]> git.ipfire.org Git - people/pmueller/ipfire-2.x.git/blame - html/cgi-bin/ovpnmain.cgi
projects / people / pmueller / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
openvpn-2fa: Drop the previous authentication handler
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT		 2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
49abe7af 5# Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
70df8302
MT		 6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535 21###
f527e53f 22# Based on IPFireCore 77
54fd0535 23###
6e13d0a5
MT		 24use CGI;
25use CGI qw/:standard/;
c63a54f0
MT		 26use Imager::QRCode;
27use MIME::Base32;
28use MIME::Base64;
6e13d0a5 29use Net::DNS;
ce9abb66 30use Net::Ping;
54fd0535 31use Net::Telnet;
6e13d0a5
MT		 32use File::Copy;
33use File::Temp qw/ tempfile tempdir /;
34use strict;
35use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
eff2dbf8 36use Sort::Naturally;
6e13d0a5 37require '/var/ipfire/general-functions.pl';
6e13d0a5
MT		 38require "${General::swroot}/lang.pl";
39require "${General::swroot}/header.pl";
40require "${General::swroot}/countries.pl";
e2e270e1 41require "${General::swroot}/location-functions.pl";
6e13d0a5
MT		 42
43# enable only the following on debugging purpose
2050be20
MT		 44#use warnings;
45#use CGI::Carp 'fatalsToBrowser';
46
6e13d0a5 47#workaround to suppress a warning when a variable is used only once
8c877a82 48my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
6e13d0a5
MT		 49undef (@dummy);
50
f2fdd0c1
CS		 51my %color = ();
52my %mainsettings = ();
53&General::readhash("${General::swroot}/main/settings", \%mainsettings);
8186b372 54&General::readhash("/srv/web/ipfire/html/themes/ipfire/include/colors.txt", \%color);
6e13d0a5
MT		 55
56###
57### Initialize variables
58###
e81be1e1
AM		 59my %ccdconfhash=();
60my %ccdroutehash=();
61my %ccdroute2hash=();
6e13d0a5
MT		 62my %netsettings=();
63my %cgiparams=();
64my %vpnsettings=();
65my %checked=();
66my %confighash=();
67my %cahash=();
68my %selected=();
69my $warnmessage = '';
70my $errormessage = '';
400c8afd
EK		 71my $cryptoerror = '';
72my $cryptowarning = '';
6e13d0a5 73my %settings=();
54fd0535 74my $routes_push_file = '';
df9b48b7
AM		 75my $confighost="${General::swroot}/fwhosts/customhosts";
76my $configgrp="${General::swroot}/fwhosts/customgroups";
77my $customnet="${General::swroot}/fwhosts/customnetworks";
78my $name;
99bfa85c 79my $col="";
ffbe77c8
EK		 80my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local";
81my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local";
82
6e13d0a5
MT		 83&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
84$cgiparams{'ENABLED'} = 'off';
85$cgiparams{'ENABLED_BLUE'} = 'off';
86$cgiparams{'ENABLED_ORANGE'} = 'off';
87$cgiparams{'EDIT_ADVANCED'} = 'off';
88$cgiparams{'NAT'} = 'off';
89$cgiparams{'COMPRESSION'} = 'off';
90$cgiparams{'ONLY_PROPOSED'} = 'off';
91$cgiparams{'ACTION'} = '';
92$cgiparams{'CA_NAME'} = '';
4c962356
EK		 93$cgiparams{'DH_NAME'} = 'dh1024.pem';
94$cgiparams{'DHLENGHT'} = '';
6e13d0a5
MT		 95$cgiparams{'DHCP_DOMAIN'} = '';
96$cgiparams{'DHCP_DNS'} = '';
97$cgiparams{'DHCP_WINS'} = '';
54fd0535 98$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 99$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 100$cgiparams{'MSSFIX'} = '';
8c877a82 101$cgiparams{'number'} = '';
4c962356 102$cgiparams{'DCIPHER'} = '';
49abe7af
EK		 103$cgiparams{'DAUTH'} = '';
104$cgiparams{'TLSAUTH'} = '';
54fd0535 105$routes_push_file = "${General::swroot}/ovpn/routes_push";
400c8afd
EK		 106# Perform crypto and configration test
107&pkiconfigcheck;
ffbe77c8
EK		 108
109# Add CCD files if not already presant
110unless (-e $routes_push_file) {
111 open(RPF, ">$routes_push_file");
112 close(RPF);
113}
114unless (-e "${General::swroot}/ovpn/ccd.conf") {
115 open(CCDC, ">${General::swroot}/ovpn/ccd.conf");
116 close (CCDC);
117}
118unless (-e "${General::swroot}/ovpn/ccdroute") {
119 open(CCDR, ">${General::swroot}/ovpn/ccdroute");
120 close (CCDR);
121}
122unless (-e "${General::swroot}/ovpn/ccdroute2") {
123 open(CCDRT, ">${General::swroot}/ovpn/ccdroute2");
124 close (CCDRT);
125}
126# Add additional configs if not already presant
127unless (-e "$local_serverconf") {
128 open(LSC, ">$local_serverconf");
129 close (LSC);
130}
131unless (-e "$local_clientconf") {
132 open(LCC, ">$local_clientconf");
133 close (LCC);
134}
ce9abb66 135
6e13d0a5
MT		 136&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
137
138# prepare openvpn config file
139###
140### Useful functions
141###
c6c9630e
MT		 142sub haveOrangeNet
143{
13211b21
CS		 144 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
145 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT		 146 return 0;
147}
148
149sub haveBlueNet
150{
13211b21 151 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 152 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT		 153 return 0;
154}
155
156sub sizeformat{
157 my $bytesize = shift;
158 my $i = 0;
159
160 while(abs($bytesize) >= 1024){
161 $bytesize=$bytesize/1024;
162 $i++;
163 last if($i==6);
164 }
165
166 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
167 my $newsize=(int($bytesize*100 +0.5))/100;
168 return("$newsize $units[$i]");
169}
170
c6c9630e
MT		 171sub cleanssldatabase
172{
173 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
174 print FILE "01";
175 close FILE;
176 }
177 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
178 print FILE "";
179 close FILE;
180 }
e6f7f8e7
EK		 181 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) {
182 print FILE "";
183 close FILE;
184 }
c6c9630e 185 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
e6f7f8e7 186 unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
c6c9630e
MT		 187 unlink ("${General::swroot}/ovpn/certs/serial.old");
188 unlink ("${General::swroot}/ovpn/certs/01.pem");
189}
190
191sub newcleanssldatabase
192{
193 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
194 open(FILE, ">${General::swroot}(ovpn/certs/serial");
195 print FILE "01";
196 close FILE;
197 }
198 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
2feacd98 199 &General::system("touch", "${General::swroot}/ovpn/certs/index.txt");
c6c9630e 200 }
e6f7f8e7 201 if (! -s ">${General::swroot}/ovpn/certs/index.txt.attr") {
2feacd98 202 &General::system("touch", "${General::swroot}/ovpn/certs/index.txt.attr");
e6f7f8e7 203 }
c6c9630e 204 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
e6f7f8e7 205 unlink ("${General::swroot}/ovpn/certs/index.txt.attr.old");
c6c9630e
MT		 206 unlink ("${General::swroot}/ovpn/certs/serial.old");
207}
208
209sub deletebackupcert
210{
211 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
212 my $hexvalue = <FILE>;
213 chomp $hexvalue;
214 close FILE;
215 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
216 }
217}
4c962356 218
400c8afd
EK		 219###
220### Check for PKI and configure problems
221###
222
223sub pkiconfigcheck
224{
225 # Warning if DH parameter is 1024 bit
226 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
2feacd98 227 my @dhparameter = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
f5604080 228 my $dhbit;
2feacd98 229
f5604080 230 # Loop through the output and search for the DH bit lenght.
2feacd98 231 foreach my $line (@dhparameter) {
f5604080
SS		 232 if ($line =~ (/(\d+)/)) {
233 # Assign match to dhbit value.
234 $dhbit = $1;
235
236 last;
2feacd98 237 }
400c8afd 238 }
f5604080
SS		 239
240 # Check if the used key lenght is at least 2048 bit.
241 if ($dhbit < 2048) {
242 $cryptoerror = "$Lang::tr{'ovpn error dh'}";
243 goto CRYPTO_ERROR;
244 }
400c8afd
EK		 245 }
246
247 # Warning if md5 is in usage
248 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
2feacd98
SS		 249 my @signature = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
250 if (grep(/md5WithRSAEncryption/, @signature) ) {
400c8afd
EK		 251 $cryptoerror = "$Lang::tr{'ovpn error md5'}";
252 goto CRYPTO_ERROR;
253 }
254 }
255
256 CRYPTO_ERROR:
257
258 # Warning if certificate is not compliant to RFC3280 TLS rules
259 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
2feacd98
SS		 260 my @extendkeyusage = &General::system_output("/usr/bin/openssl", "x509", "-noout", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
261 if ( ! grep(/TLS Web Server Authentication/, @extendkeyusage)) {
400c8afd
EK		 262 $cryptowarning = "$Lang::tr{'ovpn warning rfc3280'}";
263 goto CRYPTO_WARNING;
264 }
265 }
266
267 CRYPTO_WARNING:
268}
269
c6c9630e 270sub writeserverconf {
66c36198
PM		 271 my %sovpnsettings = ();
272 my @temp = ();
c6c9630e 273 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535 274 &read_routepushfile;
66c36198 275
c6c9630e
MT		 276 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
277 flock CONF, 2;
278 print CONF "#OpenVPN Server conf\n";
279 print CONF "\n";
280 print CONF "daemon openvpnserver\n";
281 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 282 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e 283 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
79e7688b 284 print CONF "dev tun\n";
c6c9630e
MT		 285 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
286 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
a4fd2325 287 print CONF "script-security 3\n";
07675dc3 288 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 289 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e 290 print CONF "tls-server\n";
4c962356
EK		 291 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
292 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
293 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 294 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
c6c9630e
MT		 295 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
296 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
8c877a82 297 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
4c962356 298
d6989b4b 299 print CONF "tun-mtu $sovpnsettings{'DMTU'}\n";
2ee746be 300
54fd0535 301 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
8c877a82
AM		 302 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
303 foreach (@temp)
304 {
305 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
306 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
307 }
54fd0535 308 }
8c877a82
AM		 309# a.marx ccd
310 my %ccdconfhash=();
311 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
312 foreach my $key (keys %ccdconfhash) {
313 my $a=$ccdconfhash{$key}[1];
314 my ($b,$c) = split (/\//, $a);
315 print CONF "route $b ".&General::cidrtosub($c)."\n";
316 }
317 my %ccdroutehash=();
318 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
319 foreach my $key (keys %ccdroutehash) {
320 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
321 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
322 print CONF "route $a $b\n";
323 }
324 }
325# ccd end
54fd0535 326
8c877a82 327 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
c6c9630e
MT		 328 print CONF "client-to-client\n";
329 }
1de5c945 330 if ($sovpnsettings{MSSFIX} eq 'on') {
4c962356 331 print CONF "mssfix\n";
d6989b4b
MT		 332 } else {
333 print CONF "mssfix 0\n";
1de5c945
EK		 334 }
335 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
4c962356 336 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 337 }
2ee746be 338
66c36198 339 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
c6c9630e 340 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
66c36198 341 }
c6c9630e 342 print CONF "status-version 1\n";
87fe47e9 343 print CONF "status /var/run/ovpnserver.log 30\n";
a4fd2325 344 print CONF "ncp-disable\n";
c6c9630e 345 print CONF "cipher $sovpnsettings{DCIPHER}\n";
49abe7af 346 print CONF "auth $sovpnsettings{'DAUTH'}\n";
942446b5
EK		 347 # Set TLSv2 as minimum
348 print CONF "tls-version-min 1.2\n";
86308adb 349
49abe7af 350 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
4be45949 351 print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
49abe7af 352 }
c6c9630e
MT		 353 if ($sovpnsettings{DCOMPLZO} eq 'on') {
354 print CONF "comp-lzo\n";
355 }
356 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
357 print CONF "push \"redirect-gateway def1\"\n";
358 }
359 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
360 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
361 }
362
363 if ($sovpnsettings{DHCP_DNS} ne '') {
364 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
365 }
366
367 if ($sovpnsettings{DHCP_WINS} ne '') {
368 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
369 }
66c36198 370
fa527476 371 if ($sovpnsettings{MAX_CLIENTS} eq '') {
c6c9630e 372 print CONF "max-clients 100\n";
a79fa1d6 373 }
fa527476 374 if ($sovpnsettings{MAX_CLIENTS} ne '') {
c6c9630e 375 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
66c36198 376 }
1d0a260a 377 print CONF "tls-verify /usr/lib/openvpn/verify\n";
c6c9630e 378 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
e1e10515
TE		 379 print CONF "auth-user-pass-optional\n";
380 print CONF "reneg-sec 86400\n";
c6c9630e
MT		 381 print CONF "user nobody\n";
382 print CONF "group nobody\n";
383 print CONF "persist-key\n";
384 print CONF "persist-tun\n";
385 if ($sovpnsettings{LOG_VERB} ne '') {
386 print CONF "verb $sovpnsettings{LOG_VERB}\n";
387 } else {
388 print CONF "verb 3\n";
ffbe77c8 389 }
708f2b73
MT		 390
391 print CONF "# Log clients connecting/disconnecting\n";
392 print CONF "client-connect \"/usr/sbin/openvpn-metrics client-connect\"\n";
393 print CONF "client-disconnect \"/usr/sbin/openvpn-metrics client-disconnect\"\n";
394
ffbe77c8
EK		 395 # Print server.conf.local if entries exist to server.conf
396 if ( !-z $local_serverconf && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
397 open (LSC, "$local_serverconf");
398 print CONF "\n#---------------------------\n";
399 print CONF "# Start of custom directives\n";
400 print CONF "# from server.conf.local\n";
401 print CONF "#---------------------------\n\n";
402 while (<LSC>) {
403 print CONF $_;
404 }
405 print CONF "\n#-----------------------------\n";
406 print CONF "# End of custom directives\n";
407 print CONF "#-----------------------------\n";
408 close (LSC);
409 }
c6c9630e 410 print CONF "\n";
66c36198 411
c6c9630e 412 close(CONF);
66c36198 413}
8c877a82 414
c6c9630e 415sub emptyserverlog{
87fe47e9 416 if (open(FILE, ">/var/run/ovpnserver.log")) {
c6c9630e
MT		 417 flock FILE, 2;
418 print FILE "";
419 close FILE;
420 }
421
422}
423
66c36198 424sub delccdnet
8c877a82
AM		 425{
426 my %ccdconfhash = ();
427 my %ccdhash = ();
428 my $ccdnetname=$_[0];
429 if (-f "${General::swroot}/ovpn/ovpnconfig"){
430 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
431 foreach my $key (keys %ccdhash) {
432 if ($ccdhash{$key}[32] eq $ccdnetname) {
433 $errormessage=$Lang::tr{'ccd err hostinnet'};
434 return;
435 }
436 }
437 }
438 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
439 foreach my $key (keys %ccdconfhash) {
440 if ($ccdconfhash{$key}[0] eq $ccdnetname){
441 delete $ccdconfhash{$key};
442 }
443 }
444 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
66c36198 445
8c877a82
AM		 446 &writeserverconf;
447 return 0;
448}
449
450sub addccdnet
451{
452 my %ccdconfhash=();
453 my @ccdconf=();
454 my $ccdname=$_[0];
455 my $ccdnet=$_[1];
8c877a82
AM		 456 my $subcidr;
457 my @ip2=();
458 my $checkup;
459 my $ccdip;
460 my $baseaddress;
66c36198
PM		 461
462
463 #check name
464 if ($ccdname eq '')
290007b3
AM		 465 {
466 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
467 return
468 }
66c36198 469
290007b3
AM		 470 if(!&General::validhostname($ccdname))
471 {
8c877a82
AM		 472 $errormessage=$Lang::tr{'ccd err invalidname'};
473 return;
474 }
66c36198 475
290007b3
AM		 476 ($ccdip,$subcidr) = split (/\//,$ccdnet);
477 $subcidr=&General::iporsubtocidr($subcidr);
478 #check subnet
479 if ($subcidr > 30)
480 {
8c877a82
AM		 481 $errormessage=$Lang::tr{'ccd err invalidnet'};
482 return;
483 }
290007b3
AM		 484 #check ip
485 if (!&General::validipandmask($ccdnet)){
486 $errormessage=$Lang::tr{'ccd err invalidnet'};
487 return;
8c877a82 488 }
b6c60092 489
8c877a82
AM		 490 if (!$errormessage) {
491 my %ccdconfhash=();
492 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
493 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
494 my $key = &General::findhasharraykey (\%ccdconfhash);
495 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
496 $ccdconfhash{$key}[0] = $ccdname;
497 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
498 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
499 &writeserverconf;
500 $cgiparams{'ccdname'}='';
501 $cgiparams{'ccdsubnet'}='';
502 return 1;
503 }
504}
505
506sub modccdnet
507{
66c36198 508
8c877a82
AM		 509 my $newname=$_[0];
510 my $oldname=$_[1];
511 my %ccdconfhash=();
512 my %ccdhash=();
7ad653cc
SS		 513
514 # Check if the new name is valid.
515 if(!&General::validhostname($newname)) {
516 $errormessage=$Lang::tr{'ccd err invalidname'};
517 return;
518 }
519
8c877a82
AM		 520 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
521 foreach my $key (keys %ccdconfhash) {
522 if ($ccdconfhash{$key}[0] eq $oldname) {
523 foreach my $key1 (keys %ccdconfhash) {
524 if ($ccdconfhash{$key1}[0] eq $newname){
525 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
526 return;
527 }else{
528 $ccdconfhash{$key}[0]= $newname;
529 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
530 last;
531 }
532 }
533 }
534 }
66c36198 535
8c877a82
AM		 536 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
537 foreach my $key (keys %ccdhash) {
538 if ($ccdhash{$key}[32] eq $oldname) {
539 $ccdhash{$key}[32]=$newname;
540 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
541 last;
542 }
543 }
66c36198 544
8c877a82
AM		 545 return 0;
546}
547sub ccdmaxclients
548{
549 my $ccdnetwork=$_[0];
550 my @octets=();
551 my @subnet=();
552 @octets=split("\/",$ccdnetwork);
553 @subnet= split /\./, &General::cidrtosub($octets[1]);
554 my ($a,$b,$c,$d,$e);
555 $a=256-$subnet[0];
556 $b=256-$subnet[1];
557 $c=256-$subnet[2];
558 $d=256-$subnet[3];
559 $e=($a*$b*$c*$d)/4;
560 return $e-1;
561}
562
66c36198 563sub getccdadresses
8c877a82
AM		 564{
565 my $ipin=$_[0];
566 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
567 my $cidr=$_[1];
568 chomp($cidr);
569 my $count=$_[2];
570 my $hasip=$_[3];
571 chomp($hasip);
572 my @iprange=();
573 my %ccdhash=();
574 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
d9fe5693 575 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
ac87f371 576 for (my $i=1;$i<=$count;$i++) {
8c877a82
AM		 577 my $tmpip=$iprange[$i-1];
578 my $stepper=$i*4;
579 $iprange[$i]= &General::getnextip($tmpip,4);
580 }
581 my $r=0;
582 foreach my $key (keys %ccdhash) {
583 $r=0;
584 foreach my $tmp (@iprange){
585 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
586 if ($net eq $tmp) {
587 if ( $hasip ne $ccdhash{$key}[33] ){
588 splice (@iprange,$r,1);
589 }
590 }
591 $r++;
592 }
593 }
594 return @iprange;
595}
596
597sub fillselectbox
598{
599 my $boxname=$_[1];
66c36198 600 my ($ccdip,$subcidr) = split("/",$_[0]);
8c877a82
AM		 601 my $tz=$_[2];
602 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
603 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
604 foreach (@allccdips) {
605 my $ip=$_."/30";
606 chomp($ip);
607 print "<option value='$ip' ";
608 if ( $ip eq $cgiparams{$boxname} ){
609 print"selected";
610 }
611 print ">$ip</option>";
612 }
613 print "</select>";
614}
615
616sub hostsinnet
617{
618 my $name=$_[0];
619 my %ccdhash=();
620 my $i=0;
621 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
622 foreach my $key (keys %ccdhash) {
623 if ($ccdhash{$key}[32] eq $name){ $i++;}
624 }
625 return $i;
626}
627
628sub check_routes_push
629{
630 my $val=$_[0];
631 my ($ip,$cidr) = split (/\//, $val);
632 ##check for existing routes in routes_push
633 if (-e "${General::swroot}/ovpn/routes_push") {
634 open(FILE,"${General::swroot}/ovpn/routes_push");
635 while (<FILE>) {
636 $_=~s/\s*$//g;
66c36198 637
8c877a82
AM		 638 my ($ip2,$cidr2) = split (/\//,"$_");
639 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
66c36198 640
8c877a82
AM		 641 if($val eq $val2){
642 return 0;
643 }
644 #subnetcheck
645 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
646 return 0;
647 }
648 };
649 close(FILE);
650 }
651 return 1;
652}
653
654sub check_ccdroute
655{
656 my %ccdroutehash=();
657 my $val=$_[0];
658 my ($ip,$cidr) = split (/\//, $val);
659 #check for existing routes in ccdroute
660 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
661 foreach my $key (keys %ccdroutehash) {
662 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
663 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
664 return 0;
665 }
666 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
667 #subnetcheck
668 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
669 return 0;
670 }
671 }
672 }
673 return 1;
674}
675sub check_ccdconf
676{
677 my %ccdconfhash=();
678 my $val=$_[0];
679 my ($ip,$cidr) = split (/\//, $val);
680 #check for existing routes in ccdroute
681 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
682 foreach my $key (keys %ccdconfhash) {
683 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
684 return 0;
685 }
686 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
687 #subnetcheck
688 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
689 return 0;
690 }
66c36198 691
8c877a82
AM		 692 }
693 return 1;
694}
695
7c1d9faf
AH		 696###
697# m.a.d net2net
698###
699
700sub validdotmask
701{
702 my $ipdotmask = $_[0];
703 if (&General::validip($ipdotmask)) { return 0; }
704 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
705 my $mask = $2;
66c36198 706 if (($mask =~ /\./ )) { return 0; }
7c1d9faf
AH		 707 return 1;
708}
54fd0535
MT		 709
710# -------------------------------------------------------------------
711
712sub write_routepushfile
713{
714 open(FILE, ">$routes_push_file");
715 flock(FILE, 2);
716 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
717 print FILE $vpnsettings{'ROUTES_PUSH'};
718 }
66c36198 719 close(FILE);
54fd0535
MT		 720}
721
722sub read_routepushfile
723{
724 if (-e "$routes_push_file") {
725 open(FILE,"$routes_push_file");
726 delete $vpnsettings{'ROUTES_PUSH'};
727 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
728 close(FILE);
729 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
66c36198 730
54fd0535
MT		 731 }
732}
7c1d9faf 733
775b4494
AM		 734sub writecollectdconf {
735 my $vpncollectd;
736 my %ccdhash=();
737
738 open(COLLECTDVPN, ">${General::swroot}/ovpn/collectd.vpn") or die "Unable to open collectd.vpn: $!";
739 print COLLECTDVPN "Loadplugin openvpn\n";
740 print COLLECTDVPN "\n";
741 print COLLECTDVPN "<Plugin openvpn>\n";
742 print COLLECTDVPN "Statusfile \"/var/run/ovpnserver.log\"\n";
743
744 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
745 foreach my $key (keys %ccdhash) {
746 if ($ccdhash{$key}[0] eq 'on' && $ccdhash{$key}[3] eq 'net') {
747 print COLLECTDVPN "Statusfile \"/var/run/openvpn/$ccdhash{$key}[1]-n2n\"\n";
748 }
749 }
750
751 print COLLECTDVPN "</Plugin>\n";
752 close(COLLECTDVPN);
753
754 # Reload collectd afterwards
2feacd98 755 &General::system("/usr/local/bin/collectdctrl", "restart");
775b4494 756}
7c1d9faf 757
c6c9630e
MT		 758#hier die refresh page
759if ( -e "${General::swroot}/ovpn/gencanow") {
760 my $refresh = '';
761 $refresh = "<meta http-equiv='refresh' content='15;' />";
762 &Header::showhttpheaders();
763 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
764 &Header::openbigbox('100%', 'center');
765 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
766 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
767 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
768 &Header::closebox();
769 &Header::closebigbox();
770 &Header::closepage();
771 exit (0);
772}
773##hier die refresh page
774
6e13d0a5
MT		 775
776###
777### OpenVPN Server Control
778###
779if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
780 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
781 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT		 782 #start openvpn server
783 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 784 &emptyserverlog();
2feacd98 785 &General::system("/usr/local/bin/openvpnctrl", "-s");
66c36198 786 }
6e13d0a5
MT		 787 #stop openvpn server
788 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
2feacd98 789 &General::system("/usr/local/bin/openvpnctrl", "-k");
66c36198
PM		 790 &emptyserverlog();
791 }
6e13d0a5 792# #restart openvpn server
8c877a82 793# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
66c36198
PM		 794#workarund, till SIGHUP also works when running as nobody
795# system('/usr/local/bin/openvpnctrl', '-r');
796# &emptyserverlog();
797# }
6e13d0a5
MT		 798}
799
800###
801### Save Advanced options
802###
803
804if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
805 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
806 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
807 #DAN this value has to leave.
808#new settings for daemon
809 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
810 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
811 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
812 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
813 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
814 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
6a9d9ff4 815 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
ffbe77c8 816 $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'};
6e13d0a5
MT		 817 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
818 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
819 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535
MT		 820 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
821 my @temp=();
66c36198 822
a79fa1d6
JPT		 823 if ($cgiparams{'FRAGMENT'} eq '') {
824 delete $vpnsettings{'FRAGMENT'};
825 } else {
66c36198 826 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
a79fa1d6
JPT		 827 $errormessage = "Incorrect value, please insert only numbers.";
828 goto ADV_ERROR;
829 } else {
830 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
831 }
832 }
49abe7af 833
a79fa1d6 834 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 835 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT		 836 } else {
837 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
838 }
2ee746be 839
6e13d0a5 840 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
81da1b01 841 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
6e13d0a5
MT		 842 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
843 goto ADV_ERROR;
844 }
845 }
846 if ($cgiparams{'DHCP_DNS'} ne ''){
847 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
848 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
849 goto ADV_ERROR;
850 }
851 }
852 if ($cgiparams{'DHCP_WINS'} ne ''){
853 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
854 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT		 855 goto ADV_ERROR;
856 }
857 }
858 if ($cgiparams{'ROUTES_PUSH'} ne ''){
859 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
860 undef $vpnsettings{'ROUTES_PUSH'};
66c36198 861
8c877a82 862 foreach my $tmpip (@temp)
54fd0535
MT		 863 {
864 s/^\s+//g; s/\s+$//g;
66c36198 865
8c877a82 866 if ($tmpip)
54fd0535 867 {
66c36198 868 $tmpip=~s/\s*$//g;
8c877a82
AM		 869 unless (&General::validipandmask($tmpip)) {
870 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
871 goto ADV_ERROR;
54fd0535 872 }
8c877a82 873 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
66c36198 874
54fd0535
MT		 875 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
876 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
8c877a82
AM		 877 goto ADV_ERROR;
878 }
66c36198 879# a.marx ccd
8c877a82
AM		 880 my %ccdroutehash=();
881 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
882 foreach my $key (keys %ccdroutehash) {
66c36198 883 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
8c877a82
AM		 884 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
885 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
886 goto ADV_ERROR;
887 }
888 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
889 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
890 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
891 goto ADV_ERROR;
892 }
893 }
54fd0535 894 }
66c36198 895
8c877a82 896# ccd end
66c36198 897
8c877a82 898 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
54fd0535 899 }
8c877a82
AM		 900 }
901 &write_routepushfile;
54fd0535 902 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP		 903 }
904 else {
905 undef $vpnsettings{'ROUTES_PUSH'};
906 &write_routepushfile;
6e13d0a5 907 }
ba50f66d 908 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
6e13d0a5
MT		 909 $errormessage = $Lang::tr{'invalid input for max clients'};
910 goto ADV_ERROR;
911 }
912 if ($cgiparams{'KEEPALIVE_1'} ne '') {
66c36198 913 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
6e13d0a5
MT		 914 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
915 goto ADV_ERROR;
916 }
917 }
918 if ($cgiparams{'KEEPALIVE_2'} ne ''){
66c36198 919 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
6e13d0a5
MT		 920 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
921 goto ADV_ERROR;
922 }
923 }
924 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
925 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
66c36198 926 goto ADV_ERROR;
6e13d0a5 927 }
6e13d0a5 928 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 929 &writeserverconf();#hier ok
6e13d0a5
MT		 930}
931
ce9abb66 932###
7c1d9faf 933# m.a.d net2net
ce9abb66
AH		 934###
935
936if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
937{
c6c9630e 938
ce9abb66
AH		 939my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
940my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 941my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 942my $tunmtu = '';
531f0835
AH		 943
944unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
66c36198 945unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH		 946
947 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
66c36198 948
ce9abb66 949 flock SERVERCONF, 2;
66c36198
PM		 950 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
951 print SERVERCONF "\n";
b278daf3 952 print SERVERCONF "# User Security\n";
ce9abb66
AH		 953 print SERVERCONF "user nobody\n";
954 print SERVERCONF "group nobody\n";
955 print SERVERCONF "persist-tun\n";
956 print SERVERCONF "persist-key\n";
7c1d9faf 957 print SERVERCONF "script-security 2\n";
66c36198 958 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
c125d8a2
SS		 959
960 if ($cgiparams{'REMOTE'} ne '') {
ce9abb66 961 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
c125d8a2
SS		 962 }
963
b278daf3 964 print SERVERCONF "float\n";
66c36198
PM		 965 print SERVERCONF "# IP adresses of the VPN Subnet\n";
966 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
967 print SERVERCONF "# Client Gateway Network\n";
54fd0535 968 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
2913185a 969 print SERVERCONF "up \"/etc/init.d/static-routes start\"\n";
66c36198
PM		 970 print SERVERCONF "# tun Device\n";
971 print SERVERCONF "dev tun\n";
5795fc1b
AM		 972 print SERVERCONF "#Logfile for statistics\n";
973 print SERVERCONF "status-version 1\n";
87fe47e9 974 print SERVERCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
66c36198
PM		 975 print SERVERCONF "# Port and Protokol\n";
976 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
5795fc1b 977
60f396d7 978 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1580d3b1 979 print SERVERCONF "proto tcp4-server\n";
60f396d7 980 print SERVERCONF "# Packet size\n";
d96c89eb 981 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 982 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 983 }
66c36198 984
60f396d7 985 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1580d3b1 986 print SERVERCONF "proto udp4\n";
60f396d7
AH		 987 print SERVERCONF "# Paketsize\n";
988 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
989 print SERVERCONF "tun-mtu $tunmtu\n";
66c36198 990 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
d6989b4b 991 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; } else { print SERVERCONF "mssfix 0\n" };
d96c89eb 992 }
1647059d 993
66c36198
PM		 994 print SERVERCONF "# Auth. Server\n";
995 print SERVERCONF "tls-server\n";
996 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
997 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
998 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 999 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
66c36198 1000 print SERVERCONF "# Cipher\n";
4c962356 1001 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
52f61e49
EKD		 1002
1003 # If GCM cipher is used, do not use --auth
1004 if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1005 ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1006 ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1007 print SERVERCONF unless "# HMAC algorithm\n";
1008 print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n";
49abe7af 1009 } else {
52f61e49
EKD		 1010 print SERVERCONF "# HMAC algorithm\n";
1011 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
49abe7af 1012 }
52f61e49 1013
942446b5
EK		 1014 # Set TLSv1.2 as minimum
1015 print SERVERCONF "tls-version-min 1.2\n";
1016
ce9abb66 1017 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1018 print SERVERCONF "# Enable Compression\n";
66298ef2 1019 print SERVERCONF "comp-lzo\n";
b278daf3 1020 }
66c36198
PM		 1021 print SERVERCONF "# Debug Level\n";
1022 print SERVERCONF "verb 3\n";
1023 print SERVERCONF "# Tunnel check\n";
1024 print SERVERCONF "keepalive 10 60\n";
1025 print SERVERCONF "# Start as daemon\n";
1026 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1027 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1028 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT		 1029 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1030 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH		 1031 close(SERVERCONF);
1032
1033}
1034
1035###
7c1d9faf 1036# m.a.d net2net
ce9abb66 1037###
7c1d9faf 1038
ce9abb66
AH		 1039if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1040{
4c962356 1041
ce9abb66 1042 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 1043 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1044 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 1045 my $tunmtu = '';
66c36198 1046
531f0835
AH		 1047unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1048unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
66c36198 1049
ce9abb66 1050 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
66c36198 1051
ce9abb66 1052 flock CLIENTCONF, 2;
7c1d9faf 1053 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
66c36198 1054 print CLIENTCONF "#\n";
b278daf3 1055 print CLIENTCONF "# User Security\n";
ce9abb66
AH		 1056 print CLIENTCONF "user nobody\n";
1057 print CLIENTCONF "group nobody\n";
1058 print CLIENTCONF "persist-tun\n";
1059 print CLIENTCONF "persist-key\n";
7c1d9faf 1060 print CLIENTCONF "script-security 2\n";
66c36198 1061 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 1062 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 1063 print CLIENTCONF "float\n";
66c36198
PM		 1064 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1065 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1066 print CLIENTCONF "# Server Gateway Network\n";
1067 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
ebcecb4b 1068 print CLIENTCONF "up \"/etc/init.d/static-routes start\"\n";
66c36198
PM		 1069 print CLIENTCONF "# tun Device\n";
1070 print CLIENTCONF "dev tun\n";
35a21a25
AM		 1071 print CLIENTCONF "#Logfile for statistics\n";
1072 print CLIENTCONF "status-version 1\n";
1073 print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
66c36198
PM		 1074 print CLIENTCONF "# Port and Protokol\n";
1075 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH		 1076
1077 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1580d3b1 1078 print CLIENTCONF "proto tcp4-client\n";
60f396d7 1079 print CLIENTCONF "# Packet size\n";
d96c89eb 1080 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 1081 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1082 }
66c36198 1083
60f396d7 1084 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1580d3b1 1085 print CLIENTCONF "proto udp4\n";
60f396d7
AH		 1086 print CLIENTCONF "# Paketsize\n";
1087 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1088 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 1089 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
d6989b4b 1090 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; } else { print CLIENTCONF "mssfix 0\n" };
d96c89eb 1091 }
1647059d 1092
b66b02ab
EK		 1093 # Check host certificate if X509 is RFC3280 compliant.
1094 # If not, old --ns-cert-type directive will be used.
1095 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2feacd98
SS		 1096 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1097 if ( ! grep(/TLS Web Server Authentication/, @hostcert)) {
b66b02ab
EK		 1098 print CLIENTCONF "ns-cert-type server\n";
1099 } else {
1100 print CLIENTCONF "remote-cert-tls server\n";
1101 }
66c36198
PM		 1102 print CLIENTCONF "# Auth. Client\n";
1103 print CLIENTCONF "tls-client\n";
1104 print CLIENTCONF "# Cipher\n";
4c962356 1105 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
ce9abb66 1106 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
52f61e49
EKD		 1107
1108 # If GCM cipher is used, do not use --auth
1109 if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') ||
1110 ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') ||
1111 ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) {
1112 print CLIENTCONF unless "# HMAC algorithm\n";
1113 print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n";
49abe7af 1114 } else {
52f61e49
EKD		 1115 print CLIENTCONF "# HMAC algorithm\n";
1116 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
49abe7af 1117 }
52f61e49 1118
942446b5
EK		 1119 # Set TLSv1.2 as minimum
1120 print CLIENTCONF "tls-version-min 1.2\n";
1121
ce9abb66 1122 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1123 print CLIENTCONF "# Enable Compression\n";
66298ef2 1124 print CLIENTCONF "comp-lzo\n";
4c962356 1125 }
66c36198
PM		 1126 print CLIENTCONF "# Debug Level\n";
1127 print CLIENTCONF "verb 3\n";
1128 print CLIENTCONF "# Tunnel check\n";
1129 print CLIENTCONF "keepalive 10 60\n";
1130 print CLIENTCONF "# Start as daemon\n";
ce9abb66 1131 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
66c36198
PM		 1132 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1133 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT		 1134 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1135 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 1136 close(CLIENTCONF);
c6c9630e 1137
ce9abb66 1138}
400c8afd 1139
6e13d0a5
MT		 1140###
1141### Save main settings
1142###
ce9abb66 1143
6e13d0a5
MT		 1144if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1145 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT		 1146 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1147 #DAN this value has to leave.
1148 if ($cgiparams{'ENABLED'} eq 'on'){
1149 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1150 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 1151 goto SETTINGS_ERROR;
6e13d0a5
MT		 1152 }
1153 }
f7fb5bc5 1154
6e13d0a5 1155 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e 1156 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
4c962356 1157 goto SETTINGS_ERROR;
c6c9630e
MT		 1158 }
1159 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
66c36198
PM		 1160
1161 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
c6c9630e
MT		 1162 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1163 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1164 goto SETTINGS_ERROR;
1165 }
66c36198
PM		 1166
1167 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
c6c9630e
MT		 1168 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1169 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1170 goto SETTINGS_ERROR;
1171 }
1172
66c36198 1173 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
c6c9630e
MT		 1174 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1175 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1176 goto SETTINGS_ERROR;
1177 }
66c36198
PM		 1178
1179 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
c6c9630e
MT		 1180 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1181 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1182 goto SETTINGS_ERROR;
1183 }
1184 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1185 while (<ALIASES>)
1186 {
1187 chomp($_);
1188 my @tempalias = split(/\,/,$_);
1189 if ($tempalias[1] eq 'on') {
66c36198 1190 if (&General::IpInSubnet ($tempalias[0] ,
c6c9630e
MT		 1191 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1192 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
66c36198 1193 }
c6c9630e
MT		 1194 }
1195 }
1196 close(ALIASES);
6e13d0a5 1197 if ($errormessage ne ''){
c6c9630e 1198 goto SETTINGS_ERROR;
6e13d0a5
MT		 1199 }
1200 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1201 $errormessage = $Lang::tr{'invalid input'};
1202 goto SETTINGS_ERROR;
1203 }
1204 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1205 $errormessage = $Lang::tr{'invalid mtu input'};
1206 goto SETTINGS_ERROR;
1207 }
66c36198 1208
6e13d0a5 1209 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT		 1210 $errormessage = $Lang::tr{'invalid port'};
1211 goto SETTINGS_ERROR;
6e13d0a5 1212 }
8c252e6a 1213
b21a6319
EK		 1214 # Create ta.key for tls-auth if not presant
1215 if ($cgiparams{'TLSAUTH'} eq 'on') {
1216 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
2feacd98 1217 # This system call is safe, because all arguements are passed as an array.
acbd6ff4 1218 system("/usr/sbin/openvpn", "--genkey", "secret", "${General::swroot}/ovpn/certs/ta.key");
b21a6319
EK		 1219 if ($?) {
1220 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1221 goto SETTINGS_ERROR;
1222 }
1223 }
1224 }
1225
6e13d0a5
MT		 1226 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1227 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1228 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1229 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1230#new settings for daemon
1231 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
6e13d0a5
MT		 1232 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1233 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1234 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1235 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1236 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
86308adb 1237 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
0c4ffc69 1238 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
3ffee04b
CS		 1239#wrtie enable
1240
2feacd98
SS		 1241 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {
1242 &General::system("touch", "${General::swroot}/ovpn/enable_blue");
1243 } else {
274ca65b 1244 unlink("${General::swroot}/ovpn/enable_blue");
2feacd98
SS		 1245 }
1246
1247 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {
1248 &General::system("touch", "${General::swroot}/ovpn/enable_orange");
1249 } else {
1250 unlink("${General::swroot}/ovpn/enable_orange");
1251 }
1252
1253 if ( $vpnsettings{'ENABLED'} eq 'on' ) {
1254 &General::system("touch", "${General::swroot}/ovpn/enable");
1255 } else {
1256 unlink("${General::swroot}/ovpn/enable");
1257 }
1258
66c36198 1259#new settings for daemon
6e13d0a5 1260 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 1261 &writeserverconf();#hier ok
6e13d0a5
MT		 1262SETTINGS_ERROR:
1263###
1264### Reset all step 2
1265###
4c962356 1266}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
6e13d0a5
MT		 1267 my $file = '';
1268 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1269
1e499e90 1270 # Kill all N2N connections
2feacd98 1271 &General::system("/usr/local/bin/openvpnctrl", "-kn2n");
1e499e90 1272
6e13d0a5 1273 foreach my $key (keys %confighash) {
2f36a7b4
MT		 1274 my $name = $confighash{$cgiparams{'$key'}}[1];
1275
c6c9630e
MT		 1276 if ($confighash{$key}[4] eq 'cert') {
1277 delete $confighash{$cgiparams{'$key'}};
1278 }
2f36a7b4 1279
2feacd98 1280 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$name");
6e13d0a5
MT		 1281 }
1282 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
49abe7af 1283 unlink $file;
6e13d0a5
MT		 1284 }
1285 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
49abe7af 1286 unlink $file;
6e13d0a5
MT		 1287 }
1288 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
49abe7af 1289 unlink $file;
6e13d0a5 1290 }
4c962356 1291 &cleanssldatabase();
6e13d0a5
MT		 1292 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1293 print FILE "";
1294 close FILE;
1295 }
49abe7af
EK		 1296 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1297 print FILE "";
1298 close FILE;
1299 }
1300 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1301 print FILE "";
1302 close FILE;
1303 }
1304 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1305 unlink $file
1306 }
5795fc1b
AM		 1307 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1308 unlink $file
1309 }
49abe7af
EK		 1310 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1311 print FILE "";
1312 close FILE;
1313 }
1314 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1315 print FILE "";
1316 close FILE;
1317 }
1318 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
2feacd98 1319 unlink($file);
49abe7af
EK		 1320 }
1321
2f36a7b4
MT		 1322 # Remove everything from the collectd configuration
1323 &writecollectdconf();
1324
c6c9630e 1325 #&writeserverconf();
6e13d0a5
MT		 1326###
1327### Reset all step 1
1328###
4c962356 1329}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
6e13d0a5 1330 &Header::showhttpheaders();
4c962356
EK		 1331 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1332 &Header::openbigbox('100%', 'left', '', '');
1333 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1334 print <<END;
1335 <form method='post'>
1336 <table width='100%'>
1337 <tr>
1338 <td align='center'>
1339 <input type='hidden' name='AREUSURE' value='yes' />
49abe7af 1340 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
4c962356
EK		 1341 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1342 </tr>
1343 <tr>
1344 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1345 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1346 </tr>
1347 </table>
1348 </form>
6e13d0a5
MT		 1349END
1350 ;
1351 &Header::closebox();
1352 &Header::closebigbox();
1353 &Header::closepage();
1354 exit (0);
1355
4c962356
EK		 1356###
1357### Generate DH key step 2
1358###
1359} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
49abe7af 1360 # Delete if old key exists
4c962356
EK		 1361 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1362 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1363 }
1364 # Create Diffie Hellmann Parameter
2feacd98
SS		 1365 # The system call is safe, because all arguments are passed as an array.
1366 system("/usr/bin/openssl", "dhparam", "-out", "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
4c962356
EK		 1367 if ($?) {
1368 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1369 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1370 }
1371
1372###
1373### Generate DH key step 1
1374###
1375} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1376 &Header::showhttpheaders();
1377 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1378 &Header::openbigbox('100%', 'LEFT', '', '');
1379 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1380 print <<END;
1381 <table width='100%'>
1382 <tr>
f527e53f 1383 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
49abe7af 1384 </tr>
4c962356
EK		 1385 <tr>
1386 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1387 <td align='center'>
1388 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1389 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1390 <select name='DHLENGHT'>
4c962356
EK		 1391 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1392 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1393 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1394 </select>
1395 </td>
1396 </tr>
1397 <tr><td colspan='4'><br></td></tr>
1398 </table>
1399 <table width='100%'>
1400 <tr>
49abe7af 1401 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
4c962356 1402 </tr>
49abe7af
EK		 1403 <tr>
1404 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1405 </tr>
1406 <tr><td colspan='2'><br></td></tr>
4c962356
EK		 1407 <tr>
1408 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1409 </form>
1410 </tr>
1411 </table>
1412
1413END
1414 ;
1415 &Header::closebox();
1416 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1417 &Header::closebigbox();
1418 &Header::closepage();
1419 exit (0);
1420
1421###
1422### Upload DH key
1423###
1424} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
2ad1b18b 1425 unless (ref ($cgiparams{'FH'})) {
4c962356
EK		 1426 $errormessage = $Lang::tr{'there was no file upload'};
1427 goto UPLOADCA_ERROR;
1428 }
49abe7af 1429 # Move uploaded dh key to a temporary file
4c962356
EK		 1430 (my $fh, my $filename) = tempfile( );
1431 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1432 $errormessage = $!;
49abe7af 1433 goto UPLOADCA_ERROR;
4c962356 1434 }
2feacd98
SS		 1435 my @temp = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$filename");
1436 if ( ! grep(/DH Parameters: \((2048|3072|4096) bit\)/, @temp)) {
4c962356
EK		 1437 $errormessage = $Lang::tr{'not a valid dh key'};
1438 unlink ($filename);
1439 goto UPLOADCA_ERROR;
1440 } else {
cc79d281
SS		 1441 # Delete if old key exists
1442 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1443 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
4c962356 1444 }
cc79d281
SS		 1445
1446 unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}")) {
49abe7af
EK		 1447 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1448 unlink ($filename);
1449 goto UPLOADCA_ERROR;
cc79d281 1450 }
4c962356 1451 }
6e13d0a5
MT		 1452###
1453### Upload CA Certificate
1454###
1455} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1456 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1457
1458 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1459 $errormessage = $Lang::tr{'name must only contain characters'};
1460 goto UPLOADCA_ERROR;
1461 }
1462
1463 if (length($cgiparams{'CA_NAME'}) >60) {
1464 $errormessage = $Lang::tr{'name too long'};
1465 goto VPNCONF_ERROR;
1466 }
1467
1468 if ($cgiparams{'CA_NAME'} eq 'ca') {
1469 $errormessage = $Lang::tr{'name is invalid'};
4c962356 1470 goto UPLOADCA_ERROR;
6e13d0a5
MT		 1471 }
1472
1473 # Check if there is no other entry with this name
1474 foreach my $key (keys %cahash) {
c6c9630e
MT		 1475 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1476 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1477 goto UPLOADCA_ERROR;
1478 }
6e13d0a5
MT		 1479 }
1480
2ad1b18b 1481 unless (ref ($cgiparams{'FH'})) {
c6c9630e
MT		 1482 $errormessage = $Lang::tr{'there was no file upload'};
1483 goto UPLOADCA_ERROR;
6e13d0a5
MT		 1484 }
1485 # Move uploaded ca to a temporary file
1486 (my $fh, my $filename) = tempfile( );
1487 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT		 1488 $errormessage = $!;
1489 goto UPLOADCA_ERROR;
6e13d0a5 1490 }
2feacd98
SS		 1491 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "$filename");
1492 if ( ! grep(/CA:TRUE/i, @temp )) {
c6c9630e
MT		 1493 $errormessage = $Lang::tr{'not a valid ca certificate'};
1494 unlink ($filename);
1495 goto UPLOADCA_ERROR;
6e13d0a5 1496 } else {
cc79d281 1497 unless(move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem")) {
c6c9630e
MT		 1498 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1499 unlink ($filename);
1500 goto UPLOADCA_ERROR;
1501 }
6e13d0a5
MT		 1502 }
1503
274ca65b 1504 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
2feacd98
SS		 1505 my $casubject;
1506
1507 foreach my $line (@casubject) {
1508 if ($line =~ /Subject: (.*)[\n]/) {
1509 $casubject = $1;
1510 $casubject =~ s+/Email+, E+;
1511 $casubject =~ s/ ST=/ S=/;
1512
1513 last;
1514 }
1515 }
1516
6e13d0a5
MT		 1517 $casubject = &Header::cleanhtml($casubject);
1518
1519 my $key = &General::findhasharraykey (\%cahash);
1520 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1521 $cahash{$key}[1] = $casubject;
1522 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT		 1523# system('/usr/local/bin/ipsecctrl', 'R');
1524
6e13d0a5
MT		 1525 UPLOADCA_ERROR:
1526
1527###
1528### Display ca certificate
1529###
1530} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT		 1531 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1532
1533 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1534 &Header::showhttpheaders();
4c962356 1535 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT		 1536 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1537 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
2feacd98 1538 my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
8c946d1c
MT		 1539 my $output = &Header::cleanhtml(join("", @output),"y");
1540 print "<pre>$output</pre>\n";
c6c9630e
MT		 1541 &Header::closebox();
1542 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1543 &Header::closebigbox();
1544 &Header::closepage();
1545 exit(0);
1546 } else {
1547 $errormessage = $Lang::tr{'invalid key'};
1548 }
1549
6e13d0a5
MT		 1550###
1551### Download ca certificate
1552###
1553} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1554 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1555
1556 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1557 print "Content-Type: application/octet-stream\r\n";
1558 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
2feacd98
SS		 1559
1560 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1561 print "@tmp";
1562
6e13d0a5
MT		 1563 exit(0);
1564 } else {
1565 $errormessage = $Lang::tr{'invalid key'};
1566 }
1567
1568###
1569### Remove ca certificate (step 2)
1570###
1571} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1572 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1573 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1574
1575 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1576 foreach my $key (keys %confighash) {
2feacd98
SS		 1577 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1578 if (grep(/: OK/, @test)) {
c6c9630e
MT		 1579 # Delete connection
1580# if ($vpnsettings{'ENABLED'} eq 'on' ||
1581# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1582# system('/usr/local/bin/ipsecctrl', 'D', $key);
1583# }
6e13d0a5
MT		 1584 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1585 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1586 delete $confighash{$key};
1587 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1588# &writeipsecfiles();
6e13d0a5
MT		 1589 }
1590 }
1591 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1592 delete $cahash{$cgiparams{'KEY'}};
1593 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1594# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT		 1595 } else {
1596 $errormessage = $Lang::tr{'invalid key'};
1597 }
1598###
1599### Remove ca certificate (step 1)
1600###
1601} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1602 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1603 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1604
1605 my $assignedcerts = 0;
1606 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1607 foreach my $key (keys %confighash) {
2feacd98
SS		 1608 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
1609 if (grep(/: OK/, @test)) {
6e13d0a5
MT		 1610 $assignedcerts++;
1611 }
1612 }
1613 if ($assignedcerts) {
1614 &Header::showhttpheaders();
4c962356 1615 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT		 1616 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1617 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
4c962356 1618 print <<END;
6e13d0a5
MT		 1619 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1620 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1621 <tr><td align='center'>
1622 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1623 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1624 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1625 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1626 </form></table>
1627END
1628 ;
1629 &Header::closebox();
1630 &Header::closebigbox();
1631 &Header::closepage();
1632 exit (0);
1633 } else {
1634 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1635 delete $cahash{$cgiparams{'KEY'}};
1636 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1637# system('/usr/local/bin/ipsecctrl', 'R');
1638 }
1639 } else {
1640 $errormessage = $Lang::tr{'invalid key'};
1641 }
1642
1643###
1644### Display root certificate
1645###
c6c9630e
MT		 1646}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1647 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
2feacd98 1648 my @output;
c6c9630e 1649 &Header::showhttpheaders();
4c962356 1650 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT		 1651 &Header::openbigbox('100%', 'LEFT', '', '');
1652 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1653 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
2feacd98 1654 @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
c6c9630e
MT		 1655 } else {
1656 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
2feacd98 1657 @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1658 }
8c946d1c
MT		 1659 my $output = &Header::cleanhtml(join("", @output), "y");
1660 print "<pre>$output</pre>\n";
c6c9630e
MT		 1661 &Header::closebox();
1662 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1663 &Header::closebigbox();
1664 &Header::closepage();
1665 exit(0);
1666
6e13d0a5
MT		 1667###
1668### Download root certificate
1669###
1670}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1671 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1672 print "Content-Type: application/octet-stream\r\n";
1673 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
2feacd98
SS		 1674
1675 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
1676 print "@tmp";
1677
6e13d0a5
MT		 1678 exit(0);
1679 }
66c36198 1680
6e13d0a5
MT		 1681###
1682### Download host certificate
1683###
1684}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1685 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1686 print "Content-Type: application/octet-stream\r\n";
1687 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
2feacd98
SS		 1688
1689 my @tmp = &General::system_output("/usr/bin/openssl", "x509", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
1690 print "@tmp";
1691
6e13d0a5
MT		 1692 exit(0);
1693 }
f7fb5bc5 1694
fd5ccb2d
EK		 1695###
1696### Download tls-auth key
1697###
1698}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1699 if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1700 print "Content-Type: application/octet-stream\r\n";
1701 print "Content-Disposition: filename=ta.key\r\n\r\n";
2feacd98
SS		 1702
1703 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
1704 my @tmp = <FILE>;
1705 close(FILE);
1706
1707 print "@tmp";
1708
fd5ccb2d
EK		 1709 exit(0);
1710 }
1711
6e13d0a5
MT		 1712###
1713### Form for generating a root certificate
1714###
1715}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1716 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1717
1718 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1719 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1720 $errormessage = $Lang::tr{'valid root certificate already exists'};
1721 $cgiparams{'ACTION'} = '';
1722 goto ROOTCERT_ERROR;
1723 }
1724
1725 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1726 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1727 my $ipaddr = <IPADDR>;
1728 close IPADDR;
1729 chomp ($ipaddr);
1730 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1731 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1732 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1733 }
1734 }
1735 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
2ad1b18b 1736 unless (ref ($cgiparams{'FH'})) {
6e13d0a5
MT		 1737 $errormessage = $Lang::tr{'there was no file upload'};
1738 goto ROOTCERT_ERROR;
1739 }
1740
1741 # Move uploaded certificate request to a temporary file
1742 (my $fh, my $filename) = tempfile( );
1743 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1744 $errormessage = $!;
1745 goto ROOTCERT_ERROR;
1746 }
1747
1748 # Create a temporary dirctory
1749 my $tempdir = tempdir( CLEANUP => 1 );
1750
1751 # Extract the CA certificate from the file
1752 my $pid = open(OPENSSL, "|-");
1753 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1754 if ($pid) { # parent
1755 if ($cgiparams{'P12_PASS'} ne '') {
1756 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1757 }
1758 close (OPENSSL);
1759 if ($?) {
1760 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1761 unlink ($filename);
1762 goto ROOTCERT_ERROR;
1763 }
1764 } else { # child
1765 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1766 '-in', $filename,
1767 '-out', "$tempdir/cacert.pem")) {
1768 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1769 unlink ($filename);
1770 goto ROOTCERT_ERROR;
1771 }
1772 }
1773
1774 # Extract the Host certificate from the file
1775 $pid = open(OPENSSL, "|-");
1776 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1777 if ($pid) { # parent
1778 if ($cgiparams{'P12_PASS'} ne '') {
1779 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1780 }
1781 close (OPENSSL);
1782 if ($?) {
1783 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1784 unlink ($filename);
1785 goto ROOTCERT_ERROR;
1786 }
1787 } else { # child
1788 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1789 '-in', $filename,
1790 '-out', "$tempdir/hostcert.pem")) {
1791 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1792 unlink ($filename);
1793 goto ROOTCERT_ERROR;
1794 }
1795 }
1796
1797 # Extract the Host key from the file
1798 $pid = open(OPENSSL, "|-");
1799 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1800 if ($pid) { # parent
1801 if ($cgiparams{'P12_PASS'} ne '') {
1802 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1803 }
1804 close (OPENSSL);
1805 if ($?) {
1806 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1807 unlink ($filename);
1808 goto ROOTCERT_ERROR;
1809 }
1810 } else { # child
1811 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1812 '-nodes',
1813 '-in', $filename,
1814 '-out', "$tempdir/serverkey.pem")) {
1815 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1816 unlink ($filename);
1817 goto ROOTCERT_ERROR;
1818 }
1819 }
1820
cc79d281 1821 unless(move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem")) {
6e13d0a5
MT		 1822 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1823 unlink ($filename);
1824 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1825 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1826 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1827 goto ROOTCERT_ERROR;
1828 }
1829
cc79d281 1830 unless(move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem")) {
6e13d0a5
MT		 1831 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1832 unlink ($filename);
1833 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1834 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1835 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1836 goto ROOTCERT_ERROR;
1837 }
1838
cc79d281 1839 unless(move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem")) {
6e13d0a5
MT		 1840 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1841 unlink ($filename);
1842 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1843 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1844 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1845 goto ROOTCERT_ERROR;
1846 }
1847
1848 goto ROOTCERT_SUCCESS;
1849
1850 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1851
1852 # Validate input since the form was submitted
1853 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1854 $errormessage = $Lang::tr{'organization cant be empty'};
1855 goto ROOTCERT_ERROR;
1856 }
1857 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1858 $errormessage = $Lang::tr{'organization too long'};
1859 goto ROOTCERT_ERROR;
1860 }
1861 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1862 $errormessage = $Lang::tr{'invalid input for organization'};
1863 goto ROOTCERT_ERROR;
1864 }
1865 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1866 $errormessage = $Lang::tr{'hostname cant be empty'};
1867 goto ROOTCERT_ERROR;
1868 }
1869 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1870 $errormessage = $Lang::tr{'invalid input for hostname'};
1871 goto ROOTCERT_ERROR;
1872 }
1873 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1874 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1875 goto ROOTCERT_ERROR;
1876 }
1877 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1878 $errormessage = $Lang::tr{'e-mail address too long'};
1879 goto ROOTCERT_ERROR;
1880 }
1881 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1882 $errormessage = $Lang::tr{'invalid input for department'};
1883 goto ROOTCERT_ERROR;
1884 }
1885 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1886 $errormessage = $Lang::tr{'invalid input for city'};
1887 goto ROOTCERT_ERROR;
1888 }
1889 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1890 $errormessage = $Lang::tr{'invalid input for state or province'};
1891 goto ROOTCERT_ERROR;
1892 }
1893 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1894 $errormessage = $Lang::tr{'invalid input for country'};
1895 goto ROOTCERT_ERROR;
1896 }
1897
1898 # Copy the cgisettings to vpnsettings and save the configfile
1899 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1900 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1901 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1902 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1903 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1904 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1905 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1906 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1907
1908 # Replace empty strings with a .
1909 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1910 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1911 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1912
1913 # refresh
c6c9630e 1914 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
66c36198 1915
6e13d0a5
MT		 1916 # Create the CA certificate
1917 my $pid = open(OPENSSL, "|-");
1918 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1919 if ($pid) { # parent
1920 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1921 print OPENSSL "$state\n";
1922 print OPENSSL "$city\n";
1923 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1924 print OPENSSL "$ou\n";
1925 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1926 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1927 close (OPENSSL);
1928 if ($?) {
1929 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1930 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1931 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1932 goto ROOTCERT_ERROR;
1933 }
1934 } else { # child
badd8c1c 1935 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
49abe7af 1936 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
6e13d0a5
MT		 1937 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1938 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1939 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1940 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1941 goto ROOTCERT_ERROR;
1942 }
1943 }
1944
1945 # Create the Host certificate request
1946 $pid = open(OPENSSL, "|-");
1947 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1948 if ($pid) { # parent
1949 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1950 print OPENSSL "$state\n";
1951 print OPENSSL "$city\n";
1952 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1953 print OPENSSL "$ou\n";
1954 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1955 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1956 print OPENSSL ".\n";
1957 print OPENSSL ".\n";
1958 close (OPENSSL);
1959 if ($?) {
1960 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1961 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1962 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1963 goto ROOTCERT_ERROR;
1964 }
1965 } else { # child
badd8c1c 1966 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4c962356 1967 '-newkey', 'rsa:2048',
6e13d0a5
MT		 1968 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1969 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1970 '-extensions', 'server',
1971 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1972 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1973 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1974 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1975 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1976 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1977 goto ROOTCERT_ERROR;
1978 }
1979 }
66c36198 1980
6e13d0a5 1981 # Sign the host certificate request
2feacd98 1982 # This system call is safe, because all argeuments are passed as an array.
6e13d0a5
MT		 1983 system('/usr/bin/openssl', 'ca', '-days', '999999',
1984 '-batch', '-notext',
1985 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1986 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1987 '-extensions', 'server',
1988 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1989 if ($?) {
1990 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1991 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1992 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1993 unlink ("${General::swroot}/ovpn/serverkey.pem");
1994 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1995 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1996 &newcleanssldatabase();
6e13d0a5
MT		 1997 goto ROOTCERT_ERROR;
1998 } else {
1999 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 2000 &deletebackupcert();
6e13d0a5
MT		 2001 }
2002
2003 # Create an empty CRL
2feacd98 2004 # System call is safe, because all arguments are passed as array.
6e13d0a5
MT		 2005 system('/usr/bin/openssl', 'ca', '-gencrl',
2006 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
2007 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
2008 if ($?) {
2009 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2010 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2011 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2012 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
66c36198 2013 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 2014 &cleanssldatabase();
6e13d0a5 2015 goto ROOTCERT_ERROR;
c6c9630e
MT		 2016# } else {
2017# &cleanssldatabase();
6e13d0a5 2018 }
ae04d0a3 2019 # Create ta.key for tls-auth
2feacd98 2020 # This system call is safe, because all arguments are passed as an array.
acbd6ff4 2021 system('/usr/sbin/openvpn', '--genkey', 'secret', "${General::swroot}/ovpn/certs/ta.key");
ae04d0a3
EK		 2022 if ($?) {
2023 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2024 &cleanssldatabase();
2025 goto ROOTCERT_ERROR;
2026 }
6e13d0a5 2027 # Create Diffie Hellmann Parameter
2feacd98 2028 # The system call is safe, because all arguments are passed as an array.
badd8c1c 2029 system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
6e13d0a5
MT		 2030 if ($?) {
2031 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2032 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
2033 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
2034 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
2035 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
2036 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 2037 &cleanssldatabase();
6e13d0a5 2038 goto ROOTCERT_ERROR;
c6c9630e
MT		 2039# } else {
2040# &cleanssldatabase();
4be45949 2041 }
6e13d0a5
MT		 2042 goto ROOTCERT_SUCCESS;
2043 }
2044 ROOTCERT_ERROR:
2045 if ($cgiparams{'ACTION'} ne '') {
2046 &Header::showhttpheaders();
4c962356 2047 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT		 2048 &Header::openbigbox('100%', 'LEFT', '', '');
2049 if ($errormessage) {
2050 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2051 print "<class name='base'>$errormessage";
2052 print "&nbsp;</class>";
2053 &Header::closebox();
2054 }
2055 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
49abe7af 2056 print <<END;
6e13d0a5
MT		 2057 <form method='post' enctype='multipart/form-data'>
2058 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
e3edceeb 2059 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
6e13d0a5
MT		 2060 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
2061 <td width='35%' colspan='2'>&nbsp;</td></tr>
e3edceeb 2062 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
6e13d0a5
MT		 2063 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
2064 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2065 <tr><td class='base'>$Lang::tr{'your e-mail'}:</td>
6e13d0a5
MT		 2066 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
2067 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2068 <tr><td class='base'>$Lang::tr{'your department'}:</td>
6e13d0a5
MT		 2069 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
2070 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2071 <tr><td class='base'>$Lang::tr{'city'}:</td>
6e13d0a5
MT		 2072 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
2073 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2074 <tr><td class='base'>$Lang::tr{'state or province'}:</td>
6e13d0a5
MT		 2075 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
2076 <td colspan='2'>&nbsp;</td></tr>
2077 <tr><td class='base'>$Lang::tr{'country'}:</td>
66c36198 2078 <td class='base'><select name='ROOTCERT_COUNTRY'>
6e13d0a5
MT		 2079
2080END
2081 ;
2082 foreach my $country (sort keys %{Countries::countries}) {
2083 print "<option value='$Countries::countries{$country}'";
2084 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
2085 print " selected='selected'";
2086 }
2087 print ">$country</option>";
2088 }
49abe7af 2089 print <<END;
6e13d0a5 2090 </select></td>
4c962356
EK		 2091 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
2092 <td class='base'><select name='DHLENGHT'>
4c962356
EK		 2093 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2094 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2095 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2096 </select>
2097 </td>
2098 </tr>
2099
6e13d0a5
MT		 2100 <tr><td>&nbsp;</td>
2101 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
66c36198 2102 <td>&nbsp;</td><td>&nbsp;</td></tr>
6e13d0a5 2103 <tr><td class='base' colspan='4' align='left'>
e3edceeb 2104 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
49abe7af
EK		 2105 <tr><td colspan='2'><br></td></tr>
2106 <table width='100%'>
2107 <tr>
2108 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2109 <td class='base'>$Lang::tr{'dh key warn'}</td>
4c962356 2110 </tr>
49abe7af
EK		 2111 <tr>
2112 <td class='base'>$Lang::tr{'dh key warn1'}</td>
4c962356 2113 </tr>
49abe7af
EK		 2114 <tr><td colspan='2'><br></td></tr>
2115 <tr>
2116 </table>
4c962356 2117
49abe7af 2118 <table width='100%'>
4c962356 2119 <tr><td colspan='4'><hr></td></tr>
e3edceeb 2120 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
6e13d0a5
MT		 2121 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2122 <td colspan='2'>&nbsp;</td></tr>
e3edceeb 2123 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
6e13d0a5
MT		 2124 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2125 <td colspan='2'>&nbsp;</td></tr>
2126 <tr><td>&nbsp;</td>
2127 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2128 <td colspan='2'>&nbsp;</td></tr>
2129 <tr><td class='base' colspan='4' align='left'>
e3edceeb 2130 <img src='/blob.gif' valign='top' alt='*' >&nbsp;$Lang::tr{'required field'}</td>
4c962356 2131 </tr>
6e13d0a5
MT		 2132 </form></table>
2133END
2134 ;
2135 &Header::closebox();
4c962356 2136 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT		 2137 &Header::closebigbox();
2138 &Header::closepage();
2139 exit(0)
2140 }
2141
2142 ROOTCERT_SUCCESS:
2feacd98 2143 &General::system("chmod", "600", "${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT		 2144# if ($vpnsettings{'ENABLED'} eq 'on' ||
2145# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2146# system('/usr/local/bin/ipsecctrl', 'S');
2147# }
6e13d0a5
MT		 2148
2149###
2150### Enable/Disable connection
2151###
ce9abb66
AH		 2152
2153###
7c1d9faf 2154# m.a.d net2net
ce9abb66
AH		 2155###
2156
6e13d0a5 2157}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
66c36198 2158
c6c9630e 2159 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 2160 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2feacd98
SS		 2161 my $n2nactive = '';
2162 my @ps = &General::system_output("/bin/ps", "ax");
2163
2164 if(grep(/$confighash{$cgiparams{'KEY'}}[1]/, @ps)) {
2165 $n2nactive = "1";
2166 }
66c36198 2167
6e13d0a5 2168 if ($confighash{$cgiparams{'KEY'}}) {
8c877a82
AM		 2169 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2170 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2171 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2172
8c877a82 2173 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2feacd98 2174 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
775b4494 2175 &writecollectdconf();
8c877a82
AM		 2176 }
2177 } else {
ce9abb66 2178
8c877a82
AM		 2179 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2180 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2181
8c877a82 2182 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
775b4494 2183 if ($n2nactive ne '') {
2feacd98 2184 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
775b4494
AM		 2185 &writecollectdconf();
2186 }
8c877a82 2187 }
775b4494 2188 }
ce9abb66 2189 }
6e13d0a5
MT		 2190
2191###
2192### Download OpenVPN client package
2193###
ce9abb66
AH		 2194
2195
6e13d0a5
MT		 2196} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2197 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2198 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2199 my $file = '';
2200 my $clientovpn = '';
2201 my @fileholder;
2202 my $tempdir = tempdir( CLEANUP => 1 );
2203 my $zippath = "$tempdir/";
ce9abb66
AH		 2204
2205###
7c1d9faf
AH		 2206# m.a.d net2net
2207###
ce9abb66
AH		 2208
2209if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
66c36198 2210
ce9abb66
AH		 2211 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2212 my $zippathname = "$zippath$zipname";
66c36198 2213 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
ce9abb66 2214 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 2215 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
66c36198 2216 my $tunmtu = '';
7c1d9faf 2217 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 2218 my $n2nfragment = '';
66c36198 2219
ce9abb66
AH		 2220 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2221 flock CLIENTCONF, 2;
66c36198 2222
ce9abb66 2223 my $zip = Archive::Zip->new();
7c1d9faf 2224 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 2225 print CLIENTCONF "# \n";
b278daf3 2226 print CLIENTCONF "# User Security\n";
ce9abb66
AH		 2227 print CLIENTCONF "user nobody\n";
2228 print CLIENTCONF "group nobody\n";
2229 print CLIENTCONF "persist-tun\n";
2230 print CLIENTCONF "persist-key\n";
7c1d9faf 2231 print CLIENTCONF "script-security 2\n";
66c36198 2232 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 2233 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 2234 print CLIENTCONF "float\n";
66c36198
PM		 2235 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2236 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2237 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 2238 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
66c36198
PM		 2239 print CLIENTCONF "# tun Device\n";
2240 print CLIENTCONF "dev tun\n";
35a21a25
AM		 2241 print CLIENTCONF "#Logfile for statistics\n";
2242 print CLIENTCONF "status-version 1\n";
2243 print CLIENTCONF "status /var/run/openvpn/$cgiparams{'NAME'}-n2n 10\n";
66c36198
PM		 2244 print CLIENTCONF "# Port and Protokoll\n";
2245 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2246
60f396d7 2247 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1580d3b1 2248 print CLIENTCONF "proto tcp4-client\n";
60f396d7 2249 print CLIENTCONF "# Packet size\n";
d96c89eb 2250 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 2251 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 2252 }
66c36198 2253
60f396d7 2254 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1580d3b1 2255 print CLIENTCONF "proto udp4\n";
60f396d7
AH		 2256 print CLIENTCONF "# Paketsize\n";
2257 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2258 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 2259 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
d6989b4b 2260 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";} else { print CLIENTCONF "mssfix 0\n"; }
d96c89eb 2261 }
b66b02ab
EK		 2262 # Check host certificate if X509 is RFC3280 compliant.
2263 # If not, old --ns-cert-type directive will be used.
2264 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2feacd98
SS		 2265 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2266 if (! grep(/TLS Web Server Authentication/, @hostcert)) {
b66b02ab
EK		 2267 print CLIENTCONF "ns-cert-type server\n";
2268 } else {
2269 print CLIENTCONF "remote-cert-tls server\n";
2270 }
66c36198
PM		 2271 print CLIENTCONF "# Auth. Client\n";
2272 print CLIENTCONF "tls-client\n";
49abe7af 2273 print CLIENTCONF "# Cipher\n";
4c962356 2274 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
66c36198 2275 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
ce9abb66
AH		 2276 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2277 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
49abe7af 2278 }
52f61e49
EKD		 2279
2280 # If GCM cipher is used, do not use --auth
2281 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
2282 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
2283 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
2284 print CLIENTCONF unless "# HMAC algorithm\n";
2285 print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n";
49abe7af 2286 } else {
52f61e49
EKD		 2287 print CLIENTCONF "# HMAC algorithm\n";
2288 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
49abe7af 2289 }
52f61e49 2290
4c962356 2291 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 2292 print CLIENTCONF "# Enable Compression\n";
66298ef2 2293 print CLIENTCONF "comp-lzo\n";
b278daf3 2294 }
66c36198
PM		 2295 print CLIENTCONF "# Debug Level\n";
2296 print CLIENTCONF "verb 3\n";
2297 print CLIENTCONF "# Tunnel check\n";
2298 print CLIENTCONF "keepalive 10 60\n";
2299 print CLIENTCONF "# Start as daemon\n";
2300 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2301 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2302 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT		 2303 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2304 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 2305 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
66c36198 2306
ce9abb66
AH		 2307
2308 close(CLIENTCONF);
66c36198 2309
ce9abb66
AH		 2310 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2311 my $status = $zip->writeToFileNamed($zippathname);
2312
2313 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2314 @fileholder = <DLFILE>;
2315 print "Content-Type:application/x-download\n";
2316 print "Content-Disposition:attachment;filename=$zipname\n\n";
2317 print @fileholder;
2318 exit (0);
2319}
2320else
2321{
2322 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2323 my $zippathname = "$zippath$zipname";
2324 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2325
2326###
7c1d9faf 2327# m.a.d net2net
ce9abb66 2328###
66c36198 2329
c6c9630e 2330 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5 2331 flock CLIENTCONF, 2;
66c36198 2332
6e13d0a5 2333 my $zip = Archive::Zip->new();
66c36198 2334
8c877a82 2335 print CLIENTCONF "#OpenVPN Client conf\r\n";
6e13d0a5
MT		 2336 print CLIENTCONF "tls-client\r\n";
2337 print CLIENTCONF "client\r\n";
4f6e3ae3 2338 print CLIENTCONF "nobind\r\n";
79e7688b 2339 print CLIENTCONF "dev tun\r\n";
c6c9630e 2340 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
d6989b4b 2341 print CLIENTCONF "tun-mtu $vpnsettings{'DMTU'}\r\n";
2ee746be 2342
6e13d0a5
MT		 2343 if ( $vpnsettings{'ENABLED'} eq 'on'){
2344 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
66c36198 2345 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
574f4538 2346 print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Blue interface\r\n";
c6c9630e
MT		 2347 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2348 }
2349 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
574f4538 2350 print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
c6c9630e
MT		 2351 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2352 }
2353 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2354 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2355 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
574f4538 2356 print CLIENTCONF "#comment the above line and uncomment the next line, if you want to connect on the Orange interface\r\n";
c6c9630e
MT		 2357 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2358 }
2359 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2360 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5 2361 }
66c36198 2362
71af643c
MT		 2363 my $file_crt = new File::Temp( UNLINK => 1 );
2364 my $file_key = new File::Temp( UNLINK => 1 );
b22d8aaf 2365 my $include_certs = 0;
71af643c 2366
66c36198 2367 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
71af643c 2368 if ($cgiparams{'MODE'} eq 'insecure') {
b22d8aaf
MT		 2369 $include_certs = 1;
2370
71af643c 2371 # Add the CA
b22d8aaf 2372 print CLIENTCONF ";ca cacert.pem\r\n";
71af643c
MT		 2373 $zip->addFile("${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2374
2375 # Extract the certificate
2feacd98 2376 # This system call is safe, because all arguments are passed as an array.
71af643c
MT		 2377 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2378 '-clcerts', '-nokeys', '-nodes', '-out', "$file_crt" , '-passin', 'pass:');
2379 if ($?) {
2380 die "openssl error: $?";
2381 }
2382
2383 $zip->addFile("$file_crt", "$confighash{$cgiparams{'KEY'}}[1].pem") or die;
b22d8aaf 2384 print CLIENTCONF ";cert $confighash{$cgiparams{'KEY'}}[1].pem\r\n";
71af643c
MT		 2385
2386 # Extract the key
2feacd98 2387 # This system call is safe, because all arguments are passed as an array.
71af643c
MT		 2388 system('/usr/bin/openssl', 'pkcs12', '-in', "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12",
2389 '-nocerts', '-nodes', '-out', "$file_key", '-passin', 'pass:');
2390 if ($?) {
2391 die "openssl error: $?";
2392 }
2393
2394 $zip->addFile("$file_key", "$confighash{$cgiparams{'KEY'}}[1].key") or die;
b22d8aaf 2395 print CLIENTCONF ";key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
71af643c
MT		 2396 } else {
2397 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2398 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2399 }
6e13d0a5 2400 } else {
c6c9630e
MT		 2401 print CLIENTCONF "ca cacert.pem\r\n";
2402 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2403 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2404 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
66c36198 2405 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT		 2406 }
2407 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
49abe7af 2408 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
86308adb 2409
49abe7af 2410 if ($vpnsettings{'TLSAUTH'} eq 'on') {
b22d8aaf
MT		 2411 if ($cgiparams{'MODE'} eq 'insecure') {
2412 print CLIENTCONF ";";
2413 }
4be45949
EK		 2414 print CLIENTCONF "tls-auth ta.key\r\n";
2415 $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n";
49abe7af 2416 }
6e13d0a5
MT		 2417 if ($vpnsettings{DCOMPLZO} eq 'on') {
2418 print CLIENTCONF "comp-lzo\r\n";
2419 }
2420 print CLIENTCONF "verb 3\r\n";
b66b02ab
EK		 2421 # Check host certificate if X509 is RFC3280 compliant.
2422 # If not, old --ns-cert-type directive will be used.
2423 # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
2feacd98
SS		 2424 my @hostcert = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
2425 if (! grep(/TLS Web Server Authentication/, @hostcert)) {
b66b02ab
EK		 2426 print CLIENTCONF "ns-cert-type server\r\n";
2427 } else {
2428 print CLIENTCONF "remote-cert-tls server\r\n";
2429 }
964700d4 2430 print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
a79fa1d6
JPT		 2431 if ($vpnsettings{MSSFIX} eq 'on') {
2432 print CLIENTCONF "mssfix\r\n";
d6989b4b
MT		 2433 } else {
2434 print CLIENTCONF "mssfix 0\r\n";
a79fa1d6 2435 }
74225cce 2436 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT		 2437 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2438 }
e1e10515
TE		 2439 if ($confighash{$cgiparams{'KEY'}}[43] eq 'on') {
2440 print CLIENTCONF "auth-nocache\r\n";
2441 print CLIENTCONF "auth-user-pass credentials\r\n";
2442 print CLIENTCONF "static-challenge \"One Time Password (OTP): \" 1\r\n";
2443
2444 open(CLIENTCREDS, ">$tempdir/credentials") or die "Unable to open tempfile: $!";
2445 print CLIENTCREDS "user\r\n";
2446 print CLIENTCREDS "password";
2447 close(CLIENTCREDS);
2448 $zip->addFile( "$tempdir/credentials", "credentials") or die "Can't add file credentials\n";
2449 }
1647059d 2450
b22d8aaf
MT		 2451 if ($include_certs) {
2452 print CLIENTCONF "\r\n";
2453
2454 # CA
2455 open(FILE, "<${General::swroot}/ovpn/ca/cacert.pem");
2456 print CLIENTCONF "<ca>\r\n";
2457 while (<FILE>) {
2458 chomp($_);
2459 print CLIENTCONF "$_\r\n";
2460 }
2461 print CLIENTCONF "</ca>\r\n\r\n";
2462 close(FILE);
2463
2464 # Cert
2465 open(FILE, "<$file_crt");
2466 print CLIENTCONF "<cert>\r\n";
2467 while (<FILE>) {
2468 chomp($_);
2469 print CLIENTCONF "$_\r\n";
2470 }
2471 print CLIENTCONF "</cert>\r\n\r\n";
2472 close(FILE);
2473
2474 # Key
2475 open(FILE, "<$file_key");
2476 print CLIENTCONF "<key>\r\n";
2477 while (<FILE>) {
2478 chomp($_);
2479 print CLIENTCONF "$_\r\n";
2480 }
2481 print CLIENTCONF "</key>\r\n\r\n";
2482 close(FILE);
2483
2484 # TLS auth
2485 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2486 open(FILE, "<${General::swroot}/ovpn/certs/ta.key");
2487 print CLIENTCONF "<tls-auth>\r\n";
2488 while (<FILE>) {
2489 chomp($_);
2490 print CLIENTCONF "$_\r\n";
2491 }
2492 print CLIENTCONF "</tls-auth>\r\n\r\n";
2493 close(FILE);
2494 }
2495 }
2496
ffbe77c8
EK		 2497 # Print client.conf.local if entries exist to client.ovpn
2498 if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') {
2499 open (LCC, "$local_clientconf");
2500 print CLIENTCONF "\n#---------------------------\n";
2501 print CLIENTCONF "# Start of custom directives\n";
2502 print CLIENTCONF "# from client.conf.local\n";
2503 print CLIENTCONF "#---------------------------\n\n";
2504 while (<LCC>) {
2505 print CLIENTCONF $_;
2506 }
2507 print CLIENTCONF "\n#---------------------------\n";
2508 print CLIENTCONF "# End of custom directives\n";
2509 print CLIENTCONF "#---------------------------\n\n";
2510 close (LCC);
2511 }
6e13d0a5 2512 close(CLIENTCONF);
66c36198 2513
6e13d0a5
MT		 2514 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2515 my $status = $zip->writeToFileNamed($zippathname);
2516
2517 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2518 @fileholder = <DLFILE>;
2519 print "Content-Type:application/x-download\n";
2520 print "Content-Disposition:attachment;filename=$zipname\n\n";
2521 print @fileholder;
2522 exit (0);
ce9abb66 2523 }
66c36198
PM		 2524
2525
2526
6e13d0a5
MT		 2527###
2528### Remove connection
2529###
ce9abb66
AH		 2530
2531
6e13d0a5 2532} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
323be7c4
AM		 2533 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2534 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2535
323be7c4 2536 if ($confighash{$cgiparams{'KEY'}}) {
fde9c9dd 2537 # Revoke certificate if certificate was deleted and rewrite the CRL
274ca65b 2538 &General::system("/usr/bin/openssl", "ca", "-revoke", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
2feacd98 2539 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
ce9abb66
AH		 2540
2541###
7c1d9faf 2542# m.a.d net2net
ce9abb66 2543###
7c1d9faf 2544
323be7c4 2545 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1e499e90 2546 # Stop the N2N connection before it is removed
2feacd98 2547 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
1e499e90 2548
323be7c4
AM		 2549 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2550 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2551 unlink ($certfile);
2552 unlink ($conffile);
8e6a8fd5 2553
323be7c4
AM		 2554 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2555 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2556 }
323be7c4 2557 }
ce9abb66 2558
323be7c4
AM		 2559 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2560 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
8c877a82
AM		 2561
2562# A.Marx CCD delete ccd files and routes
2563
323be7c4
AM		 2564 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2565 {
2566 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
8c877a82 2567 }
66c36198 2568
323be7c4
AM		 2569 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2570 foreach my $key (keys %ccdroutehash) {
2571 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2572 delete $ccdroutehash{$key};
2573 }
8c877a82 2574 }
323be7c4 2575 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
66c36198 2576
323be7c4
AM		 2577 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2578 foreach my $key (keys %ccdroute2hash) {
2579 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2580 delete $ccdroute2hash{$key};
2581 }
2582 }
2583 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2584 &writeserverconf;
8c877a82 2585
323be7c4
AM		 2586# CCD end
2587 # Update collectd configuration and delete all RRD files of the removed connection
2588 &writecollectdconf();
2feacd98 2589 &General::system("/usr/local/bin/openvpnctrl", "-drrd", "$confighash{$cgiparams{'KEY'}}[1]");
8c877a82 2590
323be7c4 2591 delete $confighash{$cgiparams{'KEY'}};
2feacd98 2592 &General::system("/usr/bin/openssl", "ca", "-gencrl", "-out", "${General::swroot}/ovpn/crls/cacrl.pem", "-config", "${General::swroot}/ovpn/openssl/ovpn.cnf");
323be7c4
AM		 2593 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2594
2595 } else {
2596 $errormessage = $Lang::tr{'invalid key'};
2597 }
b2e75449 2598 &General::firewall_reload();
ce9abb66 2599
6e13d0a5
MT		 2600###
2601### Download PKCS12 file
2602###
2603} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2604 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2605
2606 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2607 print "Content-Type: application/octet-stream\r\n\r\n";
2feacd98
SS		 2608
2609 open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2610 my @tmp = <FILE>;
2611 close(FILE);
2612
2613 print "@tmp";
6e13d0a5
MT		 2614 exit (0);
2615
2616###
2617### Display certificate
2618###
2619} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2620 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2621
2622 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e 2623 &Header::showhttpheaders();
4c962356 2624 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT		 2625 &Header::openbigbox('100%', 'LEFT', '', '');
2626 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2feacd98 2627 my @output = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
8c946d1c
MT		 2628 my $output = &Header::cleanhtml(join("", @output), "y");
2629 print "<pre>$output</pre>\n";
c6c9630e
MT		 2630 &Header::closebox();
2631 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2632 &Header::closebigbox();
2633 &Header::closepage();
2634 exit(0);
6e13d0a5 2635 }
4c962356 2636
e1e10515
TE		 2637###
2638### Display OTP QRCode
2639###
2640} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show otp qrcode'}) {
2641 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2642
e1e10515
TE		 2643 my $qrcode = Imager::QRCode->new(
2644 size => 6,
2645 margin => 0,
2646 version => 0,
2647 level => 'M',
2648 mode => '8-bit',
2649 casesensitive => 1,
2650 lightcolor => Imager::Color->new(255, 255, 255),
2651 darkcolor => Imager::Color->new(0, 0, 0),
2652 );
2653 my $cn = $confighash{$cgiparams{'KEY'}}[2];
2654 my $secret = encode_base32($confighash{$cgiparams{'KEY'}}[44]);
2655 my $issuer = "$mainsettings{'HOSTNAME'}.$mainsettings{'DOMAINNAME'}";
2656 my $qrcodeimg = $qrcode->plot("otpauth://totp/$cn?secret=$secret&issuer=$issuer");
2657 my $qrcodeimgdata;
2658 $qrcodeimg->write(data => \$qrcodeimgdata, type=> 'png')
2659 or die $qrcodeimg->errstr;
2660 $qrcodeimgdata = encode_base64($qrcodeimgdata, '');
2661
2662 &Header::showhttpheaders();
2663 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2664 &Header::openbigbox('100%', 'LEFT', '', '');
2665 &Header::openbox('100%', 'LEFT', "$Lang::tr{'otp qrcode'}:");
2666 print <<END;
2667$Lang::tr{'secret'}:&nbsp;$secret</br></br>
2668<img alt="$Lang::tr{'otp qrcode'}" src="data:image/png;base64,$qrcodeimgdata">
2669END
2670 &Header::closebox();
2671 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2672 &Header::closebigbox();
2673 &Header::closepage();
2674 exit(0);
2675
4c962356
EK		 2676###
2677### Display Diffie-Hellman key
2678###
2679} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2680
2681 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
49abe7af 2682 $errormessage = $Lang::tr{'not present'};
4c962356
EK		 2683 } else {
2684 &Header::showhttpheaders();
2685 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2686 &Header::openbigbox('100%', 'LEFT', '', '');
2687 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2feacd98 2688 my @output = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
8c946d1c
MT		 2689 my $output = &Header::cleanhtml(join("", @output) ,"y");
2690 print "<pre>$output</pre>\n";
4c962356
EK		 2691 &Header::closebox();
2692 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2693 &Header::closebigbox();
2694 &Header::closepage();
2695 exit(0);
2696 }
2697
fd5ccb2d
EK		 2698###
2699### Display tls-auth key
2700###
2701} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2702
2703 if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2704 $errormessage = $Lang::tr{'not present'};
2705 } else {
2706 &Header::showhttpheaders();
2707 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2708 &Header::openbigbox('100%', 'LEFT', '', '');
2709 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2feacd98
SS		 2710
2711 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
2712 my @output = <FILE>;
2713 close(FILE);
2714
8c946d1c
MT		 2715 my $output = &Header::cleanhtml(join("", @output),"y");
2716 print "<pre>$output</pre>\n";
fd5ccb2d
EK		 2717 &Header::closebox();
2718 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2719 &Header::closebigbox();
2720 &Header::closepage();
2721 exit(0);
2722 }
2723
6e13d0a5
MT		 2724###
2725### Display Certificate Revoke List
2726###
2727} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT		 2728# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2729
49abe7af
EK		 2730 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2731 $errormessage = $Lang::tr{'not present'};
2732 } else {
b2e75449
MT		 2733 &Header::showhttpheaders();
2734 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2735 &Header::openbigbox('100%', 'LEFT', '', '');
2736 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2feacd98 2737 my @output = &General::system_output("/usr/bin/openssl", "crl", "-text", "-noout", "-in", "${General::swroot}/ovpn/crls/cacrl.pem");
8c946d1c
MT		 2738 my $output = &Header::cleanhtml(join("", @output), "y");
2739 print "<pre>$output</pre>\n";
b2e75449
MT		 2740 &Header::closebox();
2741 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2742 &Header::closebigbox();
2743 &Header::closepage();
2744 exit(0);
6e13d0a5
MT		 2745 }
2746
2747###
2748### Advanced Server Settings
2749###
2750
2751} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2752 %cgiparams = ();
2753 %cahash = ();
2754 %confighash = ();
8c877a82 2755 my $disabled;
6e13d0a5 2756 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 2757 read_routepushfile;
66c36198
PM		 2758
2759
c6c9630e 2760# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
66c36198 2761# $cgiparams{'CLIENT2CLIENT'} = 'on';
c6c9630e 2762# }
6e13d0a5
MT		 2763ADV_ERROR:
2764 if ($cgiparams{'MAX_CLIENTS'} eq '') {
4c962356 2765 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 2766 }
6e13d0a5 2767 if ($cgiparams{'KEEPALIVE_1'} eq '') {
4c962356 2768 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT		 2769 }
2770 if ($cgiparams{'KEEPALIVE_2'} eq '') {
4c962356 2771 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT		 2772 }
2773 if ($cgiparams{'LOG_VERB'} eq '') {
4c962356 2774 $cgiparams{'LOG_VERB'} = '3';
ae9f6139 2775 }
f527e53f 2776 if ($cgiparams{'TLSAUTH'} eq '') {
754066e6 2777 $cgiparams{'TLSAUTH'} = 'off';
f527e53f 2778 }
6e13d0a5
MT		 2779 $checked{'CLIENT2CLIENT'}{'off'} = '';
2780 $checked{'CLIENT2CLIENT'}{'on'} = '';
2781 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2782 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2783 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2784 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
13389777
EK		 2785 $checked{'DCOMPLZO'}{'off'} = '';
2786 $checked{'DCOMPLZO'}{'on'} = '';
2787 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
ffbe77c8
EK		 2788 $checked{'ADDITIONAL_CONFIGS'}{'off'} = '';
2789 $checked{'ADDITIONAL_CONFIGS'}{'on'} = '';
2790 $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED';
a79fa1d6
JPT		 2791 $checked{'MSSFIX'}{'off'} = '';
2792 $checked{'MSSFIX'}{'on'} = '';
2793 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
49abe7af 2794 $selected{'LOG_VERB'}{'0'} = '';
6e13d0a5
MT		 2795 $selected{'LOG_VERB'}{'1'} = '';
2796 $selected{'LOG_VERB'}{'2'} = '';
2797 $selected{'LOG_VERB'}{'3'} = '';
2798 $selected{'LOG_VERB'}{'4'} = '';
2799 $selected{'LOG_VERB'}{'5'} = '';
2800 $selected{'LOG_VERB'}{'6'} = '';
2801 $selected{'LOG_VERB'}{'7'} = '';
2802 $selected{'LOG_VERB'}{'8'} = '';
2803 $selected{'LOG_VERB'}{'9'} = '';
2804 $selected{'LOG_VERB'}{'10'} = '';
2805 $selected{'LOG_VERB'}{'11'} = '';
6e13d0a5 2806 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
66c36198 2807
6e13d0a5
MT		 2808 &Header::showhttpheaders();
2809 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
66c36198 2810 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
6e13d0a5 2811 if ($errormessage) {
c6c9630e
MT		 2812 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2813 print "<class name='base'>$errormessage\n";
2814 print "&nbsp;</class>\n";
2815 &Header::closebox();
6e13d0a5
MT		 2816 }
2817 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
4c962356 2818 print <<END;
b376fae4 2819 <form method='post' enctype='multipart/form-data'>
b2e75449 2820<table width='100%' border=0>
4c962356
EK		 2821 <tr>
2822 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
6e13d0a5
MT		 2823 </tr>
2824 <tr>
4c962356 2825 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
66c36198
PM		 2826 </tr>
2827 <tr>
4c962356 2828 <td class='base'>Domain</td>
8c877a82 2829 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
6e13d0a5 2830 </tr>
66c36198 2831 <tr>
4c962356
EK		 2832 <td class='base'>DNS</td>
2833 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
66c36198
PM		 2834 </tr>
2835 <tr>
4c962356
EK		 2836 <td class='base'>WINS</td>
2837 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2838 </tr>
54fd0535 2839 <tr>
4c962356 2840 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
54fd0535 2841 </tr>
66c36198 2842 <tr>
4c962356
EK		 2843 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2844 <td colspan='2'>
2845 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
54fd0535
MT		 2846END
2847;
2848
2849if ($cgiparams{'ROUTES_PUSH'} ne '')
2850{
2851 print $cgiparams{'ROUTES_PUSH'};
2852}
2853
8c877a82 2854print <<END;
54fd0535
MT		 2855</textarea></td>
2856</tr>
6e13d0a5
MT		 2857 </tr>
2858</table>
2859<hr size='1'>
4c962356 2860<table width='100%'>
ffbe77c8 2861 <tr>
4c962356 2862 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
ffbe77c8
EK		 2863 </tr>
2864
2865 <tr>
d2de0a00 2866 <td width='20%'></td> <td width='15%'> </td><td width='35%'> </td><td width='20%'></td><td width='35%'></td>
ffbe77c8
EK		 2867 </tr>
2868
2869 <tr>
4c962356
EK		 2870 <td class='base'>Client-To-Client</td>
2871 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
ffbe77c8
EK		 2872 </tr>
2873
2874 <tr>
4c962356
EK		 2875 <td class='base'>Redirect-Gateway def1</td>
2876 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
ffbe77c8
EK		 2877 </tr>
2878
13389777
EK		 2879 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
2880 <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
2881 <td>$Lang::tr{'openvpn default'}: off <font color='red'>($Lang::tr{'attention'} exploitable via Voracle)</font></td>
2882 </tr>
2883
4c962356 2884 <tr>
ffbe77c8
EK		 2885 <td class='base'>$Lang::tr{'ovpn add conf'}</td>
2886 <td><input type='checkbox' name='ADDITIONAL_CONFIGS' $checked{'ADDITIONAL_CONFIGS'}{'on'} /></td>
2887 <td>$Lang::tr{'openvpn default'}: off</td>
2888 </tr>
2889
2890 <tr>
2891 <td class='base'>mssfix</td>
2892 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2893 <td>$Lang::tr{'openvpn default'}: off</td>
2894 </tr>
2895
4c962356 2896 <tr>
ffbe77c8
EK		 2897 <td class='base'>fragment <br></td>
2898 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2899 </tr>
2900
2901
2902 <tr>
2903 <td class='base'>Max-Clients</td>
2904 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2905 </tr>
2906 <tr>
2907 <td class='base'>Keepalive <br />
2908 (ping/ping-restart)</td>
2909 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2910 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2911 </tr>
a79fa1d6
JPT		 2912</table>
2913
a79fa1d6 2914<hr size='1'>
4c962356 2915<table width='100%'>
a79fa1d6 2916 <tr>
49abe7af 2917 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
a79fa1d6
JPT		 2918 </tr>
2919 <tr>
49abe7af 2920 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
4c962356
EK		 2921 </tr>
2922
2923 <tr><td class='base'>VERB</td>
2924 <td><select name='LOG_VERB'>
49abe7af
EK		 2925 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option>
2926 <option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2927 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2928 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2929 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2930 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2931 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2932 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2933 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2934 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2935 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2936 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2937 </td></select>
2938 </table>
4c962356 2939
6e13d0a5 2940<hr size='1'>
8c877a82
AM		 2941END
2942
2943if ( -e "/var/run/openvpn.pid"){
2944print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2945 $Lang::tr{'server restart'}<br><br>
2946 <hr>";
49abe7af 2947 print<<END;
52d08bcb
AM		 2948<table width='100%'>
2949<tr>
2950 <td>&nbsp;</td>
2951 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2952 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
66c36198 2953 <td>&nbsp;</td>
52d08bcb 2954</tr>
66c36198 2955</table>
52d08bcb
AM		 2956</form>
2957END
66c36198
PM		 2958;
2959
2960
52d08bcb 2961}else{
8c877a82 2962
49abe7af 2963 print<<END;
6e13d0a5
MT		 2964<table width='100%'>
2965<tr>
2966 <td>&nbsp;</td>
2967 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2968 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
66c36198 2969 <td>&nbsp;</td>
6e13d0a5 2970</tr>
66c36198 2971</table>
6e13d0a5
MT		 2972</form>
2973END
66c36198 2974;
52d08bcb 2975}
6e13d0a5 2976 &Header::closebox();
c6c9630e 2977# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT		 2978 &Header::closebigbox();
2979 &Header::closepage();
2980 exit(0);
66c36198 2981
8c877a82
AM		 2982
2983# A.Marx CCD Add,delete or edit CCD net
2984
66c36198
PM		 2985} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2986 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2987 $cgiparams{'ACTION'} eq "kill" ||
8c877a82
AM		 2988 $cgiparams{'ACTION'} eq "edit" ||
2989 $cgiparams{'ACTION'} eq 'editsave'){
2990 &Header::showhttpheaders();
2991 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2992 &Header::openbigbox('100%', 'LEFT', '', '');
2993
2994 if ($cgiparams{'ACTION'} eq "kill"){
2995 &delccdnet($cgiparams{'net'});
2996 }
66c36198 2997
8c877a82
AM		 2998 if ($cgiparams{'ACTION'} eq 'editsave'){
2999 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
3000 if ( $a ne $b){ &modccdnet($a,$b);}
5068ac38
AM		 3001 $cgiparams{'ccdname'}='';
3002 $cgiparams{'ccdsubnet'}='';
8c877a82 3003 }
66c36198 3004
8c877a82 3005 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
e2429e8d 3006 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
8c877a82
AM		 3007 }
3008 if ($errormessage) {
3009 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3010 print "<class name='base'>$errormessage";
3011 print "&nbsp;</class>";
66c36198 3012 &Header::closebox();
8c877a82
AM		 3013 }
3014if ($cgiparams{'ACTION'} eq "edit"){
66c36198 3015
8c877a82
AM		 3016 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
3017
49abe7af 3018 print <<END;
631b67b7 3019 <table width='100%' border='0'>
8c877a82
AM		 3020 <tr><form method='post'>
3021 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
a9fb14d0 3022 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly='readonly' /></td></tr>
8c877a82
AM		 3023 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
3024 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
3025 </td></tr>
3026 </table></form>
3027END
3028;
3029 &Header::closebox();
3030
3031 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
49abe7af 3032 print <<END;
8c877a82
AM		 3033 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
3034 <tr>
3035 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
3036END
3037;
3038}
3039else{
3040 if (! -e "/var/run/openvpn.pid"){
3041 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
49abe7af 3042 print <<END;
8c877a82
AM		 3043 <table width='100%' border='0'>
3044 <tr><form method='post'>
3045 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
3046 <tr>
3047 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
3048 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
3049 <tr><td colspan=4><hr /></td></tr><tr>
3050 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
3051 </table></form>
3052END
66c36198 3053
8c877a82
AM		 3054 &Header::closebox();
3055}
3056 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
5068ac38
AM		 3057 if ( -e "/var/run/openvpn.pid"){
3058 print "<b>$Lang::tr{'attention'}:</b><br>";
3059 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
3060 }
66c36198 3061
4c962356 3062 print <<END;
99bfa85c 3063 <table width='100%' cellpadding='0' cellspacing='1'>
8c877a82
AM		 3064 <tr>
3065 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
3066END
3067;
3068}
66c36198
PM		 3069 my %ccdconfhash=();
3070 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
8c877a82
AM		 3071 my @ccdconf=();
3072 my $count=0;
df9b48b7 3073 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM		 3074 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
3075 $count++;
3076 my $ccdhosts = &hostsinnet($ccdconf[0]);
3077 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
3078 else{ print" <tr bgcolor='$color{'color20'}'>";}
3079 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
4c962356 3080 print <<END;
8c877a82 3081 <form method='post' />
1638682b 3082 <input type='image' src='/images/edit.gif' align='middle' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
8c877a82
AM		 3083 <input type='hidden' name='ACTION' value='edit'/>
3084 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
3085 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
3086 </form></td>
3087 <form method='post' />
3088 <td><input type='hidden' name='ACTION' value='kill'/>
3089 <input type='hidden' name='number' value='$count' />
3090 <input type='hidden' name='net' value='$ccdconf[0]' />
1638682b 3091 <input type='image' src='/images/delete.gif' align='middle' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' /></form></td></tr>
8c877a82
AM		 3092END
3093;
66c36198 3094 }
8c877a82
AM		 3095 print "</table></form>";
3096 &Header::closebox();
3097 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3098 &Header::closebigbox();
3099 &Header::closepage();
3100 exit(0);
66c36198 3101
8c877a82
AM		 3102#END CCD
3103
6e13d0a5
MT		 3104###
3105### Openvpn Connections Statistics
3106###
3107} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
3108 &Header::showhttpheaders();
3109 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
3110 &Header::openbigbox('100%', 'LEFT', '', '');
3111 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
3112
3113#
3114# <td><b>$Lang::tr{'protocol'}</b></td>
66c36198 3115# protocol temp removed
4c962356 3116 print <<END;
99bfa85c 3117 <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
6e13d0a5 3118 <tr>
99bfa85c
AM		 3119 <th><b>$Lang::tr{'common name'}</b></th>
3120 <th><b>$Lang::tr{'real address'}</b></th>
d8ef6a95 3121 <th><b>$Lang::tr{'country'}</b></th>
99bfa85c
AM		 3122 <th><b>$Lang::tr{'virtual address'}</b></th>
3123 <th><b>$Lang::tr{'loged in at'}</b></th>
3124 <th><b>$Lang::tr{'bytes sent'}</b></th>
3125 <th><b>$Lang::tr{'bytes received'}</b></th>
3126 <th><b>$Lang::tr{'last activity'}</b></th>
6e13d0a5
MT		 3127 </tr>
3128END
3129;
87fe47e9 3130 my $filename = "/var/run/ovpnserver.log";
6e13d0a5
MT		 3131 open(FILE, $filename) or die 'Unable to open config file.';
3132 my @current = <FILE>;
3133 close(FILE);
3134 my @users =();
3135 my $status;
3136 my $uid = 0;
3137 my $cn;
3138 my @match = ();
3139 my $proto = "udp";
3140 my $address;
3141 my %userlookup = ();
3142 foreach my $line (@current)
3143 {
3144 chomp($line);
3145 if ( $line =~ /^Updated,(.+)/){
66c36198 3146 @match = split( /^Updated,(.+)/, $line);
6e13d0a5
MT		 3147 $status = $match[1];
3148 }
66c36198 3149#gian
6e13d0a5
MT		 3150 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3151 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3152 if ($match[1] ne "Common Name") {
3153 $cn = $match[1];
3154 $userlookup{$match[2]} = $uid;
3155 $users[$uid]{'CommonName'} = $match[1];
3156 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT		 3157 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
3158 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT		 3159 $users[$uid]{'Since'} = $match[5];
3160 $users[$uid]{'Proto'} = $proto;
d8ef6a95
PM		 3161
3162 # get country code for "RealAddress"...
07e42be9 3163 my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]);
e2e270e1 3164 my $flag_icon = &Location::Functions::get_flag_icon($ccode);
d8ef6a95 3165 $users[$uid]{'Country'} = "<a href='country.cgi#$ccode'><img src='$flag_icon' border='0' align='absmiddle' alt='$ccode' title='$ccode' /></a>";
6e13d0a5 3166 $uid++;
66c36198 3167 }
6e13d0a5
MT		 3168 }
3169 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
3170 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
3171 if ($match[1] ne "Virtual Address") {
3172 $address = $match[3];
3173 #find the uid in the lookup table
3174 $uid = $userlookup{$address};
3175 $users[$uid]{'VirtualAddress'} = $match[1];
3176 $users[$uid]{'LastRef'} = $match[4];
3177 }
3178 }
3179 }
3180 my $user2 = @users;
3181 if ($user2 >= 1){
99bfa85c 3182 for (my $idx = 1; $idx <= $user2; $idx++){
6e13d0a5 3183 if ($idx % 2) {
99bfa85c
AM		 3184 print "<tr>";
3185 $col="bgcolor='$color{'color22'}'";
3186 } else {
3187 print "<tr>";
3188 $col="bgcolor='$color{'color20'}'";
6e13d0a5 3189 }
99bfa85c
AM		 3190 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
3191 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
d8ef6a95
PM		 3192 print "<td align='center' $col>$users[$idx-1]{'Country'}</td>";
3193 print "<td align='center' $col>$users[$idx-1]{'VirtualAddress'}</td>";
99bfa85c
AM		 3194 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
3195 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
3196 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
3197 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
3198 }
3199 }
66c36198 3200
6e13d0a5 3201 print "</table>";
49abe7af 3202 print <<END;
6e13d0a5
MT		 3203 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
3204 <tr><td></td></tr>
3205 <tr><td></td></tr>
3206 <tr><td></td></tr>
3207 <tr><td></td></tr>
3208 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
3209 </table>
3210END
66c36198 3211;
6e13d0a5
MT		 3212 &Header::closebox();
3213 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3214 &Header::closebigbox();
3215 &Header::closepage();
3216 exit(0);
3217
3218###
3219### Download Certificate
3220###
3221} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
3222 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 3223
6e13d0a5 3224 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT		 3225 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
3226 print "Content-Type: application/octet-stream\r\n\r\n";
2feacd98
SS		 3227
3228 open(FILE, "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3229 my @tmp = <FILE>;
3230 close(FILE);
3231
3232 print "@tmp";
c6c9630e
MT		 3233 exit (0);
3234 }
3235
3236###
3237### Enable/Disable connection
3238###
ce9abb66 3239
c6c9630e 3240} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
66c36198 3241
c6c9630e
MT		 3242 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3243 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3244
3245 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 3246 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT		 3247 $confighash{$cgiparams{'KEY'}}[0] = 'on';
3248 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3249 #&writeserverconf();
3250# if ($vpnsettings{'ENABLED'} eq 'on' ||
3251# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3252# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3253# }
3254 } else {
3255 $confighash{$cgiparams{'KEY'}}[0] = 'off';
3256# if ($vpnsettings{'ENABLED'} eq 'on' ||
3257# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3258# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3259# }
3260 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3261 #&writeserverconf();
3262 }
3263 } else {
3264 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT		 3265 }
3266
3267###
3268### Restart connection
3269###
3270} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3271 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3272 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3273
3274 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT		 3275# if ($vpnsettings{'ENABLED'} eq 'on' ||
3276# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3277# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3278# }
6e13d0a5 3279 } else {
c6c9630e 3280 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT		 3281 }
3282
ce9abb66 3283###
7c1d9faf 3284# m.a.d net2net
ce9abb66
AH		 3285###
3286
3287} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3288 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3289 &Header::showhttpheaders();
4c962356 3290 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
ce9abb66
AH		 3291 &Header::openbigbox('100%', 'LEFT', '', '');
3292 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH		 3293
3294if ( -s "${General::swroot}/ovpn/settings") {
3295
49abe7af 3296 print <<END;
ce9abb66 3297 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3298 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
ce9abb66
AH		 3299 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3300 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3301 <tr><td><input type='radio' name='TYPE' value='net' /></td>
3302 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
66c36198 3303 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
ce9abb66
AH		 3304 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
3305 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
e3edceeb 3306 <tr><td>&nbsp;</td><td>Import Connection Name</td></tr>
040b8b0c 3307 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>$Lang::tr{'openvpn default'}: Client Packagename</td></tr>
54fd0535 3308 <tr><td colspan='3'><hr /></td></tr>
8c877a82 3309 <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
ce9abb66
AH		 3310 </form></table>
3311END
3312 ;
66c36198 3313
ce9abb66 3314
b278daf3 3315} else {
49abe7af 3316 print <<END;
b278daf3 3317 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3318 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
b278daf3 3319 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
8c877a82 3320 <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
b278daf3
AH		 3321 </form></table>
3322END
3323 ;
3324
3325}
3326
ce9abb66 3327 &Header::closebox();
4c962356 3328 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
ce9abb66
AH		 3329 &Header::closebigbox();
3330 &Header::closepage();
3331 exit (0);
3332
3333###
7c1d9faf 3334# m.a.d net2net
ce9abb66
AH		 3335###
3336
3337} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
3338
3339 my @firen2nconf;
3340 my @confdetails;
3341 my $uplconffilename ='';
54fd0535 3342 my $uplconffilename2 ='';
ce9abb66 3343 my $uplp12name = '';
54fd0535 3344 my $uplp12name2 = '';
ce9abb66
AH		 3345 my @rem_subnet;
3346 my @rem_subnet2;
66c36198 3347 my @tmposupnet3;
ce9abb66 3348 my $key;
54fd0535 3349 my @n2nname;
ce9abb66 3350
66c36198 3351 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 3352
2ad1b18b
MT		 3353 # Check if a file is uploaded
3354 unless (ref ($cgiparams{'FH'})) {
ce9abb66
AH		 3355 $errormessage = $Lang::tr{'there was no file upload'};
3356 goto N2N_ERROR;
3357 }
3358
3359# Move uploaded IPfire n2n package to temporary file
3360
3361 (my $fh, my $filename) = tempfile( );
3362 if (copy ($cgiparams{'FH'}, $fh) != 1) {
3363 $errormessage = $!;
3364 goto N2N_ERROR;
3365 }
3366
3367 my $zip = Archive::Zip->new();
3368 my $zipName = $filename;
3369 my $status = $zip->read( $zipName );
66c36198 3370 if ($status != AZ_OK) {
ce9abb66
AH		 3371 $errormessage = "Read of $zipName failed\n";
3372 goto N2N_ERROR;
3373 }
3374
3375 my $tempdir = tempdir( CLEANUP => 1 );
3376 my @files = $zip->memberNames();
3377 for(@files) {
3378 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
3379 }
3380 my $countfiles = @files;
3381
3382# Check if we have not more then 2 files
3383
3384 if ( $countfiles == 2){
3385 foreach (@files){
3386 if ( $_ =~ /.conf$/){
3387 $uplconffilename = $_;
3388 }
3389 if ( $_ =~ /.p12$/){
3390 $uplp12name = $_;
66c36198 3391 }
ce9abb66
AH		 3392 }
3393 if (($uplconffilename eq '') || ($uplp12name eq '')){
3394 $errormessage = "Either no *.conf or no *.p12 file found\n";
3395 goto N2N_ERROR;
3396 }
3397
3398 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
3399 @firen2nconf = <FILE>;
3400 close (FILE);
3401 chomp(@firen2nconf);
ce9abb66
AH		 3402 } else {
3403
3404 $errormessage = "Filecount does not match only 2 files are allowed\n";
3405 goto N2N_ERROR;
3406 }
3407
7c1d9faf
AH		 3408###
3409# m.a.d net2net
ce9abb66 3410###
66c36198 3411
54fd0535
MT		 3412 if ($cgiparams{'n2nname'} ne ''){
3413
66c36198
PM		 3414 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
3415 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
54fd0535
MT		 3416 $n2nname[0] = $cgiparams{'n2nname'};
3417 my @n2nname2 = split(/\./,$uplconffilename);
3418 $n2nname2[0] =~ s/\n|\r//g;
3419 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
3420 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
3421 my $input2 = "$n2nname2[0]n2n";
3422 my $output2 = "$n2nname[0]n2n";
3423 my $filename = "$tempdir/$uplconffilename";
3424 open(FILE, "< $filename") or die 'Unable to open config file.';
3425 my @current = <FILE>;
3426 close(FILE);
3427 foreach (@current) {s/$input1/$output1/g;}
3428 foreach (@current) {s/$input2/$output2/g;}
3429 open (OUT, "> $filename") || die 'Unable to open config file.';
3430 print OUT @current;
3431 close OUT;
ce9abb66 3432
54fd0535
MT		 3433 }else{
3434 $uplconffilename2 = $uplconffilename;
3435 $uplp12name2 = $uplp12name;
3436 @n2nname = split(/\./,$uplconffilename);
ce9abb66 3437 $n2nname[0] =~ s/\n|\r//g;
66c36198 3438 }
7c1d9faf 3439 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
66c36198 3440 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
ce9abb66 3441
7dfcaef0
AM		 3442 #Add collectd settings to configfile
3443 open(FILE, ">> $tempdir/$uplconffilename") or die 'Unable to open config file.';
3444 print FILE "# Logfile\n";
3445 print FILE "status-version 1\n";
3446 print FILE "status /var/run/openvpn/$n2nname[0]-n2n 10\n";
3447 close FILE;
3448
cc79d281 3449 unless(move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2")) {
ce9abb66
AH		 3450 $errormessage = "*.conf move failed: $!";
3451 unlink ($filename);
3452 goto N2N_ERROR;
3453 }
66c36198 3454
cc79d281 3455 unless(move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2")) {
ce9abb66
AH		 3456 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3457 unlink ($filename);
3458 goto N2N_ERROR;
cc79d281
SS		 3459 }
3460
3461 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
66c36198 3462
ce9abb66 3463my $complzoactive;
d96c89eb 3464my $mssfixactive;
4c962356 3465my $authactive;
d96c89eb 3466my $n2nfragment;
60f396d7 3467my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
54fd0535 3468my @n2nproto = split(/-/, $n2nproto2[1]);
ce9abb66
AH		 3469my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3470my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3471my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
66c36198 3472if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH		 3473my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
3474if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
54fd0535 3475#my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
d96c89eb 3476my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH		 3477my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3478my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3479my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
3480my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
54fd0535 3481my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
ce9abb66 3482my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
4c962356 3483my @n2ncipher = split(/ /, (grep { /^cipher/ } @firen2nconf)[0]);
f527e53f 3484my @n2nauth = split(/ /, (grep { /^auth/ } @firen2nconf)[0]);;
60f396d7 3485
ce9abb66
AH		 3486###
3487# m.a.d delete CR and LF from arrays for this chomp doesnt work
3488###
3489
ce9abb66 3490$n2nremote[1] =~ s/\n|\r//g;
ce9abb66
AH		 3491$n2novpnsub[0] =~ s/\n|\r//g;
3492$n2novpnsub[1] =~ s/\n|\r//g;
3493$n2novpnsub[2] =~ s/\n|\r//g;
60f396d7 3494$n2nproto[0] =~ s/\n|\r//g;
ce9abb66
AH		 3495$n2nport[1] =~ s/\n|\r//g;
3496$n2ntunmtu[1] =~ s/\n|\r//g;
3497$n2nremsub[1] =~ s/\n|\r//g;
b278daf3 3498$n2nremsub[2] =~ s/\n|\r//g;
ce9abb66 3499$n2nlocalsub[2] =~ s/\n|\r//g;
d96c89eb 3500$n2nfragment[1] =~ s/\n|\r//g;
54fd0535 3501$n2nmgmt[2] =~ s/\n|\r//g;
4c962356
EK		 3502$n2ncipher[1] =~ s/\n|\r//g;
3503$n2nauth[1] =~ s/\n|\r//g;
ce9abb66 3504chomp ($complzoactive);
d96c89eb 3505chomp ($mssfixactive);
ce9abb66
AH		 3506
3507###
7c1d9faf 3508# m.a.d net2net
ce9abb66
AH		 3509###
3510
3511###
3512# Check if there is no other entry with this name
3513###
3514
3515 foreach my $dkey (keys %confighash) {
3516 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3517 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH		 3518 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3519 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3520 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
66c36198 3521 goto N2N_ERROR;
ce9abb66
AH		 3522 }
3523 }
3524
d96c89eb
AH		 3525###
3526# Check if OpenVPN Subnet is valid
3527###
3528
3529foreach my $dkey (keys %confighash) {
3530 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3531 $errormessage = 'The OpenVPN Subnet is already in use';
b278daf3
AH		 3532 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3533 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3534 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
66c36198 3535 goto N2N_ERROR;
d96c89eb
AH		 3536 }
3537 }
3538
3539###
4c962356 3540# Check if Dest Port is vaild
d96c89eb
AH		 3541###
3542
3543foreach my $dkey (keys %confighash) {
3544 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3545 $errormessage = 'The OpenVPN Port is already in use';
b278daf3
AH		 3546 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3547 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3548 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
66c36198 3549 goto N2N_ERROR;
d96c89eb
AH		 3550 }
3551 }
66c36198
PM		 3552
3553
3554
ce9abb66
AH		 3555 $key = &General::findhasharraykey (\%confighash);
3556
49abe7af 3557 foreach my $i (0 .. 42) { $confighash{$key}[$i] = "";}
350f2980 3558
ce9abb66
AH		 3559 $confighash{$key}[0] = 'off';
3560 $confighash{$key}[1] = $n2nname[0];
66c36198 3561 $confighash{$key}[2] = $n2nname[0];
ce9abb66 3562 $confighash{$key}[3] = 'net';
66c36198
PM		 3563 $confighash{$key}[4] = 'cert';
3564 $confighash{$key}[6] = 'client';
ce9abb66 3565 $confighash{$key}[8] = $n2nlocalsub[2];
350f2980 3566 $confighash{$key}[10] = $n2nremote[1];
66c36198 3567 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
54fd0535 3568 $confighash{$key}[22] = $n2nmgmt[2];
350f2980 3569 $confighash{$key}[23] = $mssfixactive;
d96c89eb 3570 $confighash{$key}[24] = $n2nfragment[1];
350f2980 3571 $confighash{$key}[25] = 'IPFire n2n Client';
ce9abb66 3572 $confighash{$key}[26] = 'red';
350f2980
SS		 3573 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3574 $confighash{$key}[28] = $n2nproto[0];
3575 $confighash{$key}[29] = $n2nport[1];
3576 $confighash{$key}[30] = $complzoactive;
3577 $confighash{$key}[31] = $n2ntunmtu[1];
4c962356
EK		 3578 $confighash{$key}[39] = $n2nauth[1];
3579 $confighash{$key}[40] = $n2ncipher[1];
49abe7af 3580 $confighash{$key}[41] = 'disabled';
ce9abb66
AH		 3581
3582 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
66c36198 3583
ce9abb66 3584 N2N_ERROR:
66c36198 3585
ce9abb66
AH		 3586 &Header::showhttpheaders();
3587 &Header::openpage('Validate imported configuration', 1, '');
3588 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3589 if ($errormessage) {
3590 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3591 print "<class name='base'>$errormessage";
3592 print "&nbsp;</class>";
66c36198 3593 &Header::closebox();
ce9abb66 3594
66c36198
PM		 3595 } else
3596 {
ce9abb66
AH		 3597 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3598 }
3599 if ($errormessage eq ''){
49abe7af 3600 print <<END;
ce9abb66
AH		 3601 <!-- ipfire net2net config gui -->
3602 <table width='100%'>
3603 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3604 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
66c36198
PM		 3605 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3606 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
ce9abb66
AH		 3607 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3608 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
4c962356 3609 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}:</td><td><b>$confighash{$key}[11]</b></td></tr>
ce9abb66
AH		 3610 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3611 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3612 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3613 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
4c962356
EK		 3614 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX:</td><td><b>$confighash{$key}[23]</b></td></tr>
3615 <tr><td class='boldbase' nowrap='nowrap'>Fragment:</td><td><b>$confighash{$key}[24]</b></td></tr>
ce9abb66 3616 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
54fd0535 3617 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
0c4ffc69 3618 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn tls auth'}:</td><td><b>$confighash{$key}[39]</b></td></tr>
4c962356 3619 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td><td><b>$confighash{$key}[40]</b></td></tr>
66c36198 3620 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
ce9abb66
AH		 3621 </table>
3622END
66c36198 3623;
ce9abb66
AH		 3624 &Header::closebox();
3625 }
3626
3627 if ($errormessage) {
3628 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
66c36198
PM		 3629 } else {
3630 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
ce9abb66 3631 print "<input type='hidden' name='TYPE' value='net2netakn' />";
66c36198 3632 print "<input type='hidden' name='KEY' value='$key' />";
ce9abb66 3633 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
66c36198 3634 }
ce9abb66
AH		 3635 &Header::closebigbox();
3636 &Header::closepage();
4c962356 3637 exit(0);
ce9abb66
AH		 3638
3639
3640##
3641### Accept IPFire n2n Package Settings
3642###
3643
3644 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3645
3646###
3647### Discard and Rollback IPFire n2n Package Settings
3648###
3649
3650 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
66c36198 3651
ce9abb66
AH		 3652 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3653
3654if ($confighash{$cgiparams{'KEY'}}) {
3655
3656 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3657 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3658 unlink ($certfile) or die "Removing $certfile fail: $!";
3659 unlink ($conffile) or die "Removing $conffile fail: $!";
3660 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3661 delete $confighash{$cgiparams{'KEY'}};
66c36198 3662 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH		 3663
3664 } else {
3665 $errormessage = $Lang::tr{'invalid key'};
66c36198
PM		 3666 }
3667
ce9abb66
AH		 3668
3669###
7c1d9faf 3670# m.a.d net2net
ce9abb66
AH		 3671###
3672
3673
3674###
3675### Adding a new connection
3676###
6e13d0a5
MT		 3677} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3678 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3679 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
66c36198 3680
6e13d0a5
MT		 3681 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3682 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3683 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3684
3685 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
8c877a82
AM		 3686 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3687 $errormessage = $Lang::tr{'invalid key'};
3688 goto VPNCONF_END;
3689 }
4c962356
EK		 3690 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
3691 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
3692 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
3693 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
3694 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
3695 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
3696 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
3697 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
8c877a82 3698 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
4c962356
EK		 3699 $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
3700 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
3701 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
3702 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
3703 $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
3704 $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
3705 $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28];
3706 $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29];
3707 $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30];
3708 $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31];
3709 $cgiparams{'CHECK1'} = $confighash{$cgiparams{'KEY'}}[32];
df9b48b7 3710 $name=$cgiparams{'CHECK1'} ;
4c962356
EK		 3711 $cgiparams{$name} = $confighash{$cgiparams{'KEY'}}[33];
3712 $cgiparams{'RG'} = $confighash{$cgiparams{'KEY'}}[34];
3713 $cgiparams{'CCD_DNS1'} = $confighash{$cgiparams{'KEY'}}[35];
3714 $cgiparams{'CCD_DNS2'} = $confighash{$cgiparams{'KEY'}}[36];
3715 $cgiparams{'CCD_WINS'} = $confighash{$cgiparams{'KEY'}}[37];
4c962356
EK		 3716 $cgiparams{'DAUTH'} = $confighash{$cgiparams{'KEY'}}[39];
3717 $cgiparams{'DCIPHER'} = $confighash{$cgiparams{'KEY'}}[40];
49abe7af 3718 $cgiparams{'TLSAUTH'} = $confighash{$cgiparams{'KEY'}}[41];
e1e10515 3719 $cgiparams{'OTP_STATE'} = $confighash{$cgiparams{'KEY'}}[43];
8c877a82 3720 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
c6c9630e 3721 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
66c36198 3722
8c877a82 3723#A.Marx CCD check iroute field and convert it to decimal
52d08bcb 3724if ($cgiparams{'TYPE'} eq 'host') {
8c877a82
AM		 3725 my @temp=();
3726 my %ccdroutehash=();
3727 my $keypoint=0;
5068ac38
AM		 3728 my $ip;
3729 my $cidr;
8c877a82
AM		 3730 if ($cgiparams{'IR'} ne ''){
3731 @temp = split("\n",$cgiparams{'IR'});
3732 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3733 #find key to use
3734 foreach my $key (keys %ccdroutehash) {
3735 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3736 $keypoint=$key;
3737 delete $ccdroutehash{$key};
3738 }else{
3739 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3740 }
3741 }
3742 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3743 my $i=1;
3744 my $val=0;
3745 foreach $val (@temp){
3746 chomp($val);
66c36198 3747 $val=~s/\s*$//g;
5068ac38 3748 #check if iroute exists in ccdroute or if new iroute is part of an existing one
8c877a82
AM		 3749 foreach my $key (keys %ccdroutehash) {
3750 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
5068ac38
AM		 3751 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3752 $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3753 goto VPNCONF_ERROR;
3754 }
3755 my ($ip1,$cidr1) = split (/\//, $val);
82c809c7 3756 $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1));
5068ac38
AM		 3757 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3758 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3759 $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3760 goto VPNCONF_ERROR;
66c36198
PM		 3761 }
3762
8c877a82
AM		 3763 }
3764 }
5068ac38
AM		 3765 if (!&General::validipandmask($val)){
3766 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3767 goto VPNCONF_ERROR;
3768 }else{
3769 ($ip,$cidr) = split(/\//,$val);
3770 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3771 $cidr=&General::iporsubtodec($cidr);
3772 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
66c36198 3773
5068ac38 3774 }
66c36198 3775
8c877a82 3776 #check for existing network IP's
52d08bcb
AM		 3777 if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3778 {
3779 $errormessage=$Lang::tr{'ccd err green'};
3780 goto VPNCONF_ERROR;
3781 }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3782 {
3783 $errormessage=$Lang::tr{'ccd err red'};
3784 goto VPNCONF_ERROR;
3785 }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3786 {
3787 $errormessage=$Lang::tr{'ccd err blue'};
3788 goto VPNCONF_ERROR;
3789 }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3790 {
3791 $errormessage=$Lang::tr{'ccd err orange'};
8c877a82
AM		 3792 goto VPNCONF_ERROR;
3793 }
66c36198 3794
8c877a82
AM		 3795 if (&General::validipandmask($val)){
3796 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3797 }else{
3798 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3799 goto VPNCONF_ERROR;
3800 }
3801 $i++;
3802 }
3803 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3804 &writeserverconf;
3805 }else{
3806 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3807 foreach my $key (keys %ccdroutehash) {
3808 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3809 delete $ccdroutehash{$key};
3810 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3811 &writeserverconf;
3812 }
66c36198 3813 }
8c877a82
AM		 3814 }
3815 undef @temp;
3816 #check route field and convert it to decimal
8c877a82
AM		 3817 my $val=0;
3818 my $i=1;
8c877a82 3819 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
52d08bcb
AM		 3820 #find key to use
3821 foreach my $key (keys %ccdroute2hash) {
3822 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3823 $keypoint=$key;
3824 delete $ccdroute2hash{$key};
3825 }else{
3826 $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3827 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3828 &writeserverconf;
8c877a82 3829 }
52d08bcb
AM		 3830 }
3831 $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3832 if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3833 @temp = split(/\|/,$cgiparams{'IFROUTE'});
3834 my %ownnet=();
3835 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3836 foreach $val (@temp){
3837 chomp($val);
66c36198 3838 $val=~s/\s*$//g;
52d08bcb
AM		 3839 if ($val eq $Lang::tr{'green'})
3840 {
3841 $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3842 }
3843 if ($val eq $Lang::tr{'blue'})
3844 {
3845 $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3846 }
3847 if ($val eq $Lang::tr{'orange'})
3848 {
3849 $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3850 }
3851 my ($ip,$cidr) = split (/\//, $val);
66c36198 3852
52d08bcb 3853 if ($val ne $Lang::tr{'ccd none'})
66c36198 3854 {
8c877a82
AM		 3855 if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3856 if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3857 if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3858 if (&General::validipandmask($val)){
3859 $val=$ip."/".&General::iporsubtodec($cidr);
3860 $ccdroute2hash{$keypoint}[$i] = $val;
3861 }else{
3862 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3863 goto VPNCONF_ERROR;
3864 }
52d08bcb
AM		 3865 }else{
3866 $ccdroute2hash{$keypoint}[$i]='';
3867 }
3868 $i++;
66c36198 3869 }
52d08bcb
AM		 3870 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3871
8c877a82
AM		 3872 #check dns1 ip
3873 if ($cgiparams{'CCD_DNS1'} ne '' && ! &General::validip($cgiparams{'CCD_DNS1'})) {
3874 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3875 goto VPNCONF_ERROR;
3876 }
3877 #check dns2 ip
3878 if ($cgiparams{'CCD_DNS2'} ne '' && ! &General::validip($cgiparams{'CCD_DNS2'})) {
3879 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3880 goto VPNCONF_ERROR;
3881 }
3882 #check wins ip
3883 if ($cgiparams{'CCD_WINS'} ne '' && ! &General::validip($cgiparams{'CCD_WINS'})) {
3884 $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3885 goto VPNCONF_ERROR;
3886 }
52d08bcb 3887}
8c877a82
AM		 3888
3889#CCD End
52d08bcb 3890
66c36198 3891
73735ad9
EK		 3892 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3893 $errormessage = $Lang::tr{'connection type is invalid'};
3894 if ($cgiparams{'TYPE'} eq 'net') {
3895 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3896 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3897 goto VPNCONF_ERROR;
3898 }
3899 goto VPNCONF_ERROR;
c6c9630e
MT		 3900 }
3901
c6c9630e 3902 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
73735ad9
EK		 3903 $errormessage = $Lang::tr{'name must only contain characters'};
3904 if ($cgiparams{'TYPE'} eq 'net') {
3905 goto VPNCONF_ERROR;
3906 }
3907 goto VPNCONF_ERROR;
3908 }
c6c9630e
MT		 3909
3910 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
73735ad9
EK		 3911 $errormessage = $Lang::tr{'name is invalid'};
3912 if ($cgiparams{'TYPE'} eq 'net') {
3913 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3914 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3915 goto VPNCONF_ERROR;
3916 }
3917 goto VPNCONF_ERROR;
c6c9630e
MT		 3918 }
3919
3920 if (length($cgiparams{'NAME'}) >60) {
73735ad9
EK		 3921 $errormessage = $Lang::tr{'name too long'};
3922 if ($cgiparams{'TYPE'} eq 'net') {
3923 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3924 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3925 goto VPNCONF_ERROR;
3926 }
3927 goto VPNCONF_ERROR;
c6c9630e
MT		 3928 }
3929
d96c89eb 3930###
7c1d9faf 3931# m.a.d net2net
d96c89eb
AH		 3932###
3933
7c1d9faf 3934if ($cgiparams{'TYPE'} eq 'net') {
ab4cf06c 3935 if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) {
cd0c0a0d 3936 $errormessage = $Lang::tr{'openvpn destination port used'};
b278daf3
AH		 3937 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3938 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
66c36198 3939 goto VPNCONF_ERROR;
d96c89eb 3940 }
ab4cf06c
AM		 3941 #Bugfix 10357
3942 foreach my $key (sort keys %confighash){
3943 if ( ($confighash{$key}[22] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1]) || ($confighash{$key}[29] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1])){
54fd0535
MT		 3944 $errormessage = $Lang::tr{'openvpn destination port used'};
3945 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3946 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
66c36198 3947 goto VPNCONF_ERROR;
ab4cf06c
AM		 3948 }
3949 }
3950 if ($cgiparams{'DEST_PORT'} eq '') {
3951 $errormessage = $Lang::tr{'invalid port'};
3952 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3953 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
66c36198 3954 goto VPNCONF_ERROR;
54fd0535 3955 }
d96c89eb 3956
f48074ba
SS		 3957 # Check if the input for the transfer net is valid.
3958 if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
3959 $errormessage = $Lang::tr{'ccd err invalidnet'};
3960 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3961 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3962 goto VPNCONF_ERROR;
3963 }
3964
d96c89eb 3965 if ($cgiparams{'OVPN_SUBNET'} eq $vpnsettings{'DOVPN_SUBNET'}) {
cd0c0a0d 3966 $errormessage = $Lang::tr{'openvpn subnet is used'};
b278daf3
AH		 3967 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3968 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
66c36198 3969 goto VPNCONF_ERROR;
d96c89eb
AH		 3970 }
3971
3972 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
cd0c0a0d 3973 $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
b278daf3
AH		 3974 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3975 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH		 3976 goto VPNCONF_ERROR;
3977 }
66c36198 3978
d96c89eb 3979 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
cd0c0a0d 3980 $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
b278daf3
AH		 3981 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3982 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH		 3983 goto VPNCONF_ERROR;
3984 }
d96c89eb 3985
7c1d9faf 3986 if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) {
cd0c0a0d 3987 $errormessage = $Lang::tr{'openvpn prefix local subnet'};
b278daf3
AH		 3988 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3989 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3990 goto VPNCONF_ERROR;
66c36198
PM		 3991 }
3992
7c1d9faf 3993 if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) {
cd0c0a0d 3994 $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
b278daf3
AH		 3995 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3996 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3997 goto VPNCONF_ERROR;
66c36198
PM		 3998 }
3999
7c1d9faf 4000 if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) {
cd0c0a0d 4001 $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
b278daf3
AH		 4002 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4003 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4004 goto VPNCONF_ERROR;
8c252e6a 4005 }
66c36198 4006
8c252e6a
EK		 4007 if ($cgiparams{'DEST_PORT'} <= 1023) {
4008 $errormessage = $Lang::tr{'ovpn port in root range'};
4009 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4010 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4011 goto VPNCONF_ERROR;
4012 }
54fd0535 4013
4c962356 4014 if ($cgiparams{'OVPN_MGMT'} eq '') {
66c36198 4015 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
8c252e6a 4016 }
66c36198 4017
8c252e6a
EK		 4018 if ($cgiparams{'OVPN_MGMT'} <= 1023) {
4019 $errormessage = $Lang::tr{'ovpn mgmt in root range'};
4020 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4021 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4022 goto VPNCONF_ERROR;
b2e75449
MT		 4023 }
4024 #Check if remote subnet is used elsewhere
4025 my ($n2nip,$n2nsub)=split("/",$cgiparams{'REMOTE_SUBNET'});
4026 $warnmessage=&General::checksubnets('',$n2nip,'ovpn');
4027 if ($warnmessage){
4028 $warnmessage=$Lang::tr{'remote subnet'}." ($cgiparams{'REMOTE_SUBNET'}) <br>".$warnmessage;
4029 }
7c1d9faf 4030}
d96c89eb 4031
ce9abb66
AH		 4032# if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
4033# $errormessage = $Lang::tr{'ipfire side is invalid'};
4034# goto VPNCONF_ERROR;
4035# }
4036
c6c9630e
MT		 4037 # Check if there is no other entry with this name
4038 if (! $cgiparams{'KEY'}) {
4039 foreach my $key (keys %confighash) {
4040 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4041 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH		 4042 if ($cgiparams{'TYPE'} eq 'net') {
4043 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4044 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4045 }
c6c9630e 4046 goto VPNCONF_ERROR;
6e13d0a5 4047 }
c6c9630e
MT		 4048 }
4049 }
4050
c125d8a2 4051 # Check if a remote host/IP has been set for the client.
86228a56
MT		 4052 if ($cgiparams{'TYPE'} eq 'net') {
4053 if ($cgiparams{'SIDE'} ne 'server' && $cgiparams{'REMOTE'} eq '') {
4054 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
c125d8a2 4055
86228a56
MT		 4056 # Check if this is a N2N connection and drop temporary config.
4057 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4058 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
ce9abb66 4059
86228a56
MT		 4060 goto VPNCONF_ERROR;
4061 }
c125d8a2 4062
86228a56
MT		 4063 # Check if a remote host/IP has been configured - the field can be empty on the server side.
4064 if ($cgiparams{'REMOTE'} ne '') {
4065 # Check if the given IP is valid - otherwise check if it is a valid domain.
4066 if (! &General::validip($cgiparams{'REMOTE'})) {
4067 # Check for a valid domain.
4068 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
4069 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
c125d8a2 4070
86228a56
MT		 4071 # Check if this is a N2N connection and drop temporary config.
4072 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4073 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
c125d8a2 4074
86228a56
MT		 4075 goto VPNCONF_ERROR;
4076 }
4077 }
6e13d0a5 4078 }
c6c9630e 4079 }
c125d8a2 4080
c6c9630e
MT		 4081 if ($cgiparams{'TYPE'} ne 'host') {
4082 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
66c36198 4083 $errormessage = $Lang::tr{'local subnet is invalid'};
b278daf3
AH		 4084 if ($cgiparams{'TYPE'} eq 'net') {
4085 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4086 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4087 }
c6c9630e
MT		 4088 goto VPNCONF_ERROR;}
4089 }
4090 # Check if there is no other entry without IP-address and PSK
4091 if ($cgiparams{'REMOTE'} eq '') {
4092 foreach my $key (keys %confighash) {
66c36198
PM		 4093 if(($cgiparams{'KEY'} ne $key) &&
4094 ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
c6c9630e
MT		 4095 $confighash{$key}[10] eq '') {
4096 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
4097 goto VPNCONF_ERROR;
6e13d0a5 4098 }
c6c9630e
MT		 4099 }
4100 }
ce9abb66
AH		 4101 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
4102 $errormessage = $Lang::tr{'remote subnet is invalid'};
b278daf3
AH		 4103 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4104 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4105 goto VPNCONF_ERROR;
ce9abb66 4106 }
c6c9630e 4107
425465ed
EK		 4108 # Check for N2N that OpenSSL maximum of valid days will not be exceeded
4109 if ($cgiparams{'TYPE'} eq 'net') {
4110 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4111 $errormessage = $Lang::tr{'invalid input for valid till days'};
4112 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
4113 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
4114 goto VPNCONF_ERROR;
4115 }
4116 }
4117
c6c9630e
MT		 4118 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
4119 $errormessage = $Lang::tr{'invalid input'};
4120 goto VPNCONF_ERROR;
4121 }
4122 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
4123 $errormessage = $Lang::tr{'invalid input'};
4124 goto VPNCONF_ERROR;
4125 }
4126
4127#fixplausi
4128 if ($cgiparams{'AUTH'} eq 'psk') {
4129# if (! length($cgiparams{'PSK'}) ) {
4130# $errormessage = $Lang::tr{'pre-shared key is too short'};
4131# goto VPNCONF_ERROR;
4132# }
4133# if ($cgiparams{'PSK'} =~ /['",&]/) {
4134# $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
4135# goto VPNCONF_ERROR;
4136# }
4137 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
4138 if ($cgiparams{'KEY'}) {
4139 $errormessage = $Lang::tr{'cant change certificates'};
4140 goto VPNCONF_ERROR;
4141 }
2ad1b18b 4142 unless (ref ($cgiparams{'FH'})) {
c6c9630e
MT		 4143 $errormessage = $Lang::tr{'there was no file upload'};
4144 goto VPNCONF_ERROR;
4145 }
4146
4147 # Move uploaded certificate request to a temporary file
4148 (my $fh, my $filename) = tempfile( );
4149 if (copy ($cgiparams{'FH'}, $fh) != 1) {
4150 $errormessage = $!;
4151 goto VPNCONF_ERROR;
4152 }
6e13d0a5 4153
c6c9630e
MT		 4154 # Sign the certificate request and move it
4155 # Sign the host certificate request
2feacd98 4156 # The system call is safe, because all arguments are passed as an array.
f6e12093 4157 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
c6c9630e
MT		 4158 '-batch', '-notext',
4159 '-in', $filename,
4160 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4161 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4162 if ($?) {
4163 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4164 unlink ($filename);
4165 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4166 &newcleanssldatabase();
4167 goto VPNCONF_ERROR;
4168 } else {
4169 unlink ($filename);
4170 &deletebackupcert();
4171 }
4172
2feacd98
SS		 4173 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4174 my $temp;
4175
4176 foreach my $line (@temp) {
4177 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4178 $temp = $1;
4179 $temp =~ s+/Email+, E+;
4180 $temp =~ s/ ST=/ S=/;
4181
4182 last;
4183 }
4184 }
66c36198 4185
c6c9630e
MT		 4186 $cgiparams{'CERT_NAME'} = $temp;
4187 $cgiparams{'CERT_NAME'} =~ s/,//g;
4188 $cgiparams{'CERT_NAME'} =~ s/\'//g;
4189 if ($cgiparams{'CERT_NAME'} eq '') {
4190 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4191 goto VPNCONF_ERROR;
4192 }
4193 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
4194 if ($cgiparams{'KEY'}) {
4195 $errormessage = $Lang::tr{'cant change certificates'};
4196 goto VPNCONF_ERROR;
4197 }
2ad1b18b 4198 unless (ref ($cgiparams{'FH'})) {
c6c9630e
MT		 4199 $errormessage = $Lang::tr{'there was no file upload'};
4200 goto VPNCONF_ERROR;
4201 }
4202 # Move uploaded certificate to a temporary file
4203 (my $fh, my $filename) = tempfile( );
4204 if (copy ($cgiparams{'FH'}, $fh) != 1) {
4205 $errormessage = $!;
4206 goto VPNCONF_ERROR;
4207 }
4208
4209 # Verify the certificate has a valid CA and move it
4210 my $validca = 0;
2feacd98
SS		 4211 my @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/cacert.pem", "$filename");
4212 if (grep(/: OK/, @test)) {
c6c9630e
MT		 4213 $validca = 1;
4214 } else {
4215 foreach my $key (keys %cahash) {
2feacd98
SS		 4216 @test = &General::system_output("/usr/bin/openssl", "verify", "-CAfile", "${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem", "$filename");
4217 if (grep(/: OK/, @test)) {
c6c9630e
MT		 4218 $validca = 1;
4219 }
6e13d0a5 4220 }
c6c9630e
MT		 4221 }
4222 if (! $validca) {
4223 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
4224 unlink ($filename);
4225 goto VPNCONF_ERROR;
4226 } else {
cc79d281 4227 unless(move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem")) {
c6c9630e
MT		 4228 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
4229 unlink ($filename);
4230 goto VPNCONF_ERROR;
6e13d0a5 4231 }
c6c9630e
MT		 4232 }
4233
2feacd98
SS		 4234 my @temp = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4235 my $temp;
4236
4237 foreach my $line (@temp) {
4238 if ($line =~ /Subject:.*CN\s?=\s?(.*)[\n]/) {
4239 $temp = $1;
4240 $temp =~ s+/Email+, E+;
4241 $temp =~ s/ ST=/ S=/;
4242
4243 last;
4244 }
4245 }
4246
c6c9630e
MT		 4247 $cgiparams{'CERT_NAME'} = $temp;
4248 $cgiparams{'CERT_NAME'} =~ s/,//g;
4249 $cgiparams{'CERT_NAME'} =~ s/\'//g;
4250 if ($cgiparams{'CERT_NAME'} eq '') {
4251 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4252 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
4253 goto VPNCONF_ERROR;
4254 }
4255 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
4256 if ($cgiparams{'KEY'}) {
4257 $errormessage = $Lang::tr{'cant change certificates'};
4258 goto VPNCONF_ERROR;
4259 }
4260 # Validate input since the form was submitted
4261 if (length($cgiparams{'CERT_NAME'}) >60) {
4262 $errormessage = $Lang::tr{'name too long'};
4263 goto VPNCONF_ERROR;
4264 }
194314b2 4265 if ($cgiparams{'CERT_NAME'} eq '' || $cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
c6c9630e
MT		 4266 $errormessage = $Lang::tr{'invalid input for name'};
4267 goto VPNCONF_ERROR;
4268 }
4269 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
4270 $errormessage = $Lang::tr{'invalid input for e-mail address'};
4271 goto VPNCONF_ERROR;
4272 }
4273 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
4274 $errormessage = $Lang::tr{'e-mail address too long'};
4275 goto VPNCONF_ERROR;
4276 }
4277 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4278 $errormessage = $Lang::tr{'invalid input for department'};
4279 goto VPNCONF_ERROR;
4280 }
4281 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
4282 $errormessage = $Lang::tr{'organization too long'};
4283 goto VPNCONF_ERROR;
4284 }
4285 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
4286 $errormessage = $Lang::tr{'invalid input for organization'};
4287 goto VPNCONF_ERROR;
4288 }
4289 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4290 $errormessage = $Lang::tr{'invalid input for city'};
4291 goto VPNCONF_ERROR;
4292 }
4293 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
4294 $errormessage = $Lang::tr{'invalid input for state or province'};
4295 goto VPNCONF_ERROR;
4296 }
4297 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
4298 $errormessage = $Lang::tr{'invalid input for country'};
4299 goto VPNCONF_ERROR;
4300 }
4301 if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
4302 if (length($cgiparams{'CERT_PASS1'}) < 5) {
4303 $errormessage = $Lang::tr{'password too short'};
4304 goto VPNCONF_ERROR;
6e13d0a5 4305 }
66c36198 4306 }
c6c9630e
MT		 4307 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
4308 $errormessage = $Lang::tr{'passwords do not match'};
4309 goto VPNCONF_ERROR;
4310 }
425465ed 4311 if ($cgiparams{'DAYS_VALID'} eq '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) {
f4fbb935
EK		 4312 $errormessage = $Lang::tr{'invalid input for valid till days'};
4313 goto VPNCONF_ERROR;
4314 }
c6c9630e 4315
425465ed
EK		 4316 # Check for RW that OpenSSL maximum of valid days will not be exceeded
4317 if ($cgiparams{'TYPE'} eq 'host') {
4318 if ($cgiparams{'DAYS_VALID'} >= '999999') {
4319 $errormessage = $Lang::tr{'invalid input for valid till days'};
4320 goto VPNCONF_ERROR;
4321 }
4322 }
4323
beac479f
EK		 4324 # Check for RW if client name is already set
4325 if ($cgiparams{'TYPE'} eq 'host') {
4326 foreach my $key (keys %confighash) {
4327 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
4328 $errormessage = $Lang::tr{'a connection with this name already exists'};
4329 goto VPNCONF_ERROR;
4330 }
4331 }
4332 }
4333
c6c9630e
MT		 4334 # Replace empty strings with a .
4335 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
4336 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
4337 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
4338
4339 # Create the Host certificate request client
4340 my $pid = open(OPENSSL, "|-");
4341 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
4342 if ($pid) { # parent
4343 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
4344 print OPENSSL "$state\n";
4345 print OPENSSL "$city\n";
4346 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
4347 print OPENSSL "$ou\n";
4348 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
4349 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
4350 print OPENSSL ".\n";
4351 print OPENSSL ".\n";
4352 close (OPENSSL);
4353 if ($?) {
4354 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4355 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
4356 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
4357 goto VPNCONF_ERROR;
6e13d0a5 4358 }
c6c9630e 4359 } else { # child
badd8c1c 4360 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
4c962356 4361 '-newkey', 'rsa:2048',
c6c9630e
MT		 4362 '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4363 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4364 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
4365 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
4366 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4367 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4368 goto VPNCONF_ERROR;
6e13d0a5 4369 }
c6c9630e 4370 }
66c36198 4371
c6c9630e 4372 # Sign the host certificate request
2feacd98 4373 # The system call is safe, because all arguments are passed as an array.
f6e12093 4374 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
c6c9630e
MT		 4375 '-batch', '-notext',
4376 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
4377 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4378 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
4379 if ($?) {
4380 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4381 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4382 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4383 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4384 &newcleanssldatabase();
4385 goto VPNCONF_ERROR;
4386 } else {
4387 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
4388 &deletebackupcert();
4389 }
4390
4391 # Create the pkcs12 file
2feacd98 4392 # The system call is safe, because all arguments are passed as an array.
66c36198 4393 system('/usr/bin/openssl', 'pkcs12', '-export',
c6c9630e
MT		 4394 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
4395 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
4396 '-name', $cgiparams{'NAME'},
4397 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
66c36198 4398 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
c6c9630e
MT		 4399 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
4400 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4401 if ($?) {
4402 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
4403 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4404 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
4405 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
4406 goto VPNCONF_ERROR;
4407 } else {
4408 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
4409 }
4410 } elsif ($cgiparams{'AUTH'} eq 'cert') {
4411 ;# Nothing, just editing
4412 } else {
4413 $errormessage = $Lang::tr{'invalid input for authentication method'};
4414 goto VPNCONF_ERROR;
4415 }
4416
4417 # Check if there is no other entry with this common name
4418 if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
4419 foreach my $key (keys %confighash) {
4420 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
4421 $errormessage = $Lang::tr{'a connection with this common name already exists'};
4422 goto VPNCONF_ERROR;
6e13d0a5 4423 }
c6c9630e
MT		 4424 }
4425 }
4426
ab4cf06c 4427 # Save the config
c6c9630e 4428 my $key = $cgiparams{'KEY'};
66c36198 4429
c6c9630e
MT		 4430 if (! $key) {
4431 $key = &General::findhasharraykey (\%confighash);
49abe7af 4432 foreach my $i (0 .. 43) { $confighash{$key}[$i] = "";}
c6c9630e 4433 }
8c877a82
AM		 4434 $confighash{$key}[0] = $cgiparams{'ENABLED'};
4435 $confighash{$key}[1] = $cgiparams{'NAME'};
c6c9630e 4436 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
8c877a82 4437 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
c6c9630e 4438 }
66c36198 4439
8c877a82 4440 $confighash{$key}[3] = $cgiparams{'TYPE'};
c6c9630e 4441 if ($cgiparams{'AUTH'} eq 'psk') {
8c877a82
AM		 4442 $confighash{$key}[4] = 'psk';
4443 $confighash{$key}[5] = $cgiparams{'PSK'};
c6c9630e 4444 } else {
8c877a82 4445 $confighash{$key}[4] = 'cert';
c6c9630e 4446 }
ce9abb66 4447 if ($cgiparams{'TYPE'} eq 'net') {
8c877a82
AM		 4448 $confighash{$key}[6] = $cgiparams{'SIDE'};
4449 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
ce9abb66 4450 }
4c962356 4451 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
8c877a82 4452 $confighash{$key}[10] = $cgiparams{'REMOTE'};
4c962356 4453 if ($cgiparams{'OVPN_MGMT'} eq '') {
8c877a82 4454 $confighash{$key}[22] = $confighash{$key}[29];
4c962356 4455 } else {
8c877a82 4456 $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
4c962356 4457 }
8c877a82
AM		 4458 $confighash{$key}[23] = $cgiparams{'MSSFIX'};
4459 $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
4460 $confighash{$key}[25] = $cgiparams{'REMARK'};
4461 $confighash{$key}[26] = $cgiparams{'INTERFACE'};
66c36198 4462# new fields
8c877a82
AM		 4463 $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
4464 $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
4465 $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
4466 $confighash{$key}[30] = $cgiparams{'COMPLZO'};
4467 $confighash{$key}[31] = $cgiparams{'MTU'};
4468 $confighash{$key}[32] = $cgiparams{'CHECK1'};
df9b48b7 4469 $name=$cgiparams{'CHECK1'};
8c877a82
AM		 4470 $confighash{$key}[33] = $cgiparams{$name};
4471 $confighash{$key}[34] = $cgiparams{'RG'};
4472 $confighash{$key}[35] = $cgiparams{'CCD_DNS1'};
4473 $confighash{$key}[36] = $cgiparams{'CCD_DNS2'};
4474 $confighash{$key}[37] = $cgiparams{'CCD_WINS'};
4c962356
EK		 4475 $confighash{$key}[39] = $cgiparams{'DAUTH'};
4476 $confighash{$key}[40] = $cgiparams{'DCIPHER'};
350f2980 4477
71af643c
MT		 4478 if (($cgiparams{'TYPE'} eq 'host') && ($cgiparams{'CERT_PASS1'} eq "")) {
4479 $confighash{$key}[41] = "no-pass";
4480 }
4481
e1e10515
TE		 4482 $confighash{$key}[42] = 'HOTP/T30/6';
4483 $confighash{$key}[43] = $cgiparams{'OTP_STATE'};
4484 if (($confighash{$key}[43] == 'on') && ($confighash{$key}[44] == '')) {
4485 my @otp_secret = &General::system_output("/usr/bin/openssl", "rand", "-hex", "20");
4486 $confighash{$key}[44] = $otp_secret[0];
4487 } elsif ($confighash{$key}[43] == '') {
4488 $confighash{$key}[44] = '';
4489 }
4490
c6c9630e 4491 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
66c36198 4492
8c877a82 4493 if ($cgiparams{'CHECK1'} ){
66c36198 4494
8c877a82
AM		 4495 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
4496 my ($a,$b,$c,$d) = split (/\./,$ccdip);
df9b48b7
AM		 4497 if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
4498 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
4499 }
8c877a82 4500 open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
82c809c7 4501 print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n";
8c877a82
AM		 4502 if($cgiparams{'CHECK1'} eq 'dynamic'){
4503 print CCDRWCONF "#This client uses the dynamic pool\n";
4504 }else{
82c809c7 4505 print CCDRWCONF "#Ip address client and server\n";
8c877a82
AM		 4506 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
4507 }
4508 if ($confighash{$key}[34] eq 'on'){
4509 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
4510 print CCDRWCONF "push redirect-gateway\n";
4511 }
52d08bcb 4512 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
8c877a82 4513 if ($cgiparams{'IR'} ne ''){
82c809c7 4514 print CCDRWCONF "\n#Client routes these networks (behind Client)\n";
8c877a82
AM		 4515 foreach my $key (keys %ccdroutehash){
4516 if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
4517 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
4518 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
4519 print CCDRWCONF "iroute $a $b\n";
4520 }
4521 }
4522 }
4523 }
52d08bcb 4524 if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
8c877a82 4525 if ($cgiparams{'IFROUTE'} ne ''){
82c809c7 4526 print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n";
8c877a82
AM		 4527 foreach my $key (keys %ccdroute2hash){
4528 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4529 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
4530 if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
4531 my %blue=();
4532 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
52d08bcb 4533 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
8c877a82
AM		 4534 }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
4535 my %orange=();
4536 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
4537 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS} $orange{ORANGE_NETMASK}\n";
4538 }else{
4539 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
4540 print CCDRWCONF "push \"route $a $b\"\n";
4541 }
4542 }
4543 }
4544 }
4545 }
4546 if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
4547 if($cgiparams{'CCD_DNS1'} ne ''){
82c809c7 4548 print CCDRWCONF "\n#Client gets these nameservers\n";
8c877a82
AM		 4549 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4550 }
4551 if($cgiparams{'CCD_DNS2'} ne ''){
4552 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4553 }
4554 if($cgiparams{'CCD_WINS'} ne ''){
4555 print CCDRWCONF "\n#Client gets this WINS server\n";
4556 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4557 }
4558 close CCDRWCONF;
4559 }
18837a6a
AH		 4560
4561###
4562# m.a.d n2n begin
4563###
66c36198 4564
18837a6a 4565 if ($cgiparams{'TYPE'} eq 'net') {
66c36198 4566
2feacd98
SS		 4567 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4568 &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]");
66c36198 4569
2feacd98
SS		 4570 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4571 my $key = $cgiparams{'KEY'};
4572 if (! $key) {
4573 $key = &General::findhasharraykey (\%confighash);
4574 foreach my $i (0 .. 31) {
4575 $confighash{$key}[$i] = "";
4576 }
4577 }
4578
4579 $confighash{$key}[0] = 'on';
4580 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
66c36198 4581
2feacd98
SS		 4582 &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]");
4583 }
4584 }
18837a6a
AH		 4585
4586###
4587# m.a.d n2n end
66c36198 4588###
18837a6a 4589
c6c9630e
MT		 4590 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4591 $cgiparams{'KEY'} = $key;
4592 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4593 }
4594 goto VPNCONF_END;
6e13d0a5 4595 } else {
c6c9630e 4596 $cgiparams{'ENABLED'} = 'on';
54fd0535
MT		 4597###
4598# m.a.d n2n begin
66c36198 4599###
54fd0535
MT		 4600 $cgiparams{'MSSFIX'} = 'on';
4601 $cgiparams{'FRAGMENT'} = '1300';
70900745 4602 $cgiparams{'DAUTH'} = 'SHA512';
54fd0535
MT		 4603###
4604# m.a.d n2n end
66c36198 4605###
4c962356 4606 $cgiparams{'SIDE'} = 'left';
c6c9630e
MT		 4607 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4608 $cgiparams{'AUTH'} = 'psk';
4609 } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4610 $cgiparams{'AUTH'} = 'certfile';
4611 } else {
6e13d0a5 4612 $cgiparams{'AUTH'} = 'certgen';
c6c9630e
MT		 4613 }
4614 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4615 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4616 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
4617 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
4618 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
c0a7c9b2 4619 $cgiparams{'DAYS_VALID'} = $vpnsettings{'DAYS_VALID'} = '730';
6e13d0a5 4620 }
c6c9630e 4621
6e13d0a5 4622 VPNCONF_ERROR:
6e13d0a5
MT		 4623 $checked{'ENABLED'}{'off'} = '';
4624 $checked{'ENABLED'}{'on'} = '';
4625 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4626 $checked{'ENABLED_BLUE'}{'off'} = '';
4627 $checked{'ENABLED_BLUE'}{'on'} = '';
4628 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4629 $checked{'ENABLED_ORANGE'}{'off'} = '';
4630 $checked{'ENABLED_ORANGE'}{'on'} = '';
4631 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
c6c9630e
MT		 4632
4633
6e13d0a5
MT		 4634 $checked{'EDIT_ADVANCED'}{'off'} = '';
4635 $checked{'EDIT_ADVANCED'}{'on'} = '';
4636 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
c6c9630e 4637
6e13d0a5
MT		 4638 $selected{'SIDE'}{'server'} = '';
4639 $selected{'SIDE'}{'client'} = '';
4640 $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
66c36198 4641
d96c89eb
AH		 4642 $selected{'PROTOCOL'}{'udp'} = '';
4643 $selected{'PROTOCOL'}{'tcp'} = '';
4644 $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4645
c6c9630e 4646
6e13d0a5
MT		 4647 $checked{'AUTH'}{'psk'} = '';
4648 $checked{'AUTH'}{'certreq'} = '';
4649 $checked{'AUTH'}{'certgen'} = '';
4650 $checked{'AUTH'}{'certfile'} = '';
4651 $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
c6c9630e 4652
6e13d0a5 4653 $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
66c36198 4654
6e13d0a5
MT		 4655 $checked{'COMPLZO'}{'off'} = '';
4656 $checked{'COMPLZO'}{'on'} = '';
4657 $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
c6c9630e 4658
d96c89eb
AH		 4659 $checked{'MSSFIX'}{'off'} = '';
4660 $checked{'MSSFIX'}{'on'} = '';
4661 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4662
52f61e49
EKD		 4663 $selected{'DCIPHER'}{'AES-256-GCM'} = '';
4664 $selected{'DCIPHER'}{'AES-192-GCM'} = '';
4665 $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4c962356
EK		 4666 $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
4667 $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
4668 $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
4669 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4670 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4671 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4672 $selected{'DCIPHER'}{'DESX-CBC'} = '';
4673 $selected{'DCIPHER'}{'SEED-CBC'} = '';
4674 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4675 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4676 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4677 $selected{'DCIPHER'}{'BF-CBC'} = '';
4c962356 4678 $selected{'DCIPHER'}{'DES-CBC'} = '';
49abe7af
EK		 4679 # If no cipher has been chossen yet, select
4680 # the old default (AES-256-CBC) for compatiblity reasons.
4681 if ($cgiparams{'DCIPHER'} eq '') {
4682 $cgiparams{'DCIPHER'} = 'AES-256-CBC';
4683 }
4c962356 4684 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
49abe7af
EK		 4685 $selected{'DAUTH'}{'whirlpool'} = '';
4686 $selected{'DAUTH'}{'SHA512'} = '';
4687 $selected{'DAUTH'}{'SHA384'} = '';
4688 $selected{'DAUTH'}{'SHA256'} = '';
4689 $selected{'DAUTH'}{'SHA1'} = '';
49abe7af 4690 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
0c4ffc69
EK		 4691 $checked{'TLSAUTH'}{'off'} = '';
4692 $checked{'TLSAUTH'}{'on'} = '';
4693 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
49abe7af 4694
6e13d0a5
MT		 4695 if (1) {
4696 &Header::showhttpheaders();
4c962356 4697 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT		 4698 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4699 if ($errormessage) {
4700 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4701 print "<class name='base'>$errormessage";
4702 print "&nbsp;</class>";
4703 &Header::closebox();
4704 }
c6c9630e 4705
6e13d0a5
MT		 4706 if ($warnmessage) {
4707 &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4708 print "<class name='base'>$warnmessage";
4709 print "&nbsp;</class>";
4710 &Header::closebox();
4711 }
c6c9630e 4712
6e13d0a5 4713 print "<form method='post' enctype='multipart/form-data'>";
ce9abb66 4714 print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
c6c9630e 4715
6e13d0a5
MT		 4716 if ($cgiparams{'KEY'}) {
4717 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4718 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
6e13d0a5 4719 }
c6c9630e 4720
6e13d0a5 4721 &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
8c877a82 4722 print "<table width='100%' border='0'>\n";
4c962356 4723
e3edceeb 4724 print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>";
66c36198 4725
ce9abb66 4726 if ($cgiparams{'TYPE'} eq 'host') {
6e13d0a5 4727 if ($cgiparams{'KEY'}) {
8c877a82 4728 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
6e13d0a5
MT		 4729 } else {
4730 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4731 }
c6c9630e
MT		 4732# print "<tr><td>$Lang::tr{'interface'}</td>";
4733# print "<td><select name='INTERFACE'>";
4734# print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4c962356
EK		 4735# if ($netsettings{'BLUE_DEV'} ne '') {
4736# print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4737# }
4738# print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4739# print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4740# print "</select></td></tr>";
4741# print <<END;
ce9abb66
AH		 4742 } else {
4743 print "<input type='hidden' name='INTERFACE' value='red' />";
4744 if ($cgiparams{'KEY'}) {
4745 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4746 } else {
4747 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4748 }
52f61e49
EKD		 4749
4750 # If GCM ciphers are in usage, HMAC menu is disabled
4751 my $hmacdisabled;
4752 if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') ||
4753 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') ||
4754 ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) {
4755 $hmacdisabled = "disabled='disabled'";
4756 };
4757
4c962356 4758 print <<END;
ce9abb66 4759 <td width='25%'>&nbsp;</td>
66c36198 4760 <td width='25%'>&nbsp;</td></tr>
f527e53f
EK		 4761 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4762 <td><select name='SIDE'>
4763 <option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4764 <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option>
4765 </select>
4766 </td>
4c962356 4767
f527e53f
EK		 4768 <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4769 <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td>
4770 </tr>
4c962356 4771
e3edceeb 4772 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f 4773 <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4c962356 4774
e3edceeb 4775 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f
EK		 4776 <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td>
4777 </tr>
4c962356 4778
e3edceeb 4779 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f 4780 <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td>
49abe7af 4781
f527e53f
EK		 4782 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4783 <td><select name='PROTOCOL'>
4784 <option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4785 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4786 </tr>
66c36198 4787
f527e53f 4788 <tr>
e3edceeb 4789 <td class='boldbase'>$Lang::tr{'destination port'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
f527e53f 4790 <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td>
4c962356 4791
e3edceeb 4792 <td class='boldbase' nowrap='nowrap'>Management Port ($Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}):</td>
f527e53f
EK		 4793 <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4794 </tr>
49abe7af 4795
f527e53f 4796 <tr><td colspan=4><hr /></td></tr><tr>
66c36198 4797
f527e53f
EK		 4798 <tr>
4799 <td class'base'><b>$Lang::tr{'MTU settings'}</b></td>
4800 </tr>
49abe7af 4801
e3edceeb 4802 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td>
f527e53f
EK		 4803 <td><input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4804 <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4805 </tr>
4c962356 4806
e3edceeb 4807 <tr><td class='boldbase' nowrap='nowrap'>fragment:</td>
f527e53f
EK		 4808 <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4809 <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4810 </tr>
4c962356 4811
e3edceeb 4812 <tr><td class='boldbase' nowrap='nowrap'>mssfix:</td>
f527e53f
EK		 4813 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4814 <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4815 </tr>
4c962356 4816
e3edceeb 4817 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
f527e53f
EK		 4818 <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4819 </tr>
2ee746be 4820
f527e53f
EK		 4821<tr><td colspan=4><hr /></td></tr><tr>
4822 <tr>
4823 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
4824 </tr>
4825
4826 <tr><td class='boldbase'>$Lang::tr{'cipher'}</td>
52f61e49
EKD		 4827 <td><select name='DCIPHER' id="n2ncipher" required>
4828 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
4829 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
4830 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
f527e53f
EK		 4831 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
4832 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4833 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
f7fb5bc5 4834 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'}, $Lang::tr{'default'})</option>
f527e53f
EK		 4835 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
4836 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
ea6dd5b0
EK		 4837 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
4838 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4839 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4840 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4841 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4842 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
f527e53f
EK		 4843 </select>
4844 </td>
4845
4846 <td class='boldbase'>$Lang::tr{'ovpn ha'}:</td>
52f61e49 4847 <td><select name='DAUTH' id="n2nhmac" $hmacdisabled>
f527e53f
EK		 4848 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
4849 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
4850 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
4851 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
f3dfb261 4852 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
f527e53f
EK		 4853 </select>
4854 </td>
4855 </tr>
4856 <tr><td colspan=4><hr /></td></tr><tr>
4857
ce9abb66 4858END
8c877a82 4859;
ce9abb66 4860 }
52f61e49
EKD		 4861
4862#### JAVA SCRIPT ####
4863# Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange
4864print<<END;
4865 <script>
4866 var disable_options = false;
4867 document.getElementById('n2ncipher').onchange = function () {
4868 if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) {
4869 document.getElementById('n2nhmac').setAttribute('disabled', true);
4870 } else {
4871 document.getElementById('n2nhmac').removeAttribute('disabled');
4872 }
4873 }
4874 </script>
4875END
4876
2ee746be 4877#jumper
e3edceeb 4878 print "<tr><td class='boldbase'>$Lang::tr{'remark title'}</td>";
8c877a82 4879 print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
66c36198 4880
ce9abb66 4881 if ($cgiparams{'TYPE'} eq 'host') {
8c877a82 4882 print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
66c36198 4883 }
ce9abb66 4884
8c877a82 4885 print"</tr></table><br><br>";
66c36198
PM		 4886#A.Marx CCD new client
4887if ($cgiparams{'TYPE'} eq 'host') {
8c877a82 4888 print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
8c877a82
AM		 4889 my %vpnnet=();
4890 my $vpnip;
4891 &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4892 $vpnip=$vpnnet{'DOVPN_SUBNET'};
4893 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4894 my @ccdconf=();
4895 my $count=0;
4896 my $checked;
4897 $checked{'check1'}{'off'} = '';
4898 $checked{'check1'}{'on'} = '';
4899 $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4900 print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4901 print"</td></tr></table><br><br>";
4902 my $name=$cgiparams{'CHECK1'};
4903 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
e1e10515 4904 $checked{'OTP_STATE'}{$cgiparams{'OTP_STATE'}} = 'CHECKED';
66c36198
PM		 4905
4906 if (! -z "${General::swroot}/ovpn/ccd.conf"){
8c877a82 4907 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
df9b48b7 4908 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM		 4909 $count++;
4910 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4911 if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4912 print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4913 &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4914 print"</td></tr>";
4915 }
4916 print "</table><br><br><hr><br><br>";
4917 }
e81be1e1 4918}
8c877a82 4919# ccd end
6e13d0a5
MT		 4920 &Header::closebox();
4921 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
66c36198 4922
8c877a82 4923 } elsif (! $cgiparams{'KEY'}) {
66c36198
PM		 4924
4925
6e13d0a5
MT		 4926 my $disabled='';
4927 my $cakeydisabled='';
4928 my $cacrtdisabled='';
4929 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4930 if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
66c36198 4931
6e13d0a5 4932 &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
66c36198
PM		 4933
4934
ce9abb66
AH		 4935 if ($cgiparams{'TYPE'} eq 'host') {
4936
49abe7af 4937 print <<END;
6e13d0a5 4938 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
66c36198 4939
ce9abb66
AH		 4940 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4941 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
54fd0535
MT		 4942 <tr><td colspan='3'>&nbsp;</td></tr>
4943 <tr><td colspan='3'><hr /></td></tr>
4944 <tr><td colspan='3'>&nbsp;</td></tr>
ce9abb66 4945 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
e3edceeb
LS		 4946 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4947 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4948 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4949 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4950 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4951 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
ce9abb66 4952 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
6e13d0a5 4953END
ce9abb66
AH		 4954;
4955
4956###
7c1d9faf 4957# m.a.d net2net
ce9abb66
AH		 4958###
4959
4960} else {
4961
49abe7af 4962 print <<END;
ce9abb66 4963 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
66c36198 4964
ce9abb66 4965 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
e3edceeb
LS		 4966 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:&nbsp;<img src='/blob.gif' alt='*' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4967 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4968 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4969 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4970 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4971 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
ce9abb66 4972 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
66c36198
PM		 4973
4974
ce9abb66
AH		 4975END
4976;
4977
4978}
4979
4980###
7c1d9faf 4981# m.a.d net2net
ce9abb66 4982###
c6c9630e 4983
6e13d0a5
MT		 4984 foreach my $country (sort keys %{Countries::countries}) {
4985 print "<option value='$Countries::countries{$country}'";
4986 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4987 print " selected='selected'";
4988 }
4989 print ">$country</option>";
4990 }
ce9abb66 4991###
7c1d9faf 4992# m.a.d net2net
ce9abb66
AH		 4993###
4994
4995if ($cgiparams{'TYPE'} eq 'host') {
49abe7af 4996 print <<END;
f4fbb935 4997 </select></td></tr>
425465ed 4998 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
f4fbb935
EK		 4999 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
5000 <tr><td>&nbsp;</td>
6e13d0a5
MT		 5001 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
5002 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
f4fbb935 5003 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<br>($Lang::tr{'confirmation'})</td>
6e13d0a5 5004 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
f4fbb935
EK		 5005 <tr><td colspan='3'>&nbsp;</td></tr>
5006 <tr><td colspan='3'><hr /></td></tr>
e3edceeb 5007 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
f4fbb935 5008 </table>
ce9abb66
AH		 5009END
5010}else{
49abe7af 5011 print <<END;
f4fbb935 5012 </select></td></tr>
425465ed 5013 <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):&nbsp;<img src='/blob.gif' alt='*' /</td>
f4fbb935
EK		 5014 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
5015 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
5016 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
5017 <tr><td colspan='3'><hr /></td></tr>
e3edceeb 5018 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'required field'}</td></tr>
ce9abb66 5019 </table>
66c36198 5020
c6c9630e 5021END
ce9abb66
AH		 5022}
5023
5024###
7c1d9faf 5025# m.a.d net2net
ce9abb66 5026###
c6c9630e
MT		 5027 ;
5028 &Header::closebox();
66c36198 5029
8c877a82 5030 }
e81be1e1 5031
66c36198 5032#A.Marx CCD new client
e81be1e1 5033if ($cgiparams{'TYPE'} eq 'host') {
8c877a82
AM		 5034 print"<br><br>";
5035 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
5036
66c36198 5037
8c877a82
AM		 5038 print <<END;
5039 <table border='0' width='100%'>
e1e10515 5040 <tr><td width='20%'>$Lang::tr{'enable otp'}:</td><td colspan='3'><input type='checkbox' name='OTP_STATE' $checked{'OTP_STATE'}{'on'} /></td></tr>
8c877a82
AM		 5041 <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
5042 <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
5043 <tr><td colspan='4'>&nbsp</td></tr>
5044 <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
5045END
66c36198 5046
8c877a82
AM		 5047 if ($cgiparams{'IR'} ne ''){
5048 print $cgiparams{'IR'};
5049 }else{
5050 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
5051 foreach my $key (keys %ccdroutehash) {
5052 if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
5053 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
5054 if ($ccdroutehash{$key}[$i] ne ''){
5055 print $ccdroutehash{$key}[$i]."\n";
5056 }
5057 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
5058 }
5059 }
5060 }
c6c9630e 5061 }
66c36198 5062
8c877a82
AM		 5063 print <<END;
5064</textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
5065 <tr><td colspan='4'><br></td></tr>
5066 <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
5067END
66c36198 5068
52d08bcb
AM		 5069 my $set=0;
5070 my $selorange=0;
5071 my $selblue=0;
5072 my $selgreen=0;
5073 my $helpblue=0;
5074 my $helporange=0;
5075 my $other=0;
df9b48b7 5076 my $none=0;
52d08bcb 5077 my @temp=();
66c36198 5078
8c877a82 5079 our @current = ();
52d08bcb
AM		 5080 open(FILE, "${General::swroot}/main/routing") ;
5081 @current = <FILE>;
5082 close (FILE);
66c36198 5083 &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
df9b48b7
AM		 5084 #check for "none"
5085 foreach my $key (keys %ccdroute2hash) {
5086 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5087 if ($ccdroute2hash{$key}[1] eq ''){
5088 $none=1;
5089 last;
5090 }
5091 }
5092 }
5093 if ($none ne '1'){
5094 print"<option>$Lang::tr{'ccd none'}</option>";
5095 }else{
5096 print"<option selected>$Lang::tr{'ccd none'}</option>";
5097 }
52d08bcb
AM		 5098 #check if static routes are defined for client
5099 foreach my $line (@current) {
66c36198 5100 chomp($line);
52d08bcb
AM		 5101 $line=~s/\s*$//g; # remove newline
5102 @temp=split(/\,/,$line);
5103 $temp[1] = '' unless defined $temp[1]; # not always populated
5104 my ($a,$b) = split(/\//,$temp[1]);
5105 $temp[1] = $a."/".&General::iporsubtocidr($b);
5106 foreach my $key (keys %ccdroute2hash) {
5107 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5108 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5109 if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
5110 $set=1;
8c877a82
AM		 5111 }
5112 }
8c877a82 5113 }
52d08bcb
AM		 5114 }
5115 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
66c36198 5116 }
3a445974
MT		 5117
5118 my %vpnconfig = ();
5119 &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
5120 foreach my $vpn (keys %vpnconfig) {
5121 # Skip all disabled VPN connections
5122 my $enabled = $vpnconfig{$vpn}[0];
5123 next unless ($enabled eq "on");
5124
5125 my $name = $vpnconfig{$vpn}[1];
5126
5127 # Remote subnets
5128 my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
5129 foreach my $network (@networks) {
5130 my $selected = "";
5131
5132 foreach my $key (keys %ccdroute2hash) {
5133 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
5134 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5135 if ($ccdroute2hash{$key}[$i] eq $network) {
5136 $selected = "selected";
5137 }
5138 }
5139 }
5140 }
5141
5142 print "<option value=\"$network\" $selected>$name ($network)</option>\n";
5143 }
5144 }
5145
52d08bcb
AM		 5146 #check if green,blue,orange are defined for client
5147 foreach my $key (keys %ccdroute2hash) {
5148 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
5149 $other=1;
5150 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
5151 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
5152 $selgreen=1;
5153 }
5154 if (&haveBlueNet()){
5155 if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
5156 $selblue=1;
5157 }
5158 }
5159 if (&haveOrangeNet()){
5160 if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
5161 $selorange=1;
5162 }
5163 }
5164 }
5165 }
5166 }
5167 if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
66c36198 5168 if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
52d08bcb 5169 if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
66c36198 5170
49abe7af 5171 print<<END;
8c877a82
AM		 5172 </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
5173 <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
5174 <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
66c36198 5175
8c877a82
AM		 5176END
5177;
5178 &Header::closebox();
e81be1e1 5179}
c6c9630e
MT		 5180 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5181 if ($cgiparams{'KEY'}) {
5182# print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
5183 }
5184 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
5185 &Header::closebigbox();
5186 &Header::closepage();
5187 exit (0);
6e13d0a5 5188 }
c6c9630e 5189 VPNCONF_END:
6e13d0a5 5190}
c6c9630e
MT		 5191
5192# SETTINGS_ERROR:
6e13d0a5
MT		 5193###
5194### Default status page
5195###
c6c9630e
MT		 5196 %cgiparams = ();
5197 %cahash = ();
5198 %confighash = ();
5199 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
5200 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
5201 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
5202
2feacd98
SS		 5203 open(FILE, "/var/run/ovpnserver.log");
5204 my @status = <FILE>;
5205 close(FILE);
c6c9630e
MT		 5206
5207 if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
8c877a82
AM		 5208 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
5209 my $ipaddr = <IPADDR>;
5210 close IPADDR;
5211 chomp ($ipaddr);
5212 $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
5213 if ($cgiparams{'VPN_IP'} eq '') {
5214 $cgiparams{'VPN_IP'} = $ipaddr;
5215 }
5216 }
c6c9630e 5217 }
66c36198 5218
6e13d0a5 5219#default setzen
c6c9630e 5220 if ($cgiparams{'DCIPHER'} eq '') {
4c962356 5221 $cgiparams{'DCIPHER'} = 'AES-256-CBC';
c6c9630e 5222 }
c6c9630e 5223 if ($cgiparams{'DDEST_PORT'} eq '') {
4c962356 5224 $cgiparams{'DDEST_PORT'} = '1194';
c6c9630e
MT		 5225 }
5226 if ($cgiparams{'DMTU'} eq '') {
4c962356
EK		 5227 $cgiparams{'DMTU'} = '1400';
5228 }
5229 if ($cgiparams{'MSSFIX'} eq '') {
5230 $cgiparams{'MSSFIX'} = 'off';
5231 }
5232 if ($cgiparams{'DAUTH'} eq '') {
86308adb
EK		 5233 if (-z "${General::swroot}/ovpn/ovpnconfig") {
5234 $cgiparams{'DAUTH'} = 'SHA512';
5235 }
5236 foreach my $key (keys %confighash) {
5237 if ($confighash{$key}[3] ne 'host') {
5238 $cgiparams{'DAUTH'} = 'SHA512';
5239 } else {
5240 $cgiparams{'DAUTH'} = 'SHA1';
5241 }
5242 }
5243 }
0c4ffc69
EK		 5244 if ($cgiparams{'TLSAUTH'} eq '') {
5245 $cgiparams{'TLSAUTH'} = 'off';
5246 }
c6c9630e 5247 if ($cgiparams{'DOVPN_SUBNET'} eq '') {
4c962356 5248 $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
c6c9630e 5249 }
4c962356 5250 $checked{'ENABLED'}{'off'} = '';
c6c9630e
MT		 5251 $checked{'ENABLED'}{'on'} = '';
5252 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
5253 $checked{'ENABLED_BLUE'}{'off'} = '';
5254 $checked{'ENABLED_BLUE'}{'on'} = '';
5255 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
5256 $checked{'ENABLED_ORANGE'}{'off'} = '';
5257 $checked{'ENABLED_ORANGE'}{'on'} = '';
5258 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
c6c9630e
MT		 5259
5260 $selected{'DPROTOCOL'}{'udp'} = '';
5261 $selected{'DPROTOCOL'}{'tcp'} = '';
5262 $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
4c962356 5263
52f61e49
EKD		 5264 $selected{'DCIPHER'}{'AES-256-GCM'} = '';
5265 $selected{'DCIPHER'}{'AES-192-GCM'} = '';
5266 $selected{'DCIPHER'}{'AES-128-GCM'} = '';
4c962356
EK		 5267 $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
5268 $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
5269 $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
5270 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
5271 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
5272 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
c6c9630e
MT		 5273 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
5274 $selected{'DCIPHER'}{'DESX-CBC'} = '';
4c962356
EK		 5275 $selected{'DCIPHER'}{'SEED-CBC'} = '';
5276 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
5277 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
5278 $selected{'DCIPHER'}{'BF-CBC'} = '';
4c962356 5279 $selected{'DCIPHER'}{'DES-CBC'} = '';
c6c9630e 5280 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4c962356
EK		 5281
5282 $selected{'DAUTH'}{'whirlpool'} = '';
5283 $selected{'DAUTH'}{'SHA512'} = '';
5284 $selected{'DAUTH'}{'SHA384'} = '';
5285 $selected{'DAUTH'}{'SHA256'} = '';
4c962356
EK		 5286 $selected{'DAUTH'}{'SHA1'} = '';
5287 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
5288
0c4ffc69
EK		 5289 $checked{'TLSAUTH'}{'off'} = '';
5290 $checked{'TLSAUTH'}{'on'} = '';
5291 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
5292
c6c9630e
MT		 5293 $checked{'DCOMPLZO'}{'off'} = '';
5294 $checked{'DCOMPLZO'}{'on'} = '';
5295 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
4c962356 5296
d96c89eb
AH		 5297# m.a.d
5298 $checked{'MSSFIX'}{'off'} = '';
5299 $checked{'MSSFIX'}{'on'} = '';
5300 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
6e13d0a5 5301#new settings
c6c9630e
MT		 5302 &Header::showhttpheaders();
5303 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
5304 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
6e13d0a5 5305
c6c9630e 5306 if ($errormessage) {
6e13d0a5
MT		 5307 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
5308 print "<class name='base'>$errormessage\n";
5309 print "&nbsp;</class>\n";
5310 &Header::closebox();
c6c9630e 5311 }
6e13d0a5 5312
400c8afd
EK		 5313 if ($cryptoerror) {
5314 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'});
5315 print "<class name='base'>$cryptoerror";
5316 print "&nbsp;</class>";
5317 &Header::closebox();
5318 }
5319
5320 if ($cryptowarning) {
5321 &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'});
5322 print "<class name='base'>$cryptowarning";
5323 print "&nbsp;</class>";
5324 &Header::closebox();
5325 }
5326
b2e75449
MT		 5327 if ($warnmessage) {
5328 &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'});
5329 print "$warnmessage<br>";
5330 print "$Lang::tr{'fwdfw warn1'}<br>";
5331 &Header::closebox();
5332 print"<center><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'ok'}' style='width: 5em;'></form>";
5333 &Header::closepage();
5334 exit 0;
5335 }
4d81e0f3 5336
c6c9630e
MT		 5337 my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
5338 my $srunning = "no";
5339 my $activeonrun = "";
5340 if ( -e "/var/run/openvpn.pid"){
6e13d0a5
MT		 5341 $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
5342 $srunning ="yes";
5343 $activeonrun = "";
c6c9630e 5344 } else {
6e13d0a5 5345 $activeonrun = "disabled='disabled'";
66c36198
PM		 5346 }
5347 &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
4c962356 5348 print <<END;
631b67b7 5349 <table width='100%' border='0'>
c6c9630e
MT		 5350 <form method='post'>
5351 <td width='25%'>&nbsp;</td>
5352 <td width='25%'>&nbsp;</td>
5353 <td width='25%'>&nbsp;</td></tr>
5354 <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
5355 <td align='left'>$sactive</td>
5356 <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
8c877a82 5357 <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
c6c9630e
MT		 5358END
5359;
5360 if (&haveBlueNet()) {
5361 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
5362 print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
5363 }
66c36198 5364 if (&haveOrangeNet()) {
c6c9630e
MT		 5365 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
5366 print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
86308adb
EK		 5367 }
5368
5369 print <<END;
5370
5371 <tr><td colspan='4'><br></td></tr>
5372 <tr>
5373 <td class'base'><b>$Lang::tr{'net config'}:</b></td>
5374 </tr>
5375 <tr><td colspan='1'><br></td></tr>
5376
4e17adad
CS		 5377 <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
5378 <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
c6c9630e
MT		 5379 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
5380 <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
66c36198 5381 <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
c6c9630e
MT		 5382 <td class='boldbase'>$Lang::tr{'destination port'}:</td>
5383 <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
5384 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
bc2b3e94 5385 <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}' size='5' /></td>
86308adb
EK		 5386 </tr>
5387
5388 <tr><td colspan='4'><br></td></tr>
5389 <tr>
5390 <td class'base'><b>$Lang::tr{'ovpn crypt options'}:</b></td>
5391 </tr>
5392 <tr><td colspan='1'><br></td></tr>
5393
5394 <tr>
5395 <td class='base'>$Lang::tr{'ovpn ha'}</td>
5396 <td><select name='DAUTH'>
5397 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
5398 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
5399 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
5400 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
5401 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5402 </select>
5403 </td>
f527e53f 5404
4c962356
EK		 5405 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
5406 <td><select name='DCIPHER'>
52f61e49
EKD		 5407 <option value='AES-256-GCM' $selected{'DCIPHER'}{'AES-256-GCM'}>AES-GCM (256 $Lang::tr{'bit'})</option>
5408 <option value='AES-192-GCM' $selected{'DCIPHER'}{'AES-192-GCM'}>AES-GCM (192 $Lang::tr{'bit'})</option>
5409 <option value='AES-128-GCM' $selected{'DCIPHER'}{'AES-128-GCM'}>AES-GCM (128 $Lang::tr{'bit'})</option>
4c962356 5410 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-CBC (256 $Lang::tr{'bit'})</option>
f527e53f 5411 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-CBC (192 $Lang::tr{'bit'})</option>
4c962356
EK		 5412 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-CBC (128 $Lang::tr{'bit'})</option>
5413 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-CBC (256 $Lang::tr{'bit'})</option>
5414 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-CBC (192 $Lang::tr{'bit'})</option>
5415 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-CBC (128 $Lang::tr{'bit'})</option>
4c962356 5416 <option value='SEED-CBC' $selected{'DCIPHER'}{'SEED-CBC'}>SEED-CBC (128 $Lang::tr{'bit'})</option>
ea6dd5b0
EK		 5417 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5418 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC (192 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5419 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5420 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
5421 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC (128 $Lang::tr{'bit'}, $Lang::tr{'vpn weak'})</option>
4c962356
EK		 5422 </select>
5423 </td>
4c962356 5424 </tr>
0c4ffc69
EK		 5425
5426 <tr><td colspan='4'><br></td></tr>
5427 <tr>
5428 <td class='base'>$Lang::tr{'ovpn tls auth'}</td>
5429 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
5430 </tr>
5431
f7edf97a 5432 <tr><td colspan='4'><br><br></td></tr>
c6c9630e 5433END
66c36198
PM		 5434;
5435
c6c9630e 5436 if ( $srunning eq "yes" ) {
8c877a82
AM		 5437 print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
5438 print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
66c36198 5439 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
8c877a82 5440 print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
c6c9630e 5441 } else{
8c877a82
AM		 5442 print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
5443 print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
5444 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
c6c9630e
MT		 5445 if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
5446 -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
5447 -e "${General::swroot}/ovpn/certs/servercert.pem" &&
5448 -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
66c36198 5449 (( $cgiparams{'ENABLED'} eq 'on') ||
c6c9630e
MT		 5450 ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
5451 ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
8c877a82 5452 print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
c6c9630e 5453 } else {
66c36198
PM		 5454 print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
5455 }
c6c9630e
MT		 5456 }
5457 print "</form></table>";
5458 &Header::closebox();
6e13d0a5 5459
c6c9630e 5460 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
ce9abb66 5461###
7c1d9faf 5462# m.a.d net2net
54fd0535 5463#<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
ce9abb66
AH		 5464###
5465
4c962356 5466 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' });
c6c9630e 5467 ;
99bfa85c
AM		 5468 my $id = 0;
5469 my $gif;
f7edf97a 5470 my $col1="";
5b942f7f 5471 my $lastnet;
c8b51e28 5472 foreach my $key (sort { ncmp ($confighash{$a}[32],$confighash{$b}[32]) } sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
5b942f7f
AM		 5473 if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]=$Lang::tr{'fwhost OpenVPN N-2-N'};}
5474 if ($confighash{$key}[32] eq "dynamic"){$confighash{$key}[32]=$Lang::tr{'ccd dynrange'};}
5475 if($id == 0){
5476 print"<b>$confighash{$key}[32]</b>";
5477 print <<END;
5478 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5479<tr>
5480 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5481 <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5482 <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5483 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
e1e10515 5484 <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5b942f7f
AM		 5485</tr>
5486END
5487 }
5488 if ($id > 0 && $lastnet ne $confighash{$key}[32]){
5489 print "</table><br>";
5490 print"<b>$confighash{$key}[32]</b>";
5491 print <<END;
5492 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5493<tr>
5494 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5495 <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
5496 <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
5497 <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
e1e10515 5498 <th width='5%' class='boldbase' colspan='8' align='center'><b>$Lang::tr{'action'}</b></th>
5b942f7f
AM		 5499</tr>
5500END
5501 }
eff2dbf8 5502 if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
c6c9630e 5503 if ($id % 2) {
99bfa85c
AM		 5504 print "<tr>";
5505 $col="bgcolor='$color{'color20'}'";
bb89e92a 5506 } else {
99bfa85c
AM		 5507 print "<tr>";
5508 $col="bgcolor='$color{'color22'}'";
c6c9630e 5509 }
99bfa85c
AM		 5510 print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
5511 print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
8c877a82
AM		 5512 #if ($confighash{$key}[4] eq 'cert') {
5513 #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
5514 #} else {
5515 #print "<td align='left'>&nbsp;</td>";
5516 #}
2feacd98
SS		 5517 my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem");
5518 my $cavalid;
5519
5520 foreach my $line (@cavalid) {
5521 if ($line =~ /Not After : (.*)[\n]/) {
5522 $cavalid = $1;
5523
5524 last;
5525 }
5526 }
5527
99bfa85c 5528 print "<td align='center' $col>$confighash{$key}[25]</td>";
f7edf97a
AM		 5529 $col1="bgcolor='${Header::colourred}'";
5530 my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
ce9abb66 5531
c6c9630e 5532 if ($confighash{$key}[0] eq 'off') {
f7edf97a
AM		 5533 $col1="bgcolor='${Header::colourblue}'";
5534 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
c6c9630e 5535 } else {
ce9abb66
AH		 5536
5537###
7c1d9faf 5538# m.a.d net2net
f7edf97a
AM		 5539###
5540
b278daf3 5541 if ($confighash{$key}[3] eq 'net') {
54fd0535
MT		 5542
5543 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
5544 my @output = "";
5545 my @tustate = "";
5546 my $tport = $confighash{$key}[22];
66c36198 5547 my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
54fd0535
MT		 5548 if ($tport ne '') {
5549 $tnet->open('127.0.0.1');
5550 @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
5551 @tustate = split(/\,/, $output[1]);
5552###
5553#CONNECTING -- OpenVPN's initial state.
5554#WAIT -- (Client only) Waiting for initial response from server.
5555#AUTH -- (Client only) Authenticating with server.
5556#GET_CONFIG -- (Client only) Downloading configuration options from server.
5557#ASSIGN_IP -- Assigning IP address to virtual network interface.
5558#ADD_ROUTES -- Adding routes to system.
5559#CONNECTED -- Initialization Sequence Completed.
5560#RECONNECTING -- A restart has occurred.
5561#EXITING -- A graceful exit is in progress.
5562####
5563
ed4b4c19 5564 if (($tustate[1] eq 'CONNECTED') || ($tustate[1] eq 'WAIT')) {
f7edf97a
AM		 5565 $col1="bgcolor='${Header::colourgreen}'";
5566 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5567 }else {
5568 $col1="bgcolor='${Header::colourred}'";
5569 $active = "<b><font color='#FFFFFF'>$tustate[1]</font></b>";
5570 }
54fd0535 5571 }
54fd0535 5572 }
f7edf97a
AM		 5573 }else {
5574
5575 my $cn;
5576 my @match = ();
5577 foreach my $line (@status) {
5578 chomp($line);
5579 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
5580 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
5581 if ($match[1] ne "Common Name") {
5582 $cn = $match[1];
5583 }
5584 $cn =~ s/[_]/ /g;
5585 if ($cn eq "$confighash{$key}[2]") {
5586 $col1="bgcolor='${Header::colourgreen}'";
5587 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
5588 }
5589 }
5590 }
c6c9630e 5591 }
7c1d9faf 5592}
ce9abb66
AH		 5593
5594
4c962356 5595 print <<END;
f7edf97a 5596 <td align='center' $col1>$active</td>
66c36198 5597
99bfa85c 5598 <form method='post' name='frm${key}a'><td align='center' $col>
96096995
AM		 5599 <input type='image' name='$Lang::tr{'dl client arch'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
5600 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5601 <input type='hidden' name='KEY' value='$key' />
c6c9630e
MT		 5602 </td></form>
5603END
5604 ;
71af643c
MT		 5605
5606 if ($confighash{$key}[41] eq "no-pass") {
5607 print <<END;
5608 <form method='post' name='frm${key}g'><td align='center' $col>
5609 <input type='image' name='$Lang::tr{'dl client arch insecure'}' src='/images/openvpn.png'
5610 alt='$Lang::tr{'dl client arch insecure'}' title='$Lang::tr{'dl client arch insecure'}' border='0' />
5611 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
5612 <input type='hidden' name='MODE' value='insecure' />
5613 <input type='hidden' name='KEY' value='$key' />
5614 </td></form>
5615END
5616 } else {
5617 print "<td $col>&nbsp;</td>";
5618 }
5619
c6c9630e 5620 if ($confighash{$key}[4] eq 'cert') {
4c962356 5621 print <<END;
99bfa85c 5622 <form method='post' name='frm${key}b'><td align='center' $col>
c6c9630e
MT		 5623 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
5624 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
5625 <input type='hidden' name='KEY' value='$key' />
5626 </td></form>
5627END
5628 ; } else {
5629 print "<td>&nbsp;</td>";
5630 }
e1e10515
TE		 5631
5632 if ($confighash{$key}[43] eq 'on') {
5633 print <<END;
5634<form method='post' name='frm${key}o'><td align='center' $col>
5635<input type='image' name='$Lang::tr{'show otp qrcode'}' src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}' title='$Lang::tr{'show otp qrcode'}' border='0' />
5636<input type='hidden' name='ACTION' value='$Lang::tr{'show otp qrcode'}' />
5637<input type='hidden' name='KEY' value='$key' />
5638</td></form>
5639END
5640; } else {
5641 print "<td $col>&nbsp;</td>";
5642 }
5643
66c36198 5644 if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
4c962356 5645 print <<END;
99bfa85c 5646 <form method='post' name='frm${key}c'><td align='center' $col>
438dd0cc 5647 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
c6c9630e
MT		 5648 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
5649 <input type='hidden' name='KEY' value='$key' />
5650 </td></form>
5651END
5652 ; } elsif ($confighash{$key}[4] eq 'cert') {
4c962356 5653 print <<END;
99bfa85c 5654 <form method='post' name='frm${key}c'><td align='center' $col>
438dd0cc 5655 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
c6c9630e
MT		 5656 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
5657 <input type='hidden' name='KEY' value='$key' />
5658 </td></form>
5659END
5660 ; } else {
5661 print "<td>&nbsp;</td>";
5662 }
5663 print <<END
99bfa85c 5664 <form method='post' name='frm${key}d'><td align='center' $col>
c6c9630e
MT		 5665 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
5666 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
5667 <input type='hidden' name='KEY' value='$key' />
5668 </td></form>
5669
99bfa85c 5670 <form method='post' name='frm${key}e'><td align='center' $col>
c6c9630e
MT		 5671 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5672 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5673 <input type='hidden' name='KEY' value='$key' />
5674 </td></form>
99bfa85c 5675 <form method='post' name='frm${key}f'><td align='center' $col>
c6c9630e
MT		 5676 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5677 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5678 <input type='hidden' name='KEY' value='$key' />
5679 </td></form>
5680 </tr>
5681END
5682 ;
5683 $id++;
5b942f7f 5684 $lastnet = $confighash{$key}[32];
c6c9630e 5685 }
5b942f7f 5686 print"</table>";
c6c9630e
MT		 5687 ;
5688
5689 # If the config file contains entries, print Key to action icons
5690 if ( $id ) {
4c962356 5691 print <<END;
8c877a82 5692 <table border='0'>
c6c9630e 5693 <tr>
4c962356
EK		 5694 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5695 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5696 <td class='base'>$Lang::tr{'click to disable'}</td>
5697 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5698 <td class='base'>$Lang::tr{'show certificate'}</td>
5699 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5700 <td class='base'>$Lang::tr{'edit'}</td>
5701 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5702 <td class='base'>$Lang::tr{'remove'}</td>
c6c9630e
MT		 5703 </tr>
5704 <tr>
4c962356
EK		 5705 <td>&nbsp; </td>
5706 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5707 <td class='base'>$Lang::tr{'click to enable'}</td>
5708 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5709 <td class='base'>$Lang::tr{'download certificate'}</td>
5710 <td>&nbsp; &nbsp; <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5711 <td class='base'>$Lang::tr{'dl client arch'}</td>
e1e10515
TE		 5712 <td>&nbsp; &nbsp; <img src='/images/qr-code.png' alt='$Lang::tr{'show otp qrcode'}'/></td>
5713 <td class='base'>$Lang::tr{'show otp qrcode'}</td>
4c962356 5714 </tr>
f7edf97a 5715 </table><br>
c6c9630e
MT		 5716END
5717 ;
5718 }
5719
4c962356 5720 print <<END;
c6c9630e
MT		 5721 <table width='100%'>
5722 <form method='post'>
4c962356
EK		 5723 <tr><td align='right'>
5724 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5725 <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td>
5726 </tr>
c6c9630e
MT		 5727 </form>
5728 </table>
5729END
4c962356
EK		 5730 ;
5731 &Header::closebox();
5732 }
fd5ccb2d
EK		 5733
5734 # CA/key listing
4c962356
EK		 5735 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}");
5736 print <<END;
5737 <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
5738 <tr>
5739 <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
5740 <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
5741 <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
5742 </tr>
5743END
5744 ;
5745 my $col1="bgcolor='$color{'color22'}'";
f7fb5bc5 5746 my $col2="bgcolor='$color{'color20'}'";
c8f50356 5747 # DH parameter line
f7fb5bc5 5748 my $col3="bgcolor='$color{'color22'}'";
fd5ccb2d
EK		 5749 # ta.key line
5750 my $col4="bgcolor='$color{'color20'}'";
f7fb5bc5 5751
4c962356 5752 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
2feacd98
SS		 5753 my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem");
5754 my $casubject;
5755
5756 foreach my $line (@casubject) {
5757 if ($line =~ /Subject: (.*)[\n]/) {
5758 $casubject = $1;
5759 $casubject =~ s+/Email+, E+;
5760 $casubject =~ s/ ST=/ S=/;
5761
5762 last;
5763 }
5764 }
5765
4c962356
EK		 5766 print <<END;
5767 <tr>
5768 <td class='base' $col1>$Lang::tr{'root certificate'}</td>
5769 <td class='base' $col1>$casubject</td>
c8f50356 5770 <form method='post' name='frmrootcrta'><td width='3%' align='center' $col1>
4c962356
EK		 5771 <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
5772 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
c8f50356
EK		 5773 </form>
5774 <form method='post' name='frmrootcrtb'><td width='3%' align='center' $col1>
4c962356
EK		 5775 <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
5776 <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
c8f50356
EK		 5777 </form>
5778 <td width='4%' $col1>&nbsp;</td>
5779 </tr>
4c962356
EK		 5780END
5781 ;
5782 } else {
5783 # display rootcert generation buttons
5784 print <<END;
5785 <tr>
5786 <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
5787 <td class='base' $col1>$Lang::tr{'not present'}</td>
c8f50356
EK		 5788 <td colspan='3' $col1>&nbsp;</td>
5789 </tr>
4c962356
EK		 5790END
5791 ;
5792 }
5793
5794 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
2feacd98
SS		 5795 my @hostsubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/certs/servercert.pem");
5796 my $hostsubject;
5797
5798 foreach my $line (@hostsubject) {
5799 if ($line =~ /Subject: (.*)[\n]/) {
5800 $hostsubject = $1;
5801 $hostsubject =~ s+/Email+, E+;
5802 $hostsubject =~ s/ ST=/ S=/;
5803
5804 last;
5805 }
5806 }
4c962356
EK		 5807
5808 print <<END;
5809 <tr>
5810 <td class='base' $col2>$Lang::tr{'host certificate'}</td>
5811 <td class='base' $col2>$hostsubject</td>
c8f50356 5812 <form method='post' name='frmhostcrta'><td width='3%' align='center' $col2>
4c962356
EK		 5813 <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
5814 <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
c8f50356
EK		 5815 </form>
5816 <form method='post' name='frmhostcrtb'><td width='3%' align='center' $col2>
4c962356
EK		 5817 <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/media-floppy.png' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" border='0' />
5818 <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
c8f50356
EK		 5819 </td></form>
5820 <td width='4%' $col2>&nbsp;</td>
5821 </tr>
4c962356
EK		 5822END
5823 ;
5824 } else {
5825 # Nothing
5826 print <<END;
5827 <tr>
5828 <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
5829 <td class='base' $col2>$Lang::tr{'not present'}</td>
c8f50356
EK		 5830 </td><td colspan='3' $col2>&nbsp;</td>
5831 </tr>
4c962356
EK		 5832END
5833 ;
5834 }
ce9abb66 5835
f7fb5bc5
EK		 5836 # Adding DH parameter to chart
5837 if (-f "${General::swroot}/ovpn/ca/dh1024.pem") {
b959b9f5 5838 my @dhsubject = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "${General::swroot}/ovpn/ca/dh1024.pem");
2feacd98 5839 my $dhsubject;
f7fb5bc5 5840
2feacd98
SS		 5841 foreach my $line (@dhsubject) {
5842 if ($line =~ / (.*)[\n]/) {
5843 $dhsubject = $1;
5844
5845 last;
5846 }
5847 }
f7fb5bc5
EK		 5848
5849 print <<END;
5850 <tr>
5851 <td class='base' $col3>$Lang::tr{'dh parameter'}</td>
5852 <td class='base' $col3>$dhsubject</td>
c8f50356 5853 <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
f7fb5bc5
EK		 5854 <input type='hidden' name='ACTION' value='$Lang::tr{'show dh'}' />
5855 <input type='image' name='$Lang::tr{'show dh'}' src='/images/info.gif' alt='$Lang::tr{'show dh'}' title='$Lang::tr{'show dh'}' width='20' height='20' border='0' />
c8f50356
EK		 5856 </form>
5857 <form method='post' name='frmdhparam'><td width='3%' align='center' $col3>
c8f50356
EK		 5858 </form>
5859 <td width='4%' $col3>&nbsp;</td>
5860 </tr>
f7fb5bc5
EK		 5861END
5862 ;
5863 } else {
5864 # Nothing
5865 print <<END;
5866 <tr>
5867 <td width='25%' class='base' $col3>$Lang::tr{'dh parameter'}:</td>
5868 <td class='base' $col3>$Lang::tr{'not present'}</td>
c8f50356
EK		 5869 </td><td colspan='3' $col3>&nbsp;</td>
5870 </tr>
f7fb5bc5
EK		 5871END
5872 ;
5873 }
5874
fd5ccb2d
EK		 5875 # Adding ta.key to chart
5876 if (-f "${General::swroot}/ovpn/certs/ta.key") {
2feacd98
SS		 5877 open(FILE, "${General::swroot}/ovpn/certs/ta.key");
5878 my @tasubject = <FILE>;
5879 close(FILE);
5880
5881 my $tasubject;
5882 foreach my $line (@tasubject) {
5883 if($line =~ /# (.*)[\n]/) {
5884 $tasubject = $1;
5885
5886 last;
5887 }
5888 }
5889
fd5ccb2d
EK		 5890 print <<END;
5891
5892 <tr>
5893 <td class='base' $col4>$Lang::tr{'ta key'}</td>
5894 <td class='base' $col4>$tasubject</td>
5895 <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5896 <input type='hidden' name='ACTION' value='$Lang::tr{'show tls-auth key'}' />
5897 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show tls-auth key'}' title='$Lang::tr{'show tls-auth key'}' width='20' height='20' border='0' />
5898 </form>
5899 <form method='post' name='frmtakey'><td width='3%' align='center' $col4>
5900 <input type='image' name='$Lang::tr{'download tls-auth key'}' src='/images/media-floppy.png' alt='$Lang::tr{'download tls-auth key'}' title='$Lang::tr{'download tls-auth key'}' border='0' />
5901 <input type='hidden' name='ACTION' value='$Lang::tr{'download tls-auth key'}' />
5902 </form>
5903 <td width='4%' $col4>&nbsp;</td>
5904 </tr>
5905END
5906 ;
5907 } else {
5908 # Nothing
5909 print <<END;
5910 <tr>
5911 <td width='25%' class='base' $col4>$Lang::tr{'ta key'}:</td>
5912 <td class='base' $col4>$Lang::tr{'not present'}</td>
5913 <td colspan='3' $col4>&nbsp;</td>
5914 </tr>
5915END
5916 ;
5917 }
5918
4c962356
EK		 5919 if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
5920 print "<tr><td colspan='5' align='center'><form method='post'>";
5921 print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
5922 print "</form></td></tr>\n";
5923 }
5924
5925 if (keys %cahash > 0) {
5926 foreach my $key (keys %cahash) {
5927 if (($key + 1) % 2) {
5928 print "<tr bgcolor='$color{'color20'}'>\n";
5929 } else {
5930 print "<tr bgcolor='$color{'color22'}'>\n";
5931 }
5932 print "<td class='base'>$cahash{$key}[0]</td>\n";
5933 print "<td class='base'>$cahash{$key}[1]</td>\n";
5934 print <<END;
5935 <form method='post' name='cafrm${key}a'><td align='center'>
5936 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
5937 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
5938 <input type='hidden' name='KEY' value='$key' />
5939 </td></form>
5940 <form method='post' name='cafrm${key}b'><td align='center'>
5941 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
5942 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
5943 <input type='hidden' name='KEY' value='$key' />
5944 </td></form>
5945 <form method='post' name='cafrm${key}c'><td align='center'>
5946 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
5947 <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
5948 <input type='hidden' name='KEY' value='$key' />
5949 </td></form></tr>
5950END
5951 ;
5952 }
5953 }
5954
5955 print "</table>";
5956
5957 # If the file contains entries, print Key to action icons
5958 if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
5959 print <<END;
5960 <table>
5961 <tr>
5962 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5963 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5964 <td class='base'>$Lang::tr{'show certificate'}</td>
5965 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
5966 <td class='base'>$Lang::tr{'download certificate'}</td>
5967 </tr>
5968 </table>
5969END
5970 ;
5971 }
ce9abb66 5972
4c962356 5973 print <<END
578f23c8
SS		 5974
5975 <br><hr><br>
5976
4c962356 5977 <form method='post' enctype='multipart/form-data'>
578f23c8
SS		 5978 <table border='0' width='100%'>
5979 <tr>
5980 <td colspan='4'><b>$Lang::tr{'upload ca certificate'}</b></td>
5981 </tr>
4c962356 5982
578f23c8
SS		 5983 <tr>
5984 <td width='10%'>$Lang::tr{'ca name'}:</td>
5985 <td width='30%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'></td>
5986 <td width='30%'><input type='file' name='FH' size='25'>
5987 <td width='30%'align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}'></td>
5988 </tr>
f527e53f 5989
578f23c8
SS		 5990 <tr>
5991 <td colspan='3'>&nbsp;</td>
5992 <td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
5993 </tr>
5994 </table>
f527e53f 5995
578f23c8
SS		 5996 <br>
5997
5998 <table border='0' width='100%'>
5999 <tr>
6000 <td colspan='4'><b>$Lang::tr{'ovpn dh parameters'}</b></td>
6001 </tr>
6002
6003 <tr>
6004 <td width='40%'>$Lang::tr{'ovpn dh upload'}:</td>
6005 <td width='30%'><input type='file' name='FH' size='25'>
6006 <td width='30%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'upload dh key'}'></td>
6007 </tr>
6008
6009 <tr>
6010 <td width='40%'>$Lang::tr{'ovpn dh new key'}:</td>
6011 <td colspan='2' width='60%' align='right'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
6012 </tr>
6013 </table>
6014 </form>
66c36198 6015
578f23c8 6016 <br><hr>
4c962356
EK		 6017END
6018 ;
6019
6020 if ( $srunning eq "yes" ) {
6021 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' disabled='disabled' /></div></form>\n";
6022 } else {
6023 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' /></div></form>\n";
6024 }
6025 &Header::closebox();
6026END
6027 ;
6028
6029&Header::closepage();
ce9abb66 6030
Peter's tree of IPFire 2.x