Merge remote-tracking branch 'ummeegge/OpenVPN_validating_N2N' into next
[people/pmueller/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 ###
22 # Based on IPFireCore 77
23 ###
24 use CGI;
25 use CGI qw/:standard/;
26 use Net::DNS;
27 use Net::Ping;
28 use Net::Telnet;
29 use File::Copy;
30 use File::Temp qw/ tempfile tempdir /;
31 use strict;
32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
33 use Sort::Naturally;
34 require '/var/ipfire/general-functions.pl';
35 require "${General::swroot}/lang.pl";
36 require "${General::swroot}/header.pl";
37 require "${General::swroot}/countries.pl";
38
39 # enable only the following on debugging purpose
40 #use warnings;
41 #use CGI::Carp 'fatalsToBrowser';
42 #workaround to suppress a warning when a variable is used only once
43 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
44 undef (@dummy);
45
46 my %color = ();
47 my %mainsettings = ();
48 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
49 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
50
51 ###
52 ### Initialize variables
53 ###
54 my %ccdconfhash=();
55 my %ccdroutehash=();
56 my %ccdroute2hash=();
57 my %netsettings=();
58 my %cgiparams=();
59 my %vpnsettings=();
60 my %checked=();
61 my %confighash=();
62 my %cahash=();
63 my %selected=();
64 my $warnmessage = '';
65 my $errormessage = '';
66 my %settings=();
67 my $routes_push_file = '';
68 my $confighost="${General::swroot}/fwhosts/customhosts";
69 my $configgrp="${General::swroot}/fwhosts/customgroups";
70 my $customnet="${General::swroot}/fwhosts/customnetworks";
71 my $name;
72 my $col="";
73 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
74 $cgiparams{'ENABLED'} = 'off';
75 $cgiparams{'ENABLED_BLUE'} = 'off';
76 $cgiparams{'ENABLED_ORANGE'} = 'off';
77 $cgiparams{'EDIT_ADVANCED'} = 'off';
78 $cgiparams{'NAT'} = 'off';
79 $cgiparams{'COMPRESSION'} = 'off';
80 $cgiparams{'ONLY_PROPOSED'} = 'off';
81 $cgiparams{'ACTION'} = '';
82 $cgiparams{'CA_NAME'} = '';
83 $cgiparams{'DH_NAME'} = 'dh1024.pem';
84 $cgiparams{'DHLENGHT'} = '';
85 $cgiparams{'DHCP_DOMAIN'} = '';
86 $cgiparams{'DHCP_DNS'} = '';
87 $cgiparams{'DHCP_WINS'} = '';
88 $cgiparams{'ROUTES_PUSH'} = '';
89 $cgiparams{'DCOMPLZO'} = 'off';
90 $cgiparams{'MSSFIX'} = '';
91 $cgiparams{'number'} = '';
92 $cgiparams{'PMTU_DISCOVERY'} = '';
93 $cgiparams{'DCIPHER'} = '';
94 $cgiparams{'DAUTH'} = '';
95 $cgiparams{'TLSAUTH'} = '';
96 $routes_push_file = "${General::swroot}/ovpn/routes_push";
97 unless (-e $routes_push_file) { system("touch $routes_push_file"); }
98 unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
99 unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
100 unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
101
102 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
103
104 # prepare openvpn config file
105 ###
106 ### Useful functions
107 ###
108 sub haveOrangeNet
109 {
110 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
111 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
112 return 0;
113 }
114
115 sub haveBlueNet
116 {
117 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
118 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
119 return 0;
120 }
121
122 sub sizeformat{
123 my $bytesize = shift;
124 my $i = 0;
125
126 while(abs($bytesize) >= 1024){
127 $bytesize=$bytesize/1024;
128 $i++;
129 last if($i==6);
130 }
131
132 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
133 my $newsize=(int($bytesize*100 +0.5))/100;
134 return("$newsize $units[$i]");
135 }
136
137 sub cleanssldatabase
138 {
139 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
140 print FILE "01";
141 close FILE;
142 }
143 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
144 print FILE "";
145 close FILE;
146 }
147 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
148 unlink ("${General::swroot}/ovpn/certs/serial.old");
149 unlink ("${General::swroot}/ovpn/certs/01.pem");
150 }
151
152 sub newcleanssldatabase
153 {
154 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
155 open(FILE, ">${General::swroot}(ovpn/certs/serial");
156 print FILE "01";
157 close FILE;
158 }
159 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
160 system ("touch ${General::swroot}/ovpn/certs/index.txt");
161 }
162 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
163 unlink ("${General::swroot}/ovpn/certs/serial.old");
164 }
165
166 sub deletebackupcert
167 {
168 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
169 my $hexvalue = <FILE>;
170 chomp $hexvalue;
171 close FILE;
172 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
173 }
174 }
175
176 sub writeserverconf {
177 my %sovpnsettings = ();
178 my @temp = ();
179 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
180 &read_routepushfile;
181
182 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
183 flock CONF, 2;
184 print CONF "#OpenVPN Server conf\n";
185 print CONF "\n";
186 print CONF "daemon openvpnserver\n";
187 print CONF "writepid /var/run/openvpn.pid\n";
188 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
189 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
190 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
191 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
192 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
193 print CONF "script-security 3 system\n";
194 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
195 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
196 print CONF "tls-server\n";
197 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
198 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
199 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
200 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
201 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
202 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
203 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
204
205 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
206 # If we doesn't use one of them, we can use the configured mtu value.
207 if ($sovpnsettings{'MSSFIX'} eq 'on')
208 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
209 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
210 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
211 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
212 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
213 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
214 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
215 else
216 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
217
218 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
219 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
220 foreach (@temp)
221 {
222 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
223 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
224 }
225 }
226 # a.marx ccd
227 my %ccdconfhash=();
228 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
229 foreach my $key (keys %ccdconfhash) {
230 my $a=$ccdconfhash{$key}[1];
231 my ($b,$c) = split (/\//, $a);
232 print CONF "route $b ".&General::cidrtosub($c)."\n";
233 }
234 my %ccdroutehash=();
235 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
236 foreach my $key (keys %ccdroutehash) {
237 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
238 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
239 print CONF "route $a $b\n";
240 }
241 }
242 # ccd end
243
244 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
245 print CONF "client-to-client\n";
246 }
247 if ($sovpnsettings{MSSFIX} eq 'on') {
248 print CONF "mssfix\n";
249 }
250 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
251 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
252 }
253
254 # Check if a valid operating mode has been choosen and use it.
255 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
256 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
257 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
258 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
259 }
260
261 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
262 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
263 }
264 print CONF "status-version 1\n";
265 print CONF "status /var/log/ovpnserver.log 30\n";
266 print CONF "cipher $sovpnsettings{DCIPHER}\n";
267 if ($sovpnsettings{'DAUTH'} eq '') {
268 print CONF "";
269 } else {
270 print CONF "auth $sovpnsettings{'DAUTH'}\n";
271 }
272 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
273 print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n";
274 }
275 if ($sovpnsettings{DCOMPLZO} eq 'on') {
276 print CONF "comp-lzo\n";
277 }
278 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
279 print CONF "push \"redirect-gateway def1\"\n";
280 }
281 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
282 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
283 }
284
285 if ($sovpnsettings{DHCP_DNS} ne '') {
286 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
287 }
288
289 if ($sovpnsettings{DHCP_WINS} ne '') {
290 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
291 }
292
293 if ($sovpnsettings{DHCP_WINS} eq '') {
294 print CONF "max-clients 100\n";
295 }
296 if ($sovpnsettings{DHCP_WINS} ne '') {
297 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
298 }
299 print CONF "tls-verify /usr/lib/openvpn/verify\n";
300 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
301 print CONF "user nobody\n";
302 print CONF "group nobody\n";
303 print CONF "persist-key\n";
304 print CONF "persist-tun\n";
305 if ($sovpnsettings{LOG_VERB} ne '') {
306 print CONF "verb $sovpnsettings{LOG_VERB}\n";
307 } else {
308 print CONF "verb 3\n";
309 }
310 print CONF "\n";
311
312 close(CONF);
313 }
314
315 sub emptyserverlog{
316 if (open(FILE, ">/var/log/ovpnserver.log")) {
317 flock FILE, 2;
318 print FILE "";
319 close FILE;
320 }
321
322 }
323
324 sub delccdnet
325 {
326 my %ccdconfhash = ();
327 my %ccdhash = ();
328 my $ccdnetname=$_[0];
329 if (-f "${General::swroot}/ovpn/ovpnconfig"){
330 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
331 foreach my $key (keys %ccdhash) {
332 if ($ccdhash{$key}[32] eq $ccdnetname) {
333 $errormessage=$Lang::tr{'ccd err hostinnet'};
334 return;
335 }
336 }
337 }
338 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
339 foreach my $key (keys %ccdconfhash) {
340 if ($ccdconfhash{$key}[0] eq $ccdnetname){
341 delete $ccdconfhash{$key};
342 }
343 }
344 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
345
346 &writeserverconf;
347 return 0;
348 }
349
350 sub addccdnet
351 {
352 my %ccdconfhash=();
353 my @ccdconf=();
354 my $ccdname=$_[0];
355 my $ccdnet=$_[1];
356 my $subcidr;
357 my @ip2=();
358 my $checkup;
359 my $ccdip;
360 my $baseaddress;
361
362
363 #check name
364 if ($ccdname eq '')
365 {
366 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
367 return
368 }
369
370 if(!&General::validhostname($ccdname))
371 {
372 $errormessage=$Lang::tr{'ccd err invalidname'};
373 return;
374 }
375
376 ($ccdip,$subcidr) = split (/\//,$ccdnet);
377 $subcidr=&General::iporsubtocidr($subcidr);
378 #check subnet
379 if ($subcidr > 30)
380 {
381 $errormessage=$Lang::tr{'ccd err invalidnet'};
382 return;
383 }
384 #check ip
385 if (!&General::validipandmask($ccdnet)){
386 $errormessage=$Lang::tr{'ccd err invalidnet'};
387 return;
388 }
389
390 $errormessage=&General::checksubnets($ccdname,$ccdnet);
391
392
393 if (!$errormessage) {
394 my %ccdconfhash=();
395 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
396 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
397 my $key = &General::findhasharraykey (\%ccdconfhash);
398 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
399 $ccdconfhash{$key}[0] = $ccdname;
400 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
401 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
402 &writeserverconf;
403 $cgiparams{'ccdname'}='';
404 $cgiparams{'ccdsubnet'}='';
405 return 1;
406 }
407 }
408
409 sub modccdnet
410 {
411
412 my $newname=$_[0];
413 my $oldname=$_[1];
414 my %ccdconfhash=();
415 my %ccdhash=();
416 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
417 foreach my $key (keys %ccdconfhash) {
418 if ($ccdconfhash{$key}[0] eq $oldname) {
419 foreach my $key1 (keys %ccdconfhash) {
420 if ($ccdconfhash{$key1}[0] eq $newname){
421 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
422 return;
423 }else{
424 $ccdconfhash{$key}[0]= $newname;
425 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
426 last;
427 }
428 }
429 }
430 }
431
432 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
433 foreach my $key (keys %ccdhash) {
434 if ($ccdhash{$key}[32] eq $oldname) {
435 $ccdhash{$key}[32]=$newname;
436 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
437 last;
438 }
439 }
440
441 return 0;
442 }
443 sub ccdmaxclients
444 {
445 my $ccdnetwork=$_[0];
446 my @octets=();
447 my @subnet=();
448 @octets=split("\/",$ccdnetwork);
449 @subnet= split /\./, &General::cidrtosub($octets[1]);
450 my ($a,$b,$c,$d,$e);
451 $a=256-$subnet[0];
452 $b=256-$subnet[1];
453 $c=256-$subnet[2];
454 $d=256-$subnet[3];
455 $e=($a*$b*$c*$d)/4;
456 return $e-1;
457 }
458
459 sub getccdadresses
460 {
461 my $ipin=$_[0];
462 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
463 my $cidr=$_[1];
464 chomp($cidr);
465 my $count=$_[2];
466 my $hasip=$_[3];
467 chomp($hasip);
468 my @iprange=();
469 my %ccdhash=();
470 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
471 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".($ip4+2);
472 for (my $i=1;$i<=$count;$i++) {
473 my $tmpip=$iprange[$i-1];
474 my $stepper=$i*4;
475 $iprange[$i]= &General::getnextip($tmpip,4);
476 }
477 my $r=0;
478 foreach my $key (keys %ccdhash) {
479 $r=0;
480 foreach my $tmp (@iprange){
481 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
482 if ($net eq $tmp) {
483 if ( $hasip ne $ccdhash{$key}[33] ){
484 splice (@iprange,$r,1);
485 }
486 }
487 $r++;
488 }
489 }
490 return @iprange;
491 }
492
493 sub fillselectbox
494 {
495 my $boxname=$_[1];
496 my ($ccdip,$subcidr) = split("/",$_[0]);
497 my $tz=$_[2];
498 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
499 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
500 foreach (@allccdips) {
501 my $ip=$_."/30";
502 chomp($ip);
503 print "<option value='$ip' ";
504 if ( $ip eq $cgiparams{$boxname} ){
505 print"selected";
506 }
507 print ">$ip</option>";
508 }
509 print "</select>";
510 }
511
512 sub hostsinnet
513 {
514 my $name=$_[0];
515 my %ccdhash=();
516 my $i=0;
517 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
518 foreach my $key (keys %ccdhash) {
519 if ($ccdhash{$key}[32] eq $name){ $i++;}
520 }
521 return $i;
522 }
523
524 sub check_routes_push
525 {
526 my $val=$_[0];
527 my ($ip,$cidr) = split (/\//, $val);
528 ##check for existing routes in routes_push
529 if (-e "${General::swroot}/ovpn/routes_push") {
530 open(FILE,"${General::swroot}/ovpn/routes_push");
531 while (<FILE>) {
532 $_=~s/\s*$//g;
533
534 my ($ip2,$cidr2) = split (/\//,"$_");
535 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
536
537 if($val eq $val2){
538 return 0;
539 }
540 #subnetcheck
541 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
542 return 0;
543 }
544 };
545 close(FILE);
546 }
547 return 1;
548 }
549
550 sub check_ccdroute
551 {
552 my %ccdroutehash=();
553 my $val=$_[0];
554 my ($ip,$cidr) = split (/\//, $val);
555 #check for existing routes in ccdroute
556 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
557 foreach my $key (keys %ccdroutehash) {
558 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
559 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
560 return 0;
561 }
562 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
563 #subnetcheck
564 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
565 return 0;
566 }
567 }
568 }
569 return 1;
570 }
571 sub check_ccdconf
572 {
573 my %ccdconfhash=();
574 my $val=$_[0];
575 my ($ip,$cidr) = split (/\//, $val);
576 #check for existing routes in ccdroute
577 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
578 foreach my $key (keys %ccdconfhash) {
579 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
580 return 0;
581 }
582 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
583 #subnetcheck
584 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
585 return 0;
586 }
587
588 }
589 return 1;
590 }
591
592 ###
593 # m.a.d net2net
594 ###
595
596 sub validdotmask
597 {
598 my $ipdotmask = $_[0];
599 if (&General::validip($ipdotmask)) { return 0; }
600 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
601 my $mask = $2;
602 if (($mask =~ /\./ )) { return 0; }
603 return 1;
604 }
605
606 # -------------------------------------------------------------------
607
608 sub write_routepushfile
609 {
610 open(FILE, ">$routes_push_file");
611 flock(FILE, 2);
612 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
613 print FILE $vpnsettings{'ROUTES_PUSH'};
614 }
615 close(FILE);
616 }
617
618 sub read_routepushfile
619 {
620 if (-e "$routes_push_file") {
621 open(FILE,"$routes_push_file");
622 delete $vpnsettings{'ROUTES_PUSH'};
623 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
624 close(FILE);
625 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
626
627 }
628 }
629
630
631 #hier die refresh page
632 if ( -e "${General::swroot}/ovpn/gencanow") {
633 my $refresh = '';
634 $refresh = "<meta http-equiv='refresh' content='15;' />";
635 &Header::showhttpheaders();
636 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
637 &Header::openbigbox('100%', 'center');
638 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
639 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
640 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
641 &Header::closebox();
642 &Header::closebigbox();
643 &Header::closepage();
644 exit (0);
645 }
646 ##hier die refresh page
647
648
649 ###
650 ### OpenVPN Server Control
651 ###
652 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
653 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
654 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
655 #start openvpn server
656 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
657 &emptyserverlog();
658 system('/usr/local/bin/openvpnctrl', '-s');
659 }
660 #stop openvpn server
661 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
662 system('/usr/local/bin/openvpnctrl', '-k');
663 &emptyserverlog();
664 }
665 # #restart openvpn server
666 # if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
667 #workarund, till SIGHUP also works when running as nobody
668 # system('/usr/local/bin/openvpnctrl', '-r');
669 # &emptyserverlog();
670 # }
671 }
672
673 ###
674 ### Save Advanced options
675 ###
676
677 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
678 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
679 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
680 #DAN this value has to leave.
681 #new settings for daemon
682 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
683 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
684 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
685 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
686 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
687 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
688 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
689 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
690 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
691 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
692 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
693 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
694 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
695 my @temp=();
696
697 if ($cgiparams{'FRAGMENT'} eq '') {
698 delete $vpnsettings{'FRAGMENT'};
699 } else {
700 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
701 $errormessage = "Incorrect value, please insert only numbers.";
702 goto ADV_ERROR;
703 } else {
704 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
705 }
706 }
707
708 if ($cgiparams{'MSSFIX'} ne 'on') {
709 delete $vpnsettings{'MSSFIX'};
710 } else {
711 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
712 }
713
714 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
715 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
716 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
717
718 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
719 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
720 goto ADV_ERROR;
721 }
722 }
723
724 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
725 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
726 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
727 goto ADV_ERROR;
728 }
729 }
730 if ($cgiparams{'DHCP_DNS'} ne ''){
731 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
732 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
733 goto ADV_ERROR;
734 }
735 }
736 if ($cgiparams{'DHCP_WINS'} ne ''){
737 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
738 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
739 goto ADV_ERROR;
740 }
741 }
742 if ($cgiparams{'ROUTES_PUSH'} ne ''){
743 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
744 undef $vpnsettings{'ROUTES_PUSH'};
745
746 foreach my $tmpip (@temp)
747 {
748 s/^\s+//g; s/\s+$//g;
749
750 if ($tmpip)
751 {
752 $tmpip=~s/\s*$//g;
753 unless (&General::validipandmask($tmpip)) {
754 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
755 goto ADV_ERROR;
756 }
757 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
758
759 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
760 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
761 goto ADV_ERROR;
762 }
763 # a.marx ccd
764 my %ccdroutehash=();
765 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
766 foreach my $key (keys %ccdroutehash) {
767 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
768 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
769 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
770 goto ADV_ERROR;
771 }
772 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
773 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
774 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
775 goto ADV_ERROR;
776 }
777 }
778 }
779
780 # ccd end
781
782 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
783 }
784 }
785 &write_routepushfile;
786 undef $vpnsettings{'ROUTES_PUSH'};
787 }
788 else {
789 undef $vpnsettings{'ROUTES_PUSH'};
790 &write_routepushfile;
791 }
792 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
793 $errormessage = $Lang::tr{'invalid input for max clients'};
794 goto ADV_ERROR;
795 }
796 if ($cgiparams{'KEEPALIVE_1'} ne '') {
797 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
798 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
799 goto ADV_ERROR;
800 }
801 }
802 if ($cgiparams{'KEEPALIVE_2'} ne ''){
803 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
804 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
805 goto ADV_ERROR;
806 }
807 }
808 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
809 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
810 goto ADV_ERROR;
811 }
812 # Create ta.key for tls-auth if not presant
813 if ($cgiparams{'TLSAUTH'} eq 'on') {
814 if ( ! -e "${General::swroot}/ovpn/certs/ta.key") {
815 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
816 if ($?) {
817 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
818 goto ADV_ERROR;
819 }
820 }
821 }
822
823 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
824 &writeserverconf();#hier ok
825 }
826
827 ###
828 # m.a.d net2net
829 ###
830
831 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
832 {
833
834 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
835 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
836 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
837 my $tunmtu = '';
838
839 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
840 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
841
842 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
843
844 flock SERVERCONF, 2;
845 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
846 print SERVERCONF "\n";
847 print SERVERCONF "# User Security\n";
848 print SERVERCONF "user nobody\n";
849 print SERVERCONF "group nobody\n";
850 print SERVERCONF "persist-tun\n";
851 print SERVERCONF "persist-key\n";
852 print SERVERCONF "script-security 2\n";
853 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
854
855 if ($cgiparams{'REMOTE'} ne '') {
856 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
857 }
858
859 print SERVERCONF "float\n";
860 print SERVERCONF "# IP adresses of the VPN Subnet\n";
861 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
862 print SERVERCONF "# Client Gateway Network\n";
863 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
864 print SERVERCONF "# tun Device\n";
865 print SERVERCONF "dev tun\n";
866 print SERVERCONF "# Port and Protokol\n";
867 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
868
869 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
870 print SERVERCONF "proto tcp-server\n";
871 print SERVERCONF "# Packet size\n";
872 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
873 print SERVERCONF "tun-mtu $tunmtu\n";
874 }
875
876 if ($cgiparams{'PROTOCOL'} eq 'udp') {
877 print SERVERCONF "proto udp\n";
878 print SERVERCONF "# Paketsize\n";
879 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
880 print SERVERCONF "tun-mtu $tunmtu\n";
881 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
882 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
883 }
884
885 # Check if a valid operating mode has been choosen and use it.
886 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
887 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
888 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
889 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
890 if($cgiparams{'MTU'} eq '1500') {
891 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
892 }
893 }
894 }
895 print SERVERCONF "# Auth. Server\n";
896 print SERVERCONF "tls-server\n";
897 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
898 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
899 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
900 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
901 print SERVERCONF "# Cipher\n";
902 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
903 if ($cgiparams{'DAUTH'} eq '') {
904 print SERVERCONF "auth SHA1\n";
905 } else {
906 print SERVERCONF "# HMAC algorithm\n";
907 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
908 }
909 if ($cgiparams{'COMPLZO'} eq 'on') {
910 print SERVERCONF "# Enable Compression\n";
911 print SERVERCONF "comp-lzo\n";
912 }
913 print SERVERCONF "# Debug Level\n";
914 print SERVERCONF "verb 3\n";
915 print SERVERCONF "# Tunnel check\n";
916 print SERVERCONF "keepalive 10 60\n";
917 print SERVERCONF "# Start as daemon\n";
918 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
919 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
920 print SERVERCONF "# Activate Management Interface and Port\n";
921 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
922 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
923 close(SERVERCONF);
924
925 }
926
927 ###
928 # m.a.d net2net
929 ###
930
931 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
932 {
933
934 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
935 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
936 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
937 my $tunmtu = '';
938
939 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
940 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
941
942 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
943
944 flock CLIENTCONF, 2;
945 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
946 print CLIENTCONF "#\n";
947 print CLIENTCONF "# User Security\n";
948 print CLIENTCONF "user nobody\n";
949 print CLIENTCONF "group nobody\n";
950 print CLIENTCONF "persist-tun\n";
951 print CLIENTCONF "persist-key\n";
952 print CLIENTCONF "script-security 2\n";
953 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
954 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
955 print CLIENTCONF "float\n";
956 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
957 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
958 print CLIENTCONF "# Server Gateway Network\n";
959 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
960 print CLIENTCONF "# tun Device\n";
961 print CLIENTCONF "dev tun\n";
962 print CLIENTCONF "# Port and Protokol\n";
963 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
964
965 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
966 print CLIENTCONF "proto tcp-client\n";
967 print CLIENTCONF "# Packet size\n";
968 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
969 print CLIENTCONF "tun-mtu $tunmtu\n";
970 }
971
972 if ($cgiparams{'PROTOCOL'} eq 'udp') {
973 print CLIENTCONF "proto udp\n";
974 print CLIENTCONF "# Paketsize\n";
975 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
976 print CLIENTCONF "tun-mtu $tunmtu\n";
977 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
978 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
979 }
980
981 # Check if a valid operating mode has been choosen and use it.
982 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
983 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
984 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
985 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
986 if ($cgiparams{'MTU'} eq '1500') {
987 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
988 }
989 }
990 }
991
992 print CLIENTCONF "ns-cert-type server\n";
993 print CLIENTCONF "# Auth. Client\n";
994 print CLIENTCONF "tls-client\n";
995 print CLIENTCONF "# Cipher\n";
996 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
997 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
998 if ($cgiparams{'DAUTH'} eq '') {
999 print CLIENTCONF "auth SHA1\n";
1000 } else {
1001 print CLIENTCONF "# HMAC algorithm\n";
1002 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1003 }
1004 if ($cgiparams{'COMPLZO'} eq 'on') {
1005 print CLIENTCONF "# Enable Compression\n";
1006 print CLIENTCONF "comp-lzo\n";
1007 }
1008 print CLIENTCONF "# Debug Level\n";
1009 print CLIENTCONF "verb 3\n";
1010 print CLIENTCONF "# Tunnel check\n";
1011 print CLIENTCONF "keepalive 10 60\n";
1012 print CLIENTCONF "# Start as daemon\n";
1013 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1014 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1015 print CLIENTCONF "# Activate Management Interface and Port\n";
1016 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1017 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1018 close(CLIENTCONF);
1019
1020 }
1021
1022 ###
1023 ### Save main settings
1024 ###
1025
1026 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1027 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1028 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1029 #DAN this value has to leave.
1030 if ($cgiparams{'ENABLED'} eq 'on'){
1031 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1032 $errormessage = $Lang::tr{'invalid input for hostname'};
1033 goto SETTINGS_ERROR;
1034 }
1035 }
1036
1037 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1038 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1039 goto SETTINGS_ERROR;
1040 }
1041 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1042
1043 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1044 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1045 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1046 goto SETTINGS_ERROR;
1047 }
1048
1049 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1050 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1051 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1052 goto SETTINGS_ERROR;
1053 }
1054
1055 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1056 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1057 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1058 goto SETTINGS_ERROR;
1059 }
1060
1061 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1062 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1063 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1064 goto SETTINGS_ERROR;
1065 }
1066 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1067 while (<ALIASES>)
1068 {
1069 chomp($_);
1070 my @tempalias = split(/\,/,$_);
1071 if ($tempalias[1] eq 'on') {
1072 if (&General::IpInSubnet ($tempalias[0] ,
1073 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1074 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1075 }
1076 }
1077 }
1078 close(ALIASES);
1079 if ($errormessage ne ''){
1080 goto SETTINGS_ERROR;
1081 }
1082 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1083 $errormessage = $Lang::tr{'invalid input'};
1084 goto SETTINGS_ERROR;
1085 }
1086 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1087 $errormessage = $Lang::tr{'invalid mtu input'};
1088 goto SETTINGS_ERROR;
1089 }
1090
1091 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1092 $errormessage = $Lang::tr{'invalid port'};
1093 goto SETTINGS_ERROR;
1094 }
1095
1096 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1097 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1098 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1099 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1100 #new settings for daemon
1101 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1102 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1103 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1104 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1105 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1106 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1107 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1108 #wrtie enable
1109
1110 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1111 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1112 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1113 #new settings for daemon
1114 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1115 &writeserverconf();#hier ok
1116 SETTINGS_ERROR:
1117 ###
1118 ### Reset all step 2
1119 ###
1120 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
1121 my $file = '';
1122 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1123
1124 foreach my $key (keys %confighash) {
1125 if ($confighash{$key}[4] eq 'cert') {
1126 delete $confighash{$cgiparams{'$key'}};
1127 }
1128 }
1129 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1130 unlink $file;
1131 }
1132 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1133 unlink $file;
1134 }
1135 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1136 unlink $file;
1137 }
1138 &cleanssldatabase();
1139 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1140 print FILE "";
1141 close FILE;
1142 }
1143 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1144 print FILE "";
1145 close FILE;
1146 }
1147 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1148 print FILE "";
1149 close FILE;
1150 }
1151 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1152 unlink $file
1153 }
1154 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1155 print FILE "";
1156 close FILE;
1157 }
1158 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1159 print FILE "";
1160 close FILE;
1161 }
1162 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1163 system ("rm -rf $file");
1164 }
1165
1166 #&writeserverconf();
1167 ###
1168 ### Reset all step 1
1169 ###
1170 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
1171 &Header::showhttpheaders();
1172 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1173 &Header::openbigbox('100%', 'left', '', '');
1174 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1175 print <<END;
1176 <form method='post'>
1177 <table width='100%'>
1178 <tr>
1179 <td align='center'>
1180 <input type='hidden' name='AREUSURE' value='yes' />
1181 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1182 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1183 </tr>
1184 <tr>
1185 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1186 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1187 </tr>
1188 </table>
1189 </form>
1190 END
1191 ;
1192 &Header::closebox();
1193 &Header::closebigbox();
1194 &Header::closepage();
1195 exit (0);
1196
1197 ###
1198 ### Generate DH key step 2
1199 ###
1200 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
1201 # Delete if old key exists
1202 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1203 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1204 }
1205 # Create Diffie Hellmann Parameter
1206 system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1207 if ($?) {
1208 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1209 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1210 }
1211
1212 ###
1213 ### Generate DH key step 1
1214 ###
1215 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1216 &Header::showhttpheaders();
1217 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1218 &Header::openbigbox('100%', 'LEFT', '', '');
1219 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1220 print <<END;
1221 <table width='100%'>
1222 <tr>
1223 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
1224 </tr>
1225 <tr>
1226 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1227 <td align='center'>
1228 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1229 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1230 <select name='DHLENGHT'>
1231 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1232 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1233 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1234 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1235 </select>
1236 </td>
1237 </tr>
1238 <tr><td colspan='4'><br></td></tr>
1239 </table>
1240 <table width='100%'>
1241 <tr>
1242 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
1243 </tr>
1244 <tr>
1245 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1246 </tr>
1247 <tr><td colspan='2'><br></td></tr>
1248 <tr>
1249 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1250 </form>
1251 </tr>
1252 </table>
1253
1254 END
1255 ;
1256 &Header::closebox();
1257 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1258 &Header::closebigbox();
1259 &Header::closepage();
1260 exit (0);
1261
1262 ###
1263 ### Upload DH key
1264 ###
1265 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
1266 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1267 $errormessage = $Lang::tr{'there was no file upload'};
1268 goto UPLOADCA_ERROR;
1269 }
1270 # Move uploaded dh key to a temporary file
1271 (my $fh, my $filename) = tempfile( );
1272 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1273 $errormessage = $!;
1274 goto UPLOADCA_ERROR;
1275 }
1276 my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
1277 if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
1278 $errormessage = $Lang::tr{'not a valid dh key'};
1279 unlink ($filename);
1280 goto UPLOADCA_ERROR;
1281 } else {
1282 # Delete if old key exists
1283 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1284 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1285 }
1286 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
1287 if ($? ne 0) {
1288 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1289 unlink ($filename);
1290 goto UPLOADCA_ERROR;
1291 }
1292 }
1293
1294 ###
1295 ### Upload CA Certificate
1296 ###
1297 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1298 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1299
1300 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1301 $errormessage = $Lang::tr{'name must only contain characters'};
1302 goto UPLOADCA_ERROR;
1303 }
1304
1305 if (length($cgiparams{'CA_NAME'}) >60) {
1306 $errormessage = $Lang::tr{'name too long'};
1307 goto VPNCONF_ERROR;
1308 }
1309
1310 if ($cgiparams{'CA_NAME'} eq 'ca') {
1311 $errormessage = $Lang::tr{'name is invalid'};
1312 goto UPLOADCA_ERROR;
1313 }
1314
1315 # Check if there is no other entry with this name
1316 foreach my $key (keys %cahash) {
1317 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1318 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1319 goto UPLOADCA_ERROR;
1320 }
1321 }
1322
1323 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1324 $errormessage = $Lang::tr{'there was no file upload'};
1325 goto UPLOADCA_ERROR;
1326 }
1327 # Move uploaded ca to a temporary file
1328 (my $fh, my $filename) = tempfile( );
1329 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1330 $errormessage = $!;
1331 goto UPLOADCA_ERROR;
1332 }
1333 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1334 if ($temp !~ /CA:TRUE/i) {
1335 $errormessage = $Lang::tr{'not a valid ca certificate'};
1336 unlink ($filename);
1337 goto UPLOADCA_ERROR;
1338 } else {
1339 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1340 if ($? ne 0) {
1341 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1342 unlink ($filename);
1343 goto UPLOADCA_ERROR;
1344 }
1345 }
1346
1347 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1348 $casubject =~ /Subject: (.*)[\n]/;
1349 $casubject = $1;
1350 $casubject =~ s+/Email+, E+;
1351 $casubject =~ s/ ST=/ S=/;
1352 $casubject = &Header::cleanhtml($casubject);
1353
1354 my $key = &General::findhasharraykey (\%cahash);
1355 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1356 $cahash{$key}[1] = $casubject;
1357 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1358 # system('/usr/local/bin/ipsecctrl', 'R');
1359
1360 UPLOADCA_ERROR:
1361
1362 ###
1363 ### Display ca certificate
1364 ###
1365 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1366 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1367
1368 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1369 &Header::showhttpheaders();
1370 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1371 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1372 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1373 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1374 $output = &Header::cleanhtml($output,"y");
1375 print "<pre>$output</pre>\n";
1376 &Header::closebox();
1377 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1378 &Header::closebigbox();
1379 &Header::closepage();
1380 exit(0);
1381 } else {
1382 $errormessage = $Lang::tr{'invalid key'};
1383 }
1384
1385 ###
1386 ### Download ca certificate
1387 ###
1388 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1389 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1390
1391 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1392 print "Content-Type: application/octet-stream\r\n";
1393 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1394 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1395 exit(0);
1396 } else {
1397 $errormessage = $Lang::tr{'invalid key'};
1398 }
1399
1400 ###
1401 ### Remove ca certificate (step 2)
1402 ###
1403 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1404 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1405 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1406
1407 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1408 foreach my $key (keys %confighash) {
1409 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1410 if ($test =~ /: OK/) {
1411 # Delete connection
1412 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1413 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1414 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1415 # }
1416 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1417 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1418 delete $confighash{$key};
1419 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1420 # &writeipsecfiles();
1421 }
1422 }
1423 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1424 delete $cahash{$cgiparams{'KEY'}};
1425 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1426 # system('/usr/local/bin/ipsecctrl', 'R');
1427 } else {
1428 $errormessage = $Lang::tr{'invalid key'};
1429 }
1430 ###
1431 ### Remove ca certificate (step 1)
1432 ###
1433 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1434 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1435 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1436
1437 my $assignedcerts = 0;
1438 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1439 foreach my $key (keys %confighash) {
1440 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1441 if ($test =~ /: OK/) {
1442 $assignedcerts++;
1443 }
1444 }
1445 if ($assignedcerts) {
1446 &Header::showhttpheaders();
1447 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1448 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1449 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1450 print <<END;
1451 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1452 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1453 <tr><td align='center'>
1454 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1455 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1456 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1457 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1458 </form></table>
1459 END
1460 ;
1461 &Header::closebox();
1462 &Header::closebigbox();
1463 &Header::closepage();
1464 exit (0);
1465 } else {
1466 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1467 delete $cahash{$cgiparams{'KEY'}};
1468 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1469 # system('/usr/local/bin/ipsecctrl', 'R');
1470 }
1471 } else {
1472 $errormessage = $Lang::tr{'invalid key'};
1473 }
1474
1475 ###
1476 ### Display root certificate
1477 ###
1478 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1479 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1480 my $output;
1481 &Header::showhttpheaders();
1482 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1483 &Header::openbigbox('100%', 'LEFT', '', '');
1484 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1485 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1486 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1487 } else {
1488 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1489 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1490 }
1491 $output = &Header::cleanhtml($output,"y");
1492 print "<pre>$output</pre>\n";
1493 &Header::closebox();
1494 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1495 &Header::closebigbox();
1496 &Header::closepage();
1497 exit(0);
1498
1499 ###
1500 ### Download root certificate
1501 ###
1502 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1503 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1504 print "Content-Type: application/octet-stream\r\n";
1505 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1506 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1507 exit(0);
1508 }
1509
1510 ###
1511 ### Download host certificate
1512 ###
1513 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1514 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1515 print "Content-Type: application/octet-stream\r\n";
1516 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1517 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1518 exit(0);
1519 }
1520
1521 ###
1522 ### Download tls-auth key
1523 ###
1524 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) {
1525 if ( -f "${General::swroot}/ovpn/certs/ta.key" ) {
1526 print "Content-Type: application/octet-stream\r\n";
1527 print "Content-Disposition: filename=ta.key\r\n\r\n";
1528 print `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
1529 exit(0);
1530 }
1531
1532 ###
1533 ### Form for generating a root certificate
1534 ###
1535 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1536 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1537
1538 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1539 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1540 $errormessage = $Lang::tr{'valid root certificate already exists'};
1541 $cgiparams{'ACTION'} = '';
1542 goto ROOTCERT_ERROR;
1543 }
1544
1545 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1546 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1547 my $ipaddr = <IPADDR>;
1548 close IPADDR;
1549 chomp ($ipaddr);
1550 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1551 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1552 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1553 }
1554 }
1555 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1556
1557 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1558 $errormessage = $Lang::tr{'there was no file upload'};
1559 goto ROOTCERT_ERROR;
1560 }
1561
1562 # Move uploaded certificate request to a temporary file
1563 (my $fh, my $filename) = tempfile( );
1564 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1565 $errormessage = $!;
1566 goto ROOTCERT_ERROR;
1567 }
1568
1569 # Create a temporary dirctory
1570 my $tempdir = tempdir( CLEANUP => 1 );
1571
1572 # Extract the CA certificate from the file
1573 my $pid = open(OPENSSL, "|-");
1574 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1575 if ($pid) { # parent
1576 if ($cgiparams{'P12_PASS'} ne '') {
1577 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1578 }
1579 close (OPENSSL);
1580 if ($?) {
1581 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1582 unlink ($filename);
1583 goto ROOTCERT_ERROR;
1584 }
1585 } else { # child
1586 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1587 '-in', $filename,
1588 '-out', "$tempdir/cacert.pem")) {
1589 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1590 unlink ($filename);
1591 goto ROOTCERT_ERROR;
1592 }
1593 }
1594
1595 # Extract the Host certificate from the file
1596 $pid = open(OPENSSL, "|-");
1597 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1598 if ($pid) { # parent
1599 if ($cgiparams{'P12_PASS'} ne '') {
1600 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1601 }
1602 close (OPENSSL);
1603 if ($?) {
1604 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1605 unlink ($filename);
1606 goto ROOTCERT_ERROR;
1607 }
1608 } else { # child
1609 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1610 '-in', $filename,
1611 '-out', "$tempdir/hostcert.pem")) {
1612 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1613 unlink ($filename);
1614 goto ROOTCERT_ERROR;
1615 }
1616 }
1617
1618 # Extract the Host key from the file
1619 $pid = open(OPENSSL, "|-");
1620 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1621 if ($pid) { # parent
1622 if ($cgiparams{'P12_PASS'} ne '') {
1623 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1624 }
1625 close (OPENSSL);
1626 if ($?) {
1627 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1628 unlink ($filename);
1629 goto ROOTCERT_ERROR;
1630 }
1631 } else { # child
1632 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1633 '-nodes',
1634 '-in', $filename,
1635 '-out', "$tempdir/serverkey.pem")) {
1636 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1637 unlink ($filename);
1638 goto ROOTCERT_ERROR;
1639 }
1640 }
1641
1642 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1643 if ($? ne 0) {
1644 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1645 unlink ($filename);
1646 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1647 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1648 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1649 goto ROOTCERT_ERROR;
1650 }
1651
1652 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1653 if ($? ne 0) {
1654 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1655 unlink ($filename);
1656 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1657 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1658 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1659 goto ROOTCERT_ERROR;
1660 }
1661
1662 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1663 if ($? ne 0) {
1664 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1665 unlink ($filename);
1666 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1667 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1668 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1669 goto ROOTCERT_ERROR;
1670 }
1671
1672 goto ROOTCERT_SUCCESS;
1673
1674 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1675
1676 # Validate input since the form was submitted
1677 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1678 $errormessage = $Lang::tr{'organization cant be empty'};
1679 goto ROOTCERT_ERROR;
1680 }
1681 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1682 $errormessage = $Lang::tr{'organization too long'};
1683 goto ROOTCERT_ERROR;
1684 }
1685 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1686 $errormessage = $Lang::tr{'invalid input for organization'};
1687 goto ROOTCERT_ERROR;
1688 }
1689 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1690 $errormessage = $Lang::tr{'hostname cant be empty'};
1691 goto ROOTCERT_ERROR;
1692 }
1693 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1694 $errormessage = $Lang::tr{'invalid input for hostname'};
1695 goto ROOTCERT_ERROR;
1696 }
1697 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1698 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1699 goto ROOTCERT_ERROR;
1700 }
1701 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1702 $errormessage = $Lang::tr{'e-mail address too long'};
1703 goto ROOTCERT_ERROR;
1704 }
1705 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1706 $errormessage = $Lang::tr{'invalid input for department'};
1707 goto ROOTCERT_ERROR;
1708 }
1709 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1710 $errormessage = $Lang::tr{'invalid input for city'};
1711 goto ROOTCERT_ERROR;
1712 }
1713 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1714 $errormessage = $Lang::tr{'invalid input for state or province'};
1715 goto ROOTCERT_ERROR;
1716 }
1717 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1718 $errormessage = $Lang::tr{'invalid input for country'};
1719 goto ROOTCERT_ERROR;
1720 }
1721
1722 # Copy the cgisettings to vpnsettings and save the configfile
1723 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1724 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1725 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1726 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1727 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1728 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1729 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1730 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1731
1732 # Replace empty strings with a .
1733 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1734 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1735 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1736
1737 # refresh
1738 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1739
1740 # Create the CA certificate
1741 my $pid = open(OPENSSL, "|-");
1742 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1743 if ($pid) { # parent
1744 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1745 print OPENSSL "$state\n";
1746 print OPENSSL "$city\n";
1747 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1748 print OPENSSL "$ou\n";
1749 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1750 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1751 close (OPENSSL);
1752 if ($?) {
1753 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1754 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1755 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1756 goto ROOTCERT_ERROR;
1757 }
1758 } else { # child
1759 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes',
1760 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
1761 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1762 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1763 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1764 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1765 goto ROOTCERT_ERROR;
1766 }
1767 }
1768
1769 # Create the Host certificate request
1770 $pid = open(OPENSSL, "|-");
1771 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1772 if ($pid) { # parent
1773 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1774 print OPENSSL "$state\n";
1775 print OPENSSL "$city\n";
1776 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1777 print OPENSSL "$ou\n";
1778 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1779 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1780 print OPENSSL ".\n";
1781 print OPENSSL ".\n";
1782 close (OPENSSL);
1783 if ($?) {
1784 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1785 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1786 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1787 goto ROOTCERT_ERROR;
1788 }
1789 } else { # child
1790 unless (exec ('/usr/bin/openssl', 'req', '-nodes',
1791 '-newkey', 'rsa:2048',
1792 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1793 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1794 '-extensions', 'server',
1795 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1796 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1797 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1798 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1799 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1800 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1801 goto ROOTCERT_ERROR;
1802 }
1803 }
1804
1805 # Sign the host certificate request
1806 system('/usr/bin/openssl', 'ca', '-days', '999999',
1807 '-batch', '-notext',
1808 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1809 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1810 '-extensions', 'server',
1811 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1812 if ($?) {
1813 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1814 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1815 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1816 unlink ("${General::swroot}/ovpn/serverkey.pem");
1817 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1818 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1819 &newcleanssldatabase();
1820 goto ROOTCERT_ERROR;
1821 } else {
1822 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1823 &deletebackupcert();
1824 }
1825
1826 # Create an empty CRL
1827 system('/usr/bin/openssl', 'ca', '-gencrl',
1828 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1829 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1830 if ($?) {
1831 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1832 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1833 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1834 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1835 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1836 &cleanssldatabase();
1837 goto ROOTCERT_ERROR;
1838 # } else {
1839 # &cleanssldatabase();
1840 }
1841 # Create Diffie Hellmann Parameter
1842 system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1843 if ($?) {
1844 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1845 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1846 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1847 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1848 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1849 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1850 &cleanssldatabase();
1851 goto ROOTCERT_ERROR;
1852 # } else {
1853 # &cleanssldatabase();
1854 }
1855 # Create ta.key for tls-auth
1856 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key");
1857 if ($?) {
1858 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1859 &cleanssldatabase();
1860 goto ROOTCERT_ERROR;
1861 }
1862 goto ROOTCERT_SUCCESS;
1863 }
1864 ROOTCERT_ERROR:
1865 if ($cgiparams{'ACTION'} ne '') {
1866 &Header::showhttpheaders();
1867 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1868 &Header::openbigbox('100%', 'LEFT', '', '');
1869 if ($errormessage) {
1870 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1871 print "<class name='base'>$errormessage";
1872 print "&nbsp;</class>";
1873 &Header::closebox();
1874 }
1875 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1876 print <<END;
1877 <form method='post' enctype='multipart/form-data'>
1878 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1879 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1880 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1881 <td width='35%' colspan='2'>&nbsp;</td></tr>
1882 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1883 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1884 <td colspan='2'>&nbsp;</td></tr>
1885 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1886 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1887 <td colspan='2'>&nbsp;</td></tr>
1888 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1889 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1890 <td colspan='2'>&nbsp;</td></tr>
1891 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1892 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1893 <td colspan='2'>&nbsp;</td></tr>
1894 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1895 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1896 <td colspan='2'>&nbsp;</td></tr>
1897 <tr><td class='base'>$Lang::tr{'country'}:</td>
1898 <td class='base'><select name='ROOTCERT_COUNTRY'>
1899
1900 END
1901 ;
1902 foreach my $country (sort keys %{Countries::countries}) {
1903 print "<option value='$Countries::countries{$country}'";
1904 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1905 print " selected='selected'";
1906 }
1907 print ">$country</option>";
1908 }
1909 print <<END;
1910 </select></td>
1911 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
1912 <td class='base'><select name='DHLENGHT'>
1913 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1914 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1915 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1916 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1917 </select>
1918 </td>
1919 </tr>
1920
1921 <tr><td>&nbsp;</td>
1922 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1923 <td>&nbsp;</td><td>&nbsp;</td></tr>
1924 <tr><td class='base' colspan='4' align='left'>
1925 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1926 <tr><td colspan='2'><br></td></tr>
1927 <table width='100%'>
1928 <tr>
1929 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
1930 <td class='base'>$Lang::tr{'dh key warn'}</td>
1931 </tr>
1932 <tr>
1933 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1934 </tr>
1935 <tr><td colspan='2'><br></td></tr>
1936 <tr>
1937 </table>
1938
1939 <table width='100%'>
1940 <tr><td colspan='4'><hr></td></tr>
1941 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1942 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1943 <td colspan='2'>&nbsp;</td></tr>
1944 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1945 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1946 <td colspan='2'>&nbsp;</td></tr>
1947 <tr><td>&nbsp;</td>
1948 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1949 <td colspan='2'>&nbsp;</td></tr>
1950 <tr><td class='base' colspan='4' align='left'>
1951 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td>
1952 </tr>
1953 </form></table>
1954 END
1955 ;
1956 &Header::closebox();
1957 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1958 &Header::closebigbox();
1959 &Header::closepage();
1960 exit(0)
1961 }
1962
1963 ROOTCERT_SUCCESS:
1964 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1965 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1966 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1967 # system('/usr/local/bin/ipsecctrl', 'S');
1968 # }
1969
1970 ###
1971 ### Enable/Disable connection
1972 ###
1973
1974 ###
1975 # m.a.d net2net
1976 ###
1977
1978 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1979
1980 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1981 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1982 # my $n2nactive = '';
1983 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1984
1985 if ($confighash{$cgiparams{'KEY'}}) {
1986 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1987 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1988 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1989
1990 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1991 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1992 }
1993 } else {
1994
1995 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1996 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1997
1998 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1999 if ($n2nactive ne ''){
2000 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
2001 }
2002
2003 } else {
2004 $errormessage = $Lang::tr{'invalid key'};
2005 }
2006 }
2007 }
2008
2009 ###
2010 ### Download OpenVPN client package
2011 ###
2012
2013
2014 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2015 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2016 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2017 my $file = '';
2018 my $clientovpn = '';
2019 my @fileholder;
2020 my $tempdir = tempdir( CLEANUP => 1 );
2021 my $zippath = "$tempdir/";
2022
2023 ###
2024 # m.a.d net2net
2025 ###
2026
2027 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2028
2029 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2030 my $zippathname = "$zippath$zipname";
2031 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2032 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
2033 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
2034 my $tunmtu = '';
2035 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
2036 my $n2nfragment = '';
2037
2038 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2039 flock CLIENTCONF, 2;
2040
2041 my $zip = Archive::Zip->new();
2042 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2043 print CLIENTCONF "# \n";
2044 print CLIENTCONF "# User Security\n";
2045 print CLIENTCONF "user nobody\n";
2046 print CLIENTCONF "group nobody\n";
2047 print CLIENTCONF "persist-tun\n";
2048 print CLIENTCONF "persist-key\n";
2049 print CLIENTCONF "script-security 2\n";
2050 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2051 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2052 print CLIENTCONF "float\n";
2053 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2054 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2055 print CLIENTCONF "# Server Gateway Network\n";
2056 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2057 print CLIENTCONF "# tun Device\n";
2058 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
2059 print CLIENTCONF "# Port and Protokoll\n";
2060 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2061
2062 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2063 print CLIENTCONF "proto tcp-client\n";
2064 print CLIENTCONF "# Packet size\n";
2065 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2066 print CLIENTCONF "tun-mtu $tunmtu\n";
2067 }
2068
2069 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2070 print CLIENTCONF "proto udp\n";
2071 print CLIENTCONF "# Paketsize\n";
2072 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2073 print CLIENTCONF "tun-mtu $tunmtu\n";
2074 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2075 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
2076 }
2077 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2078 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2079 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2080 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2081 if ($tunmtu eq '1500' ) {
2082 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2083 }
2084 }
2085 }
2086 print CLIENTCONF "ns-cert-type server\n";
2087 print CLIENTCONF "# Auth. Client\n";
2088 print CLIENTCONF "tls-client\n";
2089 print CLIENTCONF "# Cipher\n";
2090 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2091 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2092 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2093 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2094 }
2095 if ($confighash{$cgiparams{'KEY'}}[39] eq '') {
2096 print CLIENTCONF "# HMAC algorithm\n";
2097 print CLIENTCONF "auth SHA1\n";
2098 } else {
2099 print CLIENTCONF "# HMAC algorithm\n";
2100 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2101 }
2102 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2103 print CLIENTCONF "# Enable Compression\n";
2104 print CLIENTCONF "comp-lzo\n";
2105 }
2106 print CLIENTCONF "# Debug Level\n";
2107 print CLIENTCONF "verb 3\n";
2108 print CLIENTCONF "# Tunnel check\n";
2109 print CLIENTCONF "keepalive 10 60\n";
2110 print CLIENTCONF "# Start as daemon\n";
2111 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2112 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2113 print CLIENTCONF "# Activate Management Interface and Port\n";
2114 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2115 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2116 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2117
2118
2119 close(CLIENTCONF);
2120
2121 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2122 my $status = $zip->writeToFileNamed($zippathname);
2123
2124 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2125 @fileholder = <DLFILE>;
2126 print "Content-Type:application/x-download\n";
2127 print "Content-Disposition:attachment;filename=$zipname\n\n";
2128 print @fileholder;
2129 exit (0);
2130 }
2131 else
2132 {
2133 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2134 my $zippathname = "$zippath$zipname";
2135 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2136
2137 ###
2138 # m.a.d net2net
2139 ###
2140
2141 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2142 flock CLIENTCONF, 2;
2143
2144 my $zip = Archive::Zip->new();
2145
2146 print CLIENTCONF "#OpenVPN Client conf\r\n";
2147 print CLIENTCONF "tls-client\r\n";
2148 print CLIENTCONF "client\r\n";
2149 print CLIENTCONF "nobind\r\n";
2150 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2151 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2152
2153 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2154 # or use configured value.
2155 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2156 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2157 elsif ($vpnsettings{MSSFIX} eq 'on')
2158 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2159 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2160 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2161 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2162 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2163 else
2164 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2165
2166 if ( $vpnsettings{'ENABLED'} eq 'on'){
2167 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2168 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2169 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2170 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2171 }
2172 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2173 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2174 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2175 }
2176 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2177 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2178 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2179 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2180 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2181 }
2182 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2183 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2184 }
2185
2186 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2187 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2188 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2189 } else {
2190 print CLIENTCONF "ca cacert.pem\r\n";
2191 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2192 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2193 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2194 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2195 }
2196 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2197 if ($vpnsettings{'DAUTH'} eq '') {
2198 print CLIENTCONF "";
2199 } else {
2200 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2201 }
2202 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2203 print CLIENTCONF "tls-auth ta.key\r\n";
2204 $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n";
2205 }
2206 if ($vpnsettings{DCOMPLZO} eq 'on') {
2207 print CLIENTCONF "comp-lzo\r\n";
2208 }
2209 print CLIENTCONF "verb 3\r\n";
2210 print CLIENTCONF "ns-cert-type server\r\n";
2211 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2212 if ($vpnsettings{MSSFIX} eq 'on') {
2213 print CLIENTCONF "mssfix\r\n";
2214 }
2215 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2216 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2217 }
2218
2219 # Check if a valid operating mode has been choosen and use it.
2220 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2221 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2222 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2223 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2224 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2225 }
2226 }
2227 close(CLIENTCONF);
2228
2229 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2230 my $status = $zip->writeToFileNamed($zippathname);
2231
2232 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2233 @fileholder = <DLFILE>;
2234 print "Content-Type:application/x-download\n";
2235 print "Content-Disposition:attachment;filename=$zipname\n\n";
2236 print @fileholder;
2237 exit (0);
2238 }
2239
2240
2241
2242 ###
2243 ### Remove connection
2244 ###
2245
2246
2247 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2248 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2249 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2250
2251 if ($confighash{$cgiparams{'KEY'}}) {
2252 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2253 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2254 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2255 # }
2256 #
2257 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2258
2259 ###
2260 # m.a.d net2net
2261 ###
2262
2263 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2264 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2265 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2266 unlink ($certfile);
2267 unlink ($conffile);
2268
2269 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2270 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2271 }
2272 }
2273
2274 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2275 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2276
2277 # A.Marx CCD delete ccd files and routes
2278
2279
2280 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2281 {
2282 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2283 }
2284
2285 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2286 foreach my $key (keys %ccdroutehash) {
2287 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2288 delete $ccdroutehash{$key};
2289 }
2290 }
2291 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2292
2293 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2294 foreach my $key (keys %ccdroute2hash) {
2295 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2296 delete $ccdroute2hash{$key};
2297 }
2298 }
2299 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2300 &writeserverconf;
2301
2302
2303 # CCD end
2304
2305
2306 delete $confighash{$cgiparams{'KEY'}};
2307 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2308 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2309
2310 #&writeserverconf();
2311 } else {
2312 $errormessage = $Lang::tr{'invalid key'};
2313 }
2314 &General::firewall_reload();
2315
2316 ###
2317 ### Download PKCS12 file
2318 ###
2319 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2320 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2321
2322 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2323 print "Content-Type: application/octet-stream\r\n\r\n";
2324 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2325 exit (0);
2326
2327 ###
2328 ### Display certificate
2329 ###
2330 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2331 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2332
2333 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2334 &Header::showhttpheaders();
2335 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2336 &Header::openbigbox('100%', 'LEFT', '', '');
2337 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2338 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2339 $output = &Header::cleanhtml($output,"y");
2340 print "<pre>$output</pre>\n";
2341 &Header::closebox();
2342 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2343 &Header::closebigbox();
2344 &Header::closepage();
2345 exit(0);
2346 }
2347
2348 ###
2349 ### Display Diffie-Hellman key
2350 ###
2351 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2352
2353 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
2354 $errormessage = $Lang::tr{'not present'};
2355 } else {
2356 &Header::showhttpheaders();
2357 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2358 &Header::openbigbox('100%', 'LEFT', '', '');
2359 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2360 my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
2361 $output = &Header::cleanhtml($output,"y");
2362 print "<pre>$output</pre>\n";
2363 &Header::closebox();
2364 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2365 &Header::closebigbox();
2366 &Header::closepage();
2367 exit(0);
2368 }
2369
2370 ###
2371 ### Display tls-auth key
2372 ###
2373 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-auth key'}) {
2374
2375 if (! -e "${General::swroot}/ovpn/certs/ta.key") {
2376 $errormessage = $Lang::tr{'not present'};
2377 } else {
2378 &Header::showhttpheaders();
2379 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2380 &Header::openbigbox('100%', 'LEFT', '', '');
2381 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ta key'}:");
2382 my $output = `/bin/cat ${General::swroot}/ovpn/certs/ta.key`;
2383 $output = &Header::cleanhtml($output,"y");
2384 print "<pre>$output</pre>\n";
2385 &Header::closebox();
2386 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2387 &Header::closebigbox();
2388 &Header::closepage();
2389 exit(0);
2390 }
2391
2392 ###
2393 ### Display Certificate Revoke List
2394 ###
2395 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2396 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2397
2398 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2399 $errormessage = $Lang::tr{'not present'};
2400 } else {
2401 &Header::showhttpheaders();
2402 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2403 &Header::openbigbox('100%', 'LEFT', '', '');
2404 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2405 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2406 $output = &Header::cleanhtml($output,"y");
2407 print "<pre>$output</pre>\n";
2408 &Header::closebox();
2409 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2410 &Header::closebigbox();
2411 &Header::closepage();
2412 exit(0);
2413 }
2414
2415 ###
2416 ### Advanced Server Settings
2417 ###
2418
2419 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2420 %cgiparams = ();
2421 %cahash = ();
2422 %confighash = ();
2423 my $disabled;
2424 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2425 read_routepushfile;
2426
2427
2428 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2429 # $cgiparams{'CLIENT2CLIENT'} = 'on';
2430 # }
2431 ADV_ERROR:
2432 if ($cgiparams{'MAX_CLIENTS'} eq '') {
2433 $cgiparams{'MAX_CLIENTS'} = '100';
2434 }
2435 if ($cgiparams{'KEEPALIVE_1'} eq '') {
2436 $cgiparams{'KEEPALIVE_1'} = '10';
2437 }
2438 if ($cgiparams{'KEEPALIVE_2'} eq '') {
2439 $cgiparams{'KEEPALIVE_2'} = '60';
2440 }
2441 if ($cgiparams{'LOG_VERB'} eq '') {
2442 $cgiparams{'LOG_VERB'} = '3';
2443 }
2444 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
2445 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2446 }
2447 if ($cgiparams{'DAUTH'} eq '') {
2448 $cgiparams{'DAUTH'} = 'SHA1';
2449 }
2450 if ($cgiparams{'TLSAUTH'} eq '') {
2451 $cgiparams{'TLSAUTH'} = 'off';
2452 }
2453 $checked{'CLIENT2CLIENT'}{'off'} = '';
2454 $checked{'CLIENT2CLIENT'}{'on'} = '';
2455 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2456 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2457 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2458 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2459 $checked{'MSSFIX'}{'off'} = '';
2460 $checked{'MSSFIX'}{'on'} = '';
2461 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2462 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
2463 $selected{'LOG_VERB'}{'0'} = '';
2464 $selected{'LOG_VERB'}{'1'} = '';
2465 $selected{'LOG_VERB'}{'2'} = '';
2466 $selected{'LOG_VERB'}{'3'} = '';
2467 $selected{'LOG_VERB'}{'4'} = '';
2468 $selected{'LOG_VERB'}{'5'} = '';
2469 $selected{'LOG_VERB'}{'6'} = '';
2470 $selected{'LOG_VERB'}{'7'} = '';
2471 $selected{'LOG_VERB'}{'8'} = '';
2472 $selected{'LOG_VERB'}{'9'} = '';
2473 $selected{'LOG_VERB'}{'10'} = '';
2474 $selected{'LOG_VERB'}{'11'} = '';
2475 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2476 $selected{'DAUTH'}{'whirlpool'} = '';
2477 $selected{'DAUTH'}{'SHA512'} = '';
2478 $selected{'DAUTH'}{'SHA384'} = '';
2479 $selected{'DAUTH'}{'SHA256'} = '';
2480 $selected{'DAUTH'}{'SHA1'} = '';
2481 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
2482 $checked{'TLSAUTH'}{'off'} = '';
2483 $checked{'TLSAUTH'}{'on'} = '';
2484 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
2485
2486 &Header::showhttpheaders();
2487 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2488 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2489 if ($errormessage) {
2490 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2491 print "<class name='base'>$errormessage\n";
2492 print "&nbsp;</class>\n";
2493 &Header::closebox();
2494 }
2495 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2496 print <<END;
2497 <form method='post' enctype='multipart/form-data'>
2498 <table width='100%' border=0>
2499 <tr>
2500 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2501 </tr>
2502 <tr>
2503 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2504 </tr>
2505 <tr>
2506 <td class='base'>Domain</td>
2507 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
2508 </tr>
2509 <tr>
2510 <td class='base'>DNS</td>
2511 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2512 </tr>
2513 <tr>
2514 <td class='base'>WINS</td>
2515 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2516 </tr>
2517 <tr>
2518 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2519 </tr>
2520 <tr>
2521 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2522 <td colspan='2'>
2523 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2524 END
2525 ;
2526
2527 if ($cgiparams{'ROUTES_PUSH'} ne '')
2528 {
2529 print $cgiparams{'ROUTES_PUSH'};
2530 }
2531
2532 print <<END;
2533 </textarea></td>
2534 </tr>
2535 </tr>
2536 </table>
2537 <hr size='1'>
2538 <table width='100%'>
2539 <tr>
2540 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2541 </tr>
2542 <tr>
2543 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>