n";
1002 } else {
1003 print SERVERCONF "# HMAC algorithm\n";
1004 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
1005 }
1006
1007 # Set TLSv1.2 as minimum
1008 print SERVERCONF "tls-version-min 1.2\n";
1009
1010 if ($cgiparams{'COMPLZO'} eq 'on') {
1011 print SERVERCONF "# Enable Compression\n";
1012 print SERVERCONF "comp-lzo\n";
1013 }
1014 print SERVERCONF "# Debug Level\n";
1015 print SERVERCONF "verb 3\n";
1016 print SERVERCONF "# Tunnel check\n";
1017 print SERVERCONF "keepalive 10 60\n";
1018 print SERVERCONF "# Start as daemon\n";
1019 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1020 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1021 print SERVERCONF "# Activate Management Interface and Port\n";
1022 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1023 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1024 close(SERVERCONF);
1025
1026 }
1027
1028 ###
1029 # m.a.d net2net
1030 ###
1031
1032 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1033 {
1034
1035 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
1036 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1037 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
1038 my $tunmtu = '';
1039
1040 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1041 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1042
1043 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1044
1045 flock CLIENTCONF, 2;
1046 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1047 print CLIENTCONF "#\n";
1048 print CLIENTCONF "# User Security\n";
1049 print CLIENTCONF "user nobody\n";
1050 print CLIENTCONF "group nobody\n";
1051 print CLIENTCONF "persist-tun\n";
1052 print CLIENTCONF "persist-key\n";
1053 print CLIENTCONF "script-security 2\n";
1054 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1055 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1056 print CLIENTCONF "float\n";
1057 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1058 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1059 print CLIENTCONF "# Server Gateway Network\n";
1060 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1061 print CLIENTCONF "up \"/etc/init.d/static-routes start\"\n";
1062 print CLIENTCONF "# tun Device\n";
1063 print CLIENTCONF "dev tun\n";
1064 print CLIENTCONF "#Logfile for statistics\n";
1065 print CLIENTCONF "status-version 1\n";
1066 print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
1067 print CLIENTCONF "# Port and Protokol\n";
1068 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1069
1070 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1071 print CLIENTCONF "proto tcp4-client\n";
1072 print CLIENTCONF "# Packet size\n";
1073 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1074 print CLIENTCONF "tun-mtu $tunmtu\n";
1075 }
1076
1077 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1078 print CLIENTCONF "proto udp4\n";
1079 print CLIENTCONF "# Paketsize\n";
1080 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1081 print CLIENTCONF "tun-mtu $tunmtu\n";
1082 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1083 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; } else { print CLIENTCONF "mssfix 0\n" };
1084 }
1085
1086 # Check host certificate if X509 is RFC3280 compliant.
1087 # If not, old --ns-cert-type directive will be used.
1088 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
1089 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1090 if ( ! grep(/TLS Web Server Authentication/, @hostcert)) {
1091 print CLIENTCONF "ns-cert-type server\n";
1092 } else {
1093 print CLIENTCONF "remote-cert-tls server\n";
1094 }
1095 print CLIENTCONF "# Auth. Client\n";
1096 print CLIENTCONF "tls-client\n";
1097 print CLIENTCONF "# Cipher\n";
1098 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
1099 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1100
1101 # If GCM cipher is used, do not use --auth
1102 if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1103 ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1104 ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1105 print CLIENTCONF unless "# HMAC algorithm\n";
1106 print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n";
1107 } else {
1108 print CLIENTCONF "# HMAC algorithm\n";
1109 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1110 }
1111
1112 # Set TLSv1.2 as minimum
1113 print CLIENTCONF "tls-version-min 1.2\n";
1114
1115 if ($cgiparams{'COMPLZO'} eq 'on') {
1116 print CLIENTCONF "# Enable Compression\n";
1117 print CLIENTCONF "comp-lzo\n";
1118 }
1119 print CLIENTCONF "# Debug Level\n";
1120 print CLIENTCONF "verb 3\n";
1121 print CLIENTCONF "# Tunnel check\n";
1122 print CLIENTCONF "keepalive 10 60\n";
1123 print CLIENTCONF "# Start as daemon\n";
1124 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1125 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1126 print CLIENTCONF "# Activate Management Interface and Port\n";
1127 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1128 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1129 if (&iscertlegacy("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}")) {
1130 print CLIENTCONF "providers legacy default\n";
1131 }
1132 close(CLIENTCONF);
1133
1134 }
1135
1136 ###
1137 ### Save main settings
1138 ###
1139
1140 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1141 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1142 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1143 #DAN this value has to leave.
1144 if ($cgiparams{'ENABLED'} eq 'on'){
1145 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1146 $errormessage = $Lang::tr{'invalid input for hostname'};
1147 goto SETTINGS_ERROR;
1148 }
1149 }
1150
1151 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1152 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1153 goto SETTINGS_ERROR;
1154 }
1155 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1156
1157 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1158 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1159 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1160 goto SETTINGS_ERROR;
1161 }
1162
1163 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1164 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1165 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1166 goto SETTINGS_ERROR;
1167 }
1168
1169 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1170 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1171 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1172 goto SETTINGS_ERROR;
1173 }
1174
1175 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1176 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1177 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1178 goto SETTINGS_ERROR;
1179 }
1180 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1181 while (<ALIASES>)
1182 {
1183 chomp($_);
1184 my @tempalias = split(/\,/,$_);
1185 if ($tempalias[1] eq 'on') {
1186 if (&General::IpInSubnet ($tempalias[0] ,
1187 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1188 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1189 }
1190 }
1191 }
1192 close(ALIASES);
1193 if ($errormessage ne ''){
1194 goto SETTINGS_ERROR;
1195 }
1196 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1197 $errormessage = $Lang::tr{'invalid input'};
1198 goto SETTINGS_ERROR;
1199 }
1200 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1201 $errormessage = $Lang::tr{'invalid mtu input'};
1202 goto SETTINGS_ERROR;
1203 }
1204
1205 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1206 $errormessage = $Lang::tr{'invalid port'};
1207 goto SETTINGS_ERROR;
1208 }
1209
1210 # Create ta.key for tls-auth if not presant
1211 if ($cgiparams{'TLSAUTH'} eq 'on') {
1212 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
1213 # This system call is safe, because all arguements are passed as an array.
1214 system("/usr/sbin/openvpn", "--genkey", "secret", "${General::swroot}/ovpn/certs/ta.key");
1215 if ($?) {
1216 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1217 goto SETTINGS_ERROR;
1218 }
1219 }
1220 }
1221
1222 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1223 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1224 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1225 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1226 #new settings for daemon
1227 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1228 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1229 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1230 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1231 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1232 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1233 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
1234 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
1235 #wrtie enable
1236
1237 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {
1238 &General::system("touch", "${General::swroot}/ovpn/enable_blue");
1239 } else {
1240 unlink("${General::swroot}/ovpn/enable_blue");
1241 }
1242
1243 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {
1244 &General::system("touch", "${General::swroot}/ovpn/enable_orange");
1245 } else {
1246 unlink("${General::swroot}/ovpn/enable_orange");
1247 }
1248
1249 if ( $vpnsettings{'ENABLED'} eq 'on' ) {
1250 &General::system("touch", "${General::swroot}/ovpn/enable");
1251 } else {
1252 unlink("${General::swroot}/ovpn/enable");
1253 }
1254
1255 #new settings for daemon
1256 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1257 &writeserverconf();#hier ok
1258 SETTINGS_ERROR:
1259 ###
1260 ### Reset all step 2
1261 ###
1262 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
1263 my $file = '';
1264 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1265
1266 # Kill all N2N connections
1267 &General::system("/usr/local/bin/openvpnctrl", "-kn2n");
1268
1269 foreach my $key (keys %confighash) {
1270 my $name = $confighash{$cgiparams{'$key'}}[1];
1271
1272 if ($confighash{$key}[4] eq 'cert') {
1273 delete $confighash{$cgiparams{'$key'}};
1274 }
1275
1276 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$name");
1277 }
1278 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1279 unlink $file;
1280 }
1281 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1282 unlink $file;
1283 }
1284 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1285 unlink $file;
1286 }
1287 &cleanssldatabase();
1288 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1289 print FILE "";
1290 close FILE;
1291 }
1292 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1293 print FILE "";
1294 close FILE;
1295 }
1296 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1297 print FILE "";
1298 close FILE;
1299 }
1300 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1301 unlink $file
1302 }
1303 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1304 unlink $file
1305 }
1306 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1307 print FILE "";
1308 close FILE;
1309 }
1310 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1311 print FILE "";
1312 close FILE;
1313 }
1314 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1315 unlink($file);
1316 }
1317
1318 # Remove everything from the collectd configuration
1319 &writecollectdconf();
1320
1321 #&writeserverconf();
1322 ###
1323 ### Reset all step 1
1324 ###
1325 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
1326 &Header::showhttpheaders();
1327 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1328 &Header::openbigbox('100%', 'left', '', '');
1329 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1330 print <<END;
1331 <form method='post'>
1332 <table width='100%'>
1333 <tr>
1334 <td align='center'>
1335 <input type='hidden' name='AREUSURE' value='yes' />
1336 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1337 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1338 </tr>
1339 <tr>
1340 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1341 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1342 </tr>
1343 </table>
1344 </form>
1345 END
1346 ;
1347 &Header::closebox();
1348 &Header::closebigbox();
1349 &Header::closepage();
1350 exit (0);
1351
1352 ###
1353 ### Upload CA Certificate
1354 ###
1355 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1356 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1357
1358 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1359 $errormessage = $Lang::tr{'name must only contain characters'};
1360 goto UPLOADCA_ERROR;
1361 }
1362
1363 if (length($cgiparams{'CA_NAME'}) >60) {
1364 $errormessage = $Lang::tr{'name too long'};
1365 goto VPNCONF_ERROR;
1366 }
1367
1368 if ($cgiparams{'CA_NAME'} eq 'ca') {
1369 $errormessage = $Lang::tr{'name is invalid'};
1370 goto UPLOADCA_ERROR;
1371 }
1372
1373 # Check if there is no other entry with this name
1374 foreach my $key (keys %cahash) {
1375 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1376 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1377 goto UPLOADCA_ERROR;
1378 }
1379 }
1380
1381 unless (ref ($cgiparams{'FH'})) {
1382 $errormessage = $Lang::tr{'there was no file upload'};
1383 goto UPLOADCA_ERROR;
1384 }
1385 # Move uploaded ca to a temporary file
1386 (my $fh, my $filename) = tempfile( );
1387 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1388 $errormessage = $!;
1389 goto UPLOADCA_ERROR;
1390 }
1391 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
1392 if ( ! grep(/CA:TRUE/i, @temp )) {
1393 $errormessage = $Lang::tr{'not a valid ca certificate'};
1394 unlink ($filename);
1395 goto UPLOADCA_ERROR;
1396 } else {
1397 unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem")) {
1398 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1399 unlink ($filename);
1400 goto UPLOADCA_ERROR;
1401 }
1402 }
1403
1404 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1405 my $casubject;
1406
1407 foreach my $line (@casubject) {
1408 if ($line =~ /Subject: (.*)[\n]/) {
1409 $casubject = $1;
1410 $casubject =~ s+/Email+, E+;
1411 $casubject =~ s/ ST=/ S=/;
1412
1413 last;
1414 }
1415 }
1416
1417 $casubject = &Header::cleanhtml($casubject);
1418
1419 my $key = &General::findhasharraykey (\%cahash);
1420 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1421 $cahash{$key}[1] = $casubject;
1422 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1423 # system('/usr/local/bin/ipsecctrl', 'R');
1424
1425 UPLOADCA_ERROR:
1426
1427 ###
1428 ### Display ca certificate
1429 ###
1430 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1431 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1432
1433 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1434 &Header::showhttpheaders();
1435 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1436 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1437 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1438 my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1439 my $output = &Header::cleanhtml(join("", @output),"y");
1440 print "<pre>$output</pre>\n";
1441 &Header::closebox();
1442 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1443 &Header::closebigbox();
1444 &Header::closepage();
1445 exit(0);
1446 } else {
1447 $errormessage = $Lang::tr{'invalid key'};
1448 }
1449
1450 ###
1451 ### Download ca certificate
1452 ###
1453 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1454 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1455
1456 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1457 print "Content-Type: application/octet-stream\r\n";
1458 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1459
1460 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1461 print @tmp;
1462
1463 exit(0);
1464 } else {
1465 $errormessage = $Lang::tr{'invalid key'};
1466 }
1467
1468 ###
1469 ### Remove ca certificate (step 2)
1470 ###
1471 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1472 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1473 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1474
1475 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1476 foreach my $key (keys %confighash) {
1477 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1478 if (grep(/: OK/, @test)) {
1479 # Delete connection
1480 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1481 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1482 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1483 # }
1484 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1485 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1486 delete $confighash{$key};
1487 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1488 # &writeipsecfiles();
1489 }
1490 }
1491 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1492 delete $cahash{$cgiparams{'KEY'}};
1493 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1494 # system('/usr/local/bin/ipsecctrl', 'R');
1495 } else {
1496 $errormessage = $Lang::tr{'invalid key'};
1497 }
1498 ###
1499 ### Remove ca certificate (step 1)
1500 ###
1501 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1502 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1503 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1504
1505 my $assignedcerts = 0;
1506 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1507 foreach my $key (keys %confighash) {
1508 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1509 if (grep(/: OK/, @test)) {
1510 $assignedcerts++;
1511 }
1512 }
1513 if ($assignedcerts) {
1514 &Header::showhttpheaders();
1515 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1516 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1517 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1518 print <<END;
1519 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1520 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1521 <tr><td align='center'>
1522 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1523 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1524 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1525 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1526 </form></table>
1527 END
1528 ;
1529 &Header::closebox();
1530 &Header::closebigbox();
1531 &Header::closepage();
1532 exit (0);
1533 } else {
1534 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1535 delete $cahash{$cgiparams{'KEY'}};
1536 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1537 # system('/usr/local/bin/ipsecctrl', 'R');
1538 }
1539 } else {
1540 $errormessage = $Lang::tr{'invalid key'};
1541 }
1542
1543 ###
1544 ### Display root certificate
1545 ###
1546 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1547 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1548 my @output;
1549 &Header::showhttpheaders();
1550 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1551 &Header::openbigbox('100%', 'LEFT', '', '');
1552 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1553 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1554 @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1555 } else {
1556 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1557 @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1558 }
1559 my $output = &Header::cleanhtml(join("", @output), "y");
1560 print "<pre>$output</pre>\n";
1561 &Header::closebox();
1562 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1563 &Header::closebigbox();
1564 &Header::closepage();
1565 exit(0);
1566
1567 ###
1568 ### Download root certificate
1569 ###
1570 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1571 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1572 print "Content-Type: application/octet-stream\r\n";
1573 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1574
1575 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1576 print @tmp;
1577
1578 exit(0);
1579 }
1580
1581 ###
1582 ### Download host certificate
1583 ###
1584 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1585 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1586 print "Content-Type: application/octet-stream\r\n";
1587 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1588
1589 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1590 print @tmp;
1591
1592 exit(0);
1593 }
1594
1595 ###
1596 ### Download tls-auth key
1597 ###
1598 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1599 if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1600 print "Content-Type: application/octet-stream\r\n";
1601 print "Content-Disposition: filename=ta.key\r\n\r\n";
1602
1603 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
1604 my @tmp = <FILE>;
1605 close(FILE);
1606
1607 print @tmp;
1608
1609 exit(0);
1610 }
1611
1612 ###
1613 ### Form for generating a root certificate
1614 ###
1615 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1616 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1617
1618 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1619 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1620 $errormessage = $Lang::tr{'valid root certificate already exists'};
1621 $cgiparams{'ACTION'} = '';
1622 goto ROOTCERT_ERROR;
1623 }
1624
1625 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1626 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1627 my $ipaddr = <IPADDR>;
1628 close IPADDR;
1629 chomp ($ipaddr);
1630 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1631 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1632 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1633 }
1634 }
1635 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1636 unless (ref ($cgiparams{'FH'})) {
1637 $errormessage = $Lang::tr{'there was no file upload'};
1638 goto ROOTCERT_ERROR;
1639 }
1640
1641 # Move uploaded certificate request to a temporary file
1642 (my $fh, my $filename) = tempfile( );
1643 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1644 $errormessage = $!;
1645 goto ROOTCERT_ERROR;
1646 }
1647
1648 # Create a temporary dirctory
1649 my $tempdir = tempdir( CLEANUP => 1 );
1650
1651 # Extract the CA certificate from the file
1652 my $pid = open(OPENSSL, "|-");
1653 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1654 if ($pid) { # parent
1655 if ($cgiparams{'P12_PASS'} ne '') {
1656 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1657 }
1658 close (OPENSSL);
1659 if ($?) {
1660 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1661 unlink ($filename);
1662 goto ROOTCERT_ERROR;
1663 }
1664 } else { # child
1665 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1666 '-in', $filename,
1667 '-out', "$tempdir/cacert.pem")) {
1668 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1669 unlink ($filename);
1670 goto ROOTCERT_ERROR;
1671 }
1672 }
1673
1674 # Extract the Host certificate from the file
1675 $pid = open(OPENSSL, "|-");
1676 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1677 if ($pid) { # parent
1678 if ($cgiparams{'P12_PASS'} ne '') {
1679 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1680 }
1681 close (OPENSSL);
1682 if ($?) {
1683 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1684 unlink ($filename);
1685 goto ROOTCERT_ERROR;
1686 }
1687 } else { # child
1688 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1689 '-in', $filename,
1690 '-out', "$tempdir/hostcert.pem")) {
1691 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1692 unlink ($filename);
1693 goto ROOTCERT_ERROR;
1694 }
1695 }
1696
1697 # Extract the Host key from the file
1698 $pid = open(OPENSSL, "|-");
1699 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1700 if ($pid) { # parent
1701 if ($cgiparams{'P12_PASS'} ne '') {
1702 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1703 }
1704 close (OPENSSL);
1705 if ($?) {
1706 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1707 unlink ($filename);
1708 goto ROOTCERT_ERROR;
1709 }
1710 } else { # child
1711 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1712 '-nodes',
1713 '-in', $filename,
1714 '-out', "$tempdir/serverkey.pem")) {
1715 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1716 unlink ($filename);
1717 goto ROOTCERT_ERROR;
1718 }
1719 }
1720
1721 unless(move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem")) {
1722 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1723 unlink ($filename);
1724 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1725 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1726 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1727 goto ROOTCERT_ERROR;
1728 }
1729
1730 unless(move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem")) {
1731 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1732 unlink ($filename);
1733 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1734 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1735 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1736 goto ROOTCERT_ERROR;
1737 }
1738
1739 unless(move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem")) {
1740 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1741 unlink ($filename);
1742 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1743 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1744 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1745 goto ROOTCERT_ERROR;
1746 }
1747
1748 goto ROOTCERT_SUCCESS;
1749
1750 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1751
1752 # Validate input since the form was submitted
1753 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1754 $errormessage = $Lang::tr{'organization cant be empty'};
1755 goto ROOTCERT_ERROR;
1756 }
1757 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1758 $errormessage = $Lang::tr{'organization too long'};
1759 goto ROOTCERT_ERROR;
1760 }
1761 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1762 $errormessage = $Lang::tr{'invalid input for organization'};
1763 goto ROOTCERT_ERROR;
1764 }
1765 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1766 $errormessage = $Lang::tr{'hostname cant be empty'};
1767 goto ROOTCERT_ERROR;
1768 }
1769 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1770 $errormessage = $Lang::tr{'invalid input for hostname'};
1771 goto ROOTCERT_ERROR;
1772 }
1773 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1774 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1775 goto ROOTCERT_ERROR;
1776 }
1777 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1778 $errormessage = $Lang::tr{'e-mail address too long'};
1779 goto ROOTCERT_ERROR;
1780 }
1781 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1782 $errormessage = $Lang::tr{'invalid input for department'};
1783 goto ROOTCERT_ERROR;
1784 }
1785 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1786 $errormessage = $Lang::tr{'invalid input for city'};
1787 goto ROOTCERT_ERROR;
1788 }
1789 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1790 $errormessage = $Lang::tr{'invalid input for state or province'};
1791 goto ROOTCERT_ERROR;
1792 }
1793 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1794 $errormessage = $Lang::tr{'invalid input for country'};
1795 goto ROOTCERT_ERROR;
1796 }
1797
1798 # Copy the cgisettings to vpnsettings and save the configfile
1799 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1800 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1801 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1802 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1803 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1804 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1805 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1806 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1807
1808 # Replace empty strings with a .
1809 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1810 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1811 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1812
1813 # refresh
1814 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1815
1816 # Create the CA certificate
1817 my $pid = open(OPENSSL, "|-");
1818 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1819 if ($pid) { # parent
1820 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1821 print OPENSSL "$state\n";
1822 print OPENSSL "$city\n";
1823 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1824 print OPENSSL "$ou\n";
1825 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1826 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1827 close (OPENSSL);
1828 if ($?) {
1829 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1830 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1831 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1832 goto ROOTCERT_ERROR;
1833 }
1834 } else { # child
1835 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
1836 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
1837 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1838 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1839 '-config', "/usr/share/openvpn/ovpn.cnf")) {
1840 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1841 goto ROOTCERT_ERROR;
1842 }
1843 }
1844
1845 # Create the Host certificate request
1846 $pid = open(OPENSSL, "|-");
1847 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1848 if ($pid) { # parent
1849 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1850 print OPENSSL "$state\n";
1851 print OPENSSL "$city\n";
1852 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1853 print OPENSSL "$ou\n";
1854 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1855 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1856 print OPENSSL ".\n";
1857 print OPENSSL ".\n";
1858 close (OPENSSL);
1859 if ($?) {
1860 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1861 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1862 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1863 goto ROOTCERT_ERROR;
1864 }
1865 } else { # child
1866 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
1867 '-newkey', 'rsa:4096',
1868 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1869 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1870 '-extensions', 'server',
1871 '-config', "/usr/share/openvpn/ovpn.cnf" )) {
1872 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1873 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1874 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1875 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1876 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1877 goto ROOTCERT_ERROR;
1878 }
1879 }
1880
1881 # Sign the host certificate request
1882 # This system call is safe, because all argeuments are passed as an array.
1883 system('/usr/bin/openssl', 'ca', '-days', '999999',
1884 '-batch', '-notext',
1885 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1886 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1887 '-extensions', 'server',
1888 '-config', "/usr/share/openvpn/ovpn.cnf");
1889 if ($?) {
1890 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1891 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1892 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1893 unlink ("${General::swroot}/ovpn/serverkey.pem");
1894 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1895 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1896 &newcleanssldatabase();
1897 goto ROOTCERT_ERROR;
1898 } else {
1899 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1900 &deletebackupcert();
1901 }
1902
1903 # Create an empty CRL
1904 # System call is safe, because all arguments are passed as array.
1905 system('/usr/bin/openssl', 'ca', '-gencrl',
1906 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1907 '-config', "/usr/share/openvpn/ovpn.cnf" );
1908 if ($?) {
1909 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1910 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1911 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1912 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1913 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1914 &cleanssldatabase();
1915 goto ROOTCERT_ERROR;
1916 # } else {
1917 # &cleanssldatabase();
1918 }
1919 # Create ta.key for tls-auth
1920 # This system call is safe, because all arguments are passed as an array.
1921 system('/usr/sbin/openvpn', '--genkey', 'secret', "${General::swroot}/ovpn/certs/ta.key");
1922 if ($?) {
1923 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1924 &cleanssldatabase();
1925 goto ROOTCERT_ERROR;
1926 }
1927 goto ROOTCERT_SUCCESS;
1928 }
1929 ROOTCERT_ERROR:
1930 if ($cgiparams{'ACTION'} ne '') {
1931 &Header::showhttpheaders();
1932 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1933 &Header::openbigbox('100%', 'LEFT', '', '');
1934
1935 # Show any errors
1936 &Header::errorbox($errormessage);
1937
1938 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1939 print <<END;
1940 <form method='post' enctype='multipart/form-data'>
1941 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1942 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1943 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1944 <td width='35%' colspan='2'>&nbsp;</td></tr>
1945 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1946 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1947 <td colspan='2'>&nbsp;</td></tr>
1948 <tr><td class='base'>$Lang::tr{'your e-mail'}:</td>
1949 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1950 <td colspan='2'>&nbsp;</td></tr>
1951 <tr><td class='base'>$Lang::tr{'your department'}:</td>
1952 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1953 <td colspan='2'>&nbsp;</td></tr>
1954 <tr><td class='base'>$Lang::tr{'city'}:</td>
1955 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1956 <td colspan='2'>&nbsp;</td></tr>
1957 <tr><td class='base'>$Lang::tr{'state or province'}:</td>
1958 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1959 <td colspan='2'>&nbsp;</td></tr>
1960 <tr><td class='base'>$Lang::tr{'country'}:</td>
1961 <td class='base'><select name='ROOTCERT_COUNTRY'>
1962
1963 END
1964 ;
1965 foreach my $country (sort keys %{Countries::countries}) {
1966 print "<option value='$Countries::countries{$country}'";
1967 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1968 print " selected='selected'";
1969 }
1970 print ">$country</option>";
1971 }
1972 print <<END;
1973 </select></td>
1974
1975 <tr><td>&nbsp;</td>
1976 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1977 <td>&nbsp;</td><td>&nbsp;</td></tr>
1978 <tr><td class='base' colspan='4' align='left'>
1979 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
1980 <tr><td colspan='2'><br></td></tr>
1981 </table>
1982
1983 <table width='100%'>
1984 <tr><td colspan='4'><hr></td></tr>
1985 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1986 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1987 <td colspan='2'>&nbsp;</td></tr>
1988 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
1989 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1990 <td colspan='2'>&nbsp;</td></tr>
1991 <tr><td>&nbsp;</td>
1992 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1993 <td colspan='2'>&nbsp;</td></tr>
1994 <tr><td class='base' colspan='4' align='left'>
1995 <img src='/blob.gif' valign='top' alt='*' >&nbsp;$Lang::tr{'required field'}</td>
1996 </tr>
1997 </form></table>
1998 END
1999 ;
2000 &Header::closebox();
2001 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2002 &Header::closebigbox();
2003 &Header::closepage();
2004 exit(0)
2005 }
2006
2007 ROOTCERT_SUCCESS:
2008 &General::system("chmod", "600", "${General::swroot}/ovpn/certs/serverkey.pem");
2009 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2010 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2011 # system('/usr/local/bin/ipsecctrl', 'S');
2012 # }
2013
2014 ###
2015 ### Enable/Disable connection
2016 ###
2017
2018 ###
2019 # m.a.d net2net
2020 ###
2021
2022 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2023
2024 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2025 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2026 my $n2nactive = '';
2027 my @ps = &General::system_output("/bin/ps", "ax");
2028
2029 if(grep(/$confighash{$cgiparams{'KEY'}}[1]/, @ps)) {
2030 $n2nactive = "1";
2031 }
2032
2033 if ($confighash{$cgiparams{'KEY'}}) {
2034 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2035 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2036 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2037
2038 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2039 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2040 &writecollectdconf();
2041 }
2042 } else {
2043
2044 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2045 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2046
2047 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2048 if ($n2nactive ne '') {
2049 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2050 &writecollectdconf();
2051 }
2052 }
2053 }
2054 }
2055
2056 ###
2057 ### Download OpenVPN client package
2058 ###
2059
2060
2061 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2062 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2063 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2064 my $file = '';
2065 my $clientovpn = '';
2066 my @fileholder;
2067 my $tempdir = tempdir( CLEANUP => 1 );
2068 my $zippath = "$tempdir/";
2069
2070 ###
2071 # m.a.d net2net
2072 ###
2073
2074 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2075
2076 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2077 my $zippathname = "$zippath$zipname";
2078 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2079 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
2080 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
2081 my $tunmtu = '';
2082 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
2083 my $n2nfragment = '';
2084
2085 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2086 flock CLIENTCONF, 2;
2087
2088 my $zip = Archive::Zip->new();
2089 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2090 print CLIENTCONF "# \n";
2091 print CLIENTCONF "# User Security\n";
2092 print CLIENTCONF "user nobody\n";
2093 print CLIENTCONF "group nobody\n";
2094 print CLIENTCONF "persist-tun\n";
2095 print CLIENTCONF "persist-key\n";
2096 print CLIENTCONF "script-security 2\n";
2097 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2098 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2099 print CLIENTCONF "float\n";
2100 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2101 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2102 print CLIENTCONF "# Server Gateway Network\n";
2103 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2104 print CLIENTCONF "# tun Device\n";
2105 print CLIENTCONF "dev tun\n";
2106 print CLIENTCONF "#Logfile for statistics\n";
2107 print CLIENTCONF "status-version 1\n";
2108 print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
2109 print CLIENTCONF "# Port and Protokoll\n";
2110 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2111
2112 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2113 print CLIENTCONF "proto tcp4-client\n";
2114 print CLIENTCONF "# Packet size\n";
2115 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2116 print CLIENTCONF "tun-mtu $tunmtu\n";
2117 }
2118
2119 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2120 print CLIENTCONF "proto udp4\n";
2121 print CLIENTCONF "# Paketsize\n";
2122 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2123 print CLIENTCONF "tun-mtu $tunmtu\n";
2124 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2125 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} else { print CLIENTCONF "mssfix 0\n"; }
2126 }
2127 # Check host certificate if X509 is RFC3280 compliant.
2128 # If not, old --ns-cert-type directive will be used.
2129 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2130 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2131 if (! grep(/TLS Web Server Authentication/, @hostcert)) {
2132 print CLIENTCONF "ns-cert-type server\n";
2133 } else {
2134 print CLIENTCONF "remote-cert-tls server\n";
2135 }
2136 print CLIENTCONF "# Auth. Client\n";
2137 print CLIENTCONF "tls-client\n";
2138 print CLIENTCONF "# Cipher\n";
2139 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2140 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2141 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2142 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2143 }
2144
2145 # If GCM cipher is used, do not use --auth
2146 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
2147 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
2148 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
2149 print CLIENTCONF unless "# HMAC algorithm\n";
2150 print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2151 } else {
2152 print CLIENTCONF "# HMAC algorithm\n";
2153 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2154 }
2155
2156 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2157 print CLIENTCONF "# Enable Compression\n";
2158 print CLIENTCONF "comp-lzo\n";
2159 }
2160 print CLIENTCONF "# Debug Level\n";
2161 print CLIENTCONF "verb 3\n";
2162 print CLIENTCONF "# Tunnel check\n";
2163 print CLIENTCONF "keepalive 10 60\n";
2164 print CLIENTCONF "# Start as daemon\n";
2165 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2166 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2167 print CLIENTCONF "# Activate Management Interface and Port\n";
2168 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2169 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2170 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2171 if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
2172 print CLIENTCONF "providers legacy default\n";
2173 }
2174
2175
2176
2177 close(CLIENTCONF);
2178
2179 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2180 my $status = $zip->writeToFileNamed($zippathname);
2181
2182 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2183 @fileholder = <DLFILE>;
2184 print "Content-Type:application/x-download\n";
2185 print "Content-Disposition:attachment;filename=$zipname\n\n";
2186 print @fileholder;
2187 exit (0);
2188 }
2189 else
2190 {
2191 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2192 my $zippathname = "$zippath$zipname";
2193 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2194
2195 ###
2196 # m.a.d net2net
2197 ###
2198
2199 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2200 flock CLIENTCONF, 2;
2201
2202 my $zip = Archive::Zip->new();
2203
2204 print CLIENTCONF "#OpenVPN Client conf\r\n";
2205 print CLIENTCONF "tls-client\r\n";
2206 print CLIENTCONF "client\r\n";
2207 print CLIENTCONF "nobind\r\n";
2208 print CLIENTCONF "dev tun\r\n";
2209 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2210 print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n";
2211
2212 if ( $vpnsettings{'ENABLED'} eq 'on'){
2213 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2214 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2215 print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Blue interface\r\n";
2216 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2217 }
2218 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2219 print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
2220 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2221 }
2222 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2223 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2224 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2225 print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
2226 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2227 }
2228 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2229 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2230 }
2231
2232 my $file_crt = new File::Temp( UNLINK => 1 );
2233 my $file_key = new File::Temp( UNLINK => 1 );
2234 my $include_certs = 0;
2235
2236 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2237 if ($cgiparams{'MODE'} eq 'insecure') {
2238 $include_certs = 1;
2239
2240 # Add the CA
2241 print CLIENTCONF ";ca cacert.pem\r\n";
2242 $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2243
2244 # Extract the certificate
2245 # This system call is safe, because all arguments are passed as an array.
2246 if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
2247 system('/usr/bin/openssl', 'pkcs12', '-legacy', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2248 '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
2249 if ($?) {
2250 die "openssl error: $?";
2251 }
2252 } else {
2253 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2254 '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
2255 if ($?) {
2256 die "openssl error: $?";
2257 }
2258 }
2259
2260 $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die;
2261 print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n";
2262
2263 # Extract the key
2264 # This system call is safe, because all arguments are passed as an array.
2265 if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
2266 system('/usr/bin/openssl', 'pkcs12', '-legacy', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2267 '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
2268 if ($?) {
2269 die "openssl error: $?";
2270 }
2271 } else {
2272 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2273 '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
2274 if ($?) {
2275 die "openssl error: $?";
2276 }
2277 }
2278
2279 $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die;
2280 print CLIENTCONF ";key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2281 } else {
2282 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2283 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2284 }
2285 } else {
2286 print CLIENTCONF "ca cacert.pem\r\n";
2287 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2288 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2289 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2290 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2291 }
2292 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2293 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2294
2295 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2296 if ($cgiparams{'MODE'} eq 'insecure') {
2297 print CLIENTCONF ";";
2298 }
2299 print CLIENTCONF "tls-auth ta.key\r\n";
2300 $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n";
2301 }
2302 if ($vpnsettings{DCOMPLZO} eq 'on') {
2303 print CLIENTCONF "comp-lzo\r\n";
2304 }
2305 print CLIENTCONF "verb 3\r\n";
2306 # Check host certificate if X509 is RFC3280 compliant.
2307 # If not, old --ns-cert-type directive will be used.
2308 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2309 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2310 if (! grep(/TLS Web Server Authentication/, @hostcert)) {
2311 print CLIENTCONF "ns-cert-type server\r\n";
2312 } else {
2313 print CLIENTCONF "remote-cert-tls server\r\n";
2314 }
2315 print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
2316 if ($vpnsettings{MSSFIX} eq 'on') {
2317 print CLIENTCONF "mssfix\r\n";
2318 } else {
2319 print CLIENTCONF "mssfix 0\r\n";
2320 }
2321 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2322 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2323 }
2324
2325 # Disable storing any credentials in memory
2326 print CLIENTCONF "auth-nocache\r\n";
2327
2328 # Set a fake user name for authentication
2329 print CLIENTCONF "auth-user-pass\r\n";
2330 print CLIENTCONF "auth-token-user USER\r\n";
2331 print CLIENTCONF "auth-token TOTP\r\n";
2332
2333 # If the server is asking for TOTP this needs to happen interactively
2334 print CLIENTCONF "auth-retry interact\r\n";
2335
2336 # Add provider line if certificate is legacy type
2337 if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
2338 print CLIENTCONF "providers legacy default\r\n";
2339 }
2340
2341 if ($include_certs) {
2342 print CLIENTCONF "\r\n";
2343
2344 # CA
2345 open(FILE, "<${General::swroot}/ovpn/ca/cacert.pem");
2346 print CLIENTCONF "<ca>\r\n";
2347 while (<FILE>) {
2348 chomp($_);
2349 print CLIENTCONF "$_\r\n";
2350 }
2351 print CLIENTCONF "</ca>\r\n\r\n";
2352 close(FILE);
2353
2354 # Cert
2355 open(FILE, "<$file_crt");
2356 print CLIENTCONF "<cert>\r\n";
2357 while (<FILE>) {
2358 chomp($_);
2359 print CLIENTCONF "$_\r\n";
2360 }
2361 print CLIENTCONF "</cert>\r\n\r\n";
2362 close(FILE);
2363
2364 # Key
2365 open(FILE, "<$file_key");
2366 print CLIENTCONF "<key>\r\n";
2367 while (<FILE>) {
2368 chomp($_);
2369 print CLIENTCONF "$_\r\n";
2370 }
2371 print CLIENTCONF "</key>\r\n\r\n";
2372 close(FILE);
2373
2374 # TLS auth
2375 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2376 open(FILE, "<${General::swroot}/ovpn/certs/ta.key");
2377 print CLIENTCONF "<tls-auth>\r\n";
2378 while (<FILE>) {
2379 chomp($_);
2380 print CLIENTCONF "$_\r\n";
2381 }
2382 print CLIENTCONF "</tls-auth>\r\n\r\n";
2383 close(FILE);
2384 }
2385 }
2386
2387 # Print client.conf.local if entries exist to client.ovpn
2388 if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
2389 open (LCC, "$local_clientconf");
2390 print CLIENTCONF "\n#---------------------------\n";
2391 print CLIENTCONF "# Start of custom directives\n";
2392 print CLIENTCONF "# from client.conf.local\n";
2393 print CLIENTCONF "#---------------------------\n\n";
2394 while (<LCC>) {
2395 print CLIENTCONF $_;
2396 }
2397 print CLIENTCONF "\n#---------------------------\n";
2398 print CLIENTCONF "# End of custom directives\n";
2399 print CLIENTCONF "#---------------------------\n\n";
2400 close (LCC);
2401 }
2402 close(CLIENTCONF);
2403
2404 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2405 my $status = $zip->writeToFileNamed($zippathname);
2406
2407 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2408 @fileholder = <DLFILE>;
2409 print "Content-Type:application/x-download\n";
2410 print "Content-Disposition:attachment;filename=$zipname\n\n";
2411 print @fileholder;
2412 exit (0);
2413 }
2414
2415
2416
2417 ###
2418 ### Remove connection
2419 ###
2420
2421
2422 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2423 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2424 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2425
2426 if ($confighash{$cgiparams{'KEY'}}) {
2427 # Revoke certificate if certificate was deleted and rewrite the CRL
2428 &General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "/usr/share/openvpn/ovpn.cnf");
2429 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "/usr/share/openvpn/ovpn.cnf");
2430
2431 ###
2432 # m.a.d net2net
2433 ###
2434
2435 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2436 # Stop the N2N connection before it is removed
2437 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2438
2439 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2440 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2441 unlink ($certfile);
2442 unlink ($conffile);
2443
2444 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2445 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2446 }
2447 }
2448
2449 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2450 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2451
2452 # A.Marx CCD delete ccd files and routes
2453
2454 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2455 {
2456 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2457 }
2458
2459 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2460 foreach my $key (keys %ccdroutehash) {
2461 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2462 delete $ccdroutehash{$key};
2463 }
2464 }
2465 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2466
2467 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2468 foreach my $key (keys %ccdroute2hash) {
2469 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2470 delete $ccdroute2hash{$key};
2471 }
2472 }
2473 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2474 &writeserverconf;
2475
2476 # CCD end
2477 # Update collectd configuration and delete all RRD files of the removed connection
2478 &writecollectdconf();
2479 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]");
2480
2481 delete $confighash{$cgiparams{'KEY'}};
2482 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "/usr/share/openvpn/ovpn.cnf");
2483 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2484
2485 } else {
2486 $errormessage = $Lang::tr{'invalid key'};
2487 }
2488 &General::firewall_reload();
2489
2490 ###
2491 ### Download PKCS12 file
2492 ###
2493 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2494 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2495
2496 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2497 print "Content-Type: application/octet-stream\r\n\r\n";
2498
2499 open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2500 my @tmp = <FILE>;
2501 close(FILE);
2502
2503 print @tmp;
2504 exit (0);
2505
2506 ###
2507 ### Display certificate
2508 ###
2509 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2510 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2511
2512 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2513 &Header::showhttpheaders();
2514 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2515 &Header::openbigbox('100%', 'LEFT', '', '');
2516 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2517 my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2518 my $output = &Header::cleanhtml(join("", @output), "y");
2519 print "<pre>$output</pre>\n";
2520 &Header::closebox();
2521 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2522 &Header::closebigbox();
2523 &Header::closepage();
2524 exit(0);
2525 }
2526
2527 ###
2528 ### Display OTP QRCode
2529 ###
2530 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show otp qrcode'}) {
2531 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2532
2533 my $qrcode = Imager::QRCode->new(
2534 size => 6,
2535 margin => 0,
2536 version => 0,
2537 level => 'M',
2538 mode => '8-bit',
2539 casesensitive => 1,
2540 lightcolor => Imager::Color->new(255, 255, 255),
2541 darkcolor => Imager::Color->new(0, 0, 0),
2542 );
2543 my $cn = uri_encode($confighash{$cgiparams{'KEY'}}[2]);
2544 my $secret = encode_base32(pack('H*', $confighash{$cgiparams{'KEY'}}[44]));
2545 my $issuer = uri_encode("$mainsettings{'HOSTNAME'}.$mainsettings{'DOMAINNAME'}");
2546 my $qrcodeimg = $qrcode->plot("otpauth://totp/$cn?secret=$secret&issuer=$issuer");
2547 my $qrcodeimgdata;
2548 $qrcodeimg->write(data => \$qrcodeimgdata, type=> 'png')
2549 or die $qrcodeimg->errstr;
2550 $qrcodeimgdata = encode_base64($qrcodeimgdata, '');
2551
2552 &Header::showhttpheaders();
2553 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2554 &Header::openbigbox('100%', 'LEFT', '', '');
2555 &Header::openbox('100%', 'LEFT', "$Lang::tr{'otp qrcode'}:");
2556 print <<END;
2557 $Lang::tr{'secret'}:&nbsp;$secret</br></br>
2558 <img alt="$Lang::tr{'otp qrcode'}" src="data:image/png;base64,$qrcodeimgdata">
2559 END
2560 &Header::closebox();
2561 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2562 &Header::closebigbox();
2563 &Header::closepage();
2564 exit(0);
2565
2566 ###
2567 ### Display Diffie-Hellman key
2568 ###
2569 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2570
2571 if (! -e "$dhparameter") {
2572 $errormessage = $Lang::tr{'not present'};
2573 } else {
2574 &Header::showhttpheaders();
2575 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2576 &Header::openbigbox('100%', 'LEFT', '', '');
2577 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2578 my @output = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$dhparameter");
2579 my $output = &Header::cleanhtml(join("", @output) ,"y");
2580 print "<pre>$output</pre>\n";
2581 &Header::closebox();
2582 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2583 &Header::closebigbox();
2584 &Header::closepage();
2585 exit(0);
2586 }
2587
2588 ###
2589 ### Display tls-auth key
2590 ###
2591 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2592
2593 if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2594 $errormessage = $Lang::tr{'not present'};
2595 } else {
2596 &Header::showhttpheaders();
2597 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2598 &Header::openbigbox('100%', 'LEFT', '', '');
2599 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2600
2601 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
2602 my @output = <FILE>;
2603 close(FILE);
2604
2605 my $output = &Header::cleanhtml(join("", @output),"y");
2606 print "<pre>$output</pre>\n";
2607 &Header::closebox();
2608 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2609 &Header::closebigbox();
2610 &Header::closepage();
2611 exit(0);
2612 }
2613
2614 ###
2615 ### Display Certificate Revoke List
2616 ###
2617 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2618 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2619
2620 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2621 $errormessage = $Lang::tr{'not present'};
2622 } else {
2623 &Header::showhttpheaders();
2624 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2625 &Header::openbigbox('100%', 'LEFT', '', '');
2626 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2627 my @output = &General::system_output("/usr/bin/openssl", "crl", "-text", "-noout", "-in", "${General::swroot}/ovpn/crls/cacrl.pem");
2628 my $output = &Header::cleanhtml(join("", @output), "y");
2629 print "<pre>$output</pre>\n";
2630 &Header::closebox();
2631 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2632 &Header::closebigbox();
2633 &Header::closepage();
2634 exit(0);
2635 }
2636
2637 ###
2638 ### Advanced Server Settings
2639 ###
2640
2641 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2642 %cgiparams = ();
2643 %cahash = ();
2644 %confighash = ();
2645 my $disabled;
2646 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2647 read_routepushfile;
2648
2649
2650 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2651 # $cgiparams{'CLIENT2CLIENT'} = 'on';
2652 # }
2653 ADV_ERROR:
2654 if ($cgiparams{'MAX_CLIENTS'} eq '') {
2655 $cgiparams{'MAX_CLIENTS'} = '100';
2656 }
2657 if ($cgiparams{'KEEPALIVE_1'} eq '') {
2658 $cgiparams{'KEEPALIVE_1'} = '10';
2659 }
2660 if ($cgiparams{'KEEPALIVE_2'} eq '') {
2661 $cgiparams{'KEEPALIVE_2'} = '60';
2662 }
2663 if ($cgiparams{'LOG_VERB'} eq '') {
2664 $cgiparams{'LOG_VERB'} = '3';
2665 }
2666 if ($cgiparams{'TLSAUTH'} eq '') {
2667 $cgiparams{'TLSAUTH'} = 'off';
2668 }
2669 $checked{'CLIENT2CLIENT'}{'off'} = '';
2670 $checked{'CLIENT2CLIENT'}{'on'} = '';
2671 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2672 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2673 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2674 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2675 $checked{'DCOMPLZO'}{'off'} = '';
2676 $checked{'DCOMPLZO'}{'on'} = '';
2677 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
2678 $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
2679 $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
2680 $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
2681 $checked{'MSSFIX'}{'off'} = '';
2682 $checked{'MSSFIX'}{'on'} = '';
2683 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2684 $selected{'LOG_VERB'}{'0'} = '';
2685 $selected{'LOG_VERB'}{'1'} = '';
2686 $selected{'LOG_VERB'}{'2'} = '';
2687 $selected{'LOG_VERB'}{'3'} = '';
2688 $selected{'LOG_VERB'}{'4'} = '';
2689 $selected{'LOG_VERB'}{'5'} = '';
2690 $selected{'LOG_VERB'}{'6'} = '';
2691 $selected{'LOG_VERB'}{'7'} = '';
2692 $selected{'LOG_VERB'}{'8'} = '';
2693 $selected{'LOG_VERB'}{'9'} = '';
2694 $selected{'LOG_VERB'}{'10'} = '';
2695 $selected{'LOG_VERB'}{'11'} = '';
2696 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2697
2698 &Header::showhttpheaders();
2699 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2700 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2701
2702 # Show any errors
2703 &Header::errorbox($errormessage);
2704
2705 &Header::opensection();
2706
2707 print <<END;
2708 <form method='post' enctype='multipart/form-data'>
2709 <table width='100%' border=0>
2710 <tr>
2711 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2712 </tr>
2713 <tr>
2714 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2715 </tr>
2716 <tr>
2717 <td class='base'>Domain</td>
2718 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
2719 </tr>
2720 <tr>
2721 <td class='base'>DNS</td>
2722 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2723 </tr>
2724 <tr>
2725 <td class='base'>WINS</td>
2726 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2727 </tr>
2728 <tr>
2729 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2730 </tr>
2731 <tr>
2732 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2733 <td colspan='2'>
2734 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2735 END
2736 ;
2737
2738 if ($cgiparams{'ROUTES_PUSH'} ne '')
2739 {
2740 print $cgiparams{'ROUTES_PUSH'};
2741 }
2742
2743 print <<END;
2744 </textarea></td>
2745 </tr>
2746 </tr>
2747 </table>
2748 <hr size='1'>
2749 <table width='100%'>
2750 <tr>
2751 <td class='base'><b>$Lang::tr{'misc-options'}</b></td>
2752 </tr>
2753
2754 <tr>
2755 <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td>
2756 </tr>
2757
2758 <tr>
2759 <td class='base'>Client-To-Client</td>
2760 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2761 </tr>
2762
2763 <tr>
2764 <td class='base'>Redirect-Gateway def1</td>
2765 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2766 </tr>
2767
2768 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
2769 <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
2770 <td>$Lang::tr{'openvpn default'}: off <font color='red'>($Lang::tr{'attention'} exploitable via Voracle)</font></td>
2771 </tr>
2772
2773 <tr>
2774 <td class='base'>$Lang::tr{'ovpn add conf'}</td>
2775 <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
2776 <td>$Lang::tr{'openvpn default'}: off</td>
2777 </tr>
2778
2779 <tr>
2780 <td class='base'>mssfix</td>
2781 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2782 <td>$Lang::tr{'openvpn default'}: off</td>
2783 </tr>
2784
2785 <tr>
2786 <td class='base'>fragment <br></td>
2787 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2788 </tr>
2789
2790
2791 <tr>
2792 <td class='base'>Max-Clients</td>
2793 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2794 </tr>
2795 <tr>
2796 <td class='base'>Keepalive <br />
2797 (ping/ping-restart)</td>
2798 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2799 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2800 </tr>
2801 </table>
2802
2803 <hr size='1'>
2804 <table width='100%'>
2805 <tr>
2806 <td class='base'><b>$Lang::tr{'log-options'}</b></td>
2807 </tr>
2808 <tr>
2809 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
2810 </tr>
2811
2812 <tr><td class='base'>VERB</td>
2813 <td><select name='LOG_VERB'>
2814 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option>
2815 <option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2816 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2817 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2818 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2819 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2820 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2821 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2822 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2823 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2824 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2825 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2826 </td></select>
2827 </table>
2828
2829 <hr size='1'>
2830 END
2831
2832 if ( -e "/var/run/openvpn.pid"){
2833 print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2834 $Lang::tr{'server restart'}<br><br>
2835 <hr>";
2836 print<<END;
2837 <table width='100%'>
2838 <tr>
2839 <td>&nbsp;</td>
2840 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2841 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2842 <td>&nbsp;</td>
2843 </tr>
2844 </table>
2845 </form>
2846 END
2847 ;
2848
2849
2850 }else{
2851
2852 print<<END;
2853 <table width='100%'>
2854 <tr>
2855 <td>&nbsp;</td>
2856 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2857 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2858 <td>&nbsp;</td>
2859 </tr>
2860 </table>
2861 </form>
2862 END
2863 ;
2864 }
2865 &Header::closebox();
2866 # print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2867 &Header::closebigbox();
2868 &Header::closepage();
2869 exit(0);
2870
2871
2872 # A.Marx CCD Add,delete or edit CCD net
2873
2874 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2875 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2876 $cgiparams{'ACTION'} eq "kill" ||
2877 $cgiparams{'ACTION'} eq "edit" ||
2878 $cgiparams{'ACTION'} eq 'editsave'){
2879 &Header::showhttpheaders();
2880 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2881 &Header::openbigbox('100%', 'LEFT', '', '');
2882
2883 if ($cgiparams{'ACTION'} eq "kill"){
2884 &delccdnet($cgiparams{'net'});
2885 }
2886
2887 if ($cgiparams{'ACTION'} eq 'editsave'){
2888 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2889 if ( $a ne $b){ &modccdnet($a,$b);}
2890 $cgiparams{'ccdname'}='';
2891 $cgiparams{'ccdsubnet'}='';
2892 }
2893
2894 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
2895 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
2896 }
2897 if ($errormessage) {
2898 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2899 print "<class name='base'>$errormessage";
2900 print "&nbsp;</class>";
2901 &Header::closebox();
2902 }
2903 if ($cgiparams{'ACTION'} eq "edit"){
2904
2905 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2906
2907 print <<END;
2908 <table width='100%' border='0'>
2909 <tr><form method='post'>
2910 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2911 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly='readonly' /></td></tr>
2912 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2913 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2914 </td></tr>
2915 </table></form>
2916 END
2917 ;
2918 &Header::closebox();
2919
2920 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2921 print <<END;
2922 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2923 <tr>
2924 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2925 END
2926 ;
2927 }
2928 else{
2929 if (! -e "/var/run/openvpn.pid"){
2930 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2931 print <<END;
2932 <table width='100%' border='0'>
2933 <tr><form method='post'>
2934 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2935 <tr>
2936 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2937 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2938 <tr><td colspan=4><hr /></td></tr><tr>
2939 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2940 </table></form>
2941 END
2942
2943 &Header::closebox();
2944 }
2945 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2946 if ( -e "/var/run/openvpn.pid"){
2947 print "<b>$Lang::tr{'attention'}:</b><br>";
2948 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2949 }
2950
2951 print <<END;
2952 <table width='100%' cellpadding='0' cellspacing='1'>
2953 <tr>
2954 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2955 END
2956 ;
2957 }
2958 my %ccdconfhash=();
2959 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2960 my @ccdconf=();
2961 my $count=0;
2962 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
2963 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2964 $count++;
2965 my $ccdhosts = &hostsinnet($ccdconf[0]);
2966 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2967 else{ print" <tr bgcolor='$color{'color20'}'>";}
2968 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
2969 print <<END;
2970 <form method='post' />
2971 <input type='image' src='/images/edit.gif' align='middle' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
2972 <input type='hidden' name='ACTION' value='edit'/>
2973 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2974 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2975 </form></td>
2976 <form method='post' />
2977 <td><input type='hidden' name='ACTION' value='kill'/>
2978 <input type='hidden' name='number' value='$count' />
2979 <input type='hidden' name='net' value='$ccdconf[0]' />
2980 <input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /></form></td></tr>
2981 END
2982 ;
2983 }
2984 print "</table></form>";
2985 &Header::closebox();
2986 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2987 &Header::closebigbox();
2988 &Header::closepage();
2989 exit(0);
2990
2991 #END CCD
2992
2993 ###
2994 ### Openvpn Connections Statistics
2995 ###
2996 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2997 &Header::showhttpheaders();
2998 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2999 &Header::openbigbox('100%', 'LEFT', '', '');
3000 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
3001
3002 #
3003 # <td><b>$Lang::tr{'protocol'}</b></td>
3004 # protocol temp removed
3005 print <<END;
3006 <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
3007 <tr>
3008 <th><b>$Lang::tr{'common name'}</b></th>
3009 <th><b>$Lang::tr{'real address'}</b></th>
3010 <th><b>$Lang::tr{'country'}</b></th>
3011 <th><b>$Lang::tr{'virtual address'}</b></th>
3012 <th><b>$Lang::tr{'loged in at'}</b></th>
3013 <th><b>$Lang::tr{'bytes sent'}</b></th>
3014 <th><b>$Lang::tr{'bytes received'}</b></th>
3015 <th><b>$Lang::tr{'last activity'}</b></th>
3016 </tr>
3017 END
3018 ;
3019 my $filename = "/var/run/ovpnserver.log";
3020 open(FILE, $filename) or die 'Unable to open config file.';
3021 my @current = <FILE>;
3022 close(FILE);
3023 my @users =();
3024 my $status;
3025 my $uid = 0;
3026 my $cn;
3027 my @match = ();
3028 my $proto = "udp";
3029 my $address;
3030 my %userlookup = ();
3031 foreach my $line (@current)
3032 {
3033 chomp($line);
3034 if ( $line =~ /^Updated,(.+)/){
3035 @match = split( /^Updated,(.+)/, $line);
3036 $status = $match[1];
3037 }
3038 #gian
3039 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3040 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3041 if ($match[1] ne "Common Name") {
3042 $cn = $match[1];
3043 $userlookup{$match[2]} = $uid;
3044 $users[$uid]{'CommonName'} = $match[1];
3045 $users[$uid]{'RealAddress'} = $match[2];
3046 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
3047 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
3048 $users[$uid]{'Since'} = $match[5];
3049 $users[$uid]{'Proto'} = $proto;
3050
3051 # get country code for "RealAddress"...
3052 my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]);
3053 my $flag_icon = &Location::Functions::get_flag_icon($ccode);
3054 $users[$uid]{'Country'} = "<a href='country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a>";
3055 $uid++;
3056 }
3057 }
3058 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
3059 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
3060 if ($match[1] ne "Virtual Address") {
3061 $address = $match[3];
3062 #find the uid in the lookup table
3063 $uid = $userlookup{$address};
3064 $users[$uid]{'VirtualAddress'} = $match[1];
3065 $users[$uid]{'LastRef'} = $match[4];
3066 }
3067 }
3068 }
3069 my $user2 = @users;
3070 if ($user2 >= 1){
3071 for (my $idx = 1; $idx <= $user2; $idx++){
3072 if ($idx % 2) {
3073 print "<tr>";
3074 $col="bgcolor='$color{'color22'}'";
3075 } else {
3076 print "<tr>";
3077 $col="bgcolor='$color{'color20'}'";
3078 }
3079 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
3080 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
3081 print "<td align='center' $col>$users[$idx-1]{'Country'}</td>";
3082 print "<td align='center' $col>$users[$idx-1]{'VirtualAddress'}</td>";
3083 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
3084 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
3085 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
3086 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
3087 }
3088 }
3089
3090 print "</table>";
3091 print <<END;
3092 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
3093 <tr><td></td></tr>
3094 <tr><td></td></tr>
3095 <tr><td></td></tr>
3096 <tr><td></td></tr>
3097 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
3098 </table>
3099 END
3100 ;
3101 &Header::closebox();
3102 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3103 &Header::closebigbox();
3104 &Header::closepage();
3105 exit(0);
3106
3107 ###
3108 ### Download Certificate
3109 ###
3110 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
3111 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3112
3113 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
3114 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
3115 print "Content-Type: application/octet-stream\r\n\r\n";
3116
3117 open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3118 my @tmp = <FILE>;
3119 close(FILE);
3120
3121 print @tmp;
3122 exit (0);
3123 }
3124
3125 ###
3126 ### Enable/Disable connection
3127 ###
3128
3129 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
3130
3131 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3132 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3133
3134 if ($confighash{$cgiparams{'KEY'}}) {
3135 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
3136 $confighash{$cgiparams{'KEY'}}[0] = 'on';
3137 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3138 #&writeserverconf();
3139 # if ($vpnsettings{'ENABLED'} eq 'on' ||
3140 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3141 # system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3142 # }
3143 } else {
3144 $confighash{$cgiparams{'KEY'}}[0] = 'off';
3145 # if ($vpnsettings{'ENABLED'} eq 'on' ||
3146 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3147 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3148 # }
3149 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3150 #&writeserverconf();
3151 }
3152 } else {
3153 $errormessage = $Lang::tr{'invalid key'};
3154 }
3155
3156 ###
3157 ### Restart connection
3158 ###
3159 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3160 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3161 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3162
3163 if ($confighash{$cgiparams{'KEY'}}) {
3164 # if ($vpnsettings{'ENABLED'} eq 'on' ||
3165 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3166 # system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3167 # }
3168 } else {
3169 $errormessage = $Lang::tr{'invalid key'};
3170 }
3171
3172 ###
3173 # m.a.d net2net
3174 ###
3175
3176 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3177 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3178 &Header::showhttpheaders();
3179 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
3180 &Header::openbigbox('100%', 'LEFT', '', '');
3181 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
3182
3183 if ( -s "${General::swroot}/ovpn/settings") {
3184
3185 print <<END;
3186 <b>$Lang::tr{'connection type'}:</b><br />
3187 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
3188 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3189 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3190 <tr><td><input type='radio' name='TYPE' value='net' /></td>
3191 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3192 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
3193 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3194 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
3195 <tr><td>&nbsp;</td><td>Import Connection Name</td></tr>
3196 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>$Lang::tr{'openvpn default'}: Client Packagename</td></tr>
3197 <tr><td colspan='3'><hr /></td></tr>
3198 <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
3199 </form></table>
3200 END
3201 ;
3202
3203
3204 } else {
3205 print <<END;
3206 <b>$Lang::tr{'connection type'}:</b><br />
3207 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
3208 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3209 <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
3210 </form></table>
3211 END
3212 ;
3213
3214 }
3215
3216 &Header::closebox();
3217 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3218 &Header::closebigbox();
3219 &Header::closepage();
3220 exit (0);
3221
3222 ###
3223 # m.a.d net2net
3224 ###
3225
3226 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3227
3228 my @firen2nconf;
3229 my @confdetails;
3230 my $uplconffilename ='';
3231 my $uplconffilename2 ='';
3232 my $uplp12name = '';
3233 my $uplp12name2 = '';
3234 my @rem_subnet;
3235 my @rem_subnet2;
3236 my @tmposupnet3;
3237 my $key;
3238 my @n2nname;
3239
3240 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3241
3242 # Check if a file is uploaded
3243 unless (ref ($cgiparams{'FH'})) {
3244 $errormessage = $Lang::tr{'there was no file upload'};
3245 goto N2N_ERROR;
3246 }
3247
3248 # Move uploaded IPfire n2n package to temporary file
3249
3250 (my $fh, my $filename) = tempfile( );
3251 if (copy ($cgiparams{'FH'}, $fh) != 1) {
3252 $errormessage = $!;
3253 goto N2N_ERROR;
3254 }
3255
3256 my $zip = Archive::Zip->new();
3257 my $zipName = $filename;
3258 my $status = $zip->read( $zipName );
3259 if ($status != AZ_OK) {
3260 $errormessage = "Read of $zipName failed\n";
3261 goto N2N_ERROR;
3262 }
3263
3264 my $tempdir = tempdir( CLEANUP => 1 );
3265 my @files = $zip->memberNames();
3266 for(@files) {
3267 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3268 }
3269 my $countfiles = @files;
3270
3271 # Check if we have not more then 2 files
3272
3273 if ( $countfiles == 2){
3274 foreach (@files){
3275 if ( $_ =~ /.conf$/){
3276 $uplconffilename = $_;
3277 }
3278 if ( $_ =~ /.p12$/){
3279 $uplp12name = $_;
3280 }
3281 }
3282 if (($uplconffilename eq '') || ($uplp12name eq '')){
3283 $errormessage = "Either no *.conf or no *.p12 file found\n";
3284 goto N2N_ERROR;
3285 }
3286
3287 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3288 @firen2nconf = <FILE>;
3289 close (FILE);
3290 chomp(@firen2nconf);
3291 } else {
3292
3293 $errormessage = "Filecount does not match only 2 files are allowed\n";
3294 goto N2N_ERROR;
3295 }
3296
3297 ###
3298 # m.a.d net2net
3299 ###
3300
3301 if ($cgiparams{'n2nname'} ne ''){
3302
3303 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3304 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
3305 $n2nname[0] = $cgiparams{'n2nname'};
3306 my @n2nname2 = split(/\./,$uplconffilename);
3307 $n2nname2[0] =~ s/\n|\r//g;
3308 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3309 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3310 my $input2 = "$n2nname2[0]n2n";
3311 my $output2 = "$n2nname[0]n2n";
3312 my $filename = "$tempdir/$uplconffilename";
3313 open(FILE, "< $filename") or die 'Unable to open config file.';
3314 my @current = <FILE>;
3315 close(FILE);
3316 foreach (@current) {s/$input1/$output1/g;}
3317 foreach (@current) {s/$input2/$output2/g;}
3318 open (OUT, "> $filename") || die 'Unable to open config file.';
3319 print OUT @current;
3320 close OUT;
3321
3322 }else{
3323 $uplconffilename2 = $uplconffilename;
3324 $uplp12name2 = $uplp12name;
3325 @n2nname = split(/\./,$uplconffilename);
3326 $n2nname[0] =~ s/\n|\r//g;
3327 }
3328 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3329 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
3330
3331 #Add collectd settings to configfile
3332 open(FILE, ">> $tempdir/$uplconffilename") or die 'Unable to open config file.';
3333 print FILE "# Logfile\n";
3334 print FILE "status-version 1\n";
3335 print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
3336 if (&iscertlegacy("${General::swroot}/ovpn/certs/$cgiparams{'n2nname'}")) {
3337 print CLIENTCONF "providers legacy default\n";
3338 }
3339
3340 close FILE;
3341
3342 unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2")) {
3343 $errormessage = "*.conf move failed: $!";
3344 unlink ($filename);
3345 goto N2N_ERROR;
3346 }
3347
3348 unless(move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2")) {
3349 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3350 unlink ($filename);
3351 goto N2N_ERROR;
3352 }
3353
3354 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3355
3356 my $complzoactive;
3357 my $mssfixactive;
3358 my $authactive;
3359 my $n2nfragment;
3360 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
3361 my @n2nproto = split(/-/, $n2nproto2[1]);
3362 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3363 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3364 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3365 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
3366 my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
3367 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
3368 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
3369 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
3370 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3371 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3372 my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
3373 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
3374 my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
3375 my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3376 my @n2ncipher = split(/ /, (grep { /^cipher/ } @firen2nconf)[0]);
3377 my @n2nauth = split(/ /, (grep { /^auth/ } @firen2nconf)[0]);;
3378
3379 ###
3380 # m.a.d delete CR and LF from arrays for this chomp doesnt work
3381 ###
3382
3383 $n2nremote[1] =~ s/\n|\r//g;
3384 $n2novpnsub[0] =~ s/\n|\r//g;
3385 $n2novpnsub[1] =~ s/\n|\r//g;
3386 $n2novpnsub[2] =~ s/\n|\r//g;
3387 $n2nproto[0] =~ s/\n|\r//g;
3388 $n2nport[1] =~ s/\n|\r//g;
3389 $n2ntunmtu[1] =~ s/\n|\r//g;
3390 $n2nremsub[1] =~ s/\n|\r//g;
3391 $n2nremsub[2] =~ s/\n|\r//g;
3392 $n2nlocalsub[2] =~ s/\n|\r//g;
3393 $n2nfragment[1] =~ s/\n|\r//g;
3394 $n2nmgmt[2] =~ s/\n|\r//g;
3395 $n2ncipher[1] =~ s/\n|\r//g;
3396 $n2nauth[1] =~ s/\n|\r//g;
3397 chomp ($complzoactive);
3398 chomp ($mssfixactive);
3399
3400 ###
3401 # m.a.d net2net
3402 ###
3403
3404 ###
3405 # Check if there is no other entry with this name
3406 ###
3407
3408 foreach my $dkey (keys %confighash) {
3409 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3410 $errormessage = $Lang::tr{'a connection with this name already exists'};
3411 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3412 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3413 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3414 goto N2N_ERROR;
3415 }
3416 }
3417
3418 ###
3419 # Check if OpenVPN Subnet is valid
3420 ###
3421
3422 foreach my $dkey (keys %confighash) {
3423 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3424 $errormessage = 'The OpenVPN Subnet is already in use';
3425 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3426 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3427 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3428 goto N2N_ERROR;
3429 }
3430 }
3431
3432 ###
3433 # Check if Dest Port is vaild
3434 ###
3435
3436 foreach my $dkey (keys %confighash) {
3437 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3438 $errormessage = 'The OpenVPN Port is already in use';
3439 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3440 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3441 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3442 goto N2N_ERROR;
3443 }
3444 }
3445
3446
3447
3448 $key = &General::findhasharraykey (\%confighash);
3449
3450 foreach my $i (0 .. 42) { $confighash{$key}[$i] = "";}
3451
3452 $confighash{$key}[0] = 'off';
3453 $confighash{$key}[1] = $n2nname[0];
3454 $confighash{$key}[2] = $n2nname[0];
3455 $confighash{$key}[3] = 'net';
3456 $confighash{$key}[4] = 'cert';
3457 $confighash{$key}[6] = 'client';
3458 $confighash{$key}[8] = $n2nlocalsub[2];
3459 $confighash{$key}[10] = $n2nremote[1];
3460 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3461 $confighash{$key}[22] = $n2nmgmt[2];
3462 $confighash{$key}[23] = $mssfixactive;
3463 $confighash{$key}[24] = $n2nfragment[1];
3464 $confighash{$key}[25] = 'IPFire n2n Client';
3465 $confighash{$key}[26] = 'red';
3466 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3467 $confighash{$key}[28] = $n2nproto[0];
3468 $confighash{$key}[29] = $n2nport[1];
3469 $confighash{$key}[30] = $complzoactive;
3470 $confighash{$key}[31] = $n2ntunmtu[1];
3471 $confighash{$key}[39] = $n2nauth[1];
3472 $confighash{$key}[40] = $n2ncipher[1];
3473 $confighash{$key}[41] = 'no-pass';
3474
3475 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3476
3477 N2N_ERROR:
3478
3479 &Header::showhttpheaders();
3480 &Header::openpage('Validate imported configuration', 1, '');
3481 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3482 if ($errormessage) {
3483 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3484 print "<class name='base'>$errormessage";
3485 print "&nbsp;</class>";
3486 &Header::closebox();
3487
3488 } else
3489 {
3490 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3491 }
3492 if ($errormessage eq ''){
3493 print <<END;
3494 <!-- ipfire net2net config gui -->
3495 <table width='100%'>
3496 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3497 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3498 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3499 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3500 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3501 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3502 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}:</td><td><b>$confighash{$key}[11]</b></td></tr>
3503 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3504 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3505 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3506 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3507 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td><b>$confighash{$key}[23]</b></td></tr>
3508 <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td><b>$confighash{$key}[24]</b></td></tr>
3509 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3510 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3511 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn tls auth'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
3512 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td><b>$confighash{$key}[40]</b></td></tr>
3513 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3514 </table>
3515 END
3516 ;
3517 &Header::closebox();
3518 }
3519
3520 if ($errormessage) {
3521 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3522 } else {
3523 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3524 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3525 print "<input type='hidden' name='KEY' value='$key' />";
3526 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3527 }
3528 &Header::closebigbox();
3529 &Header::closepage();
3530 exit(0);
3531
3532
3533 ##
3534 ### Accept IPFire n2n Package Settings
3535 ###
3536
3537 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3538
3539 ###
3540 ### Discard and Rollback IPFire n2n Package Settings
3541 ###
3542
3543 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3544
3545 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3546
3547 if ($confighash{$cgiparams{'KEY'}}) {
3548
3549 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3550 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3551 unlink ($certfile) or die "Removing $certfile fail: $!";
3552 unlink ($conffile) or die "Removing $conffile fail: $!";
3553 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3554 delete $confighash{$cgiparams{'KEY'}};
3555 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3556
3557 } else {
3558 $errormessage = $Lang::tr{'invalid key'};
3559 }
3560
3561
3562 ###
3563 # m.a.d net2net
3564 ###
3565
3566
3567 ###
3568 ### Adding a new connection
3569 ###
3570 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3571 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3572 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3573
3574 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3575 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3576 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3577
3578 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3579 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3580 $errormessage = $Lang::tr{'invalid key'};
3581 goto VPNCONF_END;
3582 }
3583 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
3584 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
3585 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
3586 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
3587 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
3588 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
3589 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
3590 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
3591 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
3592 $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
3593 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
3594 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
3595 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
3596 $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
3597 $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
3598 $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28];
3599 $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29];
3600 $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30];
3601 $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31];
3602 $cgiparams{'CHECK1'} = $confighash{$cgiparams{'KEY'}}[32];
3603 $name=$cgiparams{'CHECK1'} ;
3604 $cgiparams{$name} = $confighash{$cgiparams{'KEY'}}[33];
3605 $cgiparams{'RG'} = $confighash{$cgiparams{'KEY'}}[34];
3606 $cgiparams{'CCD_DNS1'} = $confighash{$cgiparams{'KEY'}}[35];
3607 $cgiparams{'CCD_DNS2'} = $confighash{$cgiparams{'KEY'}}[36];
3608 $cgiparams{'CCD_WINS'} = $confighash{$cgiparams{'KEY'}}[37];
3609 $cgiparams{'DAUTH'} = $confighash{$cgiparams{'KEY'}}[39];
3610 $cgiparams{'DCIPHER'} = $confighash{$cgiparams{'KEY'}}[40];
3611 $cgiparams{'TLSAUTH'} = $confighash{$cgiparams{'KEY'}}[41];
3612 $cgiparams{'OTP_STATE'} = $confighash{$cgiparams{'KEY'}}[43];
3613 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3614 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3615
3616 #A.Marx CCD check iroute field and convert it to decimal
3617 if ($cgiparams{'TYPE'} eq 'host') {
3618 my @temp=();
3619 my %ccdroutehash=();
3620 my $keypoint=0;
3621 my $ip;
3622 my $cidr;
3623 if ($cgiparams{'IR'} ne ''){
3624 @temp = split("\n",$cgiparams{'IR'});
3625 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3626 #find key to use
3627 foreach my $key (keys %ccdroutehash) {
3628 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3629 $keypoint=$key;
3630 delete $ccdroutehash{$key};
3631 }else{
3632 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3633 }
3634 }
3635 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3636 my $i=1;
3637 my $val=0;
3638 foreach $val (@temp){
3639 chomp($val);
3640 $val=~s/\s*$//g;
3641 #check if iroute exists in ccdroute or if new iroute is part of an existing one
3642 foreach my $key (keys %ccdroutehash) {
3643 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3644 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3645 $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3646 goto VPNCONF_ERROR;
3647 }
3648 my ($ip1,$cidr1) = split (/\//, $val);
3649 $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1));
3650 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3651 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3652 $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3653 goto VPNCONF_ERROR;
3654 }
3655
3656 }
3657 }
3658 if (!&General::validipandmask($val)){
3659 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3660 goto VPNCONF_ERROR;
3661 }else{
3662 ($ip,$cidr) = split(/\//,$val);
3663 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3664 $cidr=&General::iporsubtodec($cidr);
3665 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3666
3667 }
3668
3669 #check for existing network IP's
3670 if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3671 {
3672 $errormessage=$Lang::tr{'ccd err green'};
3673 goto VPNCONF_ERROR;
3674 }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3675 {
3676 $errormessage=$Lang::tr{'ccd err red'};
3677 goto VPNCONF_ERROR;
3678 }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3679 {
3680 $errormessage=$Lang::tr{'ccd err blue'};
3681 goto VPNCONF_ERROR;
3682 }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3683 {
3684 $errormessage=$Lang::tr{'ccd err orange'};
3685 goto VPNCONF_ERROR;
3686 }
3687
3688 if (&General::validipandmask($val)){
3689 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3690 }else{
3691 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3692 goto VPNCONF_ERROR;
3693 }
3694 $i++;
3695 }
3696 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3697 &writeserverconf;
3698 }else{
3699 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3700 foreach my $key (keys %ccdroutehash) {
3701 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3702 delete $ccdroutehash{$key};
3703 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3704 &writeserverconf;
3705 }
3706 }
3707 }
3708 undef @temp;
3709 #check route field and convert it to decimal
3710 my $val=0;
3711 my $i=1;
3712 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3713 #find key to use
3714 foreach my $key (keys %ccdroute2hash) {
3715 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3716 $keypoint=$key;
3717 delete $ccdroute2hash{$key};
3718 }else{
3719 $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3720 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3721 &writeserverconf;
3722 }
3723 }
3724 $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3725 if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3726 @temp = split(/\|/,$cgiparams{'IFROUTE'});
3727 my %ownnet=();
3728 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3729 foreach $val (@temp){
3730 chomp($val);
3731 $val=~s/\s*$//g;
3732 if ($val eq $Lang::tr{'green'})
3733 {
3734 $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3735 }
3736 if ($val eq $Lang::tr{'blue'})
3737 {
3738 $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3739 }
3740 if ($val eq $Lang::tr{'orange'})
3741 {
3742 $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3743 }
3744 my ($ip,$cidr) = split (/\//, $val);
3745
3746 if ($val ne $Lang::tr{'ccd none'})
3747 {
3748 if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3749 if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3750 if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3751 if (&General::validipandmask($val)){
3752 $val=$ip."/".&General::iporsubtodec($cidr);
3753 $ccdroute2hash{$keypoint}[$i] = $val;
3754 }else{
3755 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3756 goto VPNCONF_ERROR;
3757 }
3758 }else{
3759 $ccdroute2hash{$keypoint}[$i]='';
3760 }
3761 $i++;
3762 }
3763 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3764
3765 #check dns1 ip
3766 if ($cgiparams{'CCD_DNS1'} ne '' && ! &General::validip($cgiparams{'CCD_DNS1'})) {
3767 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3768 goto VPNCONF_ERROR;
3769 }
3770 #check dns2 ip
3771 if ($cgiparams{'CCD_DNS2'} ne '' && ! &General::validip($cgiparams{'CCD_DNS2'})) {
3772 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3773 goto VPNCONF_ERROR;
3774 }
3775 #check wins ip
3776 if ($cgiparams{'CCD_WINS'} ne '' && ! &General::validip($cgiparams{'CCD_WINS'})) {
3777 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3778 goto VPNCONF_ERROR;
3779 }
3780 }
3781
3782 #CCD End
3783
3784
3785 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3786 $errormessage = $Lang::tr{'connection type is invalid'};
3787 if ($cgiparams{'TYPE'} eq 'net') {
3788 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3789 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3790 goto VPNCONF_ERROR;
3791 }
3792 goto VPNCONF_ERROR;
3793 }
3794
3795 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3796 $errormessage = $Lang::tr{'name must only contain characters'};
3797 if ($cgiparams{'TYPE'} eq 'net') {
3798 goto VPNCONF_ERROR;
3799 }
3800 goto VPNCONF_ERROR;
3801 }
3802
3803 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3804 $errormessage = $Lang::tr{'name is invalid'};
3805 if ($cgiparams{'TYPE'} eq 'net') {
3806 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3807 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3808 goto VPNCONF_ERROR;
3809 }
3810 goto VPNCONF_ERROR;
3811 }
3812
3813 if (length($cgiparams{'NAME'}) >60) {
3814 $errormessage = $Lang::tr{'name too long'};
3815 if ($cgiparams{'TYPE'} eq 'net') {
3816 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3817 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3818 goto VPNCONF_ERROR;
3819 }
3820 goto VPNCONF_ERROR;
3821 }
3822
3823 ###
3824 # m.a.d net2net
3825 ###
3826
3827 if ($cgiparams{'TYPE'} eq 'net') {
3828 if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) {
3829 $errormessage = $Lang::tr{'openvpn destination port used'};
3830 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3831 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3832 goto VPNCONF_ERROR;
3833 }
3834 #Bugfix 10357
3835 foreach my $key (sort keys %confighash){
3836 if ( ($confighash{$key}[22] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1]) || ($confighash{$key}[29] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1])){
3837 $errormessage = $Lang::tr{'openvpn destination port used'};
3838 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3839 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3840 goto VPNCONF_ERROR;
3841 }
3842 }
3843 if ($cgiparams{'DEST_PORT'} eq '') {
3844 $errormessage = $Lang::tr{'invalid port'};
3845 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3846 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3847 goto VPNCONF_ERROR;
3848 }
3849
3850 # Check if the input for the transfer net is valid.
3851 if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
3852 $errormessage = $Lang::tr{'ccd err invalidnet'};
3853 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3854 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3855 goto VPNCONF_ERROR;
3856 }
3857
3858 if ($cgiparams{'OVPN_SUBNET'} eq $vpnsettings{'DOVPN_SUBNET'}) {
3859 $errormessage = $Lang::tr{'openvpn subnet is used'};
3860 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3861 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3862 goto VPNCONF_ERROR;
3863 }
3864
3865 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3866 $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3867 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3868 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3869 goto VPNCONF_ERROR;
3870 }
3871
3872 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3873 $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3874 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3875 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3876 goto VPNCONF_ERROR;
3877 }
3878
3879 if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) {
3880 $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3881 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3882 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3883 goto VPNCONF_ERROR;
3884 }
3885
3886 if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) {
3887 $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3888 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3889 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3890 goto VPNCONF_ERROR;
3891 }
3892
3893 if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) {
3894 $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
3895 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3896 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3897 goto VPNCONF_ERROR;
3898 }
3899
3900 if ($cgiparams{'DEST_PORT'} <= 1023) {
3901 $errormessage = $Lang::tr{'ovpn port in root range'};
3902 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3903 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3904 goto VPNCONF_ERROR;
3905 }
3906
3907 if ($cgiparams{'OVPN_MGMT'} eq '') {
3908 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
3909 }
3910
3911 if ($cgiparams{'OVPN_MGMT'} <= 1023) {
3912 $errormessage = $Lang::tr{'ovpn mgmt in root range'};
3913 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3914 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3915 goto VPNCONF_ERROR;
3916 }
3917 #Check if remote subnet is used elsewhere
3918 my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'});
3919 $warnmessage=&General::checksubnets('',$n2nip,'ovpn');
3920 if ($warnmessage){
3921 $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
3922 }
3923 }
3924
3925 # if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
3926 # $errormessage = $Lang::tr{'ipfire side is invalid'};
3927 # goto VPNCONF_ERROR;
3928 # }
3929
3930 # Check if there is no other entry with this name
3931 if (! $cgiparams{'KEY'}) {
3932 foreach my $key (keys %confighash) {
3933 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
3934 $errormessage = $Lang::tr{'a connection with this name already exists'};
3935 if ($cgiparams{'TYPE'} eq 'net') {
3936 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3937 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3938 }
3939 goto VPNCONF_ERROR;
3940 }
3941 }
3942 }
3943
3944 # Check if a remote host/IP has been set for the client.
3945 if ($cgiparams{'TYPE'} eq 'net') {
3946 if ($cgiparams{'SIDE'} ne 'server' && $cgiparams{'REMOTE'} eq '') {
3947 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3948
3949 # Check if this is a N2N connection and drop temporary config.
3950 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3951 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3952
3953 goto VPNCONF_ERROR;
3954 }
3955
3956 # Check if a remote host/IP has been configured - the field can be empty on the server side.
3957 if ($cgiparams{'REMOTE'} ne '') {
3958 # Check if the given IP is valid - otherwise check if it is a valid domain.
3959 if (! &General::validip($cgiparams{'REMOTE'})) {
3960 # Check for a valid domain.
3961 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
3962 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3963
3964 # Check if this is a N2N connection and drop temporary config.
3965 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3966 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3967
3968 goto VPNCONF_ERROR;
3969 }
3970 }
3971 }
3972 }
3973
3974 if ($cgiparams{'TYPE'} ne 'host') {
3975 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
3976 $errormessage = $Lang::tr{'local subnet is invalid'};
3977 if ($cgiparams{'TYPE'} eq 'net') {
3978 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3979 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3980 }
3981 goto VPNCONF_ERROR;}
3982 }
3983 # Check if there is no other entry without IP-address and PSK
3984 if ($cgiparams{'REMOTE'} eq '') {
3985 foreach my $key (keys %confighash) {
3986 if(($cgiparams{'KEY'} ne $key) &&
3987 ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
3988 $confighash{$key}[10] eq '') {
3989 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
3990 goto VPNCONF_ERROR;
3991 }
3992 }
3993 }
3994 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
3995 $errormessage = $Lang::tr{'remote subnet is invalid'};
3996 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3997 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3998 goto VPNCONF_ERROR;
3999 }
4000
4001 # Check for N2N that OpenSSL maximum of valid days will not be exceeded
4002 if ($cgiparams{'TYPE'} eq 'net') {
4003 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4004 $errormessage = $Lang::tr{'invalid input for valid till days'};
4005 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4006 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4007 goto VPNCONF_ERROR;
4008 }
4009 }
4010
4011 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
4012 $errormessage = $Lang::tr{'invalid input'};
4013 goto VPNCONF_ERROR;
4014 }
4015 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
4016 $errormessage = $Lang::tr{'invalid input'};
4017 goto VPNCONF_ERROR;
4018 }
4019
4020 #fixplausi
4021 if ($cgiparams{'AUTH'} eq 'psk') {
4022 # if (! length($cgiparams{'PSK'}) ) {
4023 # $errormessage = $Lang::tr{'pre-shared key is too short'};
4024 # goto VPNCONF_ERROR;
4025 # }
4026 # if ($cgiparams{'PSK'} =~ /['",&]/) {
4027 # $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
4028 # goto VPNCONF_ERROR;
4029 # }
4030 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
4031 if ($cgiparams{'KEY'}) {
4032 $errormessage = $Lang::tr{'cant change certificates'};
4033 goto VPNCONF_ERROR;
4034 }
4035 unless (ref ($cgiparams{'FH'})) {
4036 $errormessage = $Lang::tr{'there was no file upload'};
4037 goto VPNCONF_ERROR;
4038 }
4039
4040 # Move uploaded certificate request to a temporary file
4041 (my $fh, my $filename) = tempfile( );
4042 if (copy ($cgiparams{'FH'}, $fh) != 1) {
4043 $errormessage = $!;
4044 goto VPNCONF_ERROR;
4045 }
4046
4047 # Sign the certificate request and move it
4048 # Sign the host certificate request
4049 # The system call is safe, because all arguments are passed as an array.
4050 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
4051 '-batch', '-notext',
4052 '-in', $filename,
4053 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4054 '-config', "/usr/share/openvpn/ovpn.cnf");
4055 if ($?) {
4056 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4057 unlink ($filename);
4058 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4059 &newcleanssldatabase();
4060 goto VPNCONF_ERROR;
4061 } else {
4062 unlink ($filename);
4063 &deletebackupcert();
4064 }
4065
4066 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4067 my $temp;
4068
4069 foreach my $line (@temp) {
4070 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4071 $temp = $1;
4072 $temp =~ s+/Email+, E+;
4073 $temp =~ s/ ST=/ S=/;
4074
4075 last;
4076 }
4077 }
4078
4079 $cgiparams{'CERT_NAME'} = $temp;
4080 $cgiparams{'CERT_NAME'} =~ s/,//g;
4081 $cgiparams{'CERT_NAME'} =~ s/\'//g;
4082 if ($cgiparams{'CERT_NAME'} eq '') {
4083 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4084 goto VPNCONF_ERROR;
4085 }
4086 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
4087 if ($cgiparams{'KEY'}) {
4088 $errormessage = $Lang::tr{'cant change certificates'};
4089 goto VPNCONF_ERROR;
4090 }
4091 unless (ref ($cgiparams{'FH'})) {
4092 $errormessage = $Lang::tr{'there was no file upload'};
4093 goto VPNCONF_ERROR;
4094 }
4095 # Move uploaded certificate to a temporary file
4096 (my $fh, my $filename) = tempfile( );
4097 if (copy ($cgiparams{'FH'}, $fh) != 1) {
4098 $errormessage = $!;
4099 goto VPNCONF_ERROR;
4100 }
4101
4102 # Verify the certificate has a valid CA and move it
4103 my $validca = 0;
4104 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/cacert.pem", "$filename");
4105 if (grep(/: OK/, @test)) {
4106 $validca = 1;
4107 } else {
4108 foreach my $key (keys %cahash) {
4109 @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem", "$filename");
4110 if (grep(/: OK/, @test)) {
4111 $validca = 1;
4112 }
4113 }
4114 }
4115 if (! $validca) {
4116 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
4117 unlink ($filename);
4118 goto VPNCONF_ERROR;
4119 } else {
4120 unless(move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem")) {
4121 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
4122 unlink ($filename);
4123 goto VPNCONF_ERROR;
4124 }
4125 }
4126
4127 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4128 my $temp;
4129
4130 foreach my $line (@temp) {
4131 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4132 $temp = $1;
4133 $temp =~ s+/Email+, E+;
4134 $temp =~ s/ ST=/ S=/;
4135
4136 last;
4137 }
4138 }
4139
4140 $cgiparams{'CERT_NAME'} = $temp;
4141 $cgiparams{'CERT_NAME'} =~ s/,//g;
4142 $cgiparams{'CERT_NAME'} =~ s/\'//g;
4143 if ($cgiparams{'CERT_NAME'} eq '') {
4144 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4145 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4146 goto VPNCONF_ERROR;
4147 }
4148 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
4149 if ($cgiparams{'KEY'}) {
4150 $errormessage = $Lang::tr{'cant change certificates'};
4151 goto VPNCONF_ERROR;
4152 }
4153 # Validate input since the form was submitted
4154 if (length($cgiparams{'CERT_NAME'}) >60) {
4155 $errormessage = $Lang::tr{'name too long'};
4156 goto VPNCONF_ERROR;
4157 }
4158 if ($cgiparams{'CERT_NAME'} eq '' || $cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4159 $errormessage = $Lang::tr{'invalid input for name'};
4160 goto VPNCONF_ERROR;
4161 }
4162 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
4163 $errormessage = $Lang::tr{'invalid input for e-mail address'};
4164 goto VPNCONF_ERROR;
4165 }
4166 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
4167 $errormessage = $Lang::tr{'e-mail address too long'};
4168 goto VPNCONF_ERROR;
4169 }
4170 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4171 $errormessage = $Lang::tr{'invalid input for department'};
4172 goto VPNCONF_ERROR;
4173 }
4174 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
4175 $errormessage = $Lang::tr{'organization too long'};
4176 goto VPNCONF_ERROR;
4177 }
4178 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4179 $errormessage = $Lang::tr{'invalid input for organization'};
4180 goto VPNCONF_ERROR;
4181 }
4182 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4183 $errormessage = $Lang::tr{'invalid input for city'};
4184 goto VPNCONF_ERROR;
4185 }
4186 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4187 $errormessage = $Lang::tr{'invalid input for state or province'};
4188 goto VPNCONF_ERROR;
4189 }
4190 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
4191 $errormessage = $Lang::tr{'invalid input for country'};
4192 goto VPNCONF_ERROR;
4193 }
4194 if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
4195 if (length($cgiparams{'CERT_PASS1'}) < 5) {
4196 $errormessage = $Lang::tr{'password too short'};
4197 goto VPNCONF_ERROR;
4198 }
4199 }
4200 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
4201 $errormessage = $Lang::tr{'passwords do not match'};
4202 goto VPNCONF_ERROR;
4203 }
4204 if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
4205 $errormessage = $Lang::tr{'invalid input for valid till days'};
4206 goto VPNCONF_ERROR;
4207 }
4208
4209 # Check for RW that OpenSSL maximum of valid days will not be exceeded
4210 if ($cgiparams{'TYPE'} eq 'host') {
4211 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4212 $errormessage = $Lang::tr{'invalid input for valid till days'};
4213 goto VPNCONF_ERROR;
4214 }
4215 }
4216
4217 # Check for RW if client name is already set
4218 if ($cgiparams{'TYPE'} eq 'host') {
4219 foreach my $key (keys %confighash) {
4220 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4221 $errormessage = $Lang::tr{'a connection with this name already exists'};
4222 goto VPNCONF_ERROR;
4223 }
4224 }
4225 }
4226
4227 # Check if there is no other entry with this common name
4228 if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
4229 foreach my $key (keys %confighash) {
4230 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
4231 $errormessage = $Lang::tr{'a connection with this common name already exists'};
4232 goto VPNCONF_ERROR;
4233 }
4234 }
4235 }
4236
4237 # Replace empty strings with a .
4238 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
4239 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
4240 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
4241
4242 # Create the Host certificate request client
4243 my $pid = open(OPENSSL, "|-");
4244 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
4245 if ($pid) { # parent
4246 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
4247 print OPENSSL "$state\n";
4248 print OPENSSL "$city\n";
4249 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
4250 print OPENSSL "$ou\n";
4251 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
4252 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
4253 print OPENSSL ".\n";
4254 print OPENSSL ".\n";
4255 close (OPENSSL);
4256 if ($?) {
4257 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4258 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
4259 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
4260 goto VPNCONF_ERROR;
4261 }
4262 } else { # child
4263 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4264 '-newkey', 'rsa:4096',
4265 '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4266 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4267 '-config', "/usr/share/openvpn/ovpn.cnf")) {
4268 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
4269 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4270 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4271 goto VPNCONF_ERROR;
4272 }
4273 }
4274
4275 # Sign the host certificate request
4276 # The system call is safe, because all arguments are passed as an array.
4277 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
4278 '-batch', '-notext',
4279 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4280 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4281 '-config', "/usr/share/openvpn/ovpn.cnf");
4282 if ($?) {
4283 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4284 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4285 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4286 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4287 &newcleanssldatabase();
4288 goto VPNCONF_ERROR;
4289 } else {
4290 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4291 &deletebackupcert();
4292 }
4293
4294 # Create the pkcs12 file
4295 # The system call is safe, because all arguments are passed as an array.
4296 system('/usr/bin/openssl', 'pkcs12', '-export',
4297 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4298 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4299 '-name', $cgiparams{'NAME'},
4300 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
4301 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
4302 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
4303 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4304 if ($?) {
4305 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4306 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4307 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4308 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4309 goto VPNCONF_ERROR;
4310 } else {
4311 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4312 }
4313 } elsif ($cgiparams{'AUTH'} eq 'cert') {
4314 ;# Nothing, just editing
4315 } else {
4316 $errormessage = $Lang::tr{'invalid input for authentication method'};
4317 goto VPNCONF_ERROR;
4318 }
4319
4320 # Save the config
4321 my $key = $cgiparams{'KEY'};
4322
4323 if (! $key) {
4324 $key = &General::findhasharraykey (\%confighash);
4325 foreach my $i (0 .. 43) { $confighash{$key}[$i] = "";}
4326 }
4327 $confighash{$key}[0] = $cgiparams{'ENABLED'};
4328 $confighash{$key}[1] = $cgiparams{'NAME'};
4329 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
4330 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
4331 }
4332
4333 $confighash{$key}[3] = $cgiparams{'TYPE'};
4334 if ($cgiparams{'AUTH'} eq 'psk') {
4335 $confighash{$key}[4] = 'psk';
4336 $confighash{$key}[5] = $cgiparams{'PSK'};
4337 } else {
4338 $confighash{$key}[4] = 'cert';
4339 }
4340 if ($cgiparams{'TYPE'} eq 'net') {
4341 $confighash{$key}[6] = $cgiparams{'SIDE'};
4342 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
4343 }
4344 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
4345 $confighash{$key}[10] = $cgiparams{'REMOTE'};
4346 if ($cgiparams{'OVPN_MGMT'} eq '') {
4347 $confighash{$key}[22] = $confighash{$key}[29];
4348 } else {
4349 $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
4350 }
4351 $confighash{$key}[23] = $cgiparams{'MSSFIX'};
4352 $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
4353 $confighash{$key}[25] = $cgiparams{'REMARK'};
4354 $confighash{$key}[26] = $cgiparams{'INTERFACE'};
4355 # new fields
4356 $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
4357 $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
4358 $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
4359 $confighash{$key}[30] = $cgiparams{'COMPLZO'};
4360 $confighash{$key}[31] = $cgiparams{'MTU'};
4361 $confighash{$key}[32] = $cgiparams{'CHECK1'};
4362 $name=$cgiparams{'CHECK1'};
4363 $confighash{$key}[33] = $cgiparams{$name};
4364 $confighash{$key}[34] = $cgiparams{'RG'};
4365 $confighash{$key}[35] = $cgiparams{'CCD_DNS1'};
4366 $confighash{$key}[36] = $cgiparams{'CCD_DNS2'};
4367 $confighash{$key}[37] = $cgiparams{'CCD_WINS'};
4368 $confighash{$key}[39] = $cgiparams{'DAUTH'};
4369 $confighash{$key}[40] = $cgiparams{'DCIPHER'};
4370
4371 if ($confighash{$key}[41] eq "") {
4372 if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) {
4373 $confighash{$key}[41] = "no-pass";
4374 } elsif (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} ne "")) {
4375 $confighash{$key}[41] = "pass";
4376 } elsif ($cgiparams{'TYPE'} eq 'net') {
4377 $confighash{$key}[41] = "no-pass";
4378 }
4379 }
4380
4381 $confighash{$key}[42] = 'HOTP/T30/6';
4382 $confighash{$key}[43] = $cgiparams{'OTP_STATE'};
4383 if (($confighash{$key}[43] eq 'on') && ($confighash{$key}[44] eq '')) {
4384 my @otp_secret = &General::system_output("/usr/bin/openssl", "rand", "-hex", "20");
4385 chomp($otp_secret[0]);
4386 $confighash{$key}[44] = $otp_secret[0];
4387 } elsif ($confighash{$key}[43] eq '') {
4388 $confighash{$key}[44] = '';
4389 }
4390
4391 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4392
4393 if ($cgiparams{'CHECK1'} ){
4394
4395 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
4396 my ($a,$b,$c,$d) = split (/\./,$ccdip);
4397 if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
4398 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
4399 }
4400 open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
4401 print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n";
4402 if($cgiparams{'CHECK1'} eq 'dynamic'){
4403 print CCDRWCONF "#This client uses the dynamic pool\n";
4404 }else{
4405 print CCDRWCONF "#Ip address client and server\n";
4406 print CCDRWCONF "ifconfig-push $ccdip ". &Network::bin2ip(&Network::ip2bin($ccdip) - 1) ."\n";
4407 }
4408 if ($confighash{$key}[34] eq 'on'){
4409 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
4410 print CCDRWCONF "push redirect-gateway\n";
4411 }
4412 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4413 if ($cgiparams{'IR'} ne ''){
4414 print CCDRWCONF "\n#Client routes these networks (behind Client)\n";
4415 foreach my $key (keys %ccdroutehash){
4416 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
4417 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
4418 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
4419 print CCDRWCONF "iroute $a $b\n";
4420 }
4421 }
4422 }
4423 }
4424 if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
4425 if ($cgiparams{'IFROUTE'} ne ''){
4426 print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n";
4427 foreach my $key (keys %ccdroute2hash){
4428 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4429 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
4430 if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
4431 my %blue=();
4432 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
4433 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
4434 }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
4435 my %orange=();
4436 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
4437 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS} $orange{ORANGE_NETMASK}\n";
4438 }else{
4439 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
4440 print CCDRWCONF "push \"route $a $b\"\n";
4441 }
4442 }
4443 }
4444 }
4445 }
4446 if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
4447 if($cgiparams{'CCD_DNS1'} ne ''){
4448 print CCDRWCONF "\n#Client gets these nameservers\n";
4449 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4450 }
4451 if($cgiparams{'CCD_DNS2'} ne ''){
4452 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4453 }
4454 if($cgiparams{'CCD_WINS'} ne ''){
4455 print CCDRWCONF "\n#Client gets this WINS server\n";
4456 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4457 }
4458 close CCDRWCONF;
4459 }
4460
4461 ###
4462 # m.a.d n2n begin
4463 ###
4464
4465 if ($cgiparams{'TYPE'} eq 'net') {
4466
4467 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4468 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4469
4470 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4471 my $key = $cgiparams{'KEY'};
4472 if (! $key) {
4473 $key = &General::findhasharraykey (\%confighash);
4474 foreach my $i (0 .. 31) {
4475 $confighash{$key}[$i] = "";
4476 }
4477 }
4478
4479 $confighash{$key}[0] = 'on';
4480 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4481
4482 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4483 }
4484 }
4485
4486 ###
4487 # m.a.d n2n end
4488 ###
4489
4490 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4491 $cgiparams{'KEY'} = $key;
4492 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4493 }
4494 goto VPNCONF_END;
4495 } else {
4496 $cgiparams{'ENABLED'} = 'on';
4497 ###
4498 # m.a.d n2n begin
4499 ###
4500 $cgiparams{'MSSFIX'} = 'on';
4501 $cgiparams{'FRAGMENT'} = '1300';
4502 $cgiparams{'DAUTH'} = 'SHA512';
4503 ###
4504 # m.a.d n2n end
4505 ###
4506 $cgiparams{'SIDE'} = 'left';
4507 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4508 $cgiparams{'AUTH'} = 'psk';
4509 } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4510 $cgiparams{'AUTH'} = 'certfile';
4511 } else {
4512 $cgiparams{'AUTH'} = 'certgen';
4513 }
4514 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4515 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4516 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
4517 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
4518 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
4519 $cgiparams{'DAYS_VALID'} = $vpnsettings{'DAYS_VALID'} = '730';
4520 }
4521
4522 VPNCONF_ERROR:
4523 $checked{'ENABLED'}{'off'} = '';
4524 $checked{'ENABLED'}{'on'} = '';
4525 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4526 $checked{'ENABLED_BLUE'}{'off'} = '';
4527 $checked{'ENABLED_BLUE'}{'on'} = '';
4528 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4529 $checked{'ENABLED_ORANGE'}{'off'} = '';
4530 $checked{'ENABLED_ORANGE'}{'on'} = '';
4531 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4532
4533
4534 $checked{'EDIT_ADVANCED'}{'off'} = '';
4535 $checked{'EDIT_ADVANCED'}{'on'} = '';
4536 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
4537
4538 $selected{'SIDE'}{'server'} = '';
4539 $selected{'SIDE'}{'client'} = '';
4540 $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
4541
4542 $selected{'PROTOCOL'}{'udp'} = '';
4543 $selected{'PROTOCOL'}{'tcp'} = '';
4544 $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4545
4546
4547 $checked{'AUTH'}{'psk'} = '';
4548 $checked{'AUTH'}{'certreq'} = '';
4549 $checked{'AUTH'}{'certgen'} = '';
4550 $checked{'AUTH'}{'certfile'} = '';
4551 $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
4552
4553 $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
4554
4555 $checked{'COMPLZO'}{'off'} = '';
4556 $checked{'COMPLZO'}{'on'} = '';
4557 $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
4558
4559 $checked{'MSSFIX'}{'off'} = '';
4560 $checked{'MSSFIX'}{'on'} = '';
4561 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4562
4563 $selected{'DCIPHER'}{'AES-256-GCM'} = '';
4564 $selected{'DCIPHER'}{'AES-192-GCM'} = '';
4565 $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4566 $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
4567 $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
4568 $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
4569 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4570 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4571 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4572 $selected{'DCIPHER'}{'DESX-CBC'} = '';
4573 $selected{'DCIPHER'}{'SEED-CBC'} = '';
4574 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4575 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4576 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4577 $selected{'DCIPHER'}{'BF-CBC'} = '';
4578 $selected{'DCIPHER'}{'DES-CBC'} = '';
4579 # If no cipher has been chossen yet, select
4580 # the old default (AES-256-CBC) for compatiblity reasons.
4581 if ($cgiparams{'DCIPHER'} eq '') {
4582 $cgiparams{'DCIPHER'} = 'AES-256-CBC';
4583 }
4584 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4585 $selected{'DAUTH'}{'whirlpool'} = '';
4586 $selected{'DAUTH'}{'SHA512'} = '';
4587 $selected{'DAUTH'}{'SHA384'} = '';
4588 $selected{'DAUTH'}{'SHA256'} = '';
4589 $selected{'DAUTH'}{'SHA1'} = '';
4590 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
4591 $checked{'TLSAUTH'}{'off'} = '';
4592 $checked{'TLSAUTH'}{'on'} = '';
4593 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
4594
4595 if (1) {
4596 &Header::showhttpheaders();
4597 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
4598 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4599 if ($errormessage) {
4600 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4601 print "<class name='base'>$errormessage";
4602 print "&nbsp;</class>";
4603 &Header::closebox();
4604 }
4605
4606 if ($warnmessage) {
4607 &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4608 print "<class name='base'>$warnmessage";
4609 print "&nbsp;</class>";
4610 &Header::closebox();
4611 }
4612
4613 print "<form method='post' enctype='multipart/form-data'>";
4614 print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
4615
4616 if ($cgiparams{'KEY'}) {
4617 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4618 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4619 }
4620
4621 &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4622 print "<table width='100%' border='0'>\n";
4623
4624 print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>";
4625
4626 if ($cgiparams{'TYPE'} eq 'host') {
4627 if ($cgiparams{'KEY'}) {
4628 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4629 } else {
4630 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4631 }
4632 # print "<tr><td>$Lang::tr{'interface'}</td>";
4633 # print "<td><select name='INTERFACE'>";
4634 # print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4635 # if ($netsettings{'BLUE_DEV'} ne '') {
4636 # print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4637 # }
4638 # print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4639 # print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4640 # print "</select></td></tr>";
4641 # print <<END;
4642 } else {
4643 print "<input type='hidden' name='INTERFACE' value='red' />";
4644 if ($cgiparams{'KEY'}) {
4645 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4646 } else {
4647 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4648 }
4649
4650 # If GCM ciphers are in usage, HMAC menu is disabled
4651 my $hmacdisabled;
4652 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
4653 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
4654 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
4655 $hmacdisabled = "disabled='disabled'";
4656 };
4657
4658 print <<END;
4659 <td width='25%'>&nbsp;</td>
4660 <td width='25%'>&nbsp;</td></tr>
4661 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4662 <td><select name='SIDE'>
4663 <option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4664 <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option>
4665 </select>
4666 </td>
4667
4668 <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4669 <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td>
4670 </tr>
4671
4672 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4673 <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4674
4675 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4676 <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td>
4677 </tr>
4678
4679 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4680 <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td>
4681
4682 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4683 <td><select name='PROTOCOL'>
4684 <option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4685 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4686 </tr>
4687
4688 <tr>
4689 <td class='boldbase'>$Lang::tr{'destination port'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
4690 <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td>
4691
4692 <td class='boldbase' nowrap='nowrap'>Management Port ($Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}):</td>
4693 <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4694 </tr>
4695
4696 <tr><td colspan=4><hr /></td></tr><tr>
4697
4698 <tr>
4699 <td class='base'><b>$Lang::tr{'MTU settings'}</b></td>
4700 </tr>
4701
4702 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td>
4703 <td><input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4704 <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4705 </tr>
4706
4707 <tr><td class='boldbase' nowrap='nowrap'>fragment:</td>
4708 <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4709 <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4710 </tr>
4711
4712 <tr><td class='boldbase' nowrap='nowrap'>mssfix:</td>
4713 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4714 <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4715 </tr>
4716
4717 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4718 <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4719 </tr>
4720
4721 <tr><td colspan=4><hr /></td></tr><tr>
4722 <tr>
4723 <td class='base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
4724 </tr>
4725
4726 <tr><td class='boldbase'>$Lang::tr{'cipher'}</td>
4727 <td><select name='DCIPHER' id="n2ncipher" required>
4728 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
4729 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
4730 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
4731 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
4732 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4733 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
4734 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option>
4735 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
4736 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
4737 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
4738 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4739 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4740 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4741 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4742 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4743 </select>
4744 </td>
4745
4746 <td class='boldbase'>$Lang::tr{'ovpn ha'}:</td>
4747 <td><select name='DAUTH' id="n2nhmac" $hmacdisabled>
4748 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
4749 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
4750 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
4751 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
4752 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4753 </select>
4754 </td>
4755 </tr>
4756 <tr><td colspan=4><hr /></td></tr><tr>
4757
4758 END
4759 ;
4760 }
4761
4762 #### JAVA SCRIPT ####
4763 # Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange
4764 print<<END;
4765 <script>
4766 var disable_options = false;
4767 document.getElementById('n2ncipher').onchange = function () {
4768 if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) {
4769 document.getElementById('n2nhmac').setAttribute('disabled', true);
4770 } else {
4771 document.getElementById('n2nhmac').removeAttribute('disabled');
4772 }
4773 }
4774 </script>
4775 END
4776
4777 #jumper
4778 print "<tr><td class='boldbase'>$Lang::tr{'remark title'}</td>";
4779 print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4780
4781 if ($cgiparams{'TYPE'} eq 'host') {
4782 print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4783 }
4784
4785 print"</tr></table><br><br>";
4786 #A.Marx CCD new client
4787 if ($cgiparams{'TYPE'} eq 'host') {
4788 print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4789 my %vpnnet=();
4790 my $vpnip;
4791 &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4792 $vpnip=$vpnnet{'DOVPN_SUBNET'};
4793 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4794 my @ccdconf=();
4795 my $count=0;
4796 my $checked;
4797 $checked{'check1'}{'off'} = '';
4798 $checked{'check1'}{'on'} = '';
4799 $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4800 print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4801 print"</td></tr></table><br><br>";
4802 my $name=$cgiparams{'CHECK1'};
4803 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4804 $checked{'OTP_STATE'}{$cgiparams{'OTP_STATE'}} = 'CHECKED';
4805
4806 if (! -z "${General::swroot}/ovpn/ccd.conf"){
4807 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4808 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
4809 $count++;
4810 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4811 if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4812 print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4813 &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4814 print"</td></tr>";
4815 }
4816 print "</table><br><br><hr><br><br>";
4817 }
4818 }
4819 # ccd end
4820 &Header::closebox();
4821 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4822
4823 } elsif (! $cgiparams{'KEY'}) {
4824
4825
4826 my $disabled='';
4827 my $cakeydisabled='';
4828 my $cacrtdisabled='';
4829 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4830 if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4831
4832 &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4833
4834
4835 if ($cgiparams{'TYPE'} eq 'host') {
4836
4837 print <<END;
4838 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4839
4840 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4841 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4842 <tr><td colspan='3'>&nbsp;</td></tr>
4843 <tr><td colspan='3'><hr /></td></tr>
4844 <tr><td colspan='3'>&nbsp;</td></tr>
4845 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4846 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4847 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4848 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4849 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4850 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4851 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4852 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4853 END
4854 ;
4855
4856 ###
4857 # m.a.d net2net
4858 ###
4859
4860 } else {
4861
4862 print <<END;
4863 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4864
4865 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4866 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4867 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4868 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4869 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4870 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4871 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4872 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4873
4874
4875 END
4876 ;
4877
4878 }
4879
4880 ###
4881 # m.a.d net2net
4882 ###
4883
4884 foreach my $country (sort keys %{Countries::countries}) {
4885 print "<option value='$Countries::countries{$country}'";
4886 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4887 print " selected='selected'";
4888 }
4889 print ">$country</option>";
4890 }
4891 ###
4892 # m.a.d net2net
4893 ###
4894
4895 if ($cgiparams{'TYPE'} eq 'host') {
4896 print <<END;
4897 </select></td></tr>
4898 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
4899 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4900 <tr><td>&nbsp;</td>
4901 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
4902 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
4903 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<br>($Lang::tr{'confirmation'})</td>
4904 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
4905 <tr><td colspan='3'>&nbsp;</td></tr>
4906 <tr><td colspan='3'><hr /></td></tr>
4907 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
4908 </table>
4909 END
4910 }else{
4911 print <<END;
4912 </select></td></tr>
4913 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
4914 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4915 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4916 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4917 <tr><td colspan='3'><hr /></td></tr>
4918 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
4919 </table>
4920
4921 END
4922 }
4923
4924 ###
4925 # m.a.d net2net
4926 ###
4927 ;
4928 &Header::closebox();
4929
4930 }
4931
4932 #A.Marx CCD new client
4933 if ($cgiparams{'TYPE'} eq 'host') {
4934 print"<br><br>";
4935 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
4936
4937
4938 print <<END;
4939 <table border='0' width='100%'>
4940 <tr><td width='20%'>$Lang::tr{'enable otp'}:</td><td colspan='3'><input type='checkbox' name='OTP_STATE' $checked{'OTP_STATE'}{'on'} /></td></tr>
4941 <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
4942 <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
4943 <tr><td colspan='4'>&nbsp</td></tr>
4944 <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
4945 END
4946
4947 if ($cgiparams{'IR'} ne ''){
4948 print $cgiparams{'IR'};
4949 }else{
4950 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4951 foreach my $key (keys %ccdroutehash) {
4952 if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
4953 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
4954 if ($ccdroutehash{$key}[$i] ne ''){
4955 print $ccdroutehash{$key}[$i]."\n";
4956 }
4957 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
4958 }
4959 }
4960 }
4961 }
4962
4963 print <<END;
4964 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
4965 <tr><td colspan='4'><br></td></tr>
4966 <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
4967 END
4968
4969 my $set=0;
4970 my $selorange=0;
4971 my $selblue=0;
4972 my $selgreen=0;
4973 my $helpblue=0;
4974 my $helporange=0;
4975 my $other=0;
4976 my $none=0;
4977 my @temp=();
4978
4979 our @current = ();
4980 open(FILE, "${General::swroot}/main/routing") ;
4981 @current = <FILE>;
4982 close (FILE);
4983 &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
4984 #check for "none"
4985 foreach my $key (keys %ccdroute2hash) {
4986 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4987 if ($ccdroute2hash{$key}[1] eq ''){
4988 $none=1;
4989 last;
4990 }
4991 }
4992 }
4993 if ($none ne '1'){
4994 print"<option>$Lang::tr{'ccd none'}</option>";
4995 }else{
4996 print"<option selected>$Lang::tr{'ccd none'}</option>";
4997 }
4998 #check if static routes are defined for client
4999 foreach my $line (@current) {
5000 chomp($line);
5001 $line=~s/\s*$//g; # remove newline
5002 @temp=split(/\,/,$line);
5003 $temp[1] = '' unless defined $temp[1]; # not always populated
5004 my ($a,$b) = split(/\//,$temp[1]);
5005 $temp[1] = $a."/".&General::iporsubtocidr($b);
5006 foreach my $key (keys %ccdroute2hash) {
5007 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5008 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5009 if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
5010 $set=1;
5011 }
5012 }
5013 }
5014 }
5015 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
5016 }
5017
5018 my %vpnconfig = ();
5019 &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
5020 foreach my $vpn (keys %vpnconfig) {
5021 # Skip all disabled VPN connections
5022 my $enabled = $vpnconfig{$vpn}[0];
5023 next unless ($enabled eq "on");
5024
5025 my $name = $vpnconfig{$vpn}[1];
5026
5027 # Remote subnets
5028 my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
5029 foreach my $network (@networks) {
5030 my $selected = "";
5031
5032 foreach my $key (keys %ccdroute2hash) {
5033 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
5034 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5035 if ($ccdroute2hash{$key}[$i] eq $network) {
5036 $selected = "selected";
5037 }
5038 }
5039 }
5040 }
5041
5042 print "<option value=\"$network\" $selected>$name ($network)</option>\n";
5043 }
5044 }
5045
5046 #check if green,blue,orange are defined for client
5047 foreach my $key (keys %ccdroute2hash) {
5048 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5049 $other=1;
5050 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5051 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
5052 $selgreen=1;
5053 }
5054 if (&haveBlueNet()){
5055 if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
5056 $selblue=1;
5057 }
5058 }
5059 if (&haveOrangeNet()){
5060 if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
5061 $selorange=1;
5062 }
5063 }
5064 }
5065 }
5066 }
5067 if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
5068 if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
5069 if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
5070
5071 print<<END;
5072 </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
5073 <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
5074 <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
5075
5076 END
5077 ;
5078 &Header::closebox();
5079 }
5080 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5081 if ($cgiparams{'KEY'}) {
5082 # print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
5083 }
5084 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
5085 &Header::closebigbox();
5086 &Header::closepage();
5087 exit (0);
5088 }
5089 VPNCONF_END:
5090 }
5091
5092 # SETTINGS_ERROR:
5093 ###
5094 ### Default status page
5095 ###
5096 %cgiparams = ();
5097 %cahash = ();
5098 %confighash = ();
5099 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
5100 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
5101 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
5102
5103 open(FILE, "/var/run/ovpnserver.log");
5104 my @status = <FILE>;
5105 close(FILE);
5106
5107 if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
5108 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
5109 my $ipaddr = <IPADDR>;
5110 close IPADDR;
5111 chomp ($ipaddr);
5112 $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
5113 if ($cgiparams{'VPN_IP'} eq '') {
5114 $cgiparams{'VPN_IP'} = $ipaddr;
5115 }
5116 }
5117 }
5118
5119 #default setzen
5120 if ($cgiparams{'DCIPHER'} eq '') {
5121 $cgiparams{'DCIPHER'} = 'AES-256-CBC';
5122 }
5123 if ($cgiparams{'DDEST_PORT'} eq '') {
5124 $cgiparams{'DDEST_PORT'} = '1194';
5125 }
5126 if ($cgiparams{'DMTU'} eq '') {
5127 $cgiparams{'DMTU'} = '1400';
5128 }
5129 if ($cgiparams{'MSSFIX'} eq '') {
5130 $cgiparams{'MSSFIX'} = 'off';
5131 }
5132 if ($cgiparams{'DAUTH'} eq '') {
5133 if (-z "${General::swroot}/ovpn/ovpnconfig") {
5134 $cgiparams{'DAUTH'} = 'SHA512';
5135 }
5136 foreach my $key (keys %confighash) {
5137 if ($confighash{$key}[3] ne 'host') {
5138 $cgiparams{'DAUTH'} = 'SHA512';
5139 } else {
5140 $cgiparams{'DAUTH'} = 'SHA1';
5141 }
5142 }
5143 }
5144 if ($cgiparams{'TLSAUTH'} eq '') {
5145 $cgiparams{'TLSAUTH'} = 'off';
5146 }
5147 if ($cgiparams{'DOVPN_SUBNET'} eq '') {
5148 $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
5149 }
5150 $checked{'ENABLED'}{'off'} = '';
5151 $checked{'ENABLED'}{'on'} = '';
5152 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
5153 $checked{'ENABLED_BLUE'}{'off'} = '';
5154 $checked{'ENABLED_BLUE'}{'on'} = '';
5155 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
5156 $checked{'ENABLED_ORANGE'}{'off'} = '';
5157 $checked{'ENABLED_ORANGE'}{'on'} = '';
5158 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
5159
5160 $selected{'DPROTOCOL'}{'udp'} = '';
5161 $selected{'DPROTOCOL'}{'tcp'} = '';
5162 $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
5163
5164 $selected{'DCIPHER'}{'AES-256-GCM'} = '';
5165 $selected{'DCIPHER'}{'AES-192-GCM'} = '';
5166 $selected{'DCIPHER'}{'AES-128-GCM'} = '';
5167 $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
5168 $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
5169 $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
5170 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
5171 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
5172 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
5173 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
5174 $selected{'DCIPHER'}{'DESX-CBC'} = '';
5175 $selected{'DCIPHER'}{'SEED-CBC'} = '';
5176 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
5177 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
5178 $selected{'DCIPHER'}{'BF-CBC'} = '';
5179 $selected{'DCIPHER'}{'DES-CBC'} = '';
5180 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
5181
5182 $selected{'DAUTH'}{'whirlpool'} = '';
5183 $selected{'DAUTH'}{'SHA512'} = '';
5184 $selected{'DAUTH'}{'SHA384'} = '';
5185 $selected{'DAUTH'}{'SHA256'} = '';
5186 $selected{'DAUTH'}{'SHA1'} = '';
5187 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
5188
5189 $checked{'TLSAUTH'}{'off'} = '';
5190 $checked{'TLSAUTH'}{'on'} = '';
5191 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
5192
5193 $checked{'DCOMPLZO'}{'off'} = '';
5194 $checked{'DCOMPLZO'}{'on'} = '';
5195 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
5196
5197 # m.a.d
5198 $checked{'MSSFIX'}{'off'} = '';
5199 $checked{'MSSFIX'}{'on'} = '';
5200 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
5201 #new settings
5202 &Header::showhttpheaders();
5203 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
5204 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
5205
5206 # Show any errors and warnings
5207 &Header::errorbox($errormessage);
5208
5209 if ($cryptoerror) {
5210 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
5211 print "<class name='base'>$cryptoerror";
5212 print "&nbsp;</class>";
5213 &Header::closebox();
5214 }
5215
5216 if ($cryptowarning) {
5217 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
5218 print "<class name='base'>$cryptowarning";
5219 print "&nbsp;</class>";
5220 &Header::closebox();
5221 }
5222
5223 if ($warnmessage) {
5224 &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
5225 print "$warnmessage<br>";
5226 print "$Lang::tr{'fwdfw warn1'}<br>";
5227 &Header::closebox();
5228 print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>";
5229 &Header::closepage();
5230 exit 0;
5231 }
5232
5233 my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
5234 my $srunning = "no";
5235 my $activeonrun = "";
5236 if ( -e "/var/run/openvpn.pid"){
5237 $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
5238 $srunning ="yes";
5239 $activeonrun = "";
5240 } else {
5241 $activeonrun = "disabled='disabled'";
5242 }
5243 &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
5244
5245 # Show the service status
5246 &Header::ServiceStatus({
5247 $Lang::tr{'ovpn roadwarrior server'} => {
5248 "process" => "openvpn",
5249 "pidfile" => "/var/run/openvpn.pid",
5250 }
5251 });
5252
5253 print <<END;
5254 <table width='100%' border='0'>
5255 <form method='post'>
5256 <td width='25%'>&nbsp;</td>
5257 <td width='25%'>&nbsp;</td>
5258 <td width='25%'>&nbsp;</td></tr>
5259 <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
5260 <td align='left'>$sactive</td>
5261 <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
5262 <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
5263 END
5264 ;
5265 if (&haveBlueNet()) {
5266 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
5267 print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
5268 }
5269 if (&haveOrangeNet()) {
5270 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
5271 print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
5272 }
5273
5274 print <<END;
5275
5276 <tr><td colspan='4'><br></td></tr>
5277 <tr>
5278 <td class='base'><b>$Lang::tr{'net config'}:</b></td>
5279 </tr>
5280 <tr><td colspan='1'><br></td></tr>
5281
5282 <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
5283 <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
5284 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
5285 <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
5286 <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
5287 <td class='boldbase'>$Lang::tr{'destination port'}:</td>
5288 <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
5289 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
5290 <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}' size='5' /></td>
5291 </tr>
5292
5293 <tr><td colspan='4'><br></td></tr>
5294 <tr>
5295 <td class='base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
5296 </tr>
5297 <tr><td colspan='1'><br></td></tr>
5298
5299 <tr>
5300 <td class='base'>$Lang::tr{'ovpn ha'}</td>
5301 <td><select name='DAUTH'>
5302 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
5303 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
5304 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
5305 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
5306 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5307 </select>
5308 </td>
5309
5310 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
5311 <td><select name='DCIPHER'>
5312 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
5313 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
5314 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
5315 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
5316 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
5317 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
5318 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option>
5319 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
5320 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
5321 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
5322 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5323 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5324 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5325 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5326 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5327 </select>
5328 </td>
5329 </tr>
5330
5331 <tr><td colspan='4'><br></td></tr>
5332 <tr>
5333 <td class='base'>$Lang::tr{'ovpn tls auth'}</td>
5334 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
5335 </tr>
5336
5337 <tr><td colspan='4'><br><br></td></tr>
5338 END
5339 ;
5340
5341 if ( $srunning eq "yes" ) {
5342 print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
5343 print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5344 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5345 print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
5346 } else{
5347 print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5348 print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5349 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5350 if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
5351 -e "$dhparameter" &&
5352 -e "${General::swroot}/ovpn/certs/servercert.pem" &&
5353 -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
5354 (( $cgiparams{'ENABLED'} eq 'on') ||
5355 ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
5356 ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
5357 print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
5358 } else {
5359 print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
5360 }
5361 }
5362 print "</form></table>";
5363 &Header::closebox();
5364
5365 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
5366 ###
5367 # m.a.d net2net
5368 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
5369 ###
5370
5371 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' });
5372 ;
5373 my $id = 0;
5374 my $gif;
5375 my $col1="";
5376 my $lastnet;
5377 foreach my $key (sort { ncmp ($confighash{$a}[32],$confighash{$b}[32]) } sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
5378 if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]=$Lang::tr{'fwhost OpenVPN N-2-N'};}
5379 if ($confighash{$key}[32] eq "dynamic"){$confighash{$key}[32]=$Lang::tr{'ccd dynrange'};}
5380 if($id == 0){
5381 print"<b>$confighash{$key}[32]</b>";
5382 print <<END;
5383 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5384 <tr>
5385 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5386 <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5387 <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5388 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
5389 <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5390 </tr>
5391 END
5392 }
5393 if ($id > 0 && $lastnet ne $confighash{$key}[32]){
5394 print "</table><br>";
5395 print"<b>$confighash{$key}[32]</b>";
5396 print <<END;
5397 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5398 <tr>
5399 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5400 <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5401 <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5402 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
5403 <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5404 </tr>
5405 END
5406 }
5407 if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
5408
5409 # Create some simple booleans to check the status
5410 my $hasExpired;
5411 my $expiresSoon;
5412
5413 # Fetch information about the certificate for non-N2N connections only
5414 if ($confighash{$key}[3] ne 'net') {
5415 my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text",
5416 "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
5417
5418 my $expiryDate = 0;
5419
5420 # Parse the certificate information
5421 foreach my $line (@cavalid) {
5422 if ($line =~ /Not After : (.*)[\n]/) {
5423 $expiryDate = &Date::Parse::str2time($1);
5424 last;
5425 }
5426 }
5427
5428 # Calculate the remaining time
5429 my $remainingTime = $expiryDate - time();
5430
5431 # Determine whether the certificate has already expired, or will so soon
5432 $hasExpired = ($remainingTime <= 0);
5433 $expiresSoon = ($remainingTime <= 30 * 24 * 3600);
5434
5435 } else {
5436 # Populate booleans with dummy values for N2N connections (#13066)
5437 $hasExpired = 0;
5438 $expiresSoon = 0;
5439 }
5440
5441 print "<tr>";
5442
5443 if ($hasExpired || $expiresSoon) {
5444 $col="bgcolor='$color{'color14'}'";
5445 } elsif ($id % 2) {
5446 $col="bgcolor='$color{'color20'}'";
5447 } else {
5448 $col="bgcolor='$color{'color22'}'";
5449 }
5450 print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]";
5451 if ($hasExpired) {
5452 print " ($Lang::tr{'openvpn cert has expired'})";
5453 } elsif ($expiresSoon) {
5454 print " ($Lang::tr{'openvpn cert expires soon'})";
5455 }
5456 print "</td>";
5457 print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
5458 print "<td align='center' $col>$confighash{$key}[25]</td>";
5459 $col1="class='status is-disconnected'";
5460 my $active = "$Lang::tr{'capsclosed'}";
5461
5462 if ($confighash{$key}[0] eq 'off') {
5463 $col1="class='status is-disabled'";
5464 $active = "$Lang::tr{'capsclosed'}";
5465 } else {
5466
5467 ###
5468 # m.a.d net2net
5469 ###
5470
5471 if ($confighash{$key}[3] eq 'net') {
5472
5473 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
5474 my @output = "";
5475 my @tustate = "";
5476 my $tport = $confighash{$key}[22];
5477 my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
5478 if ($tport ne '') {
5479 $tnet->open('127.0.0.1');
5480 @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
5481 @tustate = split(/\,/, $output[1]);
5482 ###
5483 #CONNECTING -- OpenVPN's initial state.
5484 #WAIT -- (Client only) Waiting for initial response from server.
5485 #AUTH -- (Client only) Authenticating with server.
5486 #GET_CONFIG -- (Client only) Downloading configuration options from server.
5487 #ASSIGN_IP -- Assigning IP address to virtual network interface.
5488 #ADD_ROUTES -- Adding routes to system.
5489 #CONNECTED -- Initialization Sequence Completed.
5490 #RECONNECTING -- A restart has occurred.
5491 #EXITING -- A graceful exit is in progress.
5492 ####
5493
5494 if (($tustate[1] eq 'CONNECTED') || ($tustate[1] eq 'WAIT')) {
5495 $col1="class='status is-connected'";
5496 $active = "$Lang::tr{'capsopen'}";
5497 }else {
5498 $col1="class='status is-disconnected'";
5499 $active = "$tustate[1]";
5500 }
5501 }
5502 }
5503 }else {
5504
5505 my $cn;
5506 my @match = ();
5507 foreach my $line (@status) {
5508 chomp($line);
5509 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
5510 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
5511 if ($match[1] ne "Common Name") {
5512 $cn = $match[1];
5513 }
5514 if ($cn eq "$confighash{$key}[2]") {
5515 $col1="class='status is-connected'";
5516 $active = "$Lang::tr{'capsopen'}";
5517 }
5518 }
5519 }
5520 }
5521 }
5522
5523
5524 if ($confighash{$key}[41] eq "pass") {
5525 print <<END;
5526 <td align='center' $col1>$active</td>
5527
5528 <form method='post' name='frm${key}a'><td align='center' $col>
5529 <input type='image' name='$Lang::tr{'dl client arch'}' src='/images/openvpn_encrypted.png'
5530 alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
5531 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5532 <input type='hidden' name='MODE' value='secure' />
5533 <input type='hidden' name='KEY' value='$key' />
5534 </td></form>
5535 END
5536
5537 ; } elsif ($confighash{$key}[41] eq "no-pass") {
5538 print <<END;
5539 <td align='center' $col1>$active</td>
5540
5541 <form method='post' name='frm${key}a'><td align='center' $col>
5542 <input type='image' name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png'
5543 alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' />
5544 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5545 <input type='hidden' name='MODE' value='insecure' />
5546 <input type='hidden' name='KEY' value='$key' />
5547 </td></form>
5548 END
5549 ; } else {
5550 print "<td $col>&nbsp;</td>";
5551 }
5552
5553 if ($confighash{$key}[4] eq 'cert') {
5554 print <<END;
5555 <form method='post' name='frm${key}b'><td align='center' $col>
5556 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
5557 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
5558 <input type='hidden' name='KEY' value='$key' />
5559 </td></form>
5560 END
5561 ; } else {
5562 print "<td>&nbsp;</td>";
5563 }
5564
5565 if ($confighash{$key}[43] eq 'on') {
5566 print <<END;
5567 <form method='post' name='frm${key}o'><td align='center' $col>
5568 <input type='image' name='$Lang::tr{'show otp qrcode'}' src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}' title='$Lang::tr{'show otp qrcode'}' border='0' />
5569 <input type='hidden' name='ACTION' value='$Lang::tr{'show otp qrcode'}' />
5570 <input type='hidden' name='KEY' value='$key' />
5571 </td></form>
5572 END
5573 ; } else {
5574 print "<td $col>&nbsp;</td>";
5575 }
5576
5577 if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
5578 print <<END;
5579 <form method='post' name='frm${key}c'><td align='center' $col>
5580 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
5581 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
5582 <input type='hidden' name='KEY' value='$key' />
5583 </td></form>
5584 END
5585 ; } elsif ($confighash{$key}[4] eq 'cert') {
5586 print <<END;
5587 <form method='post' name='frm${key}c'><td align='center' $col>
5588 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
5589 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
5590 <input type='hidden' name='KEY' value='$key' />
5591 </td></form>
5592 END
5593 ; } else {
5594 print "<td>&nbsp;</td>";
5595 }
5596 print <<END
5597 <form method='post' name='frm${key}d'><td align='center' $col>
5598 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
5599 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
5600 <input type='hidden' name='KEY' value='$key' />
5601 </td></form>
5602
5603 <form method='post' name='frm${key}e'><td align='center' $col>
5604 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5605 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5606 <input type='hidden' name='KEY' value='$key' />
5607 </td></form>
5608 <form method='post' name='frm${key}f'><td align='center' $col>
5609 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5610 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5611 <input type='hidden' name='KEY' value='$key' />
5612 </td></form>
5613 </tr>
5614 END
5615 ;
5616 $id++;
5617 $lastnet = $confighash{$key}[32];
5618 }
5619 print"</table>";
5620 ;
5621
5622 # If the config file contains entries, print Key to action icons
5623 if ( $id ) {
5624 print <<END;
5625 <table width='85%' border='0'>
5626 <tr>
5627 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5628 <td>&nbsp; &nbsp; <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5629 <td class='base'>$Lang::tr{'dl client arch insecure'}</td>
5630 <td>&nbsp; &nbsp; <img src='/images/openvpn_encrypted.png' alt='?RELOAD'/></td>
5631 <td class='base'>$Lang::tr{'dl client arch'}</td>
5632 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5633 <td class='base'>$Lang::tr{'show certificate'}</td>
5634 <td>&nbsp; &nbsp; <img src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}'/></td>
5635 <td class='base'>$Lang::tr{'show otp qrcode'}</td>
5636 </tr>
5637 <tr>
5638 <td>&nbsp; </td>
5639 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5640 <td class='base'>$Lang::tr{'download certificate'}</td>
5641 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5642 <td class='base'>$Lang::tr{'click to enable'}</td>
5643 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5644 <td class='base'>$Lang::tr{'click to disable'}</td>
5645
5646 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5647 <td class='base'>$Lang::tr{'edit'}</td>
5648 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5649 <td class='base'>$Lang::tr{'remove'}</td>
5650 </tr>
5651 </table><br>
5652 END
5653 ;
5654 }
5655
5656 print <<END;
5657 <table width='100%'>
5658 <form method='post'>
5659 <tr><td align='right'>
5660 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5661 <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td>
5662 </tr>
5663 </form>
5664 </table>
5665 END
5666 ;
5667 &Header::closebox();
5668 }
5669
5670 # CA/key listing
5671 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}");
5672 print <<END;
5673 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5674 <tr>
5675 <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5676 <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
5677 <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
5678 </tr>
5679 END
5680 ;
5681 my $col1="bgcolor='$color{'color22'}'";
5682 my $col2="bgcolor='$color{'color20'}'";
5683 # DH parameter line
5684 my $col3="bgcolor='$color{'color22'}'";
5685 # ta.key line
5686 my $col4="bgcolor='$color{'color20'}'";
5687
5688 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
5689 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
5690 my $casubject;
5691
5692 foreach my $line (@casubject) {
5693 if ($line =~ /Subject: (.*)[\n]/) {
5694 $casubject = $1;
5695 $casubject =~ s+/Email+, E+;
5696 $casubject =~ s/ ST=/ S=/;
5697
5698 last;
5699 }
5700 }
5701
5702 print <<END;
5703 <tr>
5704 <td class='base' $col1>$Lang::tr{'root certificate'}</td>
5705 <td class='base' $col1>$casubject</td>
5706 <form method='post' name='frmrootcrta'><td width='3%' align='center' $col1>
5707 <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
5708 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
5709 </form>
5710 <form method='post' name='frmrootcrtb'><td width='3%' align='center' $col1>
5711 <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
5712 <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
5713 </form>
5714 <td width='4%' $col1>&nbsp;</td>
5715 </tr>
5716 END
5717 ;
5718 } else {
5719 # display rootcert generation buttons
5720 print <<END;
5721 <tr>
5722 <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
5723 <td class='base' $col1>$Lang::tr{'not present'}</td>
5724 <td colspan='3' $col1>&nbsp;</td>
5725 </tr>
5726 END
5727 ;
5728 }
5729
5730 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
5731 my @hostsubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
5732 my $hostsubject;
5733
5734 foreach my $line (@hostsubject) {
5735 if ($line =~ /Subject: (.*)[\n]/) {
5736 $hostsubject = $1;
5737 $hostsubject =~ s+/Email+, E+;
5738 $hostsubject =~ s/ ST=/ S=/;
5739
5740 last;
5741 }
5742 }
5743
5744 print <<END;
5745 <tr>
5746 <td class='base' $col2>$Lang::tr{'host certificate'}</td>
5747 <td class='base' $col2>$hostsubject</td>
5748 <form method='post' name='frmhostcrta'><td width='3%' align='center' $col2>
5749 <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
5750 <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
5751 </form>
5752 <form method='post' name='frmhostcrtb'><td width='3%' align='center' $col2>
5753 <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/media-floppy.png' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" border='0' />
5754 <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
5755 </td></form>
5756 <td width='4%' $col2>&nbsp;</td>
5757 </tr>
5758 END
5759 ;
5760 } else {
5761 # Nothing
5762 print <<END;
5763 <tr>
5764 <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
5765 <td class='base' $col2>$Lang::tr{'not present'}</td>
5766 </td><td colspan='3' $col2>&nbsp;</td>
5767 </tr>
5768 END
5769 ;
5770 }
5771
5772 # Adding DH parameter to chart
5773 if (-f "$dhparameter") {
5774 my @dhsubject = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$dhparameter");
5775 my $dhsubject;
5776
5777 foreach my $line (@dhsubject) {
5778 if ($line =~ / (.*)[\n]/) {
5779 $dhsubject = $1;
5780
5781 last;
5782 }
5783 }
5784
5785 print <<END;
5786 <tr>
5787 <td class='base' $col3>$Lang::tr{'dh'}</td>
5788 <td class='base' $col3>$dhsubject</td>
5789 <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
5790 <input type='hidden' name='ACTION' value='$Lang::tr{'show dh'}' />
5791 <input type='image' name='$Lang::tr{'show dh'}' src='/images/info.gif' alt='$Lang::tr{'show dh'}' title='$Lang::tr{'show dh'}' width='20' height='20' border='0' />
5792 </form>
5793 <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
5794 </form>
5795 <td width='4%' $col3>&nbsp;</td>
5796 </tr>
5797 END
5798 ;
5799 } else {
5800 # Nothing
5801 print <<END;
5802 <tr>
5803 <td width='25%' class='base' $col3>$Lang::tr{'dh'}:</td>
5804 <td class='base' $col3>$Lang::tr{'not present'}</td>
5805 </td><td colspan='3' $col3>&nbsp;</td>
5806 </tr>
5807 END
5808 ;
5809 }
5810
5811 # Adding ta.key to chart
5812 if (-f "${General::swroot}/ovpn/certs/ta.key") {
5813 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
5814 my @tasubject = <FILE>;
5815 close(FILE);
5816
5817 my $tasubject;
5818 foreach my $line (@tasubject) {
5819 if($line =~ /# (.*)[\n]/) {
5820 $tasubject = $1;
5821
5822 last;
5823 }
5824 }
5825
5826 print <<END;
5827
5828 <tr>
5829 <td class='base' $col4>$Lang::tr{'ta key'}</td>
5830 <td class='base' $col4>$tasubject</td>
5831 <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5832 <input type='hidden' name='ACTION' value='$Lang::tr{'show tls-auth key'}' />
5833 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show tls-auth key'}' title='$Lang::tr{'show tls-auth key'}' width='20' height='20' border='0' />
5834 </form>
5835 <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5836 <input type='image' name='$Lang::tr{'download tls-auth key'}' src='/images/media-floppy.png' alt='$Lang::tr{'download tls-auth key'}' title='$Lang::tr{'download tls-auth key'}' border='0' />
5837 <input type='hidden' name='ACTION' value='$Lang::tr{'download tls-auth key'}' />
5838 </form>
5839 <td width='4%' $col4>&nbsp;</td>
5840 </tr>
5841 END
5842 ;
5843 } else {
5844 # Nothing
5845 print <<END;
5846 <tr>
5847 <td width='25%' class='base' $col4>$Lang::tr{'ta key'}:</td>
5848 <td class='base' $col4>$Lang::tr{'not present'}</td>
5849 <td colspan='3' $col4>&nbsp;</td>
5850 </tr>
5851 END
5852 ;
5853 }
5854
5855 if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
5856 print "<tr><td colspan='5' align='center'><form method='post'>";
5857 print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
5858 print "</form></td></tr>\n";
5859 }
5860
5861 if (keys %cahash > 0) {
5862 foreach my $key (keys %cahash) {
5863 if (($key + 1) % 2) {
5864 print "<tr bgcolor='$color{'color20'}'>\n";
5865 } else {
5866 print "<tr bgcolor='$color{'color22'}'>\n";
5867 }
5868 print "<td class='base'>$cahash{$key}[0]</td>\n";
5869 print "<td class='base'>$cahash{$key}[1]</td>\n";
5870 print <<END;
5871 <form method='post' name='cafrm${key}a'><td align='center'>
5872 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
5873 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
5874 <input type='hidden' name='KEY' value='$key' />
5875 </td></form>
5876 <form method='post' name='cafrm${key}b'><td align='center'>
5877 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
5878 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
5879 <input type='hidden' name='KEY' value='$key' />
5880 </td></form>
5881 <form method='post' name='cafrm${key}c'><td align='center'>
5882 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
5883 <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
5884 <input type='hidden' name='KEY' value='$key' />
5885 </td></form></tr>
5886 END
5887 ;
5888 }
5889 }
5890
5891 print "</table>";
5892
5893 # If the file contains entries, print Key to action icons
5894 if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
5895 print <<END;
5896 <table>
5897 <tr>
5898 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5899 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5900 <td class='base'>$Lang::tr{'show certificate'}</td>
5901 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
5902 <td class='base'>$Lang::tr{'download certificate'}</td>
5903 </tr>
5904 </table>
5905 END
5906 ;
5907 }
5908
5909 print <<END
5910
5911 <br><hr><br>
5912
5913 <form method='post' enctype='multipart/form-data'>
5914 <table border='0' width='100%'>
5915 <tr>
5916 <td colspan='4'><b>$Lang::tr{'upload ca certificate'}</b></td>
5917 </tr>
5918
5919 <tr>
5920 <td width='10%'>$Lang::tr{'ca name'}:</td>
5921 <td width='30%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'></td>
5922 <td width='30%'><input type='file' name='FH' size='25'>
5923 <td width='30%'align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}'></td>
5924 </tr>
5925
5926 <tr>
5927 <td colspan='3'>&nbsp;</td>
5928 <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
5929 </tr>
5930 </table>
5931 </form>
5932
5933 <br><hr>
5934 END
5935 ;
5936
5937 if ( $srunning eq "yes" ) {
5938 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' disabled='disabled' /></div></form>\n";
5939 } else {
5940 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></div></form>\n";
5941 }
5942 &Header::closebox();
5943 END
5944 ;
5945
5946 &Header::closepage();
5947