mympd: remove create config start

[ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index 5b0accf3fc0c729432570936bbbcb21bd9ed9de7..c92d0237d2d1372656d0d6a71d9b9ee5bc663c9a 100755 (executable)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -138,6 +138,17 @@ unless (-e "$local_clientconf") {
 ###
 ### Useful functions
 ###
+sub iscertlegacy
+{
+       my $file=$_[0];
+       my @certinfo = &General::system_output("/usr/bin/openssl", "pkcs12", "-info", "-nodes", 
+       "-in", "$file.p12", "-noout", "-passin", "pass:''");
+       if (index ($certinfo[0], "MAC: sha1") != -1) {
+               return 1;
+       }
+       return 0;
+}
+
 sub haveOrangeNet
 {
        if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
@@ -494,7 +505,7 @@ sub modccdnet
        my %ccdhash=();
 
        # Check if the new name is valid.
-       if(!&General::validhostname($newname)) {
+       if(!&General::validccdname($newname)) {
                $errormessage=$Lang::tr{'ccd err invalidname'};
                return;
        }
@@ -1115,6 +1126,9 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
   print CLIENTCONF "# Activate Management Interface and Port\n";
   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
+  if (&iscertlegacy("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}")) {
+       print CLIENTCONF "providers legacy default\n";
+  }
   close(CLIENTCONF);
 
 }
@@ -2156,6 +2170,10 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
+  if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
+       print CLIENTCONF "providers legacy default\n";
+  }
+
 
 
     close(CLIENTCONF);
@@ -2227,10 +2245,18 @@ else
 
                # Extract the certificate
                # This system call is safe, because all arguments are passed as an array.
-               system('/usr/bin/openssl', 'pkcs12', '-legacy', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
-                       '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
-               if ($?) {
-                       die "openssl error: $?";
+               if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
+                       system('/usr/bin/openssl', 'pkcs12', '-legacy', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
+                               '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
+                       if ($?) {
+                               die "openssl error: $?";
+                       }
+               } else {
+                       system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
+                               '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
+                       if ($?) {
+                               die "openssl error: $?";
+                       }
                }
 
                $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die;
@@ -2238,10 +2264,18 @@ else
 
                # Extract the key
                # This system call is safe, because all arguments are passed as an array.
-               system('/usr/bin/openssl', 'pkcs12', '-legacy', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
-                       '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
-               if ($?) {
-                       die "openssl error: $?";
+               if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
+                       system('/usr/bin/openssl', 'pkcs12', '-legacy', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
+                               '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
+                       if ($?) {
+                               die "openssl error: $?";
+                       }
+               } else {
+                       system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
+                               '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
+                       if ($?) {
+                               die "openssl error: $?";
+                       }
                }
 
                $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die;
@@ -2300,6 +2334,11 @@ else
     # If the server is asking for TOTP this needs to happen interactively
     print CLIENTCONF "auth-retry interact\r\n";
 
+    # Add provider line if certificate is legacy type
+    if (&iscertlegacy("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]")) {
+       print CLIENTCONF "providers legacy default\r\n";
+    }
+
     if ($include_certs) {
        print CLIENTCONF "\r\n";
 
@@ -3296,6 +3335,10 @@ END
        print FILE "# Logfile\n";
        print FILE "status-version 1\n";
        print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
+       if (&iscertlegacy("${General::swroot}/ovpn/certs/$cgiparams{'n2nname'}")) {
+               print CLIENTCONF "providers legacy default\n";
+       }
+
        close FILE;
 
        unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2")) {
@@ -3429,7 +3472,7 @@ foreach my $dkey (keys %confighash) {
        $confighash{$key}[31] = $n2ntunmtu[1];
        $confighash{$key}[39] = $n2nauth[1];
        $confighash{$key}[40] = $n2ncipher[1];
-       $confighash{$key}[41] = 'disabled';
+       $confighash{$key}[41] = 'no-pass';
 
   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 
@@ -4173,15 +4216,25 @@ if ($cgiparams{'TYPE'} eq 'net') {
                }
            }
 
-               # Check for RW if client name is already set
-               if ($cgiparams{'TYPE'} eq 'host') {
-                       foreach my $key (keys %confighash) {
-                               if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
-                                       $errormessage = $Lang::tr{'a connection with this name already exists'};
-                                       goto VPNCONF_ERROR;
-                               }
-                       }
-               }
+           # Check for RW if client name is already set
+           if ($cgiparams{'TYPE'} eq 'host') {
+                   foreach my $key (keys %confighash) {
+                           if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
+                                   $errormessage = $Lang::tr{'a connection with this name already exists'};
+                                   goto VPNCONF_ERROR;
+                   }
+                   }
+           }
+
+           # Check if there is no other entry with this common name
+           if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
+               foreach my $key (keys %confighash) {
+                   if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
+                       $errormessage = $Lang::tr{'a connection with this common name already exists'};
+                       goto VPNCONF_ERROR;
+                   }
+               }
+           }
 
            # Replace empty strings with a .
            (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
@@ -4266,16 +4319,6 @@ if ($cgiparams{'TYPE'} eq 'net') {
            goto VPNCONF_ERROR;
        }
 
-       # Check if there is no other entry with this common name
-       if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
-           foreach my $key (keys %confighash) {
-               if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
-                   $errormessage = $Lang::tr{'a connection with this common name already exists'};
-                   goto VPNCONF_ERROR;
-               }
-           }
-       }
-
     # Save the config
        my $key = $cgiparams{'KEY'};
 
@@ -4335,7 +4378,7 @@ if ($cgiparams{'TYPE'} eq 'net') {
                } elsif ($cgiparams{'TYPE'} eq 'net') {
                        $confighash{$key}[41] = "no-pass";
                }
-       }
+       }
 
    $confighash{$key}[42] = 'HOTP/T30/6';
        $confighash{$key}[43] = $cgiparams{'OTP_STATE'};
@@ -5465,7 +5508,6 @@ END
                                if ($match[1] ne "Common Name") {
                                        $cn = $match[1];
                                }
-                               $cn =~ s/[_]/ /g;
                                if ($cn eq "$confighash{$key}[2]") {
                                        $col1="bgcolor='${Header::colourgreen}'";
                                        $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
@@ -5596,7 +5638,8 @@ END
               <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
               <td class='base'>$Lang::tr{'click to enable'}</td>
               <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
-              <td class='base'>$Lang::tr{'click to disable'}</td>
+              <td class='base'>$Lang::tr{'click to disable'}</td>              
+
                <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
                <td class='base'>$Lang::tr{'edit'}</td>
                <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>