Hardcode theme to ipfire

[ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index 00282d50b2d9c8eefa93157345c05e22ca86d9b3..f200f1002d20b12db6c2f9aa71ae17c3df9014f2 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2013  IPFire Team  info@ipfire.org                       #
+# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -54,7 +54,7 @@ my $errormessage = '';
 my %color = ();
 my %mainsettings = ();
 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
-&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
+&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
 
 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
 
@@ -604,7 +604,7 @@ END
                }
        }
 
-       if (ref ($cgiparams{'FH'}) ne 'Fh') {
+       unless (ref ($cgiparams{'FH'})) {
                $errormessage = $Lang::tr{'there was no file upload'};
                goto UPLOADCA_ERROR;
        }
@@ -689,12 +689,12 @@ END
                        my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
                        if ($test =~ /: OK/) {
                                # Delete connection
-                               system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
                                unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
                                unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
                                delete $confighash{$key};
                                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                                &writeipsecfiles();
+                               system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
                        }
                }
                unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
@@ -822,15 +822,17 @@ END
                        close IPADDR;
                        chomp ($ipaddr);
                        $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
+                       $cgiparams{'SUBJECTALTNAME'} = "DNS:" . $cgiparams{'ROOTCERT_HOSTNAME'};
                        if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
                                $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
+                               $cgiparams{'SUBJECTALTNAME'} = "IP:" . $cgiparams{'ROOTCERT_HOSTNAME'};
                        }
                }
                $cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
        } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
                &General::log("ipsec", "Importing from p12...");
 
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto ROOTCERT_ERROR;
                }
@@ -975,6 +977,11 @@ END
                #       IP: an IP address
                # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
 
+               if ($cgiparams{'SUBJECTALTNAME'} eq '') {
+                       $errormessage = $Lang::tr{'vpn subjectaltname missing'};
+                       goto ROOTCERT_ERROR;
+               }
+
                if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
                        $errormessage = $Lang::tr{'vpn altname syntax'};
                        goto VPNCONF_ERROR;
@@ -1129,7 +1136,7 @@ END
        }
        print <<END
                </select></td></tr>
-       <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)</td>
+       <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)&nbsp;<img src='/blob.gif' alt='*' /></td>
        <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr>
        <tr><td>&nbsp;</td>
                <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
@@ -1220,10 +1227,10 @@ END
                        &writeipsecfiles();
                        system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
                } else {
-                       system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
                        $confighash{$cgiparams{'KEY'}}[0] = 'off';
                        &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                        &writeipsecfiles();
+                       system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
                }
                sleep $sleepDelay;
        } else {
@@ -1254,12 +1261,12 @@ END
        &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
 
        if ($confighash{$cgiparams{'KEY'}}) {
-               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
                unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
                unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
                delete $confighash{$cgiparams{'KEY'}};
                &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
                &writeipsecfiles();
+               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
        } else {
                $errormessage = $Lang::tr{'invalid key'};
        }
@@ -1363,6 +1370,10 @@ END
                        $cgiparams{'MODE'} = "tunnel";
                }
 
+               if ($cgiparams{'INTERFACE_MTU'} eq "") {
+                       $cgiparams{'INTERFACE_MTU'} = 1500;
+               }
+
        } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
                $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
                if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
@@ -1527,7 +1538,7 @@ END
                        $errormessage = $Lang::tr{'cant change certificates'};
                        goto VPNCONF_ERROR;
                }
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto VPNCONF_ERROR;
                }
@@ -1564,7 +1575,7 @@ END
        } elsif ($cgiparams{'AUTH'} eq 'pkcs12') {
                &General::log("ipsec", "Importing from p12...");
 
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto ROOTCERT_ERROR;
                }
@@ -1654,7 +1665,7 @@ END
                        $errormessage = $Lang::tr{'cant change certificates'};
                        goto VPNCONF_ERROR;
                }
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto VPNCONF_ERROR;
                }
@@ -1996,11 +2007,11 @@ END
        #use default advanced value
        $cgiparams{'IKE_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18];
        $cgiparams{'IKE_INTEGRITY'}             = 'sha2_512|sha2_256'; #[19];
-       $cgiparams{'IKE_GROUPTYPE'}             = 'curve25519|4096|3072|2048'; #[20];
+       $cgiparams{'IKE_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[20];
        $cgiparams{'IKE_LIFETIME'}              = '3'; #[16];
        $cgiparams{'ESP_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21];
        $cgiparams{'ESP_INTEGRITY'}             = 'sha2_512|sha2_256'; #[22];
-       $cgiparams{'ESP_GROUPTYPE'}             = 'curve25519|4096|3072|2048'; #[23];
+       $cgiparams{'ESP_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[23];
        $cgiparams{'ESP_KEYLIFE'}               = '1'; #[17];
        $cgiparams{'COMPRESSION'}               = 'off'; #[13];
        $cgiparams{'ONLY_PROPOSED'}             = 'on'; #[24];
@@ -2364,7 +2375,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
-                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
+                       if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@ -2373,8 +2384,8 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        $errormessage = $Lang::tr{'invalid input for ike lifetime'};
                        goto ADVANCED_ERROR;
                }
-               if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
-                       $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
+               if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 24) {
+                       $errormessage = $Lang::tr{'ike lifetime should be between 1 and 24 hours'};
                        goto ADVANCED_ERROR;
                }
                @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
@@ -2405,7 +2416,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
-                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
+                       if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@ -2545,6 +2556,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
        foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
        $checked{'IKE_GROUPTYPE'}{'curve25519'} = '';
+       $checked{'IKE_GROUPTYPE'}{'curve448'} = '';
        $checked{'IKE_GROUPTYPE'}{'768'} = '';
        $checked{'IKE_GROUPTYPE'}{'1024'} = '';
        $checked{'IKE_GROUPTYPE'}{'1536'} = '';
@@ -2584,6 +2596,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
        foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
        $checked{'ESP_GROUPTYPE'}{'curve25519'} = '';
+       $checked{'ESP_GROUPTYPE'}{'curve448'} = '';
        $checked{'ESP_GROUPTYPE'}{'768'} = '';
        $checked{'ESP_GROUPTYPE'}{'1024'} = '';
        $checked{'ESP_GROUPTYPE'}{'1536'} = '';
@@ -2748,6 +2761,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        <td class='boldbase'>
                                <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
                                        <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
+                                       <option value='curve448' $checked{'IKE_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
                                        <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@ -2770,6 +2784,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        <td class='boldbase'>
                                <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
                                        <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
+                                       <option value='curve448' $checked{'ESP_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
                                        <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@ -3004,6 +3019,7 @@ END
                ($line =~ /$confighash{$key}[1]\{.*INSTALLED/)) {
                        $col1="bgcolor='${Header::colourgreen}'";
                        $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
+                       last;
                } elsif ($line =~ /$confighash{$key}[1]\[.*CONNECTING/) {
                        $col1="bgcolor='${Header::colourorange}'";
                        $active = "<b><font color='#FFFFFF'>$Lang::tr{'vpn connecting'}</font></b>";
@@ -3321,24 +3337,24 @@ sub make_algos($$$$$) {
 
                                        if ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
-                                       } elsif ($grp =~ m/curve25519/) {
+                                       } elsif ($grp =~ m/curve(25519|448)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");
                                        }
 
-                               } elsif ($mode eq "esp" && $pfs) {
+                               } elsif ($mode eq "esp") {
                                        my $is_aead = ($enc =~ m/[cg]cm/);
 
                                        if (!$is_aead) {
                                                push(@algo, $int);
                                        }
 
-                                       if ($grp eq "none") {
+                                       if (!$pfs || $grp eq "none") {
                                                # noop
                                        } elsif ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
-                                       } elsif ($grp =~ m/curve25519/) {
+                                       } elsif ($grp =~ m/curve(25519|448)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");