OpenVPN: Fix upload check for root and host certificate

[ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index eac962e6c7ba9f16fb7f0bd3778adaaf5df80b2f..947cbe9e7c429889f537e8711840097c5c53f5ac 100644 (file)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -1973,7 +1973,7 @@ END
            </select></td>
        <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
                <td class='base'><select name='DHLENGHT'>
-                               <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'} ($Lang::tr{'vpn weak'}</option>
+                               <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'} ($Lang::tr{'vpn weak'})</option>
                                <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
                                <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
                                <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
@@ -3980,6 +3980,16 @@ if ($cgiparams{'TYPE'} eq 'net') {
                goto VPNCONF_ERROR;
        }
 
+       # Check for N2N that OpenSSL maximum of valid days will not be exceeded
+       if ($cgiparams{'TYPE'} eq 'net') {
+               if ($cgiparams{'DAYS_VALID'} >= '999999') {
+                       $errormessage = $Lang::tr{'invalid input for valid till days'};
+                       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
+                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
+                       goto VPNCONF_ERROR;
+               }
+       }
+
        if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
            $errormessage = $Lang::tr{'invalid input'};
            goto VPNCONF_ERROR;
@@ -4035,7 +4045,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
            }
 
            my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
-           $temp =~ /Subject:.*CN=(.*)[\n]/;
+           $temp =~ /Subject:.*CN\s?=\s?(.*)[\n]/;
            $temp = $1;
            $temp =~ s+/Email+, E+;
            $temp =~ s/ ST=/ S=/;
@@ -4089,7 +4099,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
            }
 
            my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
-           $temp =~ /Subject:.*CN=(.*)[\n]/;
+           $temp =~ /Subject:.*CN\s?=\s?(.*)[\n]/;
            $temp = $1;
            $temp =~ s+/Email+, E+;
            $temp =~ s/ ST=/ S=/;
@@ -4157,11 +4167,19 @@ if ($cgiparams{'TYPE'} eq 'net') {
                $errormessage = $Lang::tr{'passwords do not match'};
                goto VPNCONF_ERROR;
            }
-           if ($cgiparams{'DAYS_VALID'} ne '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
+           if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
                $errormessage = $Lang::tr{'invalid input for valid till days'};
                goto VPNCONF_ERROR;
            }
 
+           # Check for RW that OpenSSL maximum of valid days will not be exceeded
+           if ($cgiparams{'TYPE'} eq 'host') {
+               if ($cgiparams{'DAYS_VALID'} >= '999999') {
+                       $errormessage = $Lang::tr{'invalid input for valid till days'};
+                       goto VPNCONF_ERROR;
+               }
+           }
+
            # Replace empty strings with a .
            (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
            (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
@@ -4433,7 +4451,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
        $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
        $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
        $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
-       $cgiparams{'DAYS_VALID'}        = $vpnsettings{'DAYS_VALID'};
+       $cgiparams{'DAYS_VALID'}        = $vpnsettings{'DAYS_VALID'} = '730';
     }
 
     VPNCONF_ERROR:
@@ -4813,7 +4831,7 @@ END
 if ($cgiparams{'TYPE'} eq 'host') {
        print <<END;
        </select></td></tr>
-               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
+               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
                <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
                <tr><td>&nbsp;</td>
                <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
@@ -4828,7 +4846,7 @@ END
 }else{
        print <<END;
        </select></td></tr>
-               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
+               <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
                <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
                <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
                <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>