html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 use CGI;
  23 use CGI qw/:standard/;
  24 use Imager::QRCode;
  25 use MIME::Base32;
  26 use MIME::Base64;
  27 use URI::Encode qw(uri_encode uri_decode);;
  28 use Net::DNS;
  29 use Net::Ping;
  30 use Net::Telnet;
  31 use File::Copy;
  32 use File::Temp qw/ tempfile tempdir /;
  33 use strict;
  34 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  35 use Sort::Naturally;
  36 require '/var/ipfire/general-functions.pl';
  37 require "${General::swroot}/lang.pl";
  38 require "${General::swroot}/header.pl";
  39 require "${General::swroot}/countries.pl";
  40 require "${General::swroot}/location-functions.pl";
  41
  42 # enable only the following on debugging purpose
  43 #use warnings;
  44 #use CGI::Carp 'fatalsToBrowser';
  45
  46 #workaround to suppress a warning when a variable is used only once
  47 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
  48 undef (@dummy);
  49
  50 my %color = ();
  51 my %mainsettings = ();
  52 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  53 &General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
  54
  55 ###
  56 ### Initialize variables
  57 ###
  58 my %ccdconfhash=();
  59 my %ccdroutehash=();
  60 my %ccdroute2hash=();
  61 my %netsettings=();
  62 my %cgiparams=();
  63 my %vpnsettings=();
  64 my %checked=();
  65 my %confighash=();
  66 my %cahash=();
  67 my %selected=();
  68 my $warnmessage = '';
  69 my $errormessage = '';
  70 my $cryptoerror = '';
  71 my $cryptowarning = '';
  72 my %settings=();
  73 my $routes_push_file = '';
  74 my $confighost="${General::swroot}/fwhosts/customhosts";
  75 my $configgrp="${General::swroot}/fwhosts/customgroups";
  76 my $customnet="${General::swroot}/fwhosts/customnetworks";
  77 my $name;
  78 my $col="";
  79 my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local";
  80 my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local";
  81
  82 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  83 $cgiparams{'ENABLED'} = 'off';
  84 $cgiparams{'ENABLED_BLUE'} = 'off';
  85 $cgiparams{'ENABLED_ORANGE'} = 'off';
  86 $cgiparams{'EDIT_ADVANCED'} = 'off';
  87 $cgiparams{'NAT'} = 'off';
  88 $cgiparams{'COMPRESSION'} = 'off';
  89 $cgiparams{'ONLY_PROPOSED'} = 'off';
  90 $cgiparams{'ACTION'} = '';
  91 $cgiparams{'CA_NAME'} = '';
  92 $cgiparams{'DH_NAME'} = 'dh1024.pem';
  93 $cgiparams{'DHLENGHT'} = '';
  94 $cgiparams{'DHCP_DOMAIN'} = '';
  95 $cgiparams{'DHCP_DNS'} = '';
  96 $cgiparams{'DHCP_WINS'} = '';
  97 $cgiparams{'ROUTES_PUSH'} = '';
  98 $cgiparams{'DCOMPLZO'} = 'off';
  99 $cgiparams{'MSSFIX'} = '';
 100 $cgiparams{'number'} = '';
 101 $cgiparams{'DCIPHER'} = '';
 102 $cgiparams{'DAUTH'} = '';
 103 $cgiparams{'TLSAUTH'} = '';
 104 $routes_push_file = "${General::swroot}/ovpn/routes_push";
 105 # Perform crypto and configration test
 106 &pkiconfigcheck;
 107
 108 # Add CCD files if not already presant
 109 unless (-e $routes_push_file) {
 110         open(RPF, ">$routes_push_file");
 111         close(RPF);
 112 }
 113 unless (-e "${General::swroot}/ovpn/ccd.conf") {
 114         open(CCDC, ">${General::swroot}/ovpn/ccd.conf");
 115         close (CCDC);
 116 }
 117 unless (-e "${General::swroot}/ovpn/ccdroute") {
 118         open(CCDR, ">${General::swroot}/ovpn/ccdroute");
 119         close (CCDR);
 120 }
 121 unless (-e "${General::swroot}/ovpn/ccdroute2") {
 122         open(CCDRT, ">${General::swroot}/ovpn/ccdroute2");
 123         close (CCDRT);
 124 }
 125 # Add additional configs if not already presant
 126 unless (-e "$local_serverconf") {
 127         open(LSC, ">$local_serverconf");
 128        close (LSC);
 129 }
 130 unless (-e "$local_clientconf") {
 131        open(LCC, ">$local_clientconf");
 132        close (LCC);
 133 }
 134
 135 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
 136
 137 # prepare openvpn config file
 138 ###
 139 ### Useful functions
 140 ###
 141 sub haveOrangeNet
 142 {
 143         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
 144         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 145         return 0;
 146 }
 147
 148 sub haveBlueNet
 149 {
 150         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
 151         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 152         return 0;
 153 }
 154
 155 sub sizeformat{
 156     my $bytesize = shift;
 157     my $i = 0;
 158
 159     while(abs($bytesize) >= 1024){
 160         $bytesize=$bytesize/1024;
 161         $i++;
 162         last if($i==6);
 163     }
 164
 165     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 166     my $newsize=(int($bytesize*100 +0.5))/100;
 167     return("$newsize $units[$i]");
 168 }
 169
 170 sub cleanssldatabase
 171 {
 172     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 173         print FILE "01";
 174         close FILE;
 175     }
 176     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 177         print FILE "";
 178         close FILE;
 179     }
 180     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
 181       print FILE "";
 182       close FILE;
 183     }
 184     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 185     unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
 186     unlink ("${General::swroot}/ovpn/certs/serial.old");
 187     unlink ("${General::swroot}/ovpn/certs/01.pem");
 188 }
 189
 190 sub newcleanssldatabase
 191 {
 192     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 193         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 194         print FILE "01";
 195         close FILE;
 196     }
 197     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 198         &General::system("touch", "${General::swroot}/ovpn/certs/index.txt");
 199     }
 200     if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
 201         &General::system("touch", "${General::swroot}/ovpn/certs/index.txt.attr");
 202     }
 203     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 204     unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
 205     unlink ("${General::swroot}/ovpn/certs/serial.old");
 206 }
 207
 208 sub deletebackupcert
 209 {
 210         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 211                 my $hexvalue = <FILE>;
 212                 chomp $hexvalue;
 213                 close FILE;
 214                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 215         }
 216 }
 217
 218 ###
 219 ### Check for PKI and configure problems
 220 ###
 221
 222 sub pkiconfigcheck
 223 {
 224         # Warning if DH parameter is 1024 bit
 225         if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
 226                 my @dhparameter = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
 227                 my $dhbit;
 228
 229                 # Loop through the output and search for the DH bit lenght.
 230                 foreach my $line (@dhparameter) {
 231                         if ($line =~ (/(\d+)/)) {
 232                                 # Assign match to dhbit value.
 233                                 $dhbit = $1;
 234
 235                                 last;
 236                         }
 237                 }
 238
 239                 # Check if the used key lenght is at least 2048 bit.
 240                 if ($dhbit < 2048) {
 241                         $cryptoerror = "$Lang::tr{'ovpn error dh'}";
 242                         goto CRYPTO_ERROR;
 243                 }
 244         }
 245
 246         # Warning if md5 is in usage
 247         if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
 248                 my @signature = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
 249                 if (grep(/md5WithRSAEncryption/, @signature) ) {
 250                         $cryptoerror = "$Lang::tr{'ovpn error md5'}";
 251                         goto CRYPTO_ERROR;
 252                 }
 253         }
 254
 255         CRYPTO_ERROR:
 256
 257         # Warning if certificate is not compliant to RFC3280 TLS rules
 258         if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
 259                 my @extendkeyusage = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
 260                 if ( ! grep(/TLS Web Server Authentication/, @extendkeyusage)) {
 261                         $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
 262                         goto CRYPTO_WARNING;
 263                 }
 264         }
 265
 266         CRYPTO_WARNING:
 267 }
 268
 269 sub writeserverconf {
 270     my %sovpnsettings = ();
 271     my @temp = ();
 272     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 273     &read_routepushfile;
 274
 275     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 276     flock CONF, 2;
 277     print CONF "#OpenVPN Server conf\n";
 278     print CONF "\n";
 279     print CONF "daemon openvpnserver\n";
 280     print CONF "writepid /var/run/openvpn.pid\n";
 281     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 282     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 283     print CONF "dev tun\n";
 284     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 285     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 286     print CONF "script-security 3\n";
 287     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 288     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 289     print CONF "tls-server\n";
 290     print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 291     print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 292     print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 293     print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
 294     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 295     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 296     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 297
 298     print CONF "tun-mtu $sovpnsettings{'DMTU'}\n";
 299
 300     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 301                 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 302                 foreach (@temp)
 303                 {
 304                         @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 305                         print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 306                 }
 307         }
 308 # a.marx ccd
 309         my %ccdconfhash=();
 310         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 311         foreach my $key (keys %ccdconfhash) {
 312                 my $a=$ccdconfhash{$key}[1];
 313                 my ($b,$c) = split (/\//, $a);
 314                 print CONF "route $b ".&General::cidrtosub($c)."\n";
 315         }
 316         my %ccdroutehash=();
 317         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 318         foreach my $key (keys %ccdroutehash) {
 319                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
 320                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
 321                         print CONF "route $a $b\n";
 322                 }
 323         }
 324 # ccd end
 325
 326         if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 327         print CONF "client-to-client\n";
 328     }
 329     if ($sovpnsettings{MSSFIX} eq 'on') {
 330                 print CONF "mssfix\n";
 331     } else {
 332                 print CONF "mssfix 0\n";
 333     }
 334     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 335                 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 336     }
 337
 338     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 339         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 340     }
 341     print CONF "status-version 1\n";
 342     print CONF "status /var/run/ovpnserver.log 30\n";
 343     print CONF "ncp-disable\n";
 344     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 345         print CONF "auth $sovpnsettings{'DAUTH'}\n";
 346     # Set TLSv2 as minimum
 347     print CONF "tls-version-min 1.2\n";
 348
 349     if ($sovpnsettings{'TLSAUTH'} eq 'on') {
 350         print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
 351     }
 352     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 353         print CONF "comp-lzo\n";
 354     }
 355     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 356         print CONF "push \"redirect-gateway def1\"\n";
 357     }
 358     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 359         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 360     }
 361
 362     if ($sovpnsettings{DHCP_DNS} ne '') {
 363         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 364     }
 365
 366     if ($sovpnsettings{DHCP_WINS} ne '') {
 367         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 368     }
 369
 370     if ($sovpnsettings{MAX_CLIENTS} eq '') {
 371         print CONF "max-clients 100\n";
 372     }
 373     if ($sovpnsettings{MAX_CLIENTS} ne '') {
 374         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 375     }
 376     print CONF "tls-verify /usr/lib/openvpn/verify\n";
 377     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 378     print CONF "auth-user-pass-optional\n";
 379     print CONF "reneg-sec 86400\n";
 380     print CONF "user nobody\n";
 381     print CONF "group nobody\n";
 382     print CONF "persist-key\n";
 383     print CONF "persist-tun\n";
 384         if ($sovpnsettings{LOG_VERB} ne '') {
 385                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 386         } else {
 387                 print CONF "verb 3\n";
 388         }
 389
 390     print CONF "# Log clients connecting/disconnecting\n";
 391     print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n";
 392     print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n";
 393     print CONF "\n";
 394
 395     print CONF "# Enable Management Socket\n";
 396     print CONF "management /var/run/openvpn.sock unix\n";
 397     print CONF "management-client-auth\n";
 398
 399     # Print server.conf.local if entries exist to server.conf
 400     if ( !-z $local_serverconf  && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
 401        open (LSC, "$local_serverconf");
 402                print CONF "\n#---------------------------\n";
 403                print CONF "# Start of custom directives\n";
 404                print CONF "# from server.conf.local\n";
 405                print CONF "#---------------------------\n\n";
 406        while (<LSC>) {
 407                print CONF $_;
 408        }
 409                print CONF "\n#-----------------------------\n";
 410                print CONF "# End of custom directives\n";
 411                print CONF "#-----------------------------\n";
 412        close (LSC);
 413     }
 414     print CONF "\n";
 415
 416     close(CONF);
 417 }
 418
 419 sub emptyserverlog{
 420     if (open(FILE, ">/var/run/ovpnserver.log")) {
 421         flock FILE, 2;
 422         print FILE "";
 423         close FILE;
 424     }
 425
 426 }
 427
 428 sub delccdnet
 429 {
 430         my %ccdconfhash = ();
 431         my %ccdhash = ();
 432         my $ccdnetname=$_[0];
 433         if (-f "${General::swroot}/ovpn/ovpnconfig"){
 434                 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 435                 foreach my $key (keys %ccdhash) {
 436                         if ($ccdhash{$key}[32] eq $ccdnetname) {
 437                                 $errormessage=$Lang::tr{'ccd err hostinnet'};
 438                                 return;
 439                         }
 440                 }
 441         }
 442         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 443         foreach my $key (keys %ccdconfhash) {
 444                         if ($ccdconfhash{$key}[0] eq $ccdnetname){
 445                                 delete $ccdconfhash{$key};
 446                         }
 447         }
 448         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 449
 450         &writeserverconf;
 451         return 0;
 452 }
 453
 454 sub addccdnet
 455 {
 456         my %ccdconfhash=();
 457         my @ccdconf=();
 458         my $ccdname=$_[0];
 459         my $ccdnet=$_[1];
 460         my $subcidr;
 461         my @ip2=();
 462         my $checkup;
 463         my $ccdip;
 464         my $baseaddress;
 465
 466
 467         #check name
 468         if ($ccdname eq '')
 469         {
 470                 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
 471                 return
 472         }
 473
 474         if(!&General::validccdname($ccdname))
 475         {
 476                 $errormessage=$Lang::tr{'ccd err invalidname'};
 477                 return;
 478         }
 479
 480         ($ccdip,$subcidr) = split (/\//,$ccdnet);
 481         $subcidr=&General::iporsubtocidr($subcidr);
 482         #check subnet
 483         if ($subcidr > 30)
 484         {
 485                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 486                 return;
 487         }
 488         #check ip
 489         if (!&General::validipandmask($ccdnet)){
 490                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 491                 return;
 492         }
 493
 494         if (!$errormessage) {
 495                 my %ccdconfhash=();
 496                 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
 497                 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 498                 my $key = &General::findhasharraykey (\%ccdconfhash);
 499                 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
 500                 $ccdconfhash{$key}[0] = $ccdname;
 501                 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
 502                 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 503                 &writeserverconf;
 504                 $cgiparams{'ccdname'}='';
 505                 $cgiparams{'ccdsubnet'}='';
 506                 return 1;
 507         }
 508 }
 509
 510 sub modccdnet
 511 {
 512
 513         my $newname=$_[0];
 514         my $oldname=$_[1];
 515         my %ccdconfhash=();
 516         my %ccdhash=();
 517
 518         # Check if the new name is valid.
 519         if(!&General::validhostname($newname)) {
 520                 $errormessage=$Lang::tr{'ccd err invalidname'};
 521                 return;
 522         }
 523
 524         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 525         foreach my $key (keys %ccdconfhash) {
 526                 if ($ccdconfhash{$key}[0] eq $oldname) {
 527                         foreach my $key1 (keys %ccdconfhash) {
 528                                 if ($ccdconfhash{$key1}[0] eq $newname){
 529                                         $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
 530                                         return;
 531                                 }else{
 532                                         $ccdconfhash{$key}[0]= $newname;
 533                                         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 534                                         last;
 535                                 }
 536                         }
 537                 }
 538         }
 539
 540         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 541                 foreach my $key (keys %ccdhash) {
 542                         if ($ccdhash{$key}[32] eq $oldname) {
 543                                 $ccdhash{$key}[32]=$newname;
 544                                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 545                                 last;
 546                         }
 547                 }
 548
 549         return 0;
 550 }
 551 sub ccdmaxclients
 552 {
 553         my $ccdnetwork=$_[0];
 554         my @octets=();
 555         my @subnet=();
 556         @octets=split("\/",$ccdnetwork);
 557         @subnet= split /\./, &General::cidrtosub($octets[1]);
 558         my ($a,$b,$c,$d,$e);
 559         $a=256-$subnet[0];
 560         $b=256-$subnet[1];
 561         $c=256-$subnet[2];
 562         $d=256-$subnet[3];
 563         $e=($a*$b*$c*$d)/4;
 564         return $e-1;
 565 }
 566
 567 sub getccdadresses
 568 {
 569         my $ipin=$_[0];
 570         my ($ip1,$ip2,$ip3,$ip4)=split  /\./, $ipin;
 571         my $cidr=$_[1];
 572         chomp($cidr);
 573         my $count=$_[2];
 574         my $hasip=$_[3];
 575         chomp($hasip);
 576         my @iprange=();
 577         my %ccdhash=();
 578         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 579         $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
 580         for (my $i=1;$i<=$count;$i++) {
 581                 my $tmpip=$iprange[$i-1];
 582                 my $stepper=$i*4;
 583                 $iprange[$i]= &General::getnextip($tmpip,4);
 584         }
 585         my $r=0;
 586         foreach my $key (keys %ccdhash) {
 587                 $r=0;
 588                 foreach  my $tmp (@iprange){
 589                         my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
 590                         if ($net eq $tmp) {
 591                                 if ( $hasip ne  $ccdhash{$key}[33] ){
 592                                         splice (@iprange,$r,1);
 593                                 }
 594                         }
 595                         $r++;
 596                 }
 597         }
 598         return @iprange;
 599 }
 600
 601 sub fillselectbox
 602 {
 603         my $boxname=$_[1];
 604         my ($ccdip,$subcidr) = split("/",$_[0]);
 605         my $tz=$_[2];
 606         my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
 607         print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
 608         foreach (@allccdips) {
 609                 my $ip=$_."/30";
 610                 chomp($ip);
 611                 print "<option value='$ip' ";
 612                 if ( $ip eq $cgiparams{$boxname} ){
 613                         print"selected";
 614                 }
 615                 print ">$ip</option>";
 616         }
 617         print "</select>";
 618 }
 619
 620 sub hostsinnet
 621 {
 622         my $name=$_[0];
 623         my %ccdhash=();
 624         my $i=0;
 625         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 626         foreach my $key (keys %ccdhash) {
 627                 if ($ccdhash{$key}[32] eq $name){ $i++;}
 628         }
 629         return $i;
 630 }
 631
 632 sub check_routes_push
 633 {
 634                         my $val=$_[0];
 635                         my ($ip,$cidr) = split (/\//, $val);
 636                         ##check for existing routes in routes_push
 637                         if (-e "${General::swroot}/ovpn/routes_push") {
 638                                 open(FILE,"${General::swroot}/ovpn/routes_push");
 639                                 while (<FILE>) {
 640                                         $_=~s/\s*$//g;
 641
 642                                         my ($ip2,$cidr2) = split (/\//,"$_");
 643                                         my $val2=$ip2."/".&General::iporsubtodec($cidr2);
 644
 645                                         if($val eq $val2){
 646                                                 return 0;
 647                                         }
 648                                         #subnetcheck
 649                                         if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
 650                                                 return 0;
 651                                         }
 652                                 };
 653                                 close(FILE);
 654                         }
 655         return 1;
 656 }
 657
 658 sub check_ccdroute
 659 {
 660         my %ccdroutehash=();
 661         my $val=$_[0];
 662         my ($ip,$cidr) = split (/\//, $val);
 663         #check for existing routes in ccdroute
 664         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 665         foreach my $key (keys %ccdroutehash) {
 666                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 667                         if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
 668                                 return 0;
 669                         }
 670                         my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
 671                         #subnetcheck
 672                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
 673                                 return 0;
 674                         }
 675                 }
 676         }
 677         return 1;
 678 }
 679 sub check_ccdconf
 680 {
 681         my %ccdconfhash=();
 682         my $val=$_[0];
 683         my ($ip,$cidr) = split (/\//, $val);
 684         #check for existing routes in ccdroute
 685         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 686         foreach my $key (keys %ccdconfhash) {
 687                 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
 688                                 return 0;
 689                         }
 690                         my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
 691                         #subnetcheck
 692                         if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
 693                                 return 0;
 694                         }
 695
 696         }
 697         return 1;
 698 }
 699
 700 ###
 701 # m.a.d net2net
 702 ###
 703
 704 sub validdotmask
 705 {
 706         my $ipdotmask = $_[0];
 707         if (&General::validip($ipdotmask)) { return 0; }
 708         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 709         my $mask = $2;
 710         if (($mask =~ /\./ )) { return 0; }
 711   return 1;
 712 }
 713
 714 # -------------------------------------------------------------------
 715
 716 sub write_routepushfile
 717 {
 718         open(FILE, ">$routes_push_file");
 719         flock(FILE, 2);
 720         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 721                 print FILE $vpnsettings{'ROUTES_PUSH'};
 722         }
 723         close(FILE);
 724 }
 725
 726 sub read_routepushfile
 727 {
 728         if (-e "$routes_push_file") {
 729                 open(FILE,"$routes_push_file");
 730                 delete $vpnsettings{'ROUTES_PUSH'};
 731                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 732                 close(FILE);
 733                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 734
 735         }
 736 }
 737
 738 sub writecollectdconf {
 739         my $vpncollectd;
 740         my %ccdhash=();
 741
 742         open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!";
 743         print COLLECTDVPN "Loadplugin openvpn\n";
 744         print COLLECTDVPN "\n";
 745         print COLLECTDVPN "<Plugin openvpn>\n";
 746         print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n";
 747
 748         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 749         foreach my $key (keys %ccdhash) {
 750                 if ($ccdhash{$key}[0] eq 'on' && $ccdhash{$key}[3] eq 'net') {
 751                         print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ccdhash{$key}[1]-n2n\"\n";
 752                 }
 753         }
 754
 755         print COLLECTDVPN "</Plugin>\n";
 756         close(COLLECTDVPN);
 757
 758         # Reload collectd afterwards
 759         &General::system("/usr/local/bin/collectdctrl", "restart");
 760 }
 761
 762 #hier die refresh page
 763 if ( -e "${General::swroot}/ovpn/gencanow") {
 764     my $refresh = '';
 765     $refresh = "<meta http-equiv='refresh' content='15;' />";
 766     &Header::showhttpheaders();
 767     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 768     &Header::openbigbox('100%', 'center');
 769     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 770     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 771     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 772     &Header::closebox();
 773     &Header::closebigbox();
 774     &Header::closepage();
 775     exit (0);
 776 }
 777 ##hier die refresh page
 778
 779
 780 ###
 781 ### OpenVPN Server Control
 782 ###
 783 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 784     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 785     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 786     #start openvpn server
 787     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 788         &emptyserverlog();
 789         &General::system("/usr/local/bin/openvpnctrl", "-s");
 790     }
 791     #stop openvpn server
 792     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 793         &General::system("/usr/local/bin/openvpnctrl", "-k");
 794         &emptyserverlog();
 795     }
 796 #    #restart openvpn server
 797 #    if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 798 #workarund, till SIGHUP also works when running as nobody
 799 #       system('/usr/local/bin/openvpnctrl', '-r');
 800 #       &emptyserverlog();
 801 #    }
 802 }
 803
 804 ###
 805 ### Save Advanced options
 806 ###
 807
 808 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 809     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 810     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 811     #DAN this value has to leave.
 812 #new settings for daemon
 813     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 814     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 815     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 816     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 817     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 818     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 819     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
 820     $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
 821     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 822     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 823     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 824     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 825     my @temp=();
 826
 827     if ($cgiparams{'FRAGMENT'} eq '') {
 828         delete $vpnsettings{'FRAGMENT'};
 829     } else {
 830         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 831             $errormessage = "Incorrect value, please insert only numbers.";
 832         goto ADV_ERROR;
 833                 } else {
 834                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 835         }
 836     }
 837
 838     if ($cgiparams{'MSSFIX'} ne 'on') {
 839         delete $vpnsettings{'MSSFIX'};
 840     } else {
 841         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 842     }
 843
 844     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 845         unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 846                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 847         goto ADV_ERROR;
 848         }
 849     }
 850     if ($cgiparams{'DHCP_DNS'} ne ''){
 851         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 852                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 853         goto ADV_ERROR;
 854         }
 855     }
 856     if ($cgiparams{'DHCP_WINS'} ne ''){
 857         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 858                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 859                 goto ADV_ERROR;
 860         }
 861     }
 862     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 863         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 864         undef $vpnsettings{'ROUTES_PUSH'};
 865
 866         foreach my $tmpip (@temp)
 867         {
 868                 s/^\s+//g; s/\s+$//g;
 869
 870                 if ($tmpip)
 871                 {
 872                         $tmpip=~s/\s*$//g;
 873                         unless (&General::validipandmask($tmpip)) {
 874                                 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
 875                                 goto ADV_ERROR;
 876                         }
 877                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
 878
 879                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 880                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 881                                 goto ADV_ERROR;
 882                         }
 883 # a.marx ccd
 884                         my %ccdroutehash=();
 885                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 886                         foreach my $key (keys %ccdroutehash) {
 887                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 888                                         if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
 889                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 890                                                 goto ADV_ERROR;
 891                                         }
 892                                         my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
 893                                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
 894                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 895                                                 goto ADV_ERROR;
 896                                         }
 897                                 }
 898                         }
 899
 900 # ccd end
 901
 902                         $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
 903                 }
 904         }
 905     &write_routepushfile;
 906         undef $vpnsettings{'ROUTES_PUSH'};
 907     }
 908         else {
 909         undef $vpnsettings{'ROUTES_PUSH'};
 910         &write_routepushfile;
 911     }
 912     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
 913         $errormessage = $Lang::tr{'invalid input for max clients'};
 914         goto ADV_ERROR;
 915     }
 916     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 917         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 918             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 919         goto ADV_ERROR;
 920         }
 921     }
 922     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 923         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 924             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 925         goto ADV_ERROR;
 926         }
 927     }
 928     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 929         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 930         goto ADV_ERROR;
 931     }
 932     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 933     &writeserverconf();#hier ok
 934 }
 935
 936 ###
 937 # m.a.d net2net
 938 ###
 939
 940 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 941 {
 942
 943 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 944 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 945 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 946 my $tunmtu =  '';
 947
 948 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 949 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 950
 951   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 952
 953   flock SERVERCONF, 2;
 954   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 955   print SERVERCONF "\n";
 956   print SERVERCONF "# User Security\n";
 957   print SERVERCONF "user nobody\n";
 958   print SERVERCONF "group nobody\n";
 959   print SERVERCONF "persist-tun\n";
 960   print SERVERCONF "persist-key\n";
 961   print SERVERCONF "script-security 2\n";
 962   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 963
 964   if ($cgiparams{'REMOTE'} ne '') {
 965   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 966   }
 967
 968   print SERVERCONF "float\n";
 969   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 970   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 971   print SERVERCONF "# Client Gateway Network\n";
 972   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 973   print SERVERCONF "up \"/etc/init.d/static-routes start\"\n";
 974   print SERVERCONF "# tun Device\n";
 975   print SERVERCONF "dev tun\n";
 976   print SERVERCONF "#Logfile for statistics\n";
 977   print SERVERCONF "status-version 1\n";
 978   print SERVERCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
 979   print SERVERCONF "# Port and Protokol\n";
 980   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 981
 982   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 983   print SERVERCONF "proto tcp4-server\n";
 984   print SERVERCONF "# Packet size\n";
 985   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 986   print SERVERCONF "tun-mtu $tunmtu\n";
 987   }
 988
 989   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 990   print SERVERCONF "proto udp4\n";
 991   print SERVERCONF "# Paketsize\n";
 992   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 993   print SERVERCONF "tun-mtu $tunmtu\n";
 994   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 995   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; } else { print SERVERCONF "mssfix 0\n" };
 996   }
 997
 998   print SERVERCONF "# Auth. Server\n";
 999   print SERVERCONF "tls-server\n";
1000   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
1001   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
1002   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
1003   print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
1004   print SERVERCONF "# Cipher\n";
1005   print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
1006
1007   # If GCM cipher is used, do not use --auth
1008   if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1009       ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1010       ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1011     print SERVERCONF unless "# HMAC algorithm\n";
1012     print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n";
1013   } else {
1014     print SERVERCONF "# HMAC algorithm\n";
1015     print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
1016   }
1017
1018   # Set TLSv1.2 as minimum
1019   print SERVERCONF "tls-version-min 1.2\n";
1020
1021   if ($cgiparams{'COMPLZO'} eq 'on') {
1022    print SERVERCONF "# Enable Compression\n";
1023    print SERVERCONF "comp-lzo\n";
1024      }
1025   print SERVERCONF "# Debug Level\n";
1026   print SERVERCONF "verb 3\n";
1027   print SERVERCONF "# Tunnel check\n";
1028   print SERVERCONF "keepalive 10 60\n";
1029   print SERVERCONF "# Start as daemon\n";
1030   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1031   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1032   print SERVERCONF "# Activate Management Interface and Port\n";
1033   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1034   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1035   close(SERVERCONF);
1036
1037 }
1038
1039 ###
1040 # m.a.d net2net
1041 ###
1042
1043 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1044 {
1045
1046         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
1047         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1048         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
1049         my $tunmtu =  '';
1050
1051 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1052 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1053
1054   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1055
1056   flock CLIENTCONF, 2;
1057   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1058   print CLIENTCONF "#\n";
1059   print CLIENTCONF "# User Security\n";
1060   print CLIENTCONF "user nobody\n";
1061   print CLIENTCONF "group nobody\n";
1062   print CLIENTCONF "persist-tun\n";
1063   print CLIENTCONF "persist-key\n";
1064   print CLIENTCONF "script-security 2\n";
1065   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1066   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1067   print CLIENTCONF "float\n";
1068   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1069   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1070   print CLIENTCONF "# Server Gateway Network\n";
1071   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1072   print CLIENTCONF "up \"/etc/init.d/static-routes start\"\n";
1073   print CLIENTCONF "# tun Device\n";
1074   print CLIENTCONF "dev tun\n";
1075   print CLIENTCONF "#Logfile for statistics\n";
1076   print CLIENTCONF "status-version 1\n";
1077   print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
1078   print CLIENTCONF "# Port and Protokol\n";
1079   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1080
1081   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1082   print CLIENTCONF "proto tcp4-client\n";
1083   print CLIENTCONF "# Packet size\n";
1084   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1085   print CLIENTCONF "tun-mtu $tunmtu\n";
1086   }
1087
1088   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1089   print CLIENTCONF "proto udp4\n";
1090   print CLIENTCONF "# Paketsize\n";
1091   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1092   print CLIENTCONF "tun-mtu $tunmtu\n";
1093   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1094   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; } else { print CLIENTCONF "mssfix 0\n" };
1095   }
1096
1097   # Check host certificate if X509 is RFC3280 compliant.
1098   # If not, old --ns-cert-type directive will be used.
1099   # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
1100   my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1101   if ( ! grep(/TLS Web Server Authentication/, @hostcert)) {
1102        print CLIENTCONF "ns-cert-type server\n";
1103   } else {
1104        print CLIENTCONF "remote-cert-tls server\n";
1105   }
1106   print CLIENTCONF "# Auth. Client\n";
1107   print CLIENTCONF "tls-client\n";
1108   print CLIENTCONF "# Cipher\n";
1109   print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
1110   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1111
1112   # If GCM cipher is used, do not use --auth
1113   if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1114       ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1115       ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1116     print CLIENTCONF unless "# HMAC algorithm\n";
1117     print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n";
1118   } else {
1119     print CLIENTCONF "# HMAC algorithm\n";
1120     print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1121   }
1122
1123   # Set TLSv1.2 as minimum
1124   print CLIENTCONF "tls-version-min 1.2\n";
1125
1126   if ($cgiparams{'COMPLZO'} eq 'on') {
1127    print CLIENTCONF "# Enable Compression\n";
1128    print CLIENTCONF "comp-lzo\n";
1129   }
1130   print CLIENTCONF "# Debug Level\n";
1131   print CLIENTCONF "verb 3\n";
1132   print CLIENTCONF "# Tunnel check\n";
1133   print CLIENTCONF "keepalive 10 60\n";
1134   print CLIENTCONF "# Start as daemon\n";
1135   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1136   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1137   print CLIENTCONF "# Activate Management Interface and Port\n";
1138   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1139   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1140   close(CLIENTCONF);
1141
1142 }
1143
1144 ###
1145 ### Save main settings
1146 ###
1147
1148 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1149     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1150     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1151     #DAN this value has to leave.
1152     if ($cgiparams{'ENABLED'} eq 'on'){
1153         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1154                 $errormessage = $Lang::tr{'invalid input for hostname'};
1155         goto SETTINGS_ERROR;
1156         }
1157     }
1158
1159     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1160             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1161                         goto SETTINGS_ERROR;
1162     }
1163     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1164
1165     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1166         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1167         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1168         goto SETTINGS_ERROR;
1169     }
1170
1171     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1172         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1173         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1174         goto SETTINGS_ERROR;
1175     }
1176
1177     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1178         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1179         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1180         goto SETTINGS_ERROR;
1181     }
1182
1183     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1184         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1185         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1186         goto SETTINGS_ERROR;
1187     }
1188     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1189     while (<ALIASES>)
1190     {
1191         chomp($_);
1192         my @tempalias = split(/\,/,$_);
1193         if ($tempalias[1] eq 'on') {
1194             if (&General::IpInSubnet ($tempalias[0] ,
1195                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1196                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1197             }
1198         }
1199     }
1200     close(ALIASES);
1201     if ($errormessage ne ''){
1202         goto SETTINGS_ERROR;
1203     }
1204     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1205         $errormessage = $Lang::tr{'invalid input'};
1206         goto SETTINGS_ERROR;
1207     }
1208     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1209         $errormessage = $Lang::tr{'invalid mtu input'};
1210         goto SETTINGS_ERROR;
1211     }
1212
1213     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1214         $errormessage = $Lang::tr{'invalid port'};
1215         goto SETTINGS_ERROR;
1216     }
1217
1218         # Create ta.key for tls-auth if not presant
1219         if ($cgiparams{'TLSAUTH'} eq 'on') {
1220                 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
1221                         # This system call is safe, because all arguements are passed as an array.
1222                         system("/usr/sbin/openvpn", "--genkey", "secret", "${General::swroot}/ovpn/certs/ta.key");
1223                         if ($?) {
1224                                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1225                                 goto SETTINGS_ERROR;
1226                         }
1227                 }
1228         }
1229
1230     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1231     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1232     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1233     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1234 #new settings for daemon
1235     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1236     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1237     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1238     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1239     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1240     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1241     $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
1242     $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
1243 #wrtie enable
1244
1245   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {
1246           &General::system("touch", "${General::swroot}/ovpn/enable_blue");
1247   } else {
1248           unlink("${General::swroot}/ovpn/enable_blue");
1249   }
1250
1251   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {
1252           &General::system("touch", "${General::swroot}/ovpn/enable_orange");
1253   } else {
1254           unlink("${General::swroot}/ovpn/enable_orange");
1255   }
1256
1257   if ( $vpnsettings{'ENABLED'} eq 'on' ) {
1258           &General::system("touch", "${General::swroot}/ovpn/enable");
1259   } else {
1260           unlink("${General::swroot}/ovpn/enable");
1261   }
1262
1263 #new settings for daemon
1264     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1265     &writeserverconf();#hier ok
1266 SETTINGS_ERROR:
1267 ###
1268 ### Reset all step 2
1269 ###
1270 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
1271     my $file = '';
1272     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1273
1274     # Kill all N2N connections
1275     &General::system("/usr/local/bin/openvpnctrl", "-kn2n");
1276
1277     foreach my $key (keys %confighash) {
1278         my $name = $confighash{$cgiparams{'$key'}}[1];
1279
1280         if ($confighash{$key}[4] eq 'cert') {
1281             delete $confighash{$cgiparams{'$key'}};
1282         }
1283
1284         &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$name");
1285     }
1286     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1287         unlink $file;
1288     }
1289     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1290         unlink $file;
1291     }
1292     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1293         unlink $file;
1294     }
1295         &cleanssldatabase();
1296     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1297         print FILE "";
1298         close FILE;
1299     }
1300     if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1301         print FILE "";
1302         close FILE;
1303     }
1304     if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1305         print FILE "";
1306         close FILE;
1307     }
1308     while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1309         unlink $file
1310     }
1311     while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1312         unlink $file
1313     }
1314     if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1315         print FILE "";
1316         close FILE;
1317     }
1318     if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1319         print FILE "";
1320         close FILE;
1321     }
1322     while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1323         unlink($file);
1324     }
1325
1326     # Remove everything from the collectd configuration
1327     &writecollectdconf();
1328
1329     #&writeserverconf();
1330 ###
1331 ### Reset all step 1
1332 ###
1333 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
1334     &Header::showhttpheaders();
1335     &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1336     &Header::openbigbox('100%', 'left', '', '');
1337     &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1338     print <<END;
1339         <form method='post'>
1340                 <table width='100%'>
1341                         <tr>
1342                                 <td align='center'>
1343                                 <input type='hidden' name='AREUSURE' value='yes' />
1344                                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1345                                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1346                         </tr>
1347                         <tr>
1348                                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1349                                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1350                         </tr>
1351                 </table>
1352         </form>
1353 END
1354     ;
1355     &Header::closebox();
1356     &Header::closebigbox();
1357     &Header::closepage();
1358     exit (0);
1359
1360 ###
1361 ### Generate DH key step 2
1362 ###
1363 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
1364     # Delete if old key exists
1365     if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1366         unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1367         }
1368         # Create Diffie Hellmann Parameter
1369         # The system call is safe, because all arguments are passed as an array.
1370         system("/usr/bin/openssl", "dhparam", "-out", "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1371         if ($?) {
1372                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1373                 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1374         }
1375
1376 ###
1377 ### Generate DH key step 1
1378 ###
1379 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1380         &Header::showhttpheaders();
1381         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1382         &Header::openbigbox('100%', 'LEFT', '', '');
1383         &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1384         print <<END;
1385         <table width='100%'>
1386         <tr>
1387                 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
1388         </tr>
1389         <tr>
1390                 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1391                 <td align='center'>
1392                 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1393                 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1394                         <select name='DHLENGHT'>
1395                                 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1396                                 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1397                                 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1398                         </select>
1399                 </td>
1400         </tr>
1401         <tr><td colspan='4'><br></td></tr>
1402         </table>
1403         <table width='100%'>
1404         <tr>
1405                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
1406         </tr>
1407         <tr>
1408                 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1409         </tr>
1410         <tr><td colspan='2'><br></td></tr>
1411         <tr>
1412                 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1413                 </form>
1414         </tr>
1415         </table>
1416
1417 END
1418         ;
1419         &Header::closebox();
1420         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1421         &Header::closebigbox();
1422         &Header::closepage();
1423         exit (0);
1424
1425 ###
1426 ### Upload DH key
1427 ###
1428 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
1429     unless (ref ($cgiparams{'FH'})) {
1430          $errormessage = $Lang::tr{'there was no file upload'};
1431          goto UPLOADCA_ERROR;
1432     }
1433     # Move uploaded dh key to a temporary file
1434     (my $fh, my $filename) = tempfile( );
1435     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1436         $errormessage = $!;
1437         goto UPLOADCA_ERROR;
1438     }
1439     my @temp = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$filename");
1440     if ( ! grep(/DH Parameters: \((2048|3072|4096) bit\)/, @temp)) {
1441         $errormessage = $Lang::tr{'not a valid dh key'};
1442         unlink ($filename);
1443         goto UPLOADCA_ERROR;
1444     } else {
1445         # Delete if old key exists
1446         if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1447                 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1448         }
1449
1450         unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}")) {
1451                 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1452                 unlink ($filename);
1453                 goto UPLOADCA_ERROR;
1454         }
1455     }
1456 ###
1457 ### Upload CA Certificate
1458 ###
1459 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1460     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1461
1462     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1463         $errormessage = $Lang::tr{'name must only contain characters'};
1464         goto UPLOADCA_ERROR;
1465     }
1466
1467     if (length($cgiparams{'CA_NAME'}) >60) {
1468         $errormessage = $Lang::tr{'name too long'};
1469         goto VPNCONF_ERROR;
1470     }
1471
1472     if ($cgiparams{'CA_NAME'} eq 'ca') {
1473         $errormessage = $Lang::tr{'name is invalid'};
1474         goto UPLOADCA_ERROR;
1475     }
1476
1477     # Check if there is no other entry with this name
1478     foreach my $key (keys %cahash) {
1479         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1480             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1481             goto UPLOADCA_ERROR;
1482         }
1483     }
1484
1485     unless (ref ($cgiparams{'FH'})) {
1486         $errormessage = $Lang::tr{'there was no file upload'};
1487         goto UPLOADCA_ERROR;
1488     }
1489     # Move uploaded ca to a temporary file
1490     (my $fh, my $filename) = tempfile( );
1491     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1492         $errormessage = $!;
1493         goto UPLOADCA_ERROR;
1494     }
1495     my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
1496     if ( ! grep(/CA:TRUE/i, @temp )) {
1497         $errormessage = $Lang::tr{'not a valid ca certificate'};
1498         unlink ($filename);
1499         goto UPLOADCA_ERROR;
1500     } else {
1501         unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem")) {
1502             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1503             unlink ($filename);
1504             goto UPLOADCA_ERROR;
1505         }
1506     }
1507
1508     my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1509     my $casubject;
1510
1511     foreach my $line (@casubject) {
1512         if ($line =~ /Subject: (.*)[\n]/) {
1513                 $casubject    = $1;
1514                 $casubject    =~ s+/Email+, E+;
1515                 $casubject    =~ s/ ST=/ S=/;
1516
1517                 last;
1518         }
1519     }
1520
1521     $casubject    = &Header::cleanhtml($casubject);
1522
1523     my $key = &General::findhasharraykey (\%cahash);
1524     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1525     $cahash{$key}[1] = $casubject;
1526     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1527 #    system('/usr/local/bin/ipsecctrl', 'R');
1528
1529     UPLOADCA_ERROR:
1530
1531 ###
1532 ### Display ca certificate
1533 ###
1534 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1535     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1536
1537     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1538         &Header::showhttpheaders();
1539         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1540         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1541         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1542         my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1543         my $output = &Header::cleanhtml(join("", @output),"y");
1544         print "<pre>$output</pre>\n";
1545         &Header::closebox();
1546         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1547         &Header::closebigbox();
1548         &Header::closepage();
1549         exit(0);
1550     } else {
1551         $errormessage = $Lang::tr{'invalid key'};
1552     }
1553
1554 ###
1555 ### Download ca certificate
1556 ###
1557 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1558     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1559
1560     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1561         print "Content-Type: application/octet-stream\r\n";
1562         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1563
1564         my @tmp =  &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1565         print @tmp;
1566
1567         exit(0);
1568     } else {
1569         $errormessage = $Lang::tr{'invalid key'};
1570     }
1571
1572 ###
1573 ### Remove ca certificate (step 2)
1574 ###
1575 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1576     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1577     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1578
1579     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1580         foreach my $key (keys %confighash) {
1581             my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1582             if (grep(/: OK/, @test)) {
1583                 # Delete connection
1584 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1585 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1586 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1587 #               }
1588                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1589                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1590                 delete $confighash{$key};
1591                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1592 #               &writeipsecfiles();
1593             }
1594         }
1595         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1596         delete $cahash{$cgiparams{'KEY'}};
1597         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1598 #       system('/usr/local/bin/ipsecctrl', 'R');
1599     } else {
1600         $errormessage = $Lang::tr{'invalid key'};
1601     }
1602 ###
1603 ### Remove ca certificate (step 1)
1604 ###
1605 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1606     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1607     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1608
1609     my $assignedcerts = 0;
1610     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1611         foreach my $key (keys %confighash) {
1612             my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1613             if (grep(/: OK/, @test)) {
1614                 $assignedcerts++;
1615             }
1616         }
1617         if ($assignedcerts) {
1618             &Header::showhttpheaders();
1619             &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1620             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1621             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1622             print <<END;
1623                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1624                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1625                     <tr><td align='center'>
1626                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1627                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1628                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1629                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1630                 </form></table>
1631 END
1632             ;
1633             &Header::closebox();
1634             &Header::closebigbox();
1635             &Header::closepage();
1636             exit (0);
1637         } else {
1638             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1639             delete $cahash{$cgiparams{'KEY'}};
1640             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1641 #           system('/usr/local/bin/ipsecctrl', 'R');
1642         }
1643     } else {
1644         $errormessage = $Lang::tr{'invalid key'};
1645     }
1646
1647 ###
1648 ### Display root certificate
1649 ###
1650 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1651     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1652     my @output;
1653     &Header::showhttpheaders();
1654     &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1655     &Header::openbigbox('100%', 'LEFT', '', '');
1656     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1657         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1658         @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1659     } else {
1660         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1661         @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1662     }
1663     my $output = &Header::cleanhtml(join("", @output), "y");
1664     print "<pre>$output</pre>\n";
1665     &Header::closebox();
1666     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1667     &Header::closebigbox();
1668     &Header::closepage();
1669     exit(0);
1670
1671 ###
1672 ### Download root certificate
1673 ###
1674 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1675     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1676         print "Content-Type: application/octet-stream\r\n";
1677         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1678
1679         my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1680         print @tmp;
1681
1682         exit(0);
1683     }
1684
1685 ###
1686 ### Download host certificate
1687 ###
1688 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1689     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1690         print "Content-Type: application/octet-stream\r\n";
1691         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1692
1693         my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1694         print @tmp;
1695
1696         exit(0);
1697     }
1698
1699 ###
1700 ### Download tls-auth key
1701 ###
1702 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1703     if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1704         print "Content-Type: application/octet-stream\r\n";
1705         print "Content-Disposition: filename=ta.key\r\n\r\n";
1706
1707         open(FILE, "${General::swroot}/ovpn/certs/ta.key");
1708         my @tmp = <FILE>;
1709         close(FILE);
1710
1711         print @tmp;
1712
1713         exit(0);
1714     }
1715
1716 ###
1717 ### Form for generating a root certificate
1718 ###
1719 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1720          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1721
1722     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1723     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1724         $errormessage = $Lang::tr{'valid root certificate already exists'};
1725         $cgiparams{'ACTION'} = '';
1726         goto ROOTCERT_ERROR;
1727     }
1728
1729     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1730         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1731             my $ipaddr = <IPADDR>;
1732             close IPADDR;
1733             chomp ($ipaddr);
1734             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1735             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1736                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1737             }
1738         }
1739     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1740         unless (ref ($cgiparams{'FH'})) {
1741             $errormessage = $Lang::tr{'there was no file upload'};
1742             goto ROOTCERT_ERROR;
1743         }
1744
1745         # Move uploaded certificate request to a temporary file
1746         (my $fh, my $filename) = tempfile( );
1747         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1748             $errormessage = $!;
1749             goto ROOTCERT_ERROR;
1750         }
1751
1752         # Create a temporary dirctory
1753         my $tempdir = tempdir( CLEANUP => 1 );
1754
1755         # Extract the CA certificate from the file
1756         my $pid = open(OPENSSL, "|-");
1757         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1758         if ($pid) {     # parent
1759             if ($cgiparams{'P12_PASS'} ne '') {
1760                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1761             }
1762             close (OPENSSL);
1763             if ($?) {
1764                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1765                 unlink ($filename);
1766                 goto ROOTCERT_ERROR;
1767             }
1768         } else {        # child
1769             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1770                     '-in', $filename,
1771                     '-out', "$tempdir/cacert.pem")) {
1772                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1773                 unlink ($filename);
1774                 goto ROOTCERT_ERROR;
1775             }
1776         }
1777
1778         # Extract the Host certificate from the file
1779         $pid = open(OPENSSL, "|-");
1780         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1781         if ($pid) {     # parent
1782             if ($cgiparams{'P12_PASS'} ne '') {
1783                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1784             }
1785             close (OPENSSL);
1786             if ($?) {
1787                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1788                 unlink ($filename);
1789                 goto ROOTCERT_ERROR;
1790             }
1791         } else {        # child
1792             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1793                     '-in', $filename,
1794                     '-out', "$tempdir/hostcert.pem")) {
1795                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1796                 unlink ($filename);
1797                 goto ROOTCERT_ERROR;
1798             }
1799         }
1800
1801         # Extract the Host key from the file
1802         $pid = open(OPENSSL, "|-");
1803         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1804         if ($pid) {     # parent
1805             if ($cgiparams{'P12_PASS'} ne '') {
1806                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1807             }
1808             close (OPENSSL);
1809             if ($?) {
1810                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1811                 unlink ($filename);
1812                 goto ROOTCERT_ERROR;
1813             }
1814         } else {        # child
1815             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1816                     '-nodes',
1817                     '-in', $filename,
1818                     '-out', "$tempdir/serverkey.pem")) {
1819                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1820                 unlink ($filename);
1821                 goto ROOTCERT_ERROR;
1822             }
1823         }
1824
1825         unless(move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem")) {
1826             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1827             unlink ($filename);
1828             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1829             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1830             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1831             goto ROOTCERT_ERROR;
1832         }
1833
1834         unless(move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem")) {
1835             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1836             unlink ($filename);
1837             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1838             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1839             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1840             goto ROOTCERT_ERROR;
1841         }
1842
1843         unless(move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem")) {
1844             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1845             unlink ($filename);
1846             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1847             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1848             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1849             goto ROOTCERT_ERROR;
1850         }
1851
1852         goto ROOTCERT_SUCCESS;
1853
1854     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1855
1856         # Validate input since the form was submitted
1857         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1858             $errormessage = $Lang::tr{'organization cant be empty'};
1859             goto ROOTCERT_ERROR;
1860         }
1861         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1862             $errormessage = $Lang::tr{'organization too long'};
1863             goto ROOTCERT_ERROR;
1864         }
1865         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1866             $errormessage = $Lang::tr{'invalid input for organization'};
1867             goto ROOTCERT_ERROR;
1868         }
1869         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1870             $errormessage = $Lang::tr{'hostname cant be empty'};
1871             goto ROOTCERT_ERROR;
1872         }
1873         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1874             $errormessage = $Lang::tr{'invalid input for hostname'};
1875             goto ROOTCERT_ERROR;
1876         }
1877         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1878             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1879             goto ROOTCERT_ERROR;
1880         }
1881         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1882             $errormessage = $Lang::tr{'e-mail address too long'};
1883             goto ROOTCERT_ERROR;
1884         }
1885         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1886             $errormessage = $Lang::tr{'invalid input for department'};
1887             goto ROOTCERT_ERROR;
1888         }
1889         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1890             $errormessage = $Lang::tr{'invalid input for city'};
1891             goto ROOTCERT_ERROR;
1892         }
1893         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1894             $errormessage = $Lang::tr{'invalid input for state or province'};
1895             goto ROOTCERT_ERROR;
1896         }
1897         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1898             $errormessage = $Lang::tr{'invalid input for country'};
1899             goto ROOTCERT_ERROR;
1900         }
1901
1902         # Copy the cgisettings to vpnsettings and save the configfile
1903         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1904         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1905         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1906         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1907         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1908         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1909         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1910         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1911
1912         # Replace empty strings with a .
1913         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1914         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1915         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1916
1917         # refresh
1918         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1919
1920         # Create the CA certificate
1921         my $pid = open(OPENSSL, "|-");
1922         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1923         if ($pid) {     # parent
1924             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1925             print OPENSSL "$state\n";
1926             print OPENSSL "$city\n";
1927             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1928             print OPENSSL "$ou\n";
1929             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1930             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1931             close (OPENSSL);
1932             if ($?) {
1933                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1934                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1935                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1936                 goto ROOTCERT_ERROR;
1937             }
1938         } else {        # child
1939             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
1940                         '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
1941                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1942                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1943                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1944                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1945                 goto ROOTCERT_ERROR;
1946             }
1947         }
1948
1949         # Create the Host certificate request
1950         $pid = open(OPENSSL, "|-");
1951         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1952         if ($pid) {     # parent
1953             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1954             print OPENSSL "$state\n";
1955             print OPENSSL "$city\n";
1956             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1957             print OPENSSL "$ou\n";
1958             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1959             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1960             print OPENSSL ".\n";
1961             print OPENSSL ".\n";
1962             close (OPENSSL);
1963             if ($?) {
1964                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1965                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1966                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1967                 goto ROOTCERT_ERROR;
1968             }
1969         } else {        # child
1970             unless (exec ('/usr/bin/openssl', 'req', '-nodes',
1971                         '-newkey', 'rsa:4096',
1972                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1973                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1974                         '-extensions', 'server',
1975                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1976                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1977                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1978                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1979                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1980                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1981                 goto ROOTCERT_ERROR;
1982             }
1983         }
1984
1985         # Sign the host certificate request
1986         # This system call is safe, because all argeuments are passed as an array.
1987         system('/usr/bin/openssl', 'ca', '-days', '999999',
1988                 '-batch', '-notext',
1989                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1990                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1991                 '-extensions', 'server',
1992                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1993         if ($?) {
1994             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1995             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1996             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1997             unlink ("${General::swroot}/ovpn/serverkey.pem");
1998             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1999             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2000             &newcleanssldatabase();
2001             goto ROOTCERT_ERROR;
2002         } else {
2003             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
2004             &deletebackupcert();
2005         }
2006
2007         # Create an empty CRL
2008         # System call is safe, because all arguments are passed as array.
2009         system('/usr/bin/openssl', 'ca', '-gencrl',
2010                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
2011                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
2012         if ($?) {
2013             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2014             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2015             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2016             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2017             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
2018             &cleanssldatabase();
2019             goto ROOTCERT_ERROR;
2020 #       } else {
2021 #           &cleanssldatabase();
2022         }
2023         # Create ta.key for tls-auth
2024         # This system call is safe, because all arguments are passed as an array.
2025         system('/usr/sbin/openvpn', '--genkey', 'secret', "${General::swroot}/ovpn/certs/ta.key");
2026         if ($?) {
2027             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2028             &cleanssldatabase();
2029             goto ROOTCERT_ERROR;
2030         }
2031         # Create Diffie Hellmann Parameter
2032         # The system call is safe, because all arguments are passed as an array.
2033         system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
2034         if ($?) {
2035             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2036             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2037             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2038             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2039             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
2040             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
2041             &cleanssldatabase();
2042             goto ROOTCERT_ERROR;
2043 #       } else {
2044 #           &cleanssldatabase();
2045         }
2046         goto ROOTCERT_SUCCESS;
2047     }
2048     ROOTCERT_ERROR:
2049     if ($cgiparams{'ACTION'} ne '') {
2050         &Header::showhttpheaders();
2051         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2052         &Header::openbigbox('100%', 'LEFT', '', '');
2053         if ($errormessage) {
2054             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2055             print "<class name='base'>$errormessage";
2056             print "&nbsp;</class>";
2057             &Header::closebox();
2058         }
2059         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
2060         print <<END;
2061         <form method='post' enctype='multipart/form-data'>
2062         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
2063         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2064             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
2065             <td width='35%' colspan='2'>&nbsp;</td></tr>
2066         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2067             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
2068             <td colspan='2'>&nbsp;</td></tr>
2069         <tr><td class='base'>$Lang::tr{'your e-mail'}:</td>
2070             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
2071             <td colspan='2'>&nbsp;</td></tr>
2072         <tr><td class='base'>$Lang::tr{'your department'}:</td>
2073             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
2074             <td colspan='2'>&nbsp;</td></tr>
2075         <tr><td class='base'>$Lang::tr{'city'}:</td>
2076             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
2077             <td colspan='2'>&nbsp;</td></tr>
2078         <tr><td class='base'>$Lang::tr{'state or province'}:</td>
2079             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
2080             <td colspan='2'>&nbsp;</td></tr>
2081         <tr><td class='base'>$Lang::tr{'country'}:</td>
2082             <td class='base'><select name='ROOTCERT_COUNTRY'>
2083
2084 END
2085         ;
2086         foreach my $country (sort keys %{Countries::countries}) {
2087             print "<option value='$Countries::countries{$country}'";
2088             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
2089                 print " selected='selected'";
2090             }
2091             print ">$country</option>";
2092         }
2093         print <<END;
2094             </select></td>
2095         <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
2096                 <td class='base'><select name='DHLENGHT'>
2097                                 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2098                                 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2099                                 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2100                         </select>
2101                 </td>
2102         </tr>
2103
2104         <tr><td>&nbsp;</td>
2105             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
2106             <td>&nbsp;</td><td>&nbsp;</td></tr>
2107         <tr><td class='base' colspan='4' align='left'>
2108             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
2109         <tr><td colspan='2'><br></td></tr>
2110         <table width='100%'>
2111         <tr>
2112                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2113                 <td class='base'>$Lang::tr{'dh key warn'}</td>
2114         </tr>
2115         <tr>
2116                 <td class='base'>$Lang::tr{'dh key warn1'}</td>
2117         </tr>
2118         <tr><td colspan='2'><br></td></tr>
2119         <tr>
2120         </table>
2121
2122         <table width='100%'>
2123         <tr><td colspan='4'><hr></td></tr>
2124         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2125             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2126             <td colspan='2'>&nbsp;</td></tr>
2127         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
2128             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2129             <td colspan='2'>&nbsp;</td></tr>
2130         <tr><td>&nbsp;</td>
2131             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2132             <td colspan='2'>&nbsp;</td></tr>
2133         <tr><td class='base' colspan='4' align='left'>
2134             <img src='/blob.gif' valign='top' alt='*' >&nbsp;$Lang::tr{'required field'}</td>
2135         </tr>
2136         </form></table>
2137 END
2138         ;
2139         &Header::closebox();
2140         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2141         &Header::closebigbox();
2142         &Header::closepage();
2143         exit(0)
2144     }
2145
2146     ROOTCERT_SUCCESS:
2147     &General::system("chmod", "600", "${General::swroot}/ovpn/certs/serverkey.pem");
2148 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
2149 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2150 #       system('/usr/local/bin/ipsecctrl', 'S');
2151 #    }
2152
2153 ###
2154 ### Enable/Disable connection
2155 ###
2156
2157 ###
2158 # m.a.d net2net
2159 ###
2160
2161 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2162
2163     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2164     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2165     my $n2nactive = '';
2166     my @ps = &General::system_output("/bin/ps", "ax");
2167
2168     if(grep(/$confighash{$cgiparams{'KEY'}}[1]/, @ps)) {
2169         $n2nactive = "1";
2170     }
2171
2172     if ($confighash{$cgiparams{'KEY'}}) {
2173                 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2174                         $confighash{$cgiparams{'KEY'}}[0] = 'on';
2175                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2176
2177                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2178                                 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2179                                 &writecollectdconf();
2180                         }
2181                 } else {
2182
2183                         $confighash{$cgiparams{'KEY'}}[0] = 'off';
2184                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2185
2186                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2187                                 if ($n2nactive ne '') {
2188                                         &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2189                                         &writecollectdconf();
2190                                 }
2191                         }
2192                 }
2193   }
2194
2195 ###
2196 ### Download OpenVPN client package
2197 ###
2198
2199
2200 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2201     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2202     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2203     my $file = '';
2204     my $clientovpn = '';
2205     my @fileholder;
2206     my $tempdir = tempdir( CLEANUP => 1 );
2207     my $zippath = "$tempdir/";
2208
2209 ###
2210 # m.a.d net2net
2211 ###
2212
2213 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2214
2215         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2216         my $zippathname = "$zippath$zipname";
2217         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2218         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
2219         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
2220         my $tunmtu = '';
2221         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
2222         my $n2nfragment = '';
2223
2224     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2225     flock CLIENTCONF, 2;
2226
2227     my $zip = Archive::Zip->new();
2228    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2229    print CLIENTCONF "# \n";
2230    print CLIENTCONF "# User Security\n";
2231    print CLIENTCONF "user nobody\n";
2232    print CLIENTCONF "group nobody\n";
2233    print CLIENTCONF "persist-tun\n";
2234    print CLIENTCONF "persist-key\n";
2235    print CLIENTCONF "script-security 2\n";
2236    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2237    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2238    print CLIENTCONF "float\n";
2239    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2240    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2241    print CLIENTCONF "# Server Gateway Network\n";
2242    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2243    print CLIENTCONF "# tun Device\n";
2244    print CLIENTCONF "dev tun\n";
2245    print CLIENTCONF "#Logfile for statistics\n";
2246    print CLIENTCONF "status-version 1\n";
2247    print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
2248    print CLIENTCONF "# Port and Protokoll\n";
2249    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2250
2251    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2252    print CLIENTCONF "proto tcp4-client\n";
2253    print CLIENTCONF "# Packet size\n";
2254    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2255    print CLIENTCONF "tun-mtu $tunmtu\n";
2256    }
2257
2258    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2259    print CLIENTCONF "proto udp4\n";
2260    print CLIENTCONF "# Paketsize\n";
2261    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2262    print CLIENTCONF "tun-mtu $tunmtu\n";
2263    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2264    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} else { print CLIENTCONF "mssfix 0\n"; }
2265    }
2266    # Check host certificate if X509 is RFC3280 compliant.
2267    # If not, old --ns-cert-type directive will be used.
2268    # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2269    my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2270    if (! grep(/TLS Web Server Authentication/, @hostcert)) {
2271                print CLIENTCONF "ns-cert-type server\n";
2272    } else {
2273                print CLIENTCONF "remote-cert-tls server\n";
2274    }
2275    print CLIENTCONF "# Auth. Client\n";
2276    print CLIENTCONF "tls-client\n";
2277    print CLIENTCONF "# Cipher\n";
2278    print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2279     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2280          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2281      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2282    }
2283
2284    # If GCM cipher is used, do not use --auth
2285    if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
2286        ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
2287        ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
2288         print CLIENTCONF unless "# HMAC algorithm\n";
2289         print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2290    } else {
2291         print CLIENTCONF "# HMAC algorithm\n";
2292         print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2293    }
2294
2295    if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2296    print CLIENTCONF "# Enable Compression\n";
2297    print CLIENTCONF "comp-lzo\n";
2298      }
2299    print CLIENTCONF "# Debug Level\n";
2300    print CLIENTCONF "verb 3\n";
2301    print CLIENTCONF "# Tunnel check\n";
2302    print CLIENTCONF "keepalive 10 60\n";
2303    print CLIENTCONF "# Start as daemon\n";
2304    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2305    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2306    print CLIENTCONF "# Activate Management Interface and Port\n";
2307    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2308     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2309    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2310
2311
2312     close(CLIENTCONF);
2313
2314     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2315     my $status = $zip->writeToFileNamed($zippathname);
2316
2317     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2318     @fileholder = <DLFILE>;
2319     print "Content-Type:application/x-download\n";
2320     print "Content-Disposition:attachment;filename=$zipname\n\n";
2321     print @fileholder;
2322     exit (0);
2323 }
2324 else
2325 {
2326         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2327         my $zippathname = "$zippath$zipname";
2328         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2329
2330 ###
2331 # m.a.d net2net
2332 ###
2333
2334     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2335     flock CLIENTCONF, 2;
2336
2337     my $zip = Archive::Zip->new();
2338
2339     print CLIENTCONF "#OpenVPN Client conf\r\n";
2340     print CLIENTCONF "tls-client\r\n";
2341     print CLIENTCONF "client\r\n";
2342     print CLIENTCONF "nobind\r\n";
2343     print CLIENTCONF "dev tun\r\n";
2344     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2345     print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n";
2346
2347     if ( $vpnsettings{'ENABLED'} eq 'on'){
2348         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2349         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2350             print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Blue interface\r\n";
2351             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2352         }
2353         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2354             print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
2355             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2356         }
2357     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2358         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2359         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2360             print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
2361             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2362         }
2363     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2364         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2365     }
2366
2367     my $file_crt = new File::Temp( UNLINK => 1 );
2368     my $file_key = new File::Temp( UNLINK => 1 );
2369     my $include_certs = 0;
2370
2371     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2372         if ($cgiparams{'MODE'} eq 'insecure') {
2373                 $include_certs = 1;
2374
2375                 # Add the CA
2376                 print CLIENTCONF ";ca cacert.pem\r\n";
2377                 $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2378
2379                 # Extract the certificate
2380                 # This system call is safe, because all arguments are passed as an array.
2381                 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2382                         '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
2383                 if ($?) {
2384                         die "openssl error: $?";
2385                 }
2386
2387                 $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die;
2388                 print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n";
2389
2390                 # Extract the key
2391                 # This system call is safe, because all arguments are passed as an array.
2392                 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2393                         '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
2394                 if ($?) {
2395                         die "openssl error: $?";
2396                 }
2397
2398                 $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die;
2399                 print CLIENTCONF ";key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2400         } else {
2401                 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2402                 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2403         }
2404     } else {
2405         print CLIENTCONF "ca cacert.pem\r\n";
2406         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2407         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2408         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2409         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2410     }
2411     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2412         print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2413
2414     if ($vpnsettings{'TLSAUTH'} eq 'on') {
2415         if ($cgiparams{'MODE'} eq 'insecure') {
2416                 print CLIENTCONF ";";
2417         }
2418         print CLIENTCONF "tls-auth ta.key\r\n";
2419         $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key")  or die "Can't add file ta.key\n";
2420     }
2421     if ($vpnsettings{DCOMPLZO} eq 'on') {
2422         print CLIENTCONF "comp-lzo\r\n";
2423     }
2424     print CLIENTCONF "verb 3\r\n";
2425         # Check host certificate if X509 is RFC3280 compliant.
2426         # If not, old --ns-cert-type directive will be used.
2427         # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2428         my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2429         if (! grep(/TLS Web Server Authentication/, @hostcert)) {
2430                 print CLIENTCONF "ns-cert-type server\r\n";
2431         } else {
2432                 print CLIENTCONF "remote-cert-tls server\r\n";
2433         }
2434     print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
2435     if ($vpnsettings{MSSFIX} eq 'on') {
2436         print CLIENTCONF "mssfix\r\n";
2437     } else {
2438         print CLIENTCONF "mssfix 0\r\n";
2439     }
2440     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2441         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2442     }
2443
2444     # Disable storing any credentials in memory
2445     print CLIENTCONF "auth-nocache\r\n";
2446
2447     # Set a fake user name for authentication
2448     print CLIENTCONF "auth-token-user USER\r\n";
2449     print CLIENTCONF "auth-token TOTP\r\n";
2450
2451     # If the server is asking for TOTP this needs to happen interactively
2452     print CLIENTCONF "auth-retry interact\r\n";
2453
2454     if ($include_certs) {
2455         print CLIENTCONF "\r\n";
2456
2457         # CA
2458         open(FILE, "<${General::swroot}/ovpn/ca/cacert.pem");
2459         print CLIENTCONF "<ca>\r\n";
2460         while (<FILE>) {
2461                 chomp($_);
2462                 print CLIENTCONF "$_\r\n";
2463         }
2464         print CLIENTCONF "</ca>\r\n\r\n";
2465         close(FILE);
2466
2467         # Cert
2468         open(FILE, "<$file_crt");
2469         print CLIENTCONF "<cert>\r\n";
2470         while (<FILE>) {
2471                 chomp($_);
2472                 print CLIENTCONF "$_\r\n";
2473         }
2474         print CLIENTCONF "</cert>\r\n\r\n";
2475         close(FILE);
2476
2477         # Key
2478         open(FILE, "<$file_key");
2479         print CLIENTCONF "<key>\r\n";
2480         while (<FILE>) {
2481                 chomp($_);
2482                 print CLIENTCONF "$_\r\n";
2483         }
2484         print CLIENTCONF "</key>\r\n\r\n";
2485         close(FILE);
2486
2487         # TLS auth
2488         if ($vpnsettings{'TLSAUTH'} eq 'on') {
2489                 open(FILE, "<${General::swroot}/ovpn/certs/ta.key");
2490                 print CLIENTCONF "<tls-auth>\r\n";
2491                 while (<FILE>) {
2492                         chomp($_);
2493                         print CLIENTCONF "$_\r\n";
2494                 }
2495                 print CLIENTCONF "</tls-auth>\r\n\r\n";
2496                 close(FILE);
2497         }
2498     }
2499
2500     # Print client.conf.local if entries exist to client.ovpn
2501     if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
2502        open (LCC, "$local_clientconf");
2503                print CLIENTCONF "\n#---------------------------\n";
2504                print CLIENTCONF "# Start of custom directives\n";
2505                print CLIENTCONF "# from client.conf.local\n";
2506                print CLIENTCONF "#---------------------------\n\n";
2507        while (<LCC>) {
2508                print CLIENTCONF $_;
2509        }
2510                print CLIENTCONF "\n#---------------------------\n";
2511                print CLIENTCONF "# End of custom directives\n";
2512                print CLIENTCONF "#---------------------------\n\n";
2513        close (LCC);
2514     }
2515     close(CLIENTCONF);
2516
2517     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2518     my $status = $zip->writeToFileNamed($zippathname);
2519
2520     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2521     @fileholder = <DLFILE>;
2522     print "Content-Type:application/x-download\n";
2523     print "Content-Disposition:attachment;filename=$zipname\n\n";
2524     print @fileholder;
2525     exit (0);
2526    }
2527
2528
2529
2530 ###
2531 ### Remove connection
2532 ###
2533
2534
2535 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2536         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2537         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2538
2539         if ($confighash{$cgiparams{'KEY'}}) {
2540                 # Revoke certificate if certificate was deleted and rewrite the CRL
2541                 &General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2542                 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2543
2544 ###
2545 # m.a.d net2net
2546 ###
2547
2548                 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2549                         # Stop the N2N connection before it is removed
2550                         &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
2551
2552                         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2553                         my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2554                         unlink ($certfile);
2555                         unlink ($conffile);
2556
2557                         if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2558                                 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2559                         }
2560                 }
2561
2562                 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2563                 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2564
2565 # A.Marx CCD delete ccd files and routes
2566
2567                 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2568                 {
2569                         unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2570                 }
2571
2572                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2573                 foreach my $key (keys %ccdroutehash) {
2574                         if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2575                                 delete $ccdroutehash{$key};
2576                         }
2577                 }
2578                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2579
2580                 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2581                 foreach my $key (keys %ccdroute2hash) {
2582                         if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2583                                 delete $ccdroute2hash{$key};
2584                         }
2585                 }
2586                 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2587                 &writeserverconf;
2588
2589 # CCD end
2590                 # Update collectd configuration and delete all RRD files of the removed connection
2591                 &writecollectdconf();
2592                 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]");
2593
2594                 delete $confighash{$cgiparams{'KEY'}};
2595                 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2596                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2597
2598         } else {
2599                 $errormessage = $Lang::tr{'invalid key'};
2600         }
2601         &General::firewall_reload();
2602
2603 ###
2604 ### Download PKCS12 file
2605 ###
2606 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2607     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2608
2609     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2610     print "Content-Type: application/octet-stream\r\n\r\n";
2611
2612     open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2613     my @tmp = <FILE>;
2614     close(FILE);
2615
2616     print @tmp;
2617     exit (0);
2618
2619 ###
2620 ### Display certificate
2621 ###
2622 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2623     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2624
2625     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2626         &Header::showhttpheaders();
2627         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2628         &Header::openbigbox('100%', 'LEFT', '', '');
2629         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2630         my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2631         my $output = &Header::cleanhtml(join("", @output), "y");
2632         print "<pre>$output</pre>\n";
2633         &Header::closebox();
2634         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2635         &Header::closebigbox();
2636         &Header::closepage();
2637         exit(0);
2638     }
2639
2640 ###
2641 ### Display OTP QRCode
2642 ###
2643 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show otp qrcode'}) {
2644    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2645
2646    my $qrcode = Imager::QRCode->new(
2647       size          => 6,
2648       margin        => 0,
2649       version       => 0,
2650       level         => 'M',
2651       mode          => '8-bit',
2652       casesensitive => 1,
2653       lightcolor    => Imager::Color->new(255, 255, 255),
2654       darkcolor     => Imager::Color->new(0, 0, 0),
2655    );
2656    my $cn = uri_encode($confighash{$cgiparams{'KEY'}}[2]);
2657    my $secret = encode_base32(pack('H*', $confighash{$cgiparams{'KEY'}}[44]));
2658    my $issuer = uri_encode("$mainsettings{'HOSTNAME'}.$mainsettings{'DOMAINNAME'}");
2659    my $qrcodeimg = $qrcode->plot("otpauth://totp/$cn?secret=$secret&issuer=$issuer");
2660    my $qrcodeimgdata;
2661    $qrcodeimg->write(data => \$qrcodeimgdata, type=> 'png')
2662       or die $qrcodeimg->errstr;
2663    $qrcodeimgdata = encode_base64($qrcodeimgdata, '');
2664
2665    &Header::showhttpheaders();
2666    &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2667    &Header::openbigbox('100%', 'LEFT', '', '');
2668    &Header::openbox('100%', 'LEFT', "$Lang::tr{'otp qrcode'}:");
2669    print <<END;
2670 $Lang::tr{'secret'}:&nbsp;$secret</br></br>
2671 <img alt="$Lang::tr{'otp qrcode'}" src="data:image/png;base64,$qrcodeimgdata">
2672 END
2673    &Header::closebox();
2674    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2675    &Header::closebigbox();
2676    &Header::closepage();
2677    exit(0);
2678
2679 ###
2680 ### Display Diffie-Hellman key
2681 ###
2682 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2683
2684     if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
2685         $errormessage = $Lang::tr{'not present'};
2686         } else {
2687                 &Header::showhttpheaders();
2688                 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2689                 &Header::openbigbox('100%', 'LEFT', '', '');
2690                 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2691                 my @output = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
2692                 my $output = &Header::cleanhtml(join("", @output) ,"y");
2693                 print "<pre>$output</pre>\n";
2694                 &Header::closebox();
2695                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2696                 &Header::closebigbox();
2697                 &Header::closepage();
2698                 exit(0);
2699     }
2700
2701 ###
2702 ### Display tls-auth key
2703 ###
2704 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2705
2706     if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2707         $errormessage = $Lang::tr{'not present'};
2708         } else {
2709                 &Header::showhttpheaders();
2710                 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2711                 &Header::openbigbox('100%', 'LEFT', '', '');
2712                 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2713
2714                 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
2715                 my @output = <FILE>;
2716                 close(FILE);
2717
2718                 my $output = &Header::cleanhtml(join("", @output),"y");
2719                 print "<pre>$output</pre>\n";
2720                 &Header::closebox();
2721                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2722                 &Header::closebigbox();
2723                 &Header::closepage();
2724                 exit(0);
2725     }
2726
2727 ###
2728 ### Display Certificate Revoke List
2729 ###
2730 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2731 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2732
2733     if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2734         $errormessage = $Lang::tr{'not present'};
2735         } else {
2736         &Header::showhttpheaders();
2737         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2738         &Header::openbigbox('100%', 'LEFT', '', '');
2739         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2740         my @output = &General::system_output("/usr/bin/openssl", "crl", "-text", "-noout", "-in", "${General::swroot}/ovpn/crls/cacrl.pem");
2741         my $output = &Header::cleanhtml(join("", @output), "y");
2742         print "<pre>$output</pre>\n";
2743         &Header::closebox();
2744         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2745         &Header::closebigbox();
2746         &Header::closepage();
2747         exit(0);
2748     }
2749
2750 ###
2751 ### Advanced Server Settings
2752 ###
2753
2754 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2755     %cgiparams = ();
2756     %cahash = ();
2757     %confighash = ();
2758     my $disabled;
2759     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2760     read_routepushfile;
2761
2762
2763 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2764 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
2765 #    }
2766 ADV_ERROR:
2767     if ($cgiparams{'MAX_CLIENTS'} eq '') {
2768                 $cgiparams{'MAX_CLIENTS'} =  '100';
2769     }
2770     if ($cgiparams{'KEEPALIVE_1'} eq '') {
2771                 $cgiparams{'KEEPALIVE_1'} =  '10';
2772     }
2773     if ($cgiparams{'KEEPALIVE_2'} eq '') {
2774                 $cgiparams{'KEEPALIVE_2'} =  '60';
2775     }
2776     if ($cgiparams{'LOG_VERB'} eq '') {
2777                 $cgiparams{'LOG_VERB'} =  '3';
2778     }
2779     if ($cgiparams{'TLSAUTH'} eq '') {
2780                 $cgiparams{'TLSAUTH'} = 'off';
2781     }
2782     $checked{'CLIENT2CLIENT'}{'off'} = '';
2783     $checked{'CLIENT2CLIENT'}{'on'} = '';
2784     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2785     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2786     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2787     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2788     $checked{'DCOMPLZO'}{'off'} = '';
2789     $checked{'DCOMPLZO'}{'on'} = '';
2790     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
2791     $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
2792     $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
2793     $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
2794     $checked{'MSSFIX'}{'off'} = '';
2795     $checked{'MSSFIX'}{'on'} = '';
2796     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2797     $selected{'LOG_VERB'}{'0'} = '';
2798     $selected{'LOG_VERB'}{'1'} = '';
2799     $selected{'LOG_VERB'}{'2'} = '';
2800     $selected{'LOG_VERB'}{'3'} = '';
2801     $selected{'LOG_VERB'}{'4'} = '';
2802     $selected{'LOG_VERB'}{'5'} = '';
2803     $selected{'LOG_VERB'}{'6'} = '';
2804     $selected{'LOG_VERB'}{'7'} = '';
2805     $selected{'LOG_VERB'}{'8'} = '';
2806     $selected{'LOG_VERB'}{'9'} = '';
2807     $selected{'LOG_VERB'}{'10'} = '';
2808     $selected{'LOG_VERB'}{'11'} = '';
2809     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2810
2811     &Header::showhttpheaders();
2812     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2813     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2814     if ($errormessage) {
2815         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2816         print "<class name='base'>$errormessage\n";
2817         print "&nbsp;</class>\n";
2818         &Header::closebox();
2819     }
2820     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2821     print <<END;
2822     <form method='post' enctype='multipart/form-data'>
2823 <table width='100%' border=0>
2824         <tr>
2825                 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2826     </tr>
2827     <tr>
2828                 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2829     </tr>
2830     <tr>
2831                 <td class='base'>Domain</td>
2832         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30'  /></td>
2833     </tr>
2834     <tr>
2835                 <td class='base'>DNS</td>
2836                 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2837     </tr>
2838     <tr>
2839                 <td class='base'>WINS</td>
2840                 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2841         </tr>
2842     <tr>
2843                 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2844     </tr>
2845     <tr>
2846                 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2847                 <td colspan='2'>
2848                 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2849 END
2850 ;
2851
2852 if ($cgiparams{'ROUTES_PUSH'} ne '')
2853 {
2854         print $cgiparams{'ROUTES_PUSH'};
2855 }
2856
2857 print <<END;
2858 </textarea></td>
2859 </tr>
2860     </tr>
2861 </table>
2862 <hr size='1'>
2863 <table width='100%'>
2864         <tr>
2865                 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2866         </tr>
2867
2868         <tr>
2869                 <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td>
2870         </tr>
2871
2872         <tr>
2873                 <td class='base'>Client-To-Client</td>
2874                 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2875         </tr>
2876
2877         <tr>
2878                 <td class='base'>Redirect-Gateway def1</td>
2879                 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2880         </tr>
2881
2882     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
2883         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
2884         <td>$Lang::tr{'openvpn default'}: off <font color='red'>($Lang::tr{'attention'} exploitable via Voracle)</font></td>
2885     </tr>
2886
2887         <tr>
2888                 <td class='base'>$Lang::tr{'ovpn add conf'}</td>
2889                 <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
2890                 <td>$Lang::tr{'openvpn default'}: off</td>
2891         </tr>
2892
2893         <tr>
2894                 <td class='base'>mssfix</td>
2895                 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2896                 <td>$Lang::tr{'openvpn default'}: off</td>
2897         </tr>
2898
2899         <tr>
2900                 <td class='base'>fragment <br></td>
2901                 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2902         </tr>
2903
2904
2905         <tr>
2906                 <td class='base'>Max-Clients</td>
2907                 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2908         </tr>
2909         <tr>
2910                 <td class='base'>Keepalive <br />
2911                 (ping/ping-restart)</td>
2912                 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2913                 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2914         </tr>
2915 </table>
2916
2917 <hr size='1'>
2918 <table width='100%'>
2919     <tr>
2920         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2921     </tr>
2922     <tr>
2923         <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
2924     </tr>
2925
2926     <tr><td class='base'>VERB</td>
2927         <td><select name='LOG_VERB'>
2928                         <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option>
2929                         <option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2930                         <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2931                         <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2932                         <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2933                         <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2934                         <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2935                         <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2936                         <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2937                         <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2938                         <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2939                         <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2940         </td></select>
2941     </table>
2942
2943 <hr size='1'>
2944 END
2945
2946 if ( -e "/var/run/openvpn.pid"){
2947 print"  <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2948                 $Lang::tr{'server restart'}<br><br>
2949                 <hr>";
2950         print<<END;
2951 <table width='100%'>
2952 <tr>
2953     <td>&nbsp;</td>
2954     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2955     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2956     <td>&nbsp;</td>
2957 </tr>
2958 </table>
2959 </form>
2960 END
2961 ;
2962
2963
2964 }else{
2965
2966         print<<END;
2967 <table width='100%'>
2968 <tr>
2969     <td>&nbsp;</td>
2970     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2971     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2972     <td>&nbsp;</td>
2973 </tr>
2974 </table>
2975 </form>
2976 END
2977 ;
2978 }
2979     &Header::closebox();
2980 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2981     &Header::closebigbox();
2982     &Header::closepage();
2983     exit(0);
2984
2985
2986 # A.Marx CCD   Add,delete or edit CCD net
2987
2988 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2989                 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2990                 $cgiparams{'ACTION'} eq "kill" ||
2991                 $cgiparams{'ACTION'} eq "edit" ||
2992                 $cgiparams{'ACTION'} eq 'editsave'){
2993         &Header::showhttpheaders();
2994         &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2995         &Header::openbigbox('100%', 'LEFT', '', '');
2996
2997         if ($cgiparams{'ACTION'} eq "kill"){
2998                 &delccdnet($cgiparams{'net'});
2999         }
3000
3001         if ($cgiparams{'ACTION'} eq 'editsave'){
3002                 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
3003                 if ( $a ne $b){ &modccdnet($a,$b);}
3004                 $cgiparams{'ccdname'}='';
3005                 $cgiparams{'ccdsubnet'}='';
3006         }
3007
3008         if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
3009                 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
3010         }
3011         if ($errormessage) {
3012             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3013             print "<class name='base'>$errormessage";
3014             print "&nbsp;</class>";
3015             &Header::closebox();
3016         }
3017 if ($cgiparams{'ACTION'} eq "edit"){
3018
3019         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
3020
3021         print <<END;
3022     <table width='100%' border='0'>
3023     <tr><form method='post'>
3024         <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
3025         <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly='readonly' /></td></tr>
3026         <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
3027         <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
3028         </td></tr>
3029         </table></form>
3030 END
3031 ;
3032         &Header::closebox();
3033
3034         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
3035         print <<END;
3036     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
3037     <tr>
3038         <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
3039 END
3040 ;
3041 }
3042 else{
3043         if (! -e "/var/run/openvpn.pid"){
3044         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
3045         print <<END;
3046             <table width='100%' border='0'>
3047             <tr><form method='post'>
3048                 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
3049                 <tr>
3050                 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
3051                 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
3052                 <tr><td colspan=4><hr /></td></tr><tr>
3053                 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
3054                 </table></form>
3055 END
3056
3057         &Header::closebox();
3058 }
3059         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
3060         if ( -e "/var/run/openvpn.pid"){
3061                 print "<b>$Lang::tr{'attention'}:</b><br>";
3062                 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
3063         }
3064
3065     print <<END;
3066     <table width='100%' cellpadding='0' cellspacing='1'>
3067     <tr>
3068         <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
3069 END
3070 ;
3071 }
3072         my %ccdconfhash=();
3073         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
3074         my @ccdconf=();
3075         my $count=0;
3076         foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
3077                 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
3078                 $count++;
3079                 my $ccdhosts = &hostsinnet($ccdconf[0]);
3080                 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
3081                 else{            print" <tr bgcolor='$color{'color20'}'>";}
3082                 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
3083         print <<END;
3084                 <form method='post' />
3085                 <input type='image' src='/images/edit.gif' align='middle' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
3086                 <input type='hidden' name='ACTION' value='edit'/>
3087                 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
3088                 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
3089                 </form></td>
3090                 <form method='post' />
3091                 <td><input type='hidden' name='ACTION' value='kill'/>
3092                 <input type='hidden' name='number' value='$count' />
3093                 <input type='hidden' name='net' value='$ccdconf[0]' />
3094                 <input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /></form></td></tr>
3095 END
3096 ;
3097         }
3098         print "</table></form>";
3099         &Header::closebox();
3100         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3101         &Header::closebigbox();
3102         &Header::closepage();
3103         exit(0);
3104
3105 #END CCD
3106
3107 ###
3108 ### Openvpn Connections Statistics
3109 ###
3110 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
3111         &Header::showhttpheaders();
3112         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
3113         &Header::openbigbox('100%', 'LEFT', '', '');
3114     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
3115
3116 #
3117 #       <td><b>$Lang::tr{'protocol'}</b></td>
3118 # protocol temp removed
3119     print <<END;
3120     <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
3121     <tr>
3122         <th><b>$Lang::tr{'common name'}</b></th>
3123         <th><b>$Lang::tr{'real address'}</b></th>
3124         <th><b>$Lang::tr{'country'}</b></th>
3125         <th><b>$Lang::tr{'virtual address'}</b></th>
3126         <th><b>$Lang::tr{'loged in at'}</b></th>
3127         <th><b>$Lang::tr{'bytes sent'}</b></th>
3128         <th><b>$Lang::tr{'bytes received'}</b></th>
3129         <th><b>$Lang::tr{'last activity'}</b></th>
3130     </tr>
3131 END
3132 ;
3133         my $filename = "/var/run/ovpnserver.log";
3134         open(FILE, $filename) or die 'Unable to open config file.';
3135         my @current = <FILE>;
3136         close(FILE);
3137         my @users =();
3138         my $status;
3139         my $uid = 0;
3140         my $cn;
3141         my @match = ();
3142         my $proto = "udp";
3143         my $address;
3144         my %userlookup = ();
3145         foreach my $line (@current)
3146         {
3147             chomp($line);
3148             if ( $line =~ /^Updated,(.+)/){
3149                 @match = split( /^Updated,(.+)/, $line);
3150                 $status = $match[1];
3151             }
3152 #gian
3153             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3154                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3155                 if ($match[1] ne "Common Name") {
3156                     $cn = $match[1];
3157                     $userlookup{$match[2]} = $uid;
3158                     $users[$uid]{'CommonName'} = $match[1];
3159                     $users[$uid]{'RealAddress'} = $match[2];
3160                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
3161                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
3162                     $users[$uid]{'Since'} = $match[5];
3163                     $users[$uid]{'Proto'} = $proto;
3164
3165                     # get country code for "RealAddress"...
3166                     my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]);
3167                     my $flag_icon = &Location::Functions::get_flag_icon($ccode);
3168                     $users[$uid]{'Country'} = "<a href='country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a>";
3169                     $uid++;
3170                 }
3171             }
3172             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
3173                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
3174                 if ($match[1] ne "Virtual Address") {
3175                     $address = $match[3];
3176                     #find the uid in the lookup table
3177                     $uid = $userlookup{$address};
3178                     $users[$uid]{'VirtualAddress'} = $match[1];
3179                     $users[$uid]{'LastRef'} = $match[4];
3180                 }
3181             }
3182         }
3183         my $user2 = @users;
3184         if ($user2 >= 1){
3185                 for (my $idx = 1; $idx <= $user2; $idx++){
3186                                                 if ($idx % 2) {
3187                                                         print "<tr>";
3188                                                         $col="bgcolor='$color{'color22'}'";
3189                                                 } else {
3190                                                         print "<tr>";
3191                                                         $col="bgcolor='$color{'color20'}'";
3192                                                 }
3193                                                 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
3194                                                 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
3195                                                 print "<td align='center' $col>$users[$idx-1]{'Country'}</td>";
3196                                                 print "<td align='center' $col>$users[$idx-1]{'VirtualAddress'}</td>";
3197                                                 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
3198                                                 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
3199                                                 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
3200                                                 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
3201                         }
3202         }
3203
3204         print "</table>";
3205         print <<END;
3206         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
3207         <tr><td></td></tr>
3208         <tr><td></td></tr>
3209         <tr><td></td></tr>
3210         <tr><td></td></tr>
3211         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
3212         </table>
3213 END
3214 ;
3215         &Header::closebox();
3216         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3217         &Header::closebigbox();
3218         &Header::closepage();
3219         exit(0);
3220
3221 ###
3222 ### Download Certificate
3223 ###
3224 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
3225     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3226
3227     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
3228         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
3229         print "Content-Type: application/octet-stream\r\n\r\n";
3230
3231         open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3232         my @tmp = <FILE>;
3233         close(FILE);
3234
3235         print @tmp;
3236         exit (0);
3237     }
3238
3239 ###
3240 ### Enable/Disable connection
3241 ###
3242
3243 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
3244
3245     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3246     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3247
3248     if ($confighash{$cgiparams{'KEY'}}) {
3249            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
3250             $confighash{$cgiparams{'KEY'}}[0] = 'on';
3251             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3252             #&writeserverconf();
3253 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
3254 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3255 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3256 #           }
3257         } else {
3258             $confighash{$cgiparams{'KEY'}}[0] = 'off';
3259 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
3260 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3261 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3262 #           }
3263             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3264             #&writeserverconf();
3265         }
3266     } else {
3267         $errormessage = $Lang::tr{'invalid key'};
3268     }
3269
3270 ###
3271 ### Restart connection
3272 ###
3273 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3274     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3275     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3276
3277     if ($confighash{$cgiparams{'KEY'}}) {
3278 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
3279 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3280 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3281 #       }
3282     } else {
3283         $errormessage = $Lang::tr{'invalid key'};
3284     }
3285
3286 ###
3287 # m.a.d net2net
3288 ###
3289
3290 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3291         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3292         &Header::showhttpheaders();
3293         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
3294         &Header::openbigbox('100%', 'LEFT', '', '');
3295         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
3296
3297 if ( -s "${General::swroot}/ovpn/settings") {
3298
3299         print <<END;
3300             <b>$Lang::tr{'connection type'}:</b><br />
3301             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
3302             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3303                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3304             <tr><td><input type='radio' name='TYPE' value='net' /></td>
3305                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3306                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
3307                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3308           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
3309           <tr><td>&nbsp;</td><td>Import Connection Name</td></tr>
3310     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>$Lang::tr{'openvpn default'}: Client Packagename</td></tr>
3311           <tr><td colspan='3'><hr /></td></tr>
3312     <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
3313             </form></table>
3314 END
3315         ;
3316
3317
3318 } else {
3319         print <<END;
3320                     <b>$Lang::tr{'connection type'}:</b><br />
3321             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
3322             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3323             <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
3324             </form></table>
3325 END
3326         ;
3327
3328 }
3329
3330         &Header::closebox();
3331         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3332         &Header::closebigbox();
3333         &Header::closepage();
3334         exit (0);
3335
3336 ###
3337 # m.a.d net2net
3338 ###
3339
3340 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3341
3342         my @firen2nconf;
3343         my @confdetails;
3344         my $uplconffilename ='';
3345         my $uplconffilename2 ='';
3346         my $uplp12name = '';
3347         my $uplp12name2 = '';
3348         my @rem_subnet;
3349         my @rem_subnet2;
3350         my @tmposupnet3;
3351         my $key;
3352         my @n2nname;
3353
3354         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3355
3356         # Check if a file is uploaded
3357         unless (ref ($cgiparams{'FH'})) {
3358                 $errormessage = $Lang::tr{'there was no file upload'};
3359                 goto N2N_ERROR;
3360     }
3361
3362 # Move uploaded IPfire n2n package to temporary file
3363
3364     (my $fh, my $filename) = tempfile( );
3365     if (copy ($cgiparams{'FH'}, $fh) != 1) {
3366                 $errormessage = $!;
3367                 goto N2N_ERROR;
3368     }
3369
3370         my $zip = Archive::Zip->new();
3371         my $zipName = $filename;
3372         my $status = $zip->read( $zipName );
3373         if ($status != AZ_OK) {
3374                 $errormessage = "Read of $zipName failed\n";
3375                 goto N2N_ERROR;
3376         }
3377
3378         my $tempdir = tempdir( CLEANUP => 1 );
3379         my @files = $zip->memberNames();
3380         for(@files) {
3381         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3382         }
3383         my $countfiles = @files;
3384
3385 # Check if we have not more then 2 files
3386
3387         if ( $countfiles == 2){
3388                 foreach (@files){
3389                         if ( $_ =~ /.conf$/){
3390                                 $uplconffilename = $_;
3391                         }
3392                         if ( $_ =~ /.p12$/){
3393                                 $uplp12name = $_;
3394                         }
3395                 }
3396                 if (($uplconffilename eq '') || ($uplp12name eq '')){
3397                         $errormessage = "Either no *.conf or no *.p12 file found\n";
3398                         goto N2N_ERROR;
3399                 }
3400
3401                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3402                 @firen2nconf = <FILE>;
3403                 close (FILE);
3404                 chomp(@firen2nconf);
3405         } else {
3406
3407                 $errormessage = "Filecount does not match only 2 files are allowed\n";
3408                 goto N2N_ERROR;
3409         }
3410
3411 ###
3412 # m.a.d net2net
3413 ###
3414
3415  if ($cgiparams{'n2nname'} ne ''){
3416
3417   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3418   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
3419   $n2nname[0] = $cgiparams{'n2nname'};
3420   my @n2nname2 = split(/\./,$uplconffilename);
3421   $n2nname2[0] =~ s/\n|\r//g;
3422   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3423         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3424         my $input2 = "$n2nname2[0]n2n";
3425   my $output2 = "$n2nname[0]n2n";
3426   my $filename = "$tempdir/$uplconffilename";
3427   open(FILE, "< $filename") or die 'Unable to open config file.';
3428         my @current = <FILE>;
3429         close(FILE);
3430         foreach (@current) {s/$input1/$output1/g;}
3431         foreach (@current) {s/$input2/$output2/g;}
3432   open (OUT, "> $filename") || die 'Unable to open config file.';
3433   print OUT @current;
3434   close OUT;
3435
3436     }else{
3437     $uplconffilename2 =  $uplconffilename;
3438     $uplp12name2 = $uplp12name;
3439     @n2nname = split(/\./,$uplconffilename);
3440     $n2nname[0] =~ s/\n|\r//g;
3441    }
3442     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3443     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
3444
3445         #Add collectd settings to configfile
3446         open(FILE, ">> $tempdir/$uplconffilename") or die 'Unable to open config file.';
3447         print FILE "# Logfile\n";
3448         print FILE "status-version 1\n";
3449         print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
3450         close FILE;
3451
3452         unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2")) {
3453             $errormessage = "*.conf move failed: $!";
3454             unlink ($filename);
3455             goto N2N_ERROR;
3456         }
3457
3458         unless(move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2")) {
3459             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3460             unlink ($filename);
3461             goto N2N_ERROR;
3462         }
3463
3464         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3465
3466 my $complzoactive;
3467 my $mssfixactive;
3468 my $authactive;
3469 my $n2nfragment;
3470 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
3471 my @n2nproto = split(/-/, $n2nproto2[1]);
3472 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3473 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3474 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3475 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
3476 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
3477 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
3478 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
3479 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
3480 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3481 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3482 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
3483 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
3484 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
3485 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3486 my @n2ncipher = split(/ /, (grep { /^cipher/ } @firen2nconf)[0]);
3487 my @n2nauth = split(/ /, (grep { /^auth/ } @firen2nconf)[0]);;
3488
3489 ###
3490 # m.a.d delete CR and LF from arrays for this chomp doesnt work
3491 ###
3492
3493 $n2nremote[1] =~ s/\n|\r//g;
3494 $n2novpnsub[0] =~ s/\n|\r//g;
3495 $n2novpnsub[1] =~ s/\n|\r//g;
3496 $n2novpnsub[2] =~ s/\n|\r//g;
3497 $n2nproto[0] =~ s/\n|\r//g;
3498 $n2nport[1] =~ s/\n|\r//g;
3499 $n2ntunmtu[1] =~ s/\n|\r//g;
3500 $n2nremsub[1] =~ s/\n|\r//g;
3501 $n2nremsub[2] =~ s/\n|\r//g;
3502 $n2nlocalsub[2] =~ s/\n|\r//g;
3503 $n2nfragment[1] =~ s/\n|\r//g;
3504 $n2nmgmt[2] =~ s/\n|\r//g;
3505 $n2ncipher[1] =~ s/\n|\r//g;
3506 $n2nauth[1] =~ s/\n|\r//g;
3507 chomp ($complzoactive);
3508 chomp ($mssfixactive);
3509
3510 ###
3511 # m.a.d net2net
3512 ###
3513
3514 ###
3515 # Check if there is no other entry with this name
3516 ###
3517
3518         foreach my $dkey (keys %confighash) {
3519                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3520                         $errormessage = $Lang::tr{'a connection with this name already exists'};
3521                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3522             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3523       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3524                         goto N2N_ERROR;
3525                 }
3526         }
3527
3528 ###
3529 # Check if OpenVPN Subnet is valid
3530 ###
3531
3532 foreach my $dkey (keys %confighash) {
3533                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3534                         $errormessage = 'The OpenVPN Subnet is already in use';
3535                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3536             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3537       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3538                         goto N2N_ERROR;
3539                 }
3540         }
3541
3542 ###
3543 # Check if Dest Port is vaild
3544 ###
3545
3546 foreach my $dkey (keys %confighash) {
3547                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3548                         $errormessage = 'The OpenVPN Port is already in use';
3549                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3550             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3551       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3552                         goto N2N_ERROR;
3553                 }
3554         }
3555
3556
3557
3558   $key = &General::findhasharraykey (\%confighash);
3559
3560         foreach my $i (0 .. 42) { $confighash{$key}[$i] = "";}
3561
3562         $confighash{$key}[0] = 'off';
3563         $confighash{$key}[1] = $n2nname[0];
3564         $confighash{$key}[2] = $n2nname[0];
3565         $confighash{$key}[3] = 'net';
3566         $confighash{$key}[4] = 'cert';
3567         $confighash{$key}[6] = 'client';
3568         $confighash{$key}[8] =  $n2nlocalsub[2];
3569         $confighash{$key}[10] = $n2nremote[1];
3570         $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3571         $confighash{$key}[22] = $n2nmgmt[2];
3572         $confighash{$key}[23] = $mssfixactive;
3573         $confighash{$key}[24] = $n2nfragment[1];
3574         $confighash{$key}[25] = 'IPFire n2n Client';
3575         $confighash{$key}[26] = 'red';
3576         $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3577         $confighash{$key}[28] = $n2nproto[0];
3578         $confighash{$key}[29] = $n2nport[1];
3579         $confighash{$key}[30] = $complzoactive;
3580         $confighash{$key}[31] = $n2ntunmtu[1];
3581         $confighash{$key}[39] = $n2nauth[1];
3582         $confighash{$key}[40] = $n2ncipher[1];
3583         $confighash{$key}[41] = 'disabled';
3584
3585   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3586
3587   N2N_ERROR:
3588
3589         &Header::showhttpheaders();
3590         &Header::openpage('Validate imported configuration', 1, '');
3591         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3592         if ($errormessage) {
3593             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3594             print "<class name='base'>$errormessage";
3595             print "&nbsp;</class>";
3596             &Header::closebox();
3597
3598         } else
3599   {
3600                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3601         }
3602         if ($errormessage eq ''){
3603         print <<END;
3604                 <!-- ipfire net2net config gui -->
3605                 <table width='100%'>
3606                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3607     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3608     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3609                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3610                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3611                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3612                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}:</td><td><b>$confighash{$key}[11]</b></td></tr>
3613                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3614                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3615                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3616                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3617                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td><b>$confighash{$key}[23]</b></td></tr>
3618                 <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td><b>$confighash{$key}[24]</b></td></tr>
3619                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3620                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3621                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn tls auth'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
3622                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td><b>$confighash{$key}[40]</b></td></tr>
3623                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3624     </table>
3625 END
3626 ;
3627                 &Header::closebox();
3628         }
3629
3630         if ($errormessage) {
3631                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3632         } else {
3633                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3634                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3635                 print "<input type='hidden' name='KEY' value='$key' />";
3636                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3637         }
3638         &Header::closebigbox();
3639         &Header::closepage();
3640         exit(0);
3641
3642
3643 ##
3644 ### Accept IPFire n2n Package Settings
3645 ###
3646
3647   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3648
3649 ###
3650 ### Discard and Rollback IPFire n2n Package Settings
3651 ###
3652
3653   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3654
3655      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3656
3657 if ($confighash{$cgiparams{'KEY'}}) {
3658
3659      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3660      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3661      unlink ($certfile) or die "Removing $certfile fail: $!";
3662      unlink ($conffile) or die "Removing $conffile fail: $!";
3663      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3664      delete $confighash{$cgiparams{'KEY'}};
3665     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3666
3667      } else {
3668                 $errormessage = $Lang::tr{'invalid key'};
3669    }
3670
3671
3672 ###
3673 # m.a.d net2net
3674 ###
3675
3676
3677 ###
3678 ### Adding a new connection
3679 ###
3680 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3681          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3682          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3683
3684     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3685     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3686     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3687
3688     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3689                 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3690                     $errormessage = $Lang::tr{'invalid key'};
3691                     goto VPNCONF_END;
3692                 }
3693                 $cgiparams{'ENABLED'}           = $confighash{$cgiparams{'KEY'}}[0];
3694                 $cgiparams{'NAME'}              = $confighash{$cgiparams{'KEY'}}[1];
3695                 $cgiparams{'TYPE'}              = $confighash{$cgiparams{'KEY'}}[3];
3696                 $cgiparams{'AUTH'}              = $confighash{$cgiparams{'KEY'}}[4];
3697                 $cgiparams{'PSK'}               = $confighash{$cgiparams{'KEY'}}[5];
3698                 $cgiparams{'SIDE'}              = $confighash{$cgiparams{'KEY'}}[6];
3699                 $cgiparams{'LOCAL_SUBNET'}      = $confighash{$cgiparams{'KEY'}}[8];
3700                 $cgiparams{'REMOTE'}            = $confighash{$cgiparams{'KEY'}}[10];
3701                 $cgiparams{'REMOTE_SUBNET'}     = $confighash{$cgiparams{'KEY'}}[11];
3702                 $cgiparams{'OVPN_MGMT'}         = $confighash{$cgiparams{'KEY'}}[22];
3703                 $cgiparams{'MSSFIX'}            = $confighash{$cgiparams{'KEY'}}[23];
3704                 $cgiparams{'FRAGMENT'}          = $confighash{$cgiparams{'KEY'}}[24];
3705                 $cgiparams{'REMARK'}            = $confighash{$cgiparams{'KEY'}}[25];
3706                 $cgiparams{'INTERFACE'}         = $confighash{$cgiparams{'KEY'}}[26];
3707                 $cgiparams{'OVPN_SUBNET'}       = $confighash{$cgiparams{'KEY'}}[27];
3708                 $cgiparams{'PROTOCOL'}          = $confighash{$cgiparams{'KEY'}}[28];
3709                 $cgiparams{'DEST_PORT'}         = $confighash{$cgiparams{'KEY'}}[29];
3710                 $cgiparams{'COMPLZO'}           = $confighash{$cgiparams{'KEY'}}[30];
3711                 $cgiparams{'MTU'}               = $confighash{$cgiparams{'KEY'}}[31];
3712                 $cgiparams{'CHECK1'}            = $confighash{$cgiparams{'KEY'}}[32];
3713                 $name=$cgiparams{'CHECK1'}      ;
3714                 $cgiparams{$name}               = $confighash{$cgiparams{'KEY'}}[33];
3715                 $cgiparams{'RG'}                = $confighash{$cgiparams{'KEY'}}[34];
3716                 $cgiparams{'CCD_DNS1'}          = $confighash{$cgiparams{'KEY'}}[35];
3717                 $cgiparams{'CCD_DNS2'}          = $confighash{$cgiparams{'KEY'}}[36];
3718                 $cgiparams{'CCD_WINS'}          = $confighash{$cgiparams{'KEY'}}[37];
3719                 $cgiparams{'DAUTH'}             = $confighash{$cgiparams{'KEY'}}[39];
3720                 $cgiparams{'DCIPHER'}           = $confighash{$cgiparams{'KEY'}}[40];
3721                 $cgiparams{'TLSAUTH'}           = $confighash{$cgiparams{'KEY'}}[41];
3722                 $cgiparams{'OTP_STATE'}         = $confighash{$cgiparams{'KEY'}}[43];
3723         } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3724         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3725
3726 #A.Marx CCD check iroute field and convert it to decimal
3727 if ($cgiparams{'TYPE'} eq 'host') {
3728         my @temp=();
3729         my %ccdroutehash=();
3730         my $keypoint=0;
3731         my $ip;
3732         my $cidr;
3733         if ($cgiparams{'IR'} ne ''){
3734                 @temp = split("\n",$cgiparams{'IR'});
3735                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3736                 #find key to use
3737                 foreach my $key (keys %ccdroutehash) {
3738                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3739                                 $keypoint=$key;
3740                                 delete $ccdroutehash{$key};
3741                         }else{
3742                                 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3743                         }
3744                 }
3745                 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3746                 my $i=1;
3747                 my $val=0;
3748                 foreach $val (@temp){
3749                         chomp($val);
3750                         $val=~s/\s*$//g;
3751                         #check if iroute exists in ccdroute or if new iroute is part of an existing one
3752                         foreach my $key (keys %ccdroutehash) {
3753                                 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3754                                                 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3755                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3756                                                         goto VPNCONF_ERROR;
3757                                                 }
3758                                                 my ($ip1,$cidr1) = split (/\//, $val);
3759                                                 $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1));
3760                                                 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3761                                                 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3762                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3763                                                         goto VPNCONF_ERROR;
3764                                                 }
3765
3766                                 }
3767                         }
3768                         if (!&General::validipandmask($val)){
3769                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3770                                 goto VPNCONF_ERROR;
3771                         }else{
3772                                 ($ip,$cidr) = split(/\//,$val);
3773                                 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3774                                 $cidr=&General::iporsubtodec($cidr);
3775                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3776
3777                         }
3778
3779                         #check for existing network IP's
3780                         if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3781                         {
3782                                 $errormessage=$Lang::tr{'ccd err green'};
3783                                 goto VPNCONF_ERROR;
3784                         }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3785                         {
3786                                 $errormessage=$Lang::tr{'ccd err red'};
3787                                 goto VPNCONF_ERROR;
3788                         }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3789                         {
3790                                 $errormessage=$Lang::tr{'ccd err blue'};
3791                                 goto VPNCONF_ERROR;
3792                         }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3793                         {
3794                                 $errormessage=$Lang::tr{'ccd err orange'};
3795                                 goto VPNCONF_ERROR;
3796                         }
3797
3798                         if (&General::validipandmask($val)){
3799                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3800                         }else{
3801                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3802                                 goto VPNCONF_ERROR;
3803                         }
3804                         $i++;
3805                 }
3806                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3807                 &writeserverconf;
3808         }else{
3809                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3810                 foreach my $key (keys %ccdroutehash) {
3811                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3812                                 delete $ccdroutehash{$key};
3813                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3814                                 &writeserverconf;
3815                         }
3816                 }
3817         }
3818         undef @temp;
3819         #check route field and convert it to decimal
3820         my $val=0;
3821         my $i=1;
3822         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3823         #find key to use
3824         foreach my $key (keys %ccdroute2hash) {
3825                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3826                         $keypoint=$key;
3827                         delete $ccdroute2hash{$key};
3828                 }else{
3829                         $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3830                         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3831                         &writeserverconf;
3832                 }
3833         }
3834         $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3835         if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3836         @temp = split(/\|/,$cgiparams{'IFROUTE'});
3837         my %ownnet=();
3838         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3839         foreach $val (@temp){
3840                 chomp($val);
3841                 $val=~s/\s*$//g;
3842                 if ($val eq $Lang::tr{'green'})
3843                 {
3844                         $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3845                 }
3846                 if ($val eq $Lang::tr{'blue'})
3847                 {
3848                         $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3849                 }
3850                 if ($val eq $Lang::tr{'orange'})
3851                 {
3852                         $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3853                 }
3854                 my ($ip,$cidr) = split (/\//, $val);
3855
3856                 if ($val ne $Lang::tr{'ccd none'})
3857                 {
3858                         if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3859                         if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3860                         if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3861                         if (&General::validipandmask($val)){
3862                                 $val=$ip."/".&General::iporsubtodec($cidr);
3863                                 $ccdroute2hash{$keypoint}[$i] = $val;
3864                         }else{
3865                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3866                                 goto VPNCONF_ERROR;
3867                         }
3868                 }else{
3869                         $ccdroute2hash{$keypoint}[$i]='';
3870                 }
3871                 $i++;
3872         }
3873         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3874
3875         #check dns1 ip
3876         if ($cgiparams{'CCD_DNS1'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS1'})) {
3877                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3878                         goto VPNCONF_ERROR;
3879         }
3880         #check dns2 ip
3881         if ($cgiparams{'CCD_DNS2'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS2'})) {
3882                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3883                         goto VPNCONF_ERROR;
3884         }
3885         #check wins ip
3886         if ($cgiparams{'CCD_WINS'} ne '' &&  ! &General::validip($cgiparams{'CCD_WINS'})) {
3887                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3888                         goto VPNCONF_ERROR;
3889         }
3890 }
3891
3892 #CCD End
3893
3894
3895         if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3896                 $errormessage = $Lang::tr{'connection type is invalid'};
3897                 if ($cgiparams{'TYPE'} eq 'net') {
3898                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3899                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3900                         goto VPNCONF_ERROR;
3901                 }
3902                 goto VPNCONF_ERROR;
3903         }
3904
3905         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3906                 $errormessage = $Lang::tr{'name must only contain characters'};
3907                 if ($cgiparams{'TYPE'} eq 'net') {
3908                         goto VPNCONF_ERROR;
3909                 }
3910                 goto VPNCONF_ERROR;
3911         }
3912
3913         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3914                 $errormessage = $Lang::tr{'name is invalid'};
3915                 if ($cgiparams{'TYPE'} eq 'net') {
3916                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3917                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3918                         goto VPNCONF_ERROR;
3919                 }
3920                 goto VPNCONF_ERROR;
3921         }
3922
3923         if (length($cgiparams{'NAME'}) >60) {
3924                 $errormessage = $Lang::tr{'name too long'};
3925                 if ($cgiparams{'TYPE'} eq 'net') {
3926                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3927                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3928                         goto VPNCONF_ERROR;
3929                 }
3930                 goto VPNCONF_ERROR;
3931         }
3932
3933 ###
3934 # m.a.d net2net
3935 ###
3936
3937 if ($cgiparams{'TYPE'} eq 'net') {
3938         if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
3939                         $errormessage = $Lang::tr{'openvpn destination port used'};
3940                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3941             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3942       goto VPNCONF_ERROR;
3943                 }
3944     #Bugfix 10357
3945     foreach my $key (sort keys %confighash){
3946                 if ( ($confighash{$key}[22] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1]) || ($confighash{$key}[29] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1])){
3947                         $errormessage = $Lang::tr{'openvpn destination port used'};
3948                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3949             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3950       goto VPNCONF_ERROR;
3951                 }
3952         }
3953     if ($cgiparams{'DEST_PORT'} eq  '') {
3954                         $errormessage = $Lang::tr{'invalid port'};
3955                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3956             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3957       goto VPNCONF_ERROR;
3958                 }
3959
3960     # Check if the input for the transfer net is valid.
3961     if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
3962                         $errormessage = $Lang::tr{'ccd err invalidnet'};
3963                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3964             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3965                         goto VPNCONF_ERROR;
3966                 }
3967
3968     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
3969                         $errormessage = $Lang::tr{'openvpn subnet is used'};
3970                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3971             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3972                         goto VPNCONF_ERROR;
3973                 }
3974
3975           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3976             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3977             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3978             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3979             goto VPNCONF_ERROR;
3980     }
3981
3982     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3983             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3984             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3985             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3986             goto VPNCONF_ERROR;
3987     }
3988
3989     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
3990                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3991                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3992             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3993                   goto VPNCONF_ERROR;
3994                 }
3995
3996     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
3997                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3998                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3999             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4000                   goto VPNCONF_ERROR;
4001                 }
4002
4003     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
4004                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
4005                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4006             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4007                   goto VPNCONF_ERROR;
4008                 }
4009
4010         if ($cgiparams{'DEST_PORT'} <= 1023) {
4011                 $errormessage = $Lang::tr{'ovpn port in root range'};
4012                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4013             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4014                   goto VPNCONF_ERROR;
4015                 }
4016
4017         if ($cgiparams{'OVPN_MGMT'} eq '') {
4018                 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
4019                 }
4020
4021         if ($cgiparams{'OVPN_MGMT'} <= 1023) {
4022                 $errormessage = $Lang::tr{'ovpn mgmt in root range'};
4023                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4024             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4025                   goto VPNCONF_ERROR;
4026         }
4027         #Check if remote subnet is used elsewhere
4028         my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'});
4029         $warnmessage=&General::checksubnets('',$n2nip,'ovpn');
4030         if ($warnmessage){
4031                 $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
4032         }
4033 }
4034
4035 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
4036 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
4037 #           goto VPNCONF_ERROR;
4038 #       }
4039
4040         # Check if there is no other entry with this name
4041         if (! $cgiparams{'KEY'}) {
4042             foreach my $key (keys %confighash) {
4043                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4044                     $errormessage = $Lang::tr{'a connection with this name already exists'};
4045                     if ($cgiparams{'TYPE'} eq 'net') {
4046         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4047               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4048         }
4049                     goto VPNCONF_ERROR;
4050                 }
4051             }
4052         }
4053
4054         # Check if a remote host/IP has been set for the client.
4055         if ($cgiparams{'TYPE'} eq 'net') {
4056                 if ($cgiparams{'SIDE'} ne 'server' && $cgiparams{'REMOTE'} eq '') {
4057                         $errormessage = $Lang::tr{'invalid input for remote host/ip'};
4058
4059                         # Check if this is a N2N connection and drop temporary config.
4060                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4061                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4062
4063                         goto VPNCONF_ERROR;
4064                 }
4065
4066                 # Check if a remote host/IP has been configured - the field can be empty on the server side.
4067                 if ($cgiparams{'REMOTE'} ne '') {
4068                         # Check if the given IP is valid - otherwise check if it is a valid domain.
4069                         if (! &General::validip($cgiparams{'REMOTE'})) {
4070                                 # Check for a valid domain.
4071                                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
4072                                         $errormessage = $Lang::tr{'invalid input for remote host/ip'};
4073
4074                                         # Check if this is a N2N connection and drop temporary config.
4075                                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4076                                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4077
4078                                         goto VPNCONF_ERROR;
4079                                 }
4080                         }
4081                 }
4082         }
4083
4084         if ($cgiparams{'TYPE'} ne 'host') {
4085             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
4086                     $errormessage = $Lang::tr{'local subnet is invalid'};
4087                     if ($cgiparams{'TYPE'} eq 'net') {
4088               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4089                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4090               }
4091                         goto VPNCONF_ERROR;}
4092         }
4093         # Check if there is no other entry without IP-address and PSK
4094         if ($cgiparams{'REMOTE'} eq '') {
4095             foreach my $key (keys %confighash) {
4096                 if(($cgiparams{'KEY'} ne $key) &&
4097                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
4098                     $confighash{$key}[10] eq '') {
4099                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
4100                         goto VPNCONF_ERROR;
4101                 }
4102             }
4103         }
4104         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
4105                 $errormessage = $Lang::tr{'remote subnet is invalid'};
4106                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4107                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4108                 goto VPNCONF_ERROR;
4109         }
4110
4111         # Check for N2N that OpenSSL maximum of valid days will not be exceeded
4112         if ($cgiparams{'TYPE'} eq 'net') {
4113                 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4114                         $errormessage = $Lang::tr{'invalid input for valid till days'};
4115                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4116                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4117                         goto VPNCONF_ERROR;
4118                 }
4119         }
4120
4121         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
4122             $errormessage = $Lang::tr{'invalid input'};
4123             goto VPNCONF_ERROR;
4124         }
4125         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
4126             $errormessage = $Lang::tr{'invalid input'};
4127             goto VPNCONF_ERROR;
4128         }
4129
4130 #fixplausi
4131         if ($cgiparams{'AUTH'} eq 'psk')  {
4132 #           if (! length($cgiparams{'PSK'}) ) {
4133 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
4134 #               goto VPNCONF_ERROR;
4135 #           }
4136 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
4137 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
4138 #               goto VPNCONF_ERROR;
4139 #           }
4140         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
4141             if ($cgiparams{'KEY'}) {
4142                 $errormessage = $Lang::tr{'cant change certificates'};
4143                 goto VPNCONF_ERROR;
4144             }
4145             unless (ref ($cgiparams{'FH'})) {
4146                 $errormessage = $Lang::tr{'there was no file upload'};
4147                 goto VPNCONF_ERROR;
4148             }
4149
4150             # Move uploaded certificate request to a temporary file
4151             (my $fh, my $filename) = tempfile( );
4152             if (copy ($cgiparams{'FH'}, $fh) != 1) {
4153                 $errormessage = $!;
4154                 goto VPNCONF_ERROR;
4155             }
4156
4157             # Sign the certificate request and move it
4158             # Sign the host certificate request
4159             # The system call is safe, because all arguments are passed as an array.
4160             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
4161                 '-batch', '-notext',
4162                 '-in', $filename,
4163                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4164                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4165             if ($?) {
4166                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4167                 unlink ($filename);
4168                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4169                 &newcleanssldatabase();
4170                 goto VPNCONF_ERROR;
4171             } else {
4172                 unlink ($filename);
4173                 &deletebackupcert();
4174             }
4175
4176             my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4177             my $temp;
4178
4179             foreach my $line (@temp) {
4180                 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4181                         $temp = $1;
4182                         $temp =~ s+/Email+, E+;
4183                         $temp =~ s/ ST=/ S=/;
4184
4185                         last;
4186                 }
4187             }
4188
4189             $cgiparams{'CERT_NAME'} = $temp;
4190             $cgiparams{'CERT_NAME'} =~ s/,//g;
4191             $cgiparams{'CERT_NAME'} =~ s/\'//g;
4192             if ($cgiparams{'CERT_NAME'} eq '') {
4193                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4194                 goto VPNCONF_ERROR;
4195             }
4196         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
4197             if ($cgiparams{'KEY'}) {
4198                 $errormessage = $Lang::tr{'cant change certificates'};
4199                 goto VPNCONF_ERROR;
4200             }
4201             unless (ref ($cgiparams{'FH'})) {
4202                 $errormessage = $Lang::tr{'there was no file upload'};
4203                 goto VPNCONF_ERROR;
4204             }
4205             # Move uploaded certificate to a temporary file
4206             (my $fh, my $filename) = tempfile( );
4207             if (copy ($cgiparams{'FH'}, $fh) != 1) {
4208                 $errormessage = $!;
4209                 goto VPNCONF_ERROR;
4210             }
4211
4212             # Verify the certificate has a valid CA and move it
4213             my $validca = 0;
4214             my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/cacert.pem", "$filename");
4215             if (grep(/: OK/, @test)) {
4216                 $validca = 1;
4217             } else {
4218                 foreach my $key (keys %cahash) {
4219                     @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem", "$filename");
4220                     if (grep(/: OK/, @test)) {
4221                         $validca = 1;
4222                     }
4223                 }
4224             }
4225             if (! $validca) {
4226                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
4227                 unlink ($filename);
4228                 goto VPNCONF_ERROR;
4229             } else {
4230                 unless(move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem")) {
4231                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
4232                     unlink ($filename);
4233                     goto VPNCONF_ERROR;
4234                 }
4235             }
4236
4237             my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4238             my $temp;
4239
4240             foreach my $line (@temp) {
4241                 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4242                         $temp = $1;
4243                         $temp =~ s+/Email+, E+;
4244                         $temp =~ s/ ST=/ S=/;
4245
4246                         last;
4247                 }
4248             }
4249
4250             $cgiparams{'CERT_NAME'} = $temp;
4251             $cgiparams{'CERT_NAME'} =~ s/,//g;
4252             $cgiparams{'CERT_NAME'} =~ s/\'//g;
4253             if ($cgiparams{'CERT_NAME'} eq '') {
4254                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4255                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4256                 goto VPNCONF_ERROR;
4257             }
4258         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
4259             if ($cgiparams{'KEY'}) {
4260                 $errormessage = $Lang::tr{'cant change certificates'};
4261                 goto VPNCONF_ERROR;
4262             }
4263             # Validate input since the form was submitted
4264             if (length($cgiparams{'CERT_NAME'}) >60) {
4265                 $errormessage = $Lang::tr{'name too long'};
4266                 goto VPNCONF_ERROR;
4267             }
4268             if ($cgiparams{'CERT_NAME'} eq '' || $cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4269                 $errormessage = $Lang::tr{'invalid input for name'};
4270                 goto VPNCONF_ERROR;
4271             }
4272             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
4273                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
4274                 goto VPNCONF_ERROR;
4275             }
4276             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
4277                 $errormessage = $Lang::tr{'e-mail address too long'};
4278                 goto VPNCONF_ERROR;
4279             }
4280             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4281                 $errormessage = $Lang::tr{'invalid input for department'};
4282                 goto VPNCONF_ERROR;
4283             }
4284             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
4285                 $errormessage = $Lang::tr{'organization too long'};
4286                 goto VPNCONF_ERROR;
4287             }
4288             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4289                 $errormessage = $Lang::tr{'invalid input for organization'};
4290                 goto VPNCONF_ERROR;
4291             }
4292             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4293                 $errormessage = $Lang::tr{'invalid input for city'};
4294                 goto VPNCONF_ERROR;
4295             }
4296             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4297                 $errormessage = $Lang::tr{'invalid input for state or province'};
4298                 goto VPNCONF_ERROR;
4299             }
4300             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
4301                 $errormessage = $Lang::tr{'invalid input for country'};
4302                 goto VPNCONF_ERROR;
4303             }
4304             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
4305                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
4306                     $errormessage = $Lang::tr{'password too short'};
4307                     goto VPNCONF_ERROR;
4308                 }
4309             }
4310             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
4311                 $errormessage = $Lang::tr{'passwords do not match'};
4312                 goto VPNCONF_ERROR;
4313             }
4314             if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
4315                 $errormessage = $Lang::tr{'invalid input for valid till days'};
4316                 goto VPNCONF_ERROR;
4317             }
4318
4319             # Check for RW that OpenSSL maximum of valid days will not be exceeded
4320             if ($cgiparams{'TYPE'} eq 'host') {
4321                 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4322                         $errormessage = $Lang::tr{'invalid input for valid till days'};
4323                         goto VPNCONF_ERROR;
4324                 }
4325             }
4326
4327                 # Check for RW if client name is already set
4328                 if ($cgiparams{'TYPE'} eq 'host') {
4329                         foreach my $key (keys %confighash) {
4330                                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4331                                         $errormessage = $Lang::tr{'a connection with this name already exists'};
4332                                         goto VPNCONF_ERROR;
4333                                 }
4334                         }
4335                 }
4336
4337             # Replace empty strings with a .
4338             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
4339             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
4340             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
4341
4342             # Create the Host certificate request client
4343             my $pid = open(OPENSSL, "|-");
4344             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
4345             if ($pid) { # parent
4346                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
4347                 print OPENSSL "$state\n";
4348                 print OPENSSL "$city\n";
4349                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
4350                 print OPENSSL "$ou\n";
4351                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
4352                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
4353                 print OPENSSL ".\n";
4354                 print OPENSSL ".\n";
4355                 close (OPENSSL);
4356                 if ($?) {
4357                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4358                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
4359                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
4360                     goto VPNCONF_ERROR;
4361                 }
4362             } else {    # child
4363                 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4364                         '-newkey', 'rsa:4096',
4365                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4366                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4367                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
4368                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
4369                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4370                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4371                     goto VPNCONF_ERROR;
4372                 }
4373             }
4374
4375             # Sign the host certificate request
4376             # The system call is safe, because all arguments are passed as an array.
4377             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
4378                 '-batch', '-notext',
4379                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4380                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4381                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4382             if ($?) {
4383                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4384                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4385                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4386                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4387                 &newcleanssldatabase();
4388                 goto VPNCONF_ERROR;
4389             } else {
4390                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4391                 &deletebackupcert();
4392             }
4393
4394             # Create the pkcs12 file
4395             # The system call is safe, because all arguments are passed as an array.
4396             system('/usr/bin/openssl', 'pkcs12', '-export',
4397                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4398                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4399                 '-name', $cgiparams{'NAME'},
4400                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
4401                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
4402                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
4403                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4404             if ($?) {
4405                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4406                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4407                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4408                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4409                 goto VPNCONF_ERROR;
4410             } else {
4411                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4412             }
4413         } elsif ($cgiparams{'AUTH'} eq 'cert') {
4414             ;# Nothing, just editing
4415         } else {
4416             $errormessage = $Lang::tr{'invalid input for authentication method'};
4417             goto VPNCONF_ERROR;
4418         }
4419
4420         # Check if there is no other entry with this common name
4421         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
4422             foreach my $key (keys %confighash) {
4423                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
4424                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
4425                     goto VPNCONF_ERROR;
4426                 }
4427             }
4428         }
4429
4430     # Save the config
4431         my $key = $cgiparams{'KEY'};
4432
4433         if (! $key) {
4434             $key = &General::findhasharraykey (\%confighash);
4435             foreach my $i (0 .. 43) { $confighash{$key}[$i] = "";}
4436         }
4437         $confighash{$key}[0]            = $cgiparams{'ENABLED'};
4438         $confighash{$key}[1]            = $cgiparams{'NAME'};
4439         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
4440             $confighash{$key}[2]        = $cgiparams{'CERT_NAME'};
4441         }
4442
4443         $confighash{$key}[3]            = $cgiparams{'TYPE'};
4444         if ($cgiparams{'AUTH'} eq 'psk') {
4445             $confighash{$key}[4]        = 'psk';
4446             $confighash{$key}[5]        = $cgiparams{'PSK'};
4447         } else {
4448             $confighash{$key}[4]        = 'cert';
4449         }
4450         if ($cgiparams{'TYPE'} eq 'net') {
4451             $confighash{$key}[6]        = $cgiparams{'SIDE'};
4452             $confighash{$key}[11]       = $cgiparams{'REMOTE_SUBNET'};
4453         }
4454         $confighash{$key}[8]            = $cgiparams{'LOCAL_SUBNET'};
4455         $confighash{$key}[10]           = $cgiparams{'REMOTE'};
4456         if ($cgiparams{'OVPN_MGMT'} eq '') {
4457         $confighash{$key}[22]           = $confighash{$key}[29];
4458         } else {
4459         $confighash{$key}[22]           = $cgiparams{'OVPN_MGMT'};
4460         }
4461         $confighash{$key}[23]           = $cgiparams{'MSSFIX'};
4462         $confighash{$key}[24]           = $cgiparams{'FRAGMENT'};
4463         $confighash{$key}[25]           = $cgiparams{'REMARK'};
4464         $confighash{$key}[26]           = $cgiparams{'INTERFACE'};
4465 # new fields
4466         $confighash{$key}[27]           = $cgiparams{'OVPN_SUBNET'};
4467         $confighash{$key}[28]           = $cgiparams{'PROTOCOL'};
4468         $confighash{$key}[29]           = $cgiparams{'DEST_PORT'};
4469         $confighash{$key}[30]           = $cgiparams{'COMPLZO'};
4470         $confighash{$key}[31]           = $cgiparams{'MTU'};
4471         $confighash{$key}[32]           = $cgiparams{'CHECK1'};
4472         $name=$cgiparams{'CHECK1'};
4473         $confighash{$key}[33]           = $cgiparams{$name};
4474         $confighash{$key}[34]           = $cgiparams{'RG'};
4475         $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
4476         $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
4477         $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
4478         $confighash{$key}[39]           = $cgiparams{'DAUTH'};
4479         $confighash{$key}[40]           = $cgiparams{'DCIPHER'};
4480
4481         if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) {
4482                 $confighash{$key}[41] = "no-pass";
4483         }
4484
4485    $confighash{$key}[42] = 'HOTP/T30/6';
4486         $confighash{$key}[43] = $cgiparams{'OTP_STATE'};
4487         if (($confighash{$key}[43] eq 'on') && ($confighash{$key}[44] eq '')) {
4488                 my @otp_secret = &General::system_output("/usr/bin/openssl", "rand", "-hex", "20");
4489       chomp($otp_secret[0]);
4490                 $confighash{$key}[44] = $otp_secret[0];
4491         } elsif ($confighash{$key}[43] eq '') {
4492                 $confighash{$key}[44] = '';
4493         }
4494
4495         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4496
4497         if ($cgiparams{'CHECK1'} ){
4498
4499                 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
4500                 my ($a,$b,$c,$d) = split (/\./,$ccdip);
4501                         if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
4502                                 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
4503                         }
4504                         open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
4505                         print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n";
4506                         if($cgiparams{'CHECK1'} eq 'dynamic'){
4507                                 print CCDRWCONF "#This client uses the dynamic pool\n";
4508                         }else{
4509                                 print CCDRWCONF "#Ip address client and server\n";
4510                                 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
4511                         }
4512                         if ($confighash{$key}[34] eq 'on'){
4513                                 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
4514                                 print CCDRWCONF "push redirect-gateway\n";
4515                         }
4516                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4517                         if ($cgiparams{'IR'} ne ''){
4518                                 print CCDRWCONF "\n#Client routes these networks (behind Client)\n";
4519                                 foreach my $key (keys %ccdroutehash){
4520                                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
4521                                                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
4522                                                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
4523                                                         print CCDRWCONF "iroute $a $b\n";
4524                                                 }
4525                                         }
4526                                 }
4527                         }
4528                         if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
4529                         if ($cgiparams{'IFROUTE'} ne ''){
4530                                 print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n";
4531                                 foreach my $key (keys %ccdroute2hash){
4532                                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4533                                                 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
4534                                                         if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
4535                                                                 my %blue=();
4536                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
4537                                                                 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
4538                                                         }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
4539                                                                 my %orange=();
4540                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
4541                                                                 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS}  $orange{ORANGE_NETMASK}\n";
4542                                                         }else{
4543                                                                 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
4544                                                                 print CCDRWCONF "push \"route $a $b\"\n";
4545                                                         }
4546                                                 }
4547                                         }
4548                                 }
4549                         }
4550                         if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
4551                         if($cgiparams{'CCD_DNS1'} ne ''){
4552                                 print CCDRWCONF "\n#Client gets these nameservers\n";
4553                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4554                         }
4555                         if($cgiparams{'CCD_DNS2'} ne ''){
4556                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4557                         }
4558                         if($cgiparams{'CCD_WINS'} ne ''){
4559                                 print CCDRWCONF "\n#Client gets this WINS server\n";
4560                                 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4561                         }
4562                         close CCDRWCONF;
4563         }
4564
4565 ###
4566 # m.a.d n2n begin
4567 ###
4568
4569         if ($cgiparams{'TYPE'} eq 'net') {
4570
4571                 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4572                         &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4573
4574                         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4575                         my $key = $cgiparams{'KEY'};
4576                         if (! $key) {
4577                             $key = &General::findhasharraykey (\%confighash);
4578                             foreach my $i (0 .. 31) {
4579                                     $confighash{$key}[$i] = "";
4580                             }
4581                         }
4582
4583                         $confighash{$key}[0] = 'on';
4584                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4585
4586                         &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4587                 }
4588         }
4589
4590 ###
4591 # m.a.d n2n end
4592 ###
4593
4594         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4595             $cgiparams{'KEY'} = $key;
4596             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4597         }
4598         goto VPNCONF_END;
4599     } else {
4600         $cgiparams{'ENABLED'} = 'on';
4601 ###
4602 # m.a.d n2n begin
4603 ###
4604         $cgiparams{'MSSFIX'} = 'on';
4605         $cgiparams{'FRAGMENT'} = '1300';
4606         $cgiparams{'DAUTH'} = 'SHA512';
4607 ###
4608 # m.a.d n2n end
4609 ###
4610         $cgiparams{'SIDE'} = 'left';
4611         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4612             $cgiparams{'AUTH'} = 'psk';
4613         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4614             $cgiparams{'AUTH'} = 'certfile';
4615         } else {
4616             $cgiparams{'AUTH'} = 'certgen';
4617         }
4618         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4619         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4620         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
4621         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
4622         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
4623         $cgiparams{'DAYS_VALID'}        = $vpnsettings{'DAYS_VALID'} = '730';
4624     }
4625
4626     VPNCONF_ERROR:
4627     $checked{'ENABLED'}{'off'} = '';
4628     $checked{'ENABLED'}{'on'} = '';
4629     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4630     $checked{'ENABLED_BLUE'}{'off'} = '';
4631     $checked{'ENABLED_BLUE'}{'on'} = '';
4632     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4633     $checked{'ENABLED_ORANGE'}{'off'} = '';
4634     $checked{'ENABLED_ORANGE'}{'on'} = '';
4635     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4636
4637
4638     $checked{'EDIT_ADVANCED'}{'off'} = '';
4639     $checked{'EDIT_ADVANCED'}{'on'} = '';
4640     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
4641
4642     $selected{'SIDE'}{'server'} = '';
4643     $selected{'SIDE'}{'client'} = '';
4644     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
4645
4646     $selected{'PROTOCOL'}{'udp'} = '';
4647     $selected{'PROTOCOL'}{'tcp'} = '';
4648     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4649
4650
4651     $checked{'AUTH'}{'psk'} = '';
4652     $checked{'AUTH'}{'certreq'} = '';
4653     $checked{'AUTH'}{'certgen'} = '';
4654     $checked{'AUTH'}{'certfile'} = '';
4655     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
4656
4657     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
4658
4659     $checked{'COMPLZO'}{'off'} = '';
4660     $checked{'COMPLZO'}{'on'} = '';
4661     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
4662
4663     $checked{'MSSFIX'}{'off'} = '';
4664     $checked{'MSSFIX'}{'on'} = '';
4665     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4666
4667     $selected{'DCIPHER'}{'AES-256-GCM'} = '';
4668     $selected{'DCIPHER'}{'AES-192-GCM'} = '';
4669     $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4670     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
4671     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
4672     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
4673     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4674     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4675     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4676     $selected{'DCIPHER'}{'DESX-CBC'} = '';
4677     $selected{'DCIPHER'}{'SEED-CBC'} = '';
4678     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4679     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4680     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4681     $selected{'DCIPHER'}{'BF-CBC'} = '';
4682     $selected{'DCIPHER'}{'DES-CBC'} = '';
4683     # If no cipher has been chossen yet, select
4684     # the old default (AES-256-CBC) for compatiblity reasons.
4685     if ($cgiparams{'DCIPHER'} eq '') {
4686         $cgiparams{'DCIPHER'} = 'AES-256-CBC';
4687     }
4688     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4689     $selected{'DAUTH'}{'whirlpool'} = '';
4690     $selected{'DAUTH'}{'SHA512'} = '';
4691     $selected{'DAUTH'}{'SHA384'} = '';
4692     $selected{'DAUTH'}{'SHA256'} = '';
4693     $selected{'DAUTH'}{'SHA1'} = '';
4694     $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
4695     $checked{'TLSAUTH'}{'off'} = '';
4696     $checked{'TLSAUTH'}{'on'} = '';
4697     $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
4698
4699     if (1) {
4700         &Header::showhttpheaders();
4701         &Header::openpage($Lang::tr{'ovpn'}, 1, '');
4702         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4703         if ($errormessage) {
4704             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4705             print "<class name='base'>$errormessage";
4706             print "&nbsp;</class>";
4707             &Header::closebox();
4708         }
4709
4710         if ($warnmessage) {
4711             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4712             print "<class name='base'>$warnmessage";
4713             print "&nbsp;</class>";
4714             &Header::closebox();
4715         }
4716
4717         print "<form method='post' enctype='multipart/form-data'>";
4718         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
4719
4720         if ($cgiparams{'KEY'}) {
4721             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4722             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4723         }
4724
4725         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4726         print "<table width='100%'  border='0'>\n";
4727
4728         print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>";
4729
4730         if ($cgiparams{'TYPE'} eq 'host') {
4731             if ($cgiparams{'KEY'}) {
4732                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4733             } else {
4734                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4735             }
4736 #           print "<tr><td>$Lang::tr{'interface'}</td>";
4737 #           print "<td><select name='INTERFACE'>";
4738 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4739 #               if ($netsettings{'BLUE_DEV'} ne '') {
4740 #                       print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4741 #               }
4742 #               print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4743 #               print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4744 #               print "</select></td></tr>";
4745 #               print <<END;
4746         } else {
4747             print "<input type='hidden' name='INTERFACE' value='red' />";
4748             if ($cgiparams{'KEY'}) {
4749                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4750             } else {
4751                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4752             }
4753
4754                 # If GCM ciphers are in usage, HMAC menu is disabled
4755                 my $hmacdisabled;
4756                 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
4757                         ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
4758                         ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
4759                                 $hmacdisabled = "disabled='disabled'";
4760                 };
4761
4762             print <<END;
4763                     <td width='25%'>&nbsp;</td>
4764                     <td width='25%'>&nbsp;</td></tr>
4765         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4766                 <td><select name='SIDE'>
4767                                 <option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4768                                 <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option>
4769                         </select>
4770                 </td>
4771
4772                 <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4773                 <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td>
4774         </tr>
4775
4776         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4777                 <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4778
4779                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4780                 <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td>
4781         </tr>
4782
4783         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
4784                 <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td>
4785
4786                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4787                 <td><select name='PROTOCOL'>
4788                         <option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4789                         <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4790         </tr>
4791
4792         <tr>
4793                 <td class='boldbase'>$Lang::tr{'destination port'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
4794                 <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td>
4795
4796                 <td class='boldbase' nowrap='nowrap'>Management Port ($Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}):</td>
4797                 <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4798         </tr>
4799
4800         <tr><td colspan=4><hr /></td></tr><tr>
4801
4802         <tr>
4803                 <td class'base'><b>$Lang::tr{'MTU settings'}</b></td>
4804         </tr>
4805
4806         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td>
4807                 <td><input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4808                 <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4809         </tr>
4810
4811         <tr><td class='boldbase' nowrap='nowrap'>fragment:</td>
4812                 <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4813                 <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4814         </tr>
4815
4816         <tr><td class='boldbase' nowrap='nowrap'>mssfix:</td>
4817                 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4818                 <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4819         </tr>
4820
4821         <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4822                 <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4823         </tr>
4824
4825 <tr><td colspan=4><hr /></td></tr><tr>
4826         <tr>
4827                 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
4828         </tr>
4829
4830         <tr><td class='boldbase'>$Lang::tr{'cipher'}</td>
4831                 <td><select name='DCIPHER'  id="n2ncipher" required>
4832                                 <option value='AES-256-GCM'             $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
4833                                 <option value='AES-192-GCM'             $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
4834                                 <option value='AES-128-GCM'             $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
4835                                 <option value='CAMELLIA-256-CBC'        $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
4836                                 <option value='CAMELLIA-192-CBC'        $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4837                                 <option value='CAMELLIA-128-CBC'        $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
4838                                 <option value='AES-256-CBC'             $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option>
4839                                 <option value='AES-192-CBC'             $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
4840                                 <option value='AES-128-CBC'             $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
4841                                 <option value='SEED-CBC'                        $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
4842                                 <option value='DES-EDE3-CBC'            $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4843                                 <option value='DESX-CBC'                        $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4844                                 <option value='DES-EDE-CBC'             $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4845                                 <option value='BF-CBC'                          $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4846                                 <option value='CAST5-CBC'                       $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4847                         </select>
4848                 </td>
4849
4850                 <td class='boldbase'>$Lang::tr{'ovpn ha'}:</td>
4851                 <td><select name='DAUTH' id="n2nhmac" $hmacdisabled>
4852                                 <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
4853                                 <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
4854                                 <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
4855                                 <option value='SHA256'                  $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
4856                                 <option value='SHA1'                    $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4857                         </select>
4858                 </td>
4859         </tr>
4860         <tr><td colspan=4><hr /></td></tr><tr>
4861
4862 END
4863 ;
4864         }
4865
4866 #### JAVA SCRIPT ####
4867 # Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange
4868 print<<END;
4869         <script>
4870                 var disable_options = false;
4871                 document.getElementById('n2ncipher').onchange = function () {
4872                         if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) {
4873                                 document.getElementById('n2nhmac').setAttribute('disabled', true);
4874                         } else {
4875                                 document.getElementById('n2nhmac').removeAttribute('disabled');
4876                         }
4877                 }
4878         </script>
4879 END
4880
4881 #jumper
4882         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}</td>";
4883         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4884
4885         if ($cgiparams{'TYPE'} eq 'host') {
4886       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4887     }
4888
4889                 print"</tr></table><br><br>";
4890 #A.Marx CCD new client
4891 if ($cgiparams{'TYPE'} eq 'host') {
4892             print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4893             my %vpnnet=();
4894             my $vpnip;
4895             &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4896             $vpnip=$vpnnet{'DOVPN_SUBNET'};
4897             &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4898             my @ccdconf=();
4899                 my $count=0;
4900                 my $checked;
4901                 $checked{'check1'}{'off'} = '';
4902             $checked{'check1'}{'on'} = '';
4903             $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4904             print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4905             print"</td></tr></table><br><br>";
4906                 my $name=$cgiparams{'CHECK1'};
4907                 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4908                 $checked{'OTP_STATE'}{$cgiparams{'OTP_STATE'}} = 'CHECKED';
4909
4910         if (! -z "${General::swroot}/ovpn/ccd.conf"){
4911                 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4912                 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
4913                         $count++;
4914                         @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4915                         if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4916                         print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4917                         &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4918                         print"</td></tr>";
4919                 }
4920                 print "</table><br><br><hr><br><br>";
4921         }
4922 }
4923 # ccd end
4924         &Header::closebox();
4925         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4926
4927                 } elsif (! $cgiparams{'KEY'}) {
4928
4929
4930             my $disabled='';
4931             my $cakeydisabled='';
4932             my $cacrtdisabled='';
4933             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4934             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4935
4936             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4937
4938
4939  if ($cgiparams{'TYPE'} eq 'host') {
4940
4941         print <<END;
4942             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4943
4944             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4945             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4946             <tr><td colspan='3'>&nbsp;</td></tr>
4947       <tr><td colspan='3'><hr /></td></tr>
4948       <tr><td colspan='3'>&nbsp;</td></tr>
4949             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4950             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4951             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4952             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4953             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4954             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4955             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4956             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4957 END
4958 ;
4959
4960 ###
4961 # m.a.d net2net
4962 ###
4963
4964 } else {
4965
4966         print <<END;
4967             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4968
4969             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4970             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4971             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4972             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4973             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4974             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4975             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4976             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4977
4978
4979 END
4980 ;
4981
4982 }
4983
4984 ###
4985 # m.a.d net2net
4986 ###
4987
4988             foreach my $country (sort keys %{Countries::countries}) {
4989                 print "<option value='$Countries::countries{$country}'";
4990                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4991                     print " selected='selected'";
4992                 }
4993                 print ">$country</option>";
4994             }
4995 ###
4996 # m.a.d net2net
4997 ###
4998
4999 if ($cgiparams{'TYPE'} eq 'host') {
5000         print <<END;
5001         </select></td></tr>
5002                 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
5003                 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
5004                 <tr><td>&nbsp;</td>
5005                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
5006                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
5007                 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<br>($Lang::tr{'confirmation'})</td>
5008                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
5009                 <tr><td colspan='3'>&nbsp;</td></tr>
5010                 <tr><td colspan='3'><hr /></td></tr>
5011                 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
5012         </table>
5013 END
5014 }else{
5015         print <<END;
5016         </select></td></tr>
5017                 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
5018                 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
5019                 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
5020                 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
5021                 <tr><td colspan='3'><hr /></td></tr>
5022                 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
5023        </table>
5024
5025 END
5026 }
5027
5028 ###
5029 # m.a.d net2net
5030 ###
5031             ;
5032             &Header::closebox();
5033
5034         }
5035
5036 #A.Marx CCD new client
5037 if ($cgiparams{'TYPE'} eq 'host') {
5038             print"<br><br>";
5039             &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
5040
5041
5042         print <<END;
5043         <table border='0' width='100%'>
5044         <tr><td width='20%'>$Lang::tr{'enable otp'}:</td><td colspan='3'><input type='checkbox' name='OTP_STATE' $checked{'OTP_STATE'}{'on'} /></td></tr>
5045         <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
5046         <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
5047         <tr><td colspan='4'>&nbsp</td></tr>
5048         <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
5049 END
5050
5051         if ($cgiparams{'IR'} ne ''){
5052                 print $cgiparams{'IR'};
5053         }else{
5054                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
5055                 foreach my $key (keys %ccdroutehash) {
5056                         if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
5057                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
5058                                                 if ($ccdroutehash{$key}[$i] ne ''){
5059                                                         print $ccdroutehash{$key}[$i]."\n";
5060                                                 }
5061                                                 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
5062                                 }
5063                         }
5064                 }
5065         }
5066
5067         print <<END;
5068 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
5069         <tr><td colspan='4'><br></td></tr>
5070         <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
5071 END
5072
5073         my $set=0;
5074         my $selorange=0;
5075         my $selblue=0;
5076         my $selgreen=0;
5077         my $helpblue=0;
5078         my $helporange=0;
5079         my $other=0;
5080         my $none=0;
5081         my @temp=();
5082
5083         our @current = ();
5084         open(FILE, "${General::swroot}/main/routing") ;
5085         @current = <FILE>;
5086         close (FILE);
5087         &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
5088         #check for "none"
5089         foreach my $key (keys %ccdroute2hash) {
5090                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5091                         if ($ccdroute2hash{$key}[1] eq ''){
5092                                 $none=1;
5093                                 last;
5094                         }
5095                 }
5096         }
5097         if ($none ne '1'){
5098                 print"<option>$Lang::tr{'ccd none'}</option>";
5099         }else{
5100                 print"<option selected>$Lang::tr{'ccd none'}</option>";
5101         }
5102         #check if static routes are defined for client
5103         foreach my $line (@current) {
5104                 chomp($line);
5105                 $line=~s/\s*$//g;                       # remove newline
5106                 @temp=split(/\,/,$line);
5107                 $temp[1] = '' unless defined $temp[1]; # not always populated
5108                 my ($a,$b) = split(/\//,$temp[1]);
5109                 $temp[1] = $a."/".&General::iporsubtocidr($b);
5110                 foreach my $key (keys %ccdroute2hash) {
5111                         if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5112                                 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5113                                         if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
5114                                                 $set=1;
5115                                         }
5116                                 }
5117                         }
5118                 }
5119                 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
5120         }
5121
5122         my %vpnconfig = ();
5123         &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
5124         foreach my $vpn (keys %vpnconfig) {
5125                 # Skip all disabled VPN connections
5126                 my $enabled = $vpnconfig{$vpn}[0];
5127                 next unless ($enabled eq "on");
5128
5129                 my $name = $vpnconfig{$vpn}[1];
5130
5131                 # Remote subnets
5132                 my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
5133                 foreach my $network (@networks) {
5134                         my $selected = "";
5135
5136                         foreach my $key (keys %ccdroute2hash) {
5137                                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
5138                                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5139                                                 if ($ccdroute2hash{$key}[$i] eq $network) {
5140                                                         $selected = "selected";
5141                                                 }
5142                                         }
5143                                 }
5144                         }
5145
5146                         print "<option value=\"$network\" $selected>$name ($network)</option>\n";
5147                 }
5148         }
5149
5150         #check if green,blue,orange are defined for client
5151         foreach my $key (keys %ccdroute2hash) {
5152                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5153                         $other=1;
5154                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5155                                 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
5156                                         $selgreen=1;
5157                                 }
5158                                 if (&haveBlueNet()){
5159                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
5160                                                 $selblue=1;
5161                                         }
5162                                 }
5163                                 if (&haveOrangeNet()){
5164                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
5165                                                 $selorange=1;
5166                                         }
5167                                 }
5168                         }
5169                 }
5170         }
5171         if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
5172         if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
5173         if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
5174
5175         print<<END;
5176         </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
5177         <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
5178         <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
5179
5180 END
5181 ;
5182      &Header::closebox();
5183 }
5184         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5185         if ($cgiparams{'KEY'}) {
5186 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
5187         }
5188         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
5189         &Header::closebigbox();
5190         &Header::closepage();
5191         exit (0);
5192     }
5193     VPNCONF_END:
5194 }
5195
5196 #    SETTINGS_ERROR:
5197 ###
5198 ### Default status page
5199 ###
5200     %cgiparams = ();
5201     %cahash = ();
5202     %confighash = ();
5203     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
5204     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
5205     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
5206
5207     open(FILE, "/var/run/ovpnserver.log");
5208     my @status = <FILE>;
5209     close(FILE);
5210
5211     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
5212                 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
5213                     my $ipaddr = <IPADDR>;
5214                     close IPADDR;
5215                     chomp ($ipaddr);
5216                     $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
5217                     if ($cgiparams{'VPN_IP'} eq '') {
5218                                 $cgiparams{'VPN_IP'} = $ipaddr;
5219                     }
5220                 }
5221     }
5222
5223 #default setzen
5224     if ($cgiparams{'DCIPHER'} eq '') {
5225                 $cgiparams{'DCIPHER'} =  'AES-256-CBC';
5226     }
5227     if ($cgiparams{'DDEST_PORT'} eq '') {
5228                 $cgiparams{'DDEST_PORT'} =  '1194';
5229     }
5230     if ($cgiparams{'DMTU'} eq '') {
5231                 $cgiparams{'DMTU'} =  '1400';
5232     }
5233     if ($cgiparams{'MSSFIX'} eq '') {
5234                 $cgiparams{'MSSFIX'} = 'off';
5235     }
5236         if ($cgiparams{'DAUTH'} eq '') {
5237                 if (-z "${General::swroot}/ovpn/ovpnconfig") {
5238                         $cgiparams{'DAUTH'} = 'SHA512';
5239                 }
5240                 foreach my $key (keys %confighash) {
5241                         if ($confighash{$key}[3] ne 'host') {
5242                                 $cgiparams{'DAUTH'} = 'SHA512';
5243                         } else {
5244                                 $cgiparams{'DAUTH'} = 'SHA1';
5245                         }
5246                 }
5247         }
5248         if ($cgiparams{'TLSAUTH'} eq '') {
5249                 $cgiparams{'TLSAUTH'} = 'off';
5250         }
5251     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
5252                 $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
5253     }
5254     $checked{'ENABLED'}{'off'} = '';
5255     $checked{'ENABLED'}{'on'} = '';
5256     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
5257     $checked{'ENABLED_BLUE'}{'off'} = '';
5258     $checked{'ENABLED_BLUE'}{'on'} = '';
5259     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
5260     $checked{'ENABLED_ORANGE'}{'off'} = '';
5261     $checked{'ENABLED_ORANGE'}{'on'} = '';
5262     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
5263
5264     $selected{'DPROTOCOL'}{'udp'} = '';
5265     $selected{'DPROTOCOL'}{'tcp'} = '';
5266     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
5267
5268     $selected{'DCIPHER'}{'AES-256-GCM'} = '';
5269     $selected{'DCIPHER'}{'AES-192-GCM'} = '';
5270     $selected{'DCIPHER'}{'AES-128-GCM'} = '';
5271     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
5272     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
5273     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
5274     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
5275     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
5276     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
5277     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
5278     $selected{'DCIPHER'}{'DESX-CBC'} = '';
5279     $selected{'DCIPHER'}{'SEED-CBC'} = '';
5280     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
5281     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
5282     $selected{'DCIPHER'}{'BF-CBC'} = '';
5283     $selected{'DCIPHER'}{'DES-CBC'} = '';
5284     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
5285
5286     $selected{'DAUTH'}{'whirlpool'} = '';
5287     $selected{'DAUTH'}{'SHA512'} = '';
5288     $selected{'DAUTH'}{'SHA384'} = '';
5289     $selected{'DAUTH'}{'SHA256'} = '';
5290     $selected{'DAUTH'}{'SHA1'} = '';
5291     $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
5292
5293     $checked{'TLSAUTH'}{'off'} = '';
5294     $checked{'TLSAUTH'}{'on'} = '';
5295     $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
5296
5297     $checked{'DCOMPLZO'}{'off'} = '';
5298     $checked{'DCOMPLZO'}{'on'} = '';
5299     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
5300
5301 # m.a.d
5302     $checked{'MSSFIX'}{'off'} = '';
5303     $checked{'MSSFIX'}{'on'} = '';
5304     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
5305 #new settings
5306     &Header::showhttpheaders();
5307     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
5308     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
5309
5310     if ($errormessage) {
5311         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
5312         print "<class name='base'>$errormessage\n";
5313         print "&nbsp;</class>\n";
5314         &Header::closebox();
5315     }
5316
5317         if ($cryptoerror) {
5318                 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
5319                 print "<class name='base'>$cryptoerror";
5320                 print "&nbsp;</class>";
5321                 &Header::closebox();
5322         }
5323
5324         if ($cryptowarning) {
5325                 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
5326                 print "<class name='base'>$cryptowarning";
5327                 print "&nbsp;</class>";
5328                 &Header::closebox();
5329         }
5330
5331         if ($warnmessage) {
5332                 &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
5333                 print "$warnmessage<br>";
5334                 print "$Lang::tr{'fwdfw warn1'}<br>";
5335                 &Header::closebox();
5336                 print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>";
5337                 &Header::closepage();
5338                 exit 0;
5339         }
5340
5341     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
5342     my $srunning = "no";
5343     my $activeonrun = "";
5344     if ( -e "/var/run/openvpn.pid"){
5345         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
5346         $srunning ="yes";
5347         $activeonrun = "";
5348     } else {
5349         $activeonrun = "disabled='disabled'";
5350     }
5351     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
5352         print <<END;
5353     <table width='100%' border='0'>
5354     <form method='post'>
5355     <td width='25%'>&nbsp;</td>
5356     <td width='25%'>&nbsp;</td>
5357     <td width='25%'>&nbsp;</td></tr>
5358     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
5359     <td align='left'>$sactive</td>
5360     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
5361     <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
5362 END
5363 ;
5364     if (&haveBlueNet()) {
5365         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
5366         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
5367     }
5368     if (&haveOrangeNet()) {
5369         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
5370         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
5371     }
5372
5373         print <<END;
5374
5375         <tr><td colspan='4'><br></td></tr>
5376         <tr>
5377                 <td class'base'><b>$Lang::tr{'net config'}:</b></td>
5378         </tr>
5379     <tr><td colspan='1'><br></td></tr>
5380
5381     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
5382         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
5383     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
5384         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
5385                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
5386         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
5387         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
5388     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
5389         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}' size='5' /></td>
5390     </tr>
5391
5392         <tr><td colspan='4'><br></td></tr>
5393         <tr>
5394                 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
5395         </tr>
5396         <tr><td colspan='1'><br></td></tr>
5397
5398         <tr>
5399                 <td class='base'>$Lang::tr{'ovpn ha'}</td>
5400                 <td><select name='DAUTH'>
5401                                 <option value='whirlpool'               $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
5402                                 <option value='SHA512'                  $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
5403                                 <option value='SHA384'                  $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
5404                                 <option value='SHA256'                  $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
5405                                 <option value='SHA1'                    $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5406                         </select>
5407                 </td>
5408
5409                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
5410                 <td><select name='DCIPHER'>
5411                                 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
5412                                 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
5413                                 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
5414                                 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
5415                                 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
5416                                 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
5417                                 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option>
5418                                 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
5419                                 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
5420                                 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
5421                                 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5422                                 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5423                                 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5424                                 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5425                                 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5426                         </select>
5427                 </td>
5428         </tr>
5429
5430     <tr><td colspan='4'><br></td></tr>
5431         <tr>
5432                 <td class='base'>$Lang::tr{'ovpn tls auth'}</td>
5433                 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
5434         </tr>
5435
5436     <tr><td colspan='4'><br><br></td></tr>
5437 END
5438 ;
5439
5440     if ( $srunning eq "yes" ) {
5441         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
5442         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5443         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5444         print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
5445     } else{
5446         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5447         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5448         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
5449         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
5450              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
5451              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
5452              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
5453             (( $cgiparams{'ENABLED'} eq 'on') ||
5454             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
5455             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
5456             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
5457         } else {
5458             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
5459         }
5460     }
5461     print "</form></table>";
5462     &Header::closebox();
5463
5464     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
5465 ###
5466 # m.a.d net2net
5467 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
5468 ###
5469
5470     &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' });
5471         ;
5472         my $id = 0;
5473         my $gif;
5474         my $col1="";
5475         my $lastnet;
5476         foreach my $key (sort { ncmp ($confighash{$a}[32],$confighash{$b}[32]) } sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
5477                 if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]=$Lang::tr{'fwhost OpenVPN N-2-N'};}
5478                 if ($confighash{$key}[32] eq "dynamic"){$confighash{$key}[32]=$Lang::tr{'ccd dynrange'};}
5479                 if($id == 0){
5480                         print"<b>$confighash{$key}[32]</b>";
5481                         print <<END;
5482         <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5483 <tr>
5484         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5485         <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5486         <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5487         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
5488         <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5489 </tr>
5490 END
5491                 }
5492                 if ($id > 0 && $lastnet ne $confighash{$key}[32]){
5493                         print "</table><br>";
5494                         print"<b>$confighash{$key}[32]</b>";
5495                         print <<END;
5496         <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5497 <tr>
5498         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5499         <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5500         <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5501         <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
5502         <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5503 </tr>
5504 END
5505                 }
5506         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
5507         if ($id % 2) {
5508                 print "<tr>";
5509                 $col="bgcolor='$color{'color20'}'";
5510         } else {
5511                 print "<tr>";
5512                 $col="bgcolor='$color{'color22'}'";
5513         }
5514         print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
5515         print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
5516         #if ($confighash{$key}[4] eq 'cert') {
5517             #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
5518         #} else {
5519             #print "<td align='left'>&nbsp;</td>";
5520         #}
5521         my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
5522         my $cavalid;
5523
5524         foreach my $line (@cavalid) {
5525                 if ($line =~ /Not After : (.*)[\n]/) {
5526                         $cavalid    = $1;
5527
5528                         last;
5529                 }
5530         }
5531
5532         print "<td align='center' $col>$confighash{$key}[25]</td>";
5533         $col1="bgcolor='${Header::colourred}'";
5534         my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
5535
5536         if ($confighash{$key}[0] eq 'off') {
5537                 $col1="bgcolor='${Header::colourblue}'";
5538                 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
5539         } else {
5540
5541 ###
5542 # m.a.d net2net
5543 ###
5544
5545        if ($confighash{$key}[3] eq 'net') {
5546
5547         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
5548           my @output = "";
5549           my @tustate = "";
5550           my $tport = $confighash{$key}[22];
5551           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
5552           if ($tport ne '') {
5553           $tnet->open('127.0.0.1');
5554           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
5555           @tustate = split(/\,/, $output[1]);
5556 ###
5557 #CONNECTING    -- OpenVPN's initial state.
5558 #WAIT          -- (Client only) Waiting for initial response from server.
5559 #AUTH          -- (Client only) Authenticating with server.
5560 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
5561 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
5562 #ADD_ROUTES    -- Adding routes to system.
5563 #CONNECTED     -- Initialization Sequence Completed.
5564 #RECONNECTING  -- A restart has occurred.
5565 #EXITING       -- A graceful exit is in progress.
5566 ####
5567
5568                 if (($tustate[1] eq 'CONNECTED') || ($tustate[1] eq 'WAIT')) {
5569                         $col1="bgcolor='${Header::colourgreen}'";
5570                         $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5571                 }else {
5572                         $col1="bgcolor='${Header::colourred}'";
5573                         $active = "<b><font color='#FFFFFF'>$tustate[1]</font></b>";
5574                 }
5575            }
5576            }
5577         }else {
5578
5579                                 my $cn;
5580                                 my @match = ();
5581                 foreach my $line (@status) {
5582                         chomp($line);
5583                         if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
5584                                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
5585                                 if ($match[1] ne "Common Name") {
5586                                         $cn = $match[1];
5587                                 }
5588                                 $cn =~ s/[_]/ /g;
5589                                 if ($cn eq "$confighash{$key}[2]") {
5590                                         $col1="bgcolor='${Header::colourgreen}'";
5591                                         $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5592                                 }
5593                         }
5594                 }
5595         }
5596 }
5597
5598
5599     print <<END;
5600         <td align='center' $col1>$active</td>
5601
5602         <form method='post' name='frm${key}a'><td align='center' $col>
5603             <input type='image'  name='$Lang::tr{'dl client arch'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
5604             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5605             <input type='hidden' name='KEY' value='$key' />
5606         </td></form>
5607 END
5608         ;
5609
5610         if ($confighash{$key}[41] eq "no-pass") {
5611                 print <<END;
5612                         <form method='post' name='frm${key}g'><td align='center' $col>
5613                                 <input type='image'  name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png'
5614                                         alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' />
5615                                 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5616                                 <input type='hidden' name='MODE' value='insecure' />
5617                                 <input type='hidden' name='KEY' value='$key' />
5618                         </td></form>
5619 END
5620         } else {
5621                 print "<td $col>&nbsp;</td>";
5622         }
5623
5624         if ($confighash{$key}[4] eq 'cert') {
5625             print <<END;
5626             <form method='post' name='frm${key}b'><td align='center' $col>
5627                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
5628                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
5629                 <input type='hidden' name='KEY' value='$key' />
5630             </td></form>
5631 END
5632         ; } else {
5633             print "<td>&nbsp;</td>";
5634         }
5635
5636    if ($confighash{$key}[43] eq 'on') {
5637       print <<END;
5638 <form method='post' name='frm${key}o'><td align='center' $col>
5639 <input type='image' name='$Lang::tr{'show otp qrcode'}' src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}' title='$Lang::tr{'show otp qrcode'}' border='0' />
5640 <input type='hidden' name='ACTION' value='$Lang::tr{'show otp qrcode'}' />
5641 <input type='hidden' name='KEY' value='$key' />
5642 </td></form>
5643 END
5644 ; } else {
5645       print "<td $col>&nbsp;</td>";
5646    }
5647
5648         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
5649             print <<END;
5650             <form method='post' name='frm${key}c'><td align='center' $col>
5651                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
5652                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
5653                 <input type='hidden' name='KEY' value='$key' />
5654             </td></form>
5655 END
5656         ; } elsif ($confighash{$key}[4] eq 'cert') {
5657             print <<END;
5658             <form method='post' name='frm${key}c'><td align='center' $col>
5659                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
5660                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
5661                 <input type='hidden' name='KEY' value='$key' />
5662             </td></form>
5663 END
5664         ; } else {
5665             print "<td>&nbsp;</td>";
5666         }
5667         print <<END
5668         <form method='post' name='frm${key}d'><td align='center' $col>
5669             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
5670             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
5671             <input type='hidden' name='KEY' value='$key' />
5672         </td></form>
5673
5674         <form method='post' name='frm${key}e'><td align='center' $col>
5675             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5676             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5677             <input type='hidden' name='KEY' value='$key' />
5678         </td></form>
5679         <form method='post' name='frm${key}f'><td align='center' $col>
5680             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5681             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5682             <input type='hidden' name='KEY' value='$key' />
5683         </td></form>
5684         </tr>
5685 END
5686         ;
5687         $id++;
5688         $lastnet = $confighash{$key}[32];
5689     }
5690     print"</table>";
5691     ;
5692
5693     # If the config file contains entries, print Key to action icons
5694     if ( $id ) {
5695     print <<END;
5696     <table border='0'>
5697     <tr>
5698                 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5699                 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5700                 <td class='base'>$Lang::tr{'click to disable'}</td>
5701                 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5702                 <td class='base'>$Lang::tr{'show certificate'}</td>
5703                 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5704                 <td class='base'>$Lang::tr{'edit'}</td>
5705                 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5706                 <td class='base'>$Lang::tr{'remove'}</td>
5707     </tr>
5708     <tr>
5709                 <td>&nbsp; </td>
5710                 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5711                 <td class='base'>$Lang::tr{'click to enable'}</td>
5712                 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5713                 <td class='base'>$Lang::tr{'download certificate'}</td>
5714                 <td>&nbsp; &nbsp; <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5715                 <td class='base'>$Lang::tr{'dl client arch'}</td>
5716                 <td>&nbsp; &nbsp; <img src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}'/></td>
5717                 <td class='base'>$Lang::tr{'show otp qrcode'}</td>
5718                 </tr>
5719     </table><br>
5720 END
5721     ;
5722     }
5723
5724     print <<END;
5725     <table width='100%'>
5726     <form method='post'>
5727     <tr><td align='right'>
5728                 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5729                 <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td>
5730         </tr>
5731     </form>
5732     </table>
5733 END
5734     ;
5735         &Header::closebox();
5736         }
5737
5738     # CA/key listing
5739     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}");
5740     print <<END;
5741     <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5742     <tr>
5743                 <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5744                 <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
5745                 <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
5746     </tr>
5747 END
5748     ;
5749     my $col1="bgcolor='$color{'color22'}'";
5750     my $col2="bgcolor='$color{'color20'}'";
5751     # DH parameter line
5752     my $col3="bgcolor='$color{'color22'}'";
5753     # ta.key line
5754     my $col4="bgcolor='$color{'color20'}'";
5755
5756     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
5757                 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
5758                 my $casubject;
5759
5760                 foreach my $line (@casubject) {
5761                         if ($line =~ /Subject: (.*)[\n]/) {
5762                                 $casubject    = $1;
5763                                 $casubject    =~ s+/Email+, E+;
5764                                 $casubject    =~ s/ ST=/ S=/;
5765
5766                                 last;
5767                         }
5768                 }
5769
5770                 print <<END;
5771                 <tr>
5772                         <td class='base' $col1>$Lang::tr{'root certificate'}</td>
5773                         <td class='base' $col1>$casubject</td>
5774                         <form method='post' name='frmrootcrta'><td width='3%' align='center' $col1>
5775                         <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
5776                         <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
5777                         </form>
5778                         <form method='post' name='frmrootcrtb'><td width='3%' align='center' $col1>
5779                         <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
5780                         <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
5781                         </form>
5782                         <td width='4%' $col1>&nbsp;</td>
5783                 </tr>
5784 END
5785                 ;
5786     } else {
5787                 # display rootcert generation buttons
5788                 print <<END;
5789                 <tr>
5790                         <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
5791                         <td class='base' $col1>$Lang::tr{'not present'}</td>
5792                         <td colspan='3' $col1>&nbsp;</td>
5793                 </tr>
5794 END
5795                 ;
5796     }
5797
5798     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
5799                 my @hostsubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
5800                 my $hostsubject;
5801
5802                 foreach my $line (@hostsubject) {
5803                         if ($line =~ /Subject: (.*)[\n]/) {
5804                                 $hostsubject    = $1;
5805                                 $hostsubject    =~ s+/Email+, E+;
5806                                 $hostsubject    =~ s/ ST=/ S=/;
5807
5808                                 last;
5809                         }
5810                 }
5811
5812                 print <<END;
5813                 <tr>
5814                         <td class='base' $col2>$Lang::tr{'host certificate'}</td>
5815                         <td class='base' $col2>$hostsubject</td>
5816                         <form method='post' name='frmhostcrta'><td width='3%' align='center' $col2>
5817                         <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
5818                         <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
5819                         </form>
5820                         <form method='post' name='frmhostcrtb'><td width='3%' align='center' $col2>
5821                         <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/media-floppy.png' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" border='0' />
5822                         <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
5823                         </td></form>
5824                         <td width='4%' $col2>&nbsp;</td>
5825                 </tr>
5826 END
5827                 ;
5828     } else {
5829                 # Nothing
5830                 print <<END;
5831                 <tr>
5832                         <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
5833                         <td class='base' $col2>$Lang::tr{'not present'}</td>
5834                         </td><td colspan='3' $col2>&nbsp;</td>
5835                 </tr>
5836 END
5837                 ;
5838     }
5839
5840     # Adding DH parameter to chart
5841     if (-f "${General::swroot}/ovpn/ca/dh1024.pem") {
5842                 my @dhsubject = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
5843                 my $dhsubject;
5844
5845                 foreach my $line (@dhsubject) {
5846                         if ($line =~ /    (.*)[\n]/) {
5847                                 $dhsubject = $1;
5848
5849                                 last;
5850                         }
5851                 }
5852
5853         print <<END;
5854                 <tr>
5855                         <td class='base' $col3>$Lang::tr{'dh parameter'}</td>
5856                         <td class='base' $col3>$dhsubject</td>
5857                         <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
5858                         <input type='hidden' name='ACTION' value='$Lang::tr{'show dh'}' />
5859                         <input type='image' name='$Lang::tr{'show dh'}' src='/images/info.gif' alt='$Lang::tr{'show dh'}' title='$Lang::tr{'show dh'}' width='20' height='20' border='0' />
5860                         </form>
5861                         <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
5862                         </form>
5863                         <td width='4%' $col3>&nbsp;</td>
5864                 </tr>
5865 END
5866                 ;
5867     } else {
5868                 # Nothing
5869                 print <<END;
5870                 <tr>
5871                         <td width='25%' class='base' $col3>$Lang::tr{'dh parameter'}:</td>
5872                         <td class='base' $col3>$Lang::tr{'not present'}</td>
5873                         </td><td colspan='3' $col3>&nbsp;</td>
5874                 </tr>
5875 END
5876                 ;
5877     }
5878
5879     # Adding ta.key to chart
5880     if (-f "${General::swroot}/ovpn/certs/ta.key") {
5881                 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
5882                 my @tasubject = <FILE>;
5883                 close(FILE);
5884
5885                 my $tasubject;
5886                 foreach my $line (@tasubject) {
5887                         if($line =~ /# (.*)[\n]/) {
5888                                 $tasubject    = $1;
5889
5890                                 last;
5891                         }
5892                 }
5893
5894                 print <<END;
5895
5896                 <tr>
5897                         <td class='base' $col4>$Lang::tr{'ta key'}</td>
5898                         <td class='base' $col4>$tasubject</td>
5899                         <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5900                         <input type='hidden' name='ACTION' value='$Lang::tr{'show tls-auth key'}' />
5901                         <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show tls-auth key'}' title='$Lang::tr{'show tls-auth key'}' width='20' height='20' border='0' />
5902                         </form>
5903                         <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5904                         <input type='image' name='$Lang::tr{'download tls-auth key'}' src='/images/media-floppy.png' alt='$Lang::tr{'download tls-auth key'}' title='$Lang::tr{'download tls-auth key'}' border='0' />
5905                         <input type='hidden' name='ACTION' value='$Lang::tr{'download tls-auth key'}' />
5906                         </form>
5907                         <td width='4%' $col4>&nbsp;</td>
5908                 </tr>
5909 END
5910                 ;
5911     } else {
5912                 # Nothing
5913                 print <<END;
5914                 <tr>
5915                         <td width='25%' class='base' $col4>$Lang::tr{'ta key'}:</td>
5916                         <td class='base' $col4>$Lang::tr{'not present'}</td>
5917                         <td colspan='3' $col4>&nbsp;</td>
5918                 </tr>
5919 END
5920                 ;
5921     }
5922
5923     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
5924         print "<tr><td colspan='5' align='center'><form method='post'>";
5925                 print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
5926         print "</form></td></tr>\n";
5927     }
5928
5929     if (keys %cahash > 0) {
5930                 foreach my $key (keys %cahash) {
5931                         if (($key + 1) % 2) {
5932                                 print "<tr bgcolor='$color{'color20'}'>\n";
5933                         } else {
5934                                 print "<tr bgcolor='$color{'color22'}'>\n";
5935                         }
5936                         print "<td class='base'>$cahash{$key}[0]</td>\n";
5937                         print "<td class='base'>$cahash{$key}[1]</td>\n";
5938                         print <<END;
5939                         <form method='post' name='cafrm${key}a'><td align='center'>
5940                                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
5941                                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
5942                                 <input type='hidden' name='KEY' value='$key' />
5943                         </td></form>
5944                         <form method='post' name='cafrm${key}b'><td align='center'>
5945                                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
5946                                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
5947                                 <input type='hidden' name='KEY' value='$key' />
5948                         </td></form>
5949                         <form method='post' name='cafrm${key}c'><td align='center'>
5950                                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
5951                                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
5952                                 <input type='hidden' name='KEY' value='$key' />
5953                         </td></form></tr>
5954 END
5955                         ;
5956                 }
5957     }
5958
5959     print "</table>";
5960
5961     # If the file contains entries, print Key to action icons
5962     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
5963                 print <<END;
5964                 <table>
5965                 <tr>
5966                         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5967                         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5968                         <td class='base'>$Lang::tr{'show certificate'}</td>
5969                         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
5970                         <td class='base'>$Lang::tr{'download certificate'}</td>
5971                 </tr>
5972                 </table>
5973 END
5974                 ;
5975     }
5976
5977         print <<END
5978
5979         <br><hr><br>
5980
5981         <form method='post' enctype='multipart/form-data'>
5982                 <table border='0' width='100%'>
5983                         <tr>
5984                                 <td colspan='4'><b>$Lang::tr{'upload ca certificate'}</b></td>
5985                         </tr>
5986
5987                         <tr>
5988                                 <td width='10%'>$Lang::tr{'ca name'}:</td>
5989                                 <td width='30%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'></td>
5990                                 <td width='30%'><input type='file' name='FH' size='25'>
5991                                 <td width='30%'align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}'></td>
5992                         </tr>
5993
5994                         <tr>
5995                                 <td colspan='3'>&nbsp;</td>
5996                                 <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
5997                         </tr>
5998                 </table>
5999
6000                 <br>
6001
6002                 <table border='0' width='100%'>
6003                         <tr>
6004                                 <td colspan='4'><b>$Lang::tr{'ovpn dh parameters'}</b></td>
6005                         </tr>
6006
6007                         <tr>
6008                                 <td width='40%'>$Lang::tr{'ovpn dh upload'}:</td>
6009                                 <td width='30%'><input type='file' name='FH' size='25'>
6010                                 <td width='30%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload dh key'}'></td>
6011                         </tr>
6012
6013                         <tr>
6014                                 <td width='40%'>$Lang::tr{'ovpn dh new key'}:</td>
6015                                 <td colspan='2' width='60%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
6016                         </tr>
6017                 </table>
6018         </form>
6019
6020         <br><hr>
6021 END
6022         ;
6023
6024     if ( $srunning eq "yes" ) {
6025                 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' disabled='disabled' /></div></form>\n";
6026     } else {
6027                 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></div></form>\n";
6028     }
6029         &Header::closebox();
6030 END
6031         ;
6032
6033 &Header::closepage();
6034