html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/countries.pl";
  37
  38 # enable only the following on debugging purpose
  39 #use warnings;
  40 #use CGI::Carp 'fatalsToBrowser';
  41 #workaround to suppress a warning when a variable is used only once
  42 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
  43 undef (@dummy);
  44
  45 my %color = ();
  46 my %mainsettings = ();
  47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  49
  50 ###
  51 ### Initialize variables
  52 ###
  53 my %netsettings=();
  54 my %cgiparams=();
  55 my %vpnsettings=();
  56 my %checked=();
  57 my %confighash=();
  58 my %cahash=();
  59 my %selected=();
  60 my $warnmessage = '';
  61 my $errormessage = '';
  62 my %settings=();
  63 my $routes_push_file = '';
  64 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  65 $cgiparams{'ENABLED'} = 'off';
  66 $cgiparams{'ENABLED_BLUE'} = 'off';
  67 $cgiparams{'ENABLED_ORANGE'} = 'off';
  68 $cgiparams{'EDIT_ADVANCED'} = 'off';
  69 $cgiparams{'NAT'} = 'off';
  70 $cgiparams{'COMPRESSION'} = 'off';
  71 $cgiparams{'ONLY_PROPOSED'} = 'off';
  72 $cgiparams{'ACTION'} = '';
  73 $cgiparams{'CA_NAME'} = '';
  74 $cgiparams{'DHCP_DOMAIN'} = '';
  75 $cgiparams{'DHCP_DNS'} = '';
  76 $cgiparams{'DHCP_WINS'} = '';
  77 $cgiparams{'ROUTES_PUSH'} = '';
  78 $cgiparams{'DCOMPLZO'} = 'off';
  79 $cgiparams{'MSSFIX'} = '';
  80 $cgiparams{'number'} = '';
  81 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  82 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  83 unless (-e "${General::swroot}/ovpn/ccd.conf")    { system("touch ${General::swroot}/ovpn/ccd.conf"); }
  84 unless (-e "${General::swroot}/ovpn/ccdroute")    { system("touch ${General::swroot}/ovpn/ccdroute"); }
  85 unless (-e "${General::swroot}/ovpn/ccdroute2")    { system("touch ${General::swroot}/ovpn/ccdroute2"); }
  86
  87 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  88
  89 # prepare openvpn config file
  90 ###
  91 ### Useful functions
  92 ###
  93 sub haveOrangeNet
  94 {
  95         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
  96         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
  97         return 0;
  98 }
  99
 100 sub haveBlueNet
 101 {
 102         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
 103         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 104         return 0;
 105 }
 106
 107 sub sizeformat{
 108     my $bytesize = shift;
 109     my $i = 0;
 110
 111     while(abs($bytesize) >= 1024){
 112         $bytesize=$bytesize/1024;
 113         $i++;
 114         last if($i==6);
 115     }
 116
 117     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 118     my $newsize=(int($bytesize*100 +0.5))/100;
 119     return("$newsize $units[$i]");
 120 }
 121
 122 sub valid_dns_host {
 123         my $hostname = $_[0];
 124         unless ($hostname) { return "No hostname"};
 125         my $res = new Net::DNS::Resolver;
 126         my $query = $res->search("$hostname");
 127         if ($query) {
 128                 foreach my $rr ($query->answer) {
 129                         ## Potential bug - we are only looking at A records:
 130                         return 0 if $rr->type eq "A";
 131                 }
 132         } else {
 133                 return $res->errorstring;
 134         }
 135 }
 136
 137 sub cleanssldatabase
 138 {
 139     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 140         print FILE "01";
 141         close FILE;
 142     }
 143     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 144         print FILE "";
 145         close FILE;
 146     }
 147     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 148     unlink ("${General::swroot}/ovpn/certs/serial.old");
 149     unlink ("${General::swroot}/ovpn/certs/01.pem");
 150 }
 151
 152 sub newcleanssldatabase
 153 {
 154     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 155         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 156         print FILE "01";
 157         close FILE;
 158     }
 159     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 160         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 161     }
 162     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 163     unlink ("${General::swroot}/ovpn/certs/serial.old");
 164 }
 165
 166 sub deletebackupcert
 167 {
 168         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 169                 my $hexvalue = <FILE>;
 170                 chomp $hexvalue;
 171                 close FILE;
 172                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 173         }
 174 }
 175
 176 sub checkportfw {
 177     my $KEY2 = $_[0]; # key2
 178     my $SRC_PORT = $_[1]; # src_port
 179     my $PROTOCOL = $_[2]; # protocol
 180     my $SRC_IP = $_[3]; # sourceip
 181
 182     my $pfwfilename = "${General::swroot}/portfw/config";
 183     open(FILE, $pfwfilename) or die 'Unable to open config file.';
 184     my @pfwcurrent = <FILE>;
 185     close(FILE);
 186     my $pfwkey1 = 0; # used for finding last sequence number used
 187     foreach my $pfwline (@pfwcurrent)
 188     {
 189         my @pfwtemp = split(/\,/,$pfwline);
 190
 191         chomp ($pfwtemp[8]);
 192         if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
 193                 if ( $SRC_PORT eq $pfwtemp[3] &&
 194                         $PROTOCOL eq $pfwtemp[2] &&
 195                         $SRC_IP eq $pfwtemp[7])
 196                 {
 197                          $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
 198                 }
 199                 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
 200                 if ( $pfwtemp[1] eq "0") {
 201                         $pfwkey1=$pfwtemp[0];
 202                 }
 203                 # Darren Critchley - Duplicate or overlapping Port range check
 204                 if ($pfwtemp[1] eq "0" &&
 205                         $PROTOCOL eq $pfwtemp[2] &&
 206                         $SRC_IP eq $pfwtemp[7] &&
 207                         $errormessage eq '')
 208                 {
 209                         &portchecks($SRC_PORT, $pfwtemp[5]);
 210 #                       &portchecks($pfwtemp[3], $pfwtemp[5]);
 211 #                       &portchecks($pfwtemp[3], $SRC_IP);
 212                 }
 213         }
 214     }
 215 #    $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
 216
 217     return;
 218 }
 219
 220 sub checkportoverlap
 221 {
 222         my $portrange1 = $_[0]; # New port range
 223         my $portrange2 = $_[1]; # existing port range
 224         my @tempr1 = split(/\:/,$portrange1);
 225         my @tempr2 = split(/\:/,$portrange2);
 226
 227         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 228         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 229
 230         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 231         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 232
 233         return 1; # Everything checks out!
 234 }
 235
 236 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 237 sub checkportinc
 238 {
 239         my $port1 = $_[0]; # Port
 240         my $portrange2 = $_[1]; # Port range
 241         my @tempr1 = split(/\:/,$portrange2);
 242
 243         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 244                 return 1;
 245         } else {
 246                 return 0;
 247         }
 248 }
 249 # Darren Critchley - Duplicate or overlapping Port range check
 250 sub portchecks
 251 {
 252         my $p1 = $_[0]; # New port range
 253         my $p2 = $_[1]; # existing port range
 254 #       $_ = $_[0];
 255         our ($prtrange1, $prtrange2);
 256         $prtrange1 = 0;
 257 #       if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
 258 #               unless (&checkportoverlap($p1,$p2)) {
 259 #                       $errormessage = "$Lang::tr{'source port overlaps'} $p1";
 260 #               }
 261 #       }
 262         if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
 263                 unless (&checkportinc($p2,$p1)) {
 264                         $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
 265                 }
 266         }
 267         $prtrange1 = 1;
 268         if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
 269                 unless (&checkportinc($p1,$p2)) {
 270                         $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
 271                 }
 272         }
 273         return;
 274 }
 275
 276 # Darren Critchley - certain ports are reserved for IPFire
 277 # TCP 67,68,81,222,445
 278 # UDP 67,68
 279 # Params passed in -> port, rangeyn, protocol
 280 sub disallowreserved
 281 {
 282         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 283         my $msg = "";
 284         my @tcp_reserved = (81,222,445);
 285         my $prt = $_[0]; # the port or range
 286         my $ryn = $_[1]; # tells us whether or not it is a port range
 287         my $prot = $_[2]; # protocol
 288         my $srcdst = $_[3]; # source or destination
 289         if ($ryn) { # disect port range
 290                 if ($srcdst eq "src") {
 291                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 292                 } else {
 293                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 294                 }
 295                 my @tmprng = split(/\:/,$prt);
 296                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 297                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 298                 if ($prot eq "tcp") {
 299                         foreach my $prange (@tcp_reserved) {
 300                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 301                         }
 302                 }
 303         } else {
 304                 if ($srcdst eq "src") {
 305                         $msg = "$Lang::tr{'reserved src port'}";
 306                 } else {
 307                         $msg = "$Lang::tr{'reserved dst port'}";
 308                 }
 309                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 310                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 311                 if ($prot eq "tcp") {
 312                         foreach my $prange (@tcp_reserved) {
 313                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 314                         }
 315                 }
 316         }
 317         return;
 318 }
 319
 320
 321 sub writeserverconf {
 322     my %sovpnsettings = ();
 323     my @temp = ();
 324     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 325     &read_routepushfile;
 326
 327     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 328     flock CONF, 2;
 329     print CONF "#OpenVPN Server conf\n";
 330     print CONF "\n";
 331     print CONF "daemon openvpnserver\n";
 332     print CONF "writepid /var/run/openvpn.pid\n";
 333     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 334     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 335     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 336     print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
 337     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 338     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 339     print CONF "script-security 3 system\n";
 340     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 341     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 342     print CONF "tls-server\n";
 343     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 344     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 345     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 346     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 347     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 348     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 349     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 350
 351     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 352                 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 353                 foreach (@temp)
 354                 {
 355                         @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 356                         print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 357                 }
 358         }
 359 # a.marx ccd
 360         my %ccdconfhash=();
 361         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 362         foreach my $key (keys %ccdconfhash) {
 363                 my $a=$ccdconfhash{$key}[1];
 364                 my ($b,$c) = split (/\//, $a);
 365                 print CONF "route $b ".&General::cidrtosub($c)."\n";
 366         }
 367         my %ccdroutehash=();
 368         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 369         foreach my $key (keys %ccdroutehash) {
 370                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
 371                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
 372                         print CONF "route $a $b\n";
 373                 }
 374         }
 375 # ccd end
 376
 377         if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 378         print CONF "client-to-client\n";
 379     }
 380     if ($sovpnsettings{MSSFIX} eq 'on') {
 381         print CONF "mssfix\n";
 382     }
 383     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 384         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 385     }
 386     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 387         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 388     }
 389     print CONF "status-version 1\n";
 390     print CONF "status /var/log/ovpnserver.log 30\n";
 391     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 392     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 393         print CONF "comp-lzo\n";
 394     }
 395     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 396         print CONF "push \"redirect-gateway def1\"\n";
 397     }
 398     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 399         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 400     }
 401
 402     if ($sovpnsettings{DHCP_DNS} ne '') {
 403         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 404     }
 405
 406     if ($sovpnsettings{DHCP_WINS} ne '') {
 407         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 408     }
 409
 410     if ($sovpnsettings{DHCP_WINS} eq '') {
 411         print CONF "max-clients 100\n";
 412     }
 413     if ($sovpnsettings{DHCP_WINS} ne '') {
 414         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 415     }
 416     print CONF "tls-verify /var/ipfire/ovpn/verify\n";
 417     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 418     print CONF "user nobody\n";
 419     print CONF "group nobody\n";
 420     print CONF "persist-key\n";
 421     print CONF "persist-tun\n";
 422         if ($sovpnsettings{LOG_VERB} ne '') {
 423                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 424         } else {
 425                 print CONF "verb 3\n";
 426         }
 427     print CONF "\n";
 428
 429     close(CONF);
 430 }
 431
 432 sub emptyserverlog{
 433     if (open(FILE, ">/var/log/ovpnserver.log")) {
 434         flock FILE, 2;
 435         print FILE "";
 436         close FILE;
 437     }
 438
 439 }
 440
 441 sub delccdnet
 442 {
 443         my %ccdconfhash = ();
 444         my %ccdhash = ();
 445         my $ccdnetname=$_[0];
 446         if (-f "${General::swroot}/ovpn/ovpnconfig"){
 447                 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 448                 foreach my $key (keys %ccdhash) {
 449                         if ($ccdhash{$key}[32] eq $ccdnetname) {
 450                                 $errormessage=$Lang::tr{'ccd err hostinnet'};
 451                                 return;
 452                         }
 453                 }
 454         }
 455         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 456         foreach my $key (keys %ccdconfhash) {
 457                         if ($ccdconfhash{$key}[0] eq $ccdnetname){
 458                                 delete $ccdconfhash{$key};
 459                         }
 460         }
 461         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 462
 463         &writeserverconf;
 464         return 0;
 465 }
 466
 467 sub addccdnet
 468 {
 469         my %ccdconfhash=();
 470         my @ccdconf=();
 471         my $ccdname=$_[0];
 472         my $ccdnet=$_[1];
 473         my $ovpnsubnet=$_[2];
 474         my $subcidr;
 475         my @ip2=();
 476         my $checkup;
 477         my $ccdip;
 478         my $baseaddress;
 479         if(!&General::validhostname($ccdname)){
 480                 $errormessage=$Lang::tr{'ccd err invalidname'};
 481                 return;
 482         }
 483         #check ip
 484         if (&General::validipandmask($ccdnet)){
 485                         $ccdnet=&General::iporsubtocidr($ccdnet);
 486         }else{
 487                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 488                 return;
 489         }
 490         ($ccdip,$subcidr) = split (/\//,$ccdnet);
 491         if ($ccdname eq '') {
 492                 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
 493         }
 494         #check if we try to use same network as ovpn server
 495         if (&General::iporsubtocidr($ccdnet) eq &General::iporsubtocidr($ovpnsubnet)) {
 496                         $errormessage=$errormessage.$Lang::tr{'ccd err isovpnnet'}."<br>";
 497         }
 498
 499         #check if we use a name/subnet that already exists
 500         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 501         foreach my $key (keys %ccdconfhash) {
 502                         @ccdconf=split(/\//,$ccdconfhash{$key}[1]);
 503                         if ($ccdname eq $ccdconfhash{$key}[0]) {$errormessage=$errormessage.$Lang::tr{'ccd err nameexist'}."<br>";}
 504                         my ($newip,$newsub) = split(/\//,$ccdnet);
 505                         if (&General::IpInSubnet($newip,$ccdconf[0],&General::iporsubtodec($ccdconf[1]))) {$errormessage=$errormessage.$Lang::tr{'ccd err issubnet'}."<br>";}
 506
 507         }
 508         #check if we use one of ipfire's networks (green,orange,blue)
 509         my %ownnet=();
 510         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
 511         if (($ownnet{'GREEN_NETADDRESS'}        ne '' && $ownnet{'GREEN_NETADDRESS'}    ne '0.0.0.0') && &General::IpInSubnet($ownnet{'GREEN_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err green'};}
 512         if (($ownnet{'ORANGE_NETADDRESS'}       ne '' && $ownnet{'ORANGE_NETADDRESS'}   ne '0.0.0.0') && &General::IpInSubnet($ownnet{'ORANGE_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err orange'};}
 513         if (($ownnet{'BLUE_NETADDRESS'}         ne '' && $ownnet{'BLUE_NETADDRESS'}     ne '0.0.0.0') && &General::IpInSubnet($ownnet{'BLUE_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err blue'};}
 514         if (($ownnet{'RED_NETADDRESS'}  ne '' && $ownnet{'RED_NETADDRESS'}      ne '0.0.0.0') && &General::IpInSubnet($ownnet{'RED_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err red'};}
 515
 516
 517         if (!$errormessage) {
 518                 my %ccdconfhash=();
 519                 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
 520                 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 521                 my $key = &General::findhasharraykey (\%ccdconfhash);
 522                 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
 523                 $ccdconfhash{$key}[0] = $ccdname;
 524                 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
 525                 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 526                 &writeserverconf;
 527                 $cgiparams{'ccdname'}='';
 528                 $cgiparams{'ccdsubnet'}='';
 529                 return 1;
 530         }
 531 }
 532
 533 sub modccdnet
 534 {
 535
 536         my $newname=$_[0];
 537         my $oldname=$_[1];
 538         my %ccdconfhash=();
 539         my %ccdhash=();
 540         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 541         foreach my $key (keys %ccdconfhash) {
 542                 if ($ccdconfhash{$key}[0] eq $oldname) {
 543                         foreach my $key1 (keys %ccdconfhash) {
 544                                 if ($ccdconfhash{$key1}[0] eq $newname){
 545                                         $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
 546                                         return;
 547                                 }else{
 548                                         $ccdconfhash{$key}[0]= $newname;
 549                                         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 550                                         last;
 551                                 }
 552                         }
 553                 }
 554         }
 555
 556         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 557                 foreach my $key (keys %ccdhash) {
 558                         if ($ccdhash{$key}[32] eq $oldname) {
 559                                 $ccdhash{$key}[32]=$newname;
 560                                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 561                                 last;
 562                         }
 563                 }
 564
 565         return 0;
 566 }
 567 sub ccdmaxclients
 568 {
 569         my $ccdnetwork=$_[0];
 570         my @octets=();
 571         my @subnet=();
 572         @octets=split("\/",$ccdnetwork);
 573         @subnet= split /\./, &General::cidrtosub($octets[1]);
 574         my ($a,$b,$c,$d,$e);
 575         $a=256-$subnet[0];
 576         $b=256-$subnet[1];
 577         $c=256-$subnet[2];
 578         $d=256-$subnet[3];
 579         $e=($a*$b*$c*$d)/4;
 580         return $e-1;
 581 }
 582
 583 sub getccdadresses
 584 {
 585         my $ipin=$_[0];
 586         my ($ip1,$ip2,$ip3,$ip4)=split  /\./, $ipin;
 587         my $cidr=$_[1];
 588         chomp($cidr);
 589         my $count=$_[2];
 590         my $hasip=$_[3];
 591         chomp($hasip);
 592         my @iprange=();
 593         my %ccdhash=();
 594         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 595         $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
 596         for (my $i=0;$i<=$count-1;$i++) {
 597                 my $tmpip=$iprange[$i-1];
 598                 my $stepper=$i*4;
 599                 $iprange[$i]= &General::getnextip($tmpip,4);
 600         }
 601         my $r=0;
 602         foreach my $key (keys %ccdhash) {
 603                 $r=0;
 604                 foreach  my $tmp (@iprange){
 605                         my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
 606                         if ($net eq $tmp) {
 607                                 if ( $hasip ne  $ccdhash{$key}[33] ){
 608                                         splice (@iprange,$r,1);
 609                                 }
 610                         }
 611                         $r++;
 612                 }
 613         }
 614         return @iprange;
 615 }
 616
 617 sub fillselectbox
 618 {
 619         my $boxname=$_[1];
 620         my ($ccdip,$subcidr) = split("/",$_[0]);
 621         my $tz=$_[2];
 622         my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
 623         print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
 624         foreach (@allccdips) {
 625                 my $ip=$_."/30";
 626                 chomp($ip);
 627                 print "<option value='$ip' ";
 628                 if ( $ip eq $cgiparams{$boxname} ){
 629                         print"selected";
 630                 }
 631                 print ">$ip</option>";
 632         }
 633         print "</select>";
 634 }
 635
 636 sub hostsinnet
 637 {
 638         my $name=$_[0];
 639         my %ccdhash=();
 640         my $i=0;
 641         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 642         foreach my $key (keys %ccdhash) {
 643                 if ($ccdhash{$key}[32] eq $name){ $i++;}
 644         }
 645         return $i;
 646 }
 647
 648 sub check_routes_push
 649 {
 650                         my $val=$_[0];
 651                         my ($ip,$cidr) = split (/\//, $val);
 652                         ##check for existing routes in routes_push
 653                         if (-e "${General::swroot}/ovpn/routes_push") {
 654                                 open(FILE,"${General::swroot}/ovpn/routes_push");
 655                                 while (<FILE>) {
 656                                         $_=~s/\s*$//g;
 657
 658                                         my ($ip2,$cidr2) = split (/\//,"$_");
 659                                         my $val2=$ip2."/".&General::iporsubtodec($cidr2);
 660
 661                                         if($val eq $val2){
 662                                                 return 0;
 663                                         }
 664                                         #subnetcheck
 665                                         if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
 666                                                 return 0;
 667                                         }
 668                                 };
 669                                 close(FILE);
 670                         }
 671         return 1;
 672 }
 673
 674 sub check_ccdroute
 675 {
 676         my %ccdroutehash=();
 677         my $val=$_[0];
 678         my ($ip,$cidr) = split (/\//, $val);
 679         #check for existing routes in ccdroute
 680         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 681         foreach my $key (keys %ccdroutehash) {
 682                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 683                         if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
 684                                 return 0;
 685                         }
 686                         my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
 687                         #subnetcheck
 688                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
 689                                 return 0;
 690                         }
 691                 }
 692         }
 693         return 1;
 694 }
 695 sub check_ccdconf
 696 {
 697         my %ccdconfhash=();
 698         my $val=$_[0];
 699         my ($ip,$cidr) = split (/\//, $val);
 700         #check for existing routes in ccdroute
 701         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 702         foreach my $key (keys %ccdconfhash) {
 703                 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
 704                                 return 0;
 705                         }
 706                         my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
 707                         #subnetcheck
 708                         if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
 709                                 return 0;
 710                         }
 711
 712         }
 713         return 1;
 714 }
 715
 716 ###
 717 # m.a.d net2net
 718 ###
 719
 720 sub validdotmask
 721 {
 722         my $ipdotmask = $_[0];
 723         if (&General::validip($ipdotmask)) { return 0; }
 724         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 725         my $mask = $2;
 726         if (($mask =~ /\./ )) { return 0; }
 727   return 1;
 728 }
 729
 730 # -------------------------------------------------------------------
 731
 732 sub write_routepushfile
 733 {
 734         open(FILE, ">$routes_push_file");
 735         flock(FILE, 2);
 736         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 737                 print FILE $vpnsettings{'ROUTES_PUSH'};
 738         }
 739         close(FILE);
 740 }
 741
 742 sub read_routepushfile
 743 {
 744         if (-e "$routes_push_file") {
 745                 open(FILE,"$routes_push_file");
 746                 delete $vpnsettings{'ROUTES_PUSH'};
 747                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 748                 close(FILE);
 749                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 750
 751         }
 752 }
 753
 754
 755 #hier die refresh page
 756 if ( -e "${General::swroot}/ovpn/gencanow") {
 757     my $refresh = '';
 758     $refresh = "<meta http-equiv='refresh' content='15;' />";
 759     &Header::showhttpheaders();
 760     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 761     &Header::openbigbox('100%', 'center');
 762     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 763     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 764     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 765     &Header::closebox();
 766     &Header::closebigbox();
 767     &Header::closepage();
 768     exit (0);
 769 }
 770 ##hier die refresh page
 771
 772
 773 ###
 774 ### OpenVPN Server Control
 775 ###
 776 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 777     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 778     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 779     #start openvpn server
 780     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 781         &emptyserverlog();
 782         system('/usr/local/bin/openvpnctrl', '-s');
 783     }
 784     #stop openvpn server
 785     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 786         system('/usr/local/bin/openvpnctrl', '-k');
 787         &emptyserverlog();
 788     }
 789 #    #restart openvpn server
 790 #    if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 791 #workarund, till SIGHUP also works when running as nobody
 792 #       system('/usr/local/bin/openvpnctrl', '-r');
 793 #       &emptyserverlog();
 794 #    }
 795 }
 796
 797 ###
 798 ### Save Advanced options
 799 ###
 800
 801 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 802     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 803     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 804     #DAN this value has to leave.
 805 #new settings for daemon
 806     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 807     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 808     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 809     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 810     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 811     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 812     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 813     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 814     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 815     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 816     my @temp=();
 817
 818     if ($cgiparams{'FRAGMENT'} eq '') {
 819         delete $vpnsettings{'FRAGMENT'};
 820     } else {
 821         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 822             $errormessage = "Incorrect value, please insert only numbers.";
 823         goto ADV_ERROR;
 824                 } else {
 825                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 826         }
 827     }
 828     if ($cgiparams{'MSSFIX'} ne 'on') {
 829         delete $vpnsettings{'MSSFIX'};
 830     } else {
 831         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 832     }
 833     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 834         unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 835                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 836         goto ADV_ERROR;
 837         }
 838     }
 839     if ($cgiparams{'DHCP_DNS'} ne ''){
 840         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 841                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 842         goto ADV_ERROR;
 843         }
 844     }
 845     if ($cgiparams{'DHCP_WINS'} ne ''){
 846         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 847                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 848                 goto ADV_ERROR;
 849         }
 850     }
 851     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 852         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 853         undef $vpnsettings{'ROUTES_PUSH'};
 854
 855         foreach my $tmpip (@temp)
 856         {
 857                 s/^\s+//g; s/\s+$//g;
 858
 859                 if ($tmpip)
 860                 {
 861                         $tmpip=~s/\s*$//g;
 862                         unless (&General::validipandmask($tmpip)) {
 863                                 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
 864                                 goto ADV_ERROR;
 865                         }
 866                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
 867
 868                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 869                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 870                                 goto ADV_ERROR;
 871                         }
 872 # a.marx ccd
 873                         my %ccdroutehash=();
 874                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 875                         foreach my $key (keys %ccdroutehash) {
 876                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 877                                         if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
 878                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 879                                                 goto ADV_ERROR;
 880                                         }
 881                                         my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
 882                                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
 883                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 884                                                 goto ADV_ERROR;
 885                                         }
 886                                 }
 887                         }
 888
 889 # ccd end
 890
 891                         $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
 892                 }
 893         }
 894     &write_routepushfile;
 895         undef $vpnsettings{'ROUTES_PUSH'};
 896     }
 897         else {
 898         undef $vpnsettings{'ROUTES_PUSH'};
 899         &write_routepushfile;
 900     }
 901     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 902         $errormessage = $Lang::tr{'invalid input for max clients'};
 903         goto ADV_ERROR;
 904     }
 905     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 906         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 907             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 908         goto ADV_ERROR;
 909         }
 910     }
 911     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 912         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 913             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 914         goto ADV_ERROR;
 915         }
 916     }
 917     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 918         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 919         goto ADV_ERROR;
 920     }
 921
 922     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 923     &writeserverconf();#hier ok
 924 }
 925
 926 ###
 927 # m.a.d net2net
 928 ###
 929
 930 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 931 {
 932
 933 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 934 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 935 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 936 my $tunmtu =  '';
 937
 938 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 939 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 940
 941   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 942
 943   flock SERVERCONF, 2;
 944   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 945   print SERVERCONF "\n";
 946   print SERVERCONF "# User Security\n";
 947   print SERVERCONF "user nobody\n";
 948   print SERVERCONF "group nobody\n";
 949   print SERVERCONF "persist-tun\n";
 950   print SERVERCONF "persist-key\n";
 951   print SERVERCONF "script-security 2\n";
 952   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 953   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 954   print SERVERCONF "float\n";
 955   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 956   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 957   print SERVERCONF "# Client Gateway Network\n";
 958   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 959   print SERVERCONF "# tun Device\n";
 960   print SERVERCONF "dev tun\n";
 961   print SERVERCONF "# Port and Protokol\n";
 962   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 963
 964   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 965   print SERVERCONF "proto tcp-server\n";
 966   print SERVERCONF "# Packet size\n";
 967   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 968   print SERVERCONF "tun-mtu $tunmtu\n";
 969   }
 970
 971   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 972   print SERVERCONF "proto udp\n";
 973   print SERVERCONF "# Paketsize\n";
 974   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 975   print SERVERCONF "tun-mtu $tunmtu\n";
 976   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 977   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
 978   }
 979   print SERVERCONF "# Auth. Server\n";
 980   print SERVERCONF "tls-server\n";
 981   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 982   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 983   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 984   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
 985   print SERVERCONF "# Cipher\n";
 986   print SERVERCONF "cipher AES-256-CBC\n";
 987   if ($cgiparams{'COMPLZO'} eq 'on') {
 988    print SERVERCONF "# Enable Compression\n";
 989    print SERVERCONF "comp-lzo\r\n";
 990      }
 991   print SERVERCONF "# Debug Level\n";
 992   print SERVERCONF "verb 3\n";
 993   print SERVERCONF "# Tunnel check\n";
 994   print SERVERCONF "keepalive 10 60\n";
 995   print SERVERCONF "# Start as daemon\n";
 996   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
 997   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 998   print SERVERCONF "# Activate Management Interface and Port\n";
 999   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1000   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1001   close(SERVERCONF);
1002
1003 }
1004
1005 ###
1006 # m.a.d net2net
1007 ###
1008
1009 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1010 {
1011         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
1012         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1013         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
1014         my $tunmtu =  '';
1015
1016 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1017 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1018
1019   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1020
1021   flock CLIENTCONF, 2;
1022   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1023   print CLIENTCONF "#\n";
1024   print CLIENTCONF "# User Security\n";
1025   print CLIENTCONF "user nobody\n";
1026   print CLIENTCONF "group nobody\n";
1027   print CLIENTCONF "persist-tun\n";
1028   print CLIENTCONF "persist-key\n";
1029   print CLIENTCONF "script-security 2\n";
1030   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1031   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1032   print CLIENTCONF "float\n";
1033   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1034   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1035   print CLIENTCONF "# Server Gateway Network\n";
1036   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1037   print CLIENTCONF "# tun Device\n";
1038   print CLIENTCONF "dev tun\n";
1039   print CLIENTCONF "# Port and Protokol\n";
1040   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1041
1042   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1043   print CLIENTCONF "proto tcp-client\n";
1044   print CLIENTCONF "# Packet size\n";
1045   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1046   print CLIENTCONF "tun-mtu $tunmtu\n";
1047   }
1048
1049   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1050   print CLIENTCONF "proto udp\n";
1051   print CLIENTCONF "# Paketsize\n";
1052   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1053   print CLIENTCONF "tun-mtu $tunmtu\n";
1054   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1055   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1056   }
1057
1058   print CLIENTCONF "ns-cert-type server\n";
1059   print CLIENTCONF "# Auth. Client\n";
1060   print CLIENTCONF "tls-client\n";
1061   print CLIENTCONF "# Cipher\n";
1062   print CLIENTCONF "cipher AES-256-CBC\n";
1063   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1064   if ($cgiparams{'COMPLZO'} eq 'on') {
1065    print CLIENTCONF "# Enable Compression\n";
1066    print CLIENTCONF "comp-lzo\r\n";
1067      }
1068   print CLIENTCONF "# Debug Level\n";
1069   print CLIENTCONF "verb 3\n";
1070   print CLIENTCONF "# Tunnel check\n";
1071   print CLIENTCONF "keepalive 10 60\n";
1072   print CLIENTCONF "# Start as daemon\n";
1073   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1074   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1075   print CLIENTCONF "# Activate Management Interface and Port\n";
1076   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1077   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1078   close(CLIENTCONF);
1079
1080 }
1081
1082 ###
1083 ### Save main settings
1084 ###
1085
1086
1087 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1088     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1089     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1090     #DAN this value has to leave.
1091     if ($cgiparams{'ENABLED'} eq 'on'){
1092         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1093                 $errormessage = $Lang::tr{'invalid input for hostname'};
1094         goto SETTINGS_ERROR;
1095         }
1096     }
1097     if ($cgiparams{'ENABLED'} eq 'on'){
1098         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
1099     }
1100     if ($errormessage) { goto SETTINGS_ERROR; }
1101
1102
1103     if ($cgiparams{'ENABLED'} eq 'on'){
1104         &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
1105     }
1106
1107     if ($errormessage) { goto SETTINGS_ERROR; }
1108
1109     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1110             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1111         goto SETTINGS_ERROR;
1112     }
1113     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1114
1115     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1116         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1117         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1118         goto SETTINGS_ERROR;
1119     }
1120
1121     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1122         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1123         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1124         goto SETTINGS_ERROR;
1125     }
1126
1127     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1128         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1129         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1130         goto SETTINGS_ERROR;
1131     }
1132
1133     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1134         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1135         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1136         goto SETTINGS_ERROR;
1137     }
1138     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1139     while (<ALIASES>)
1140     {
1141         chomp($_);
1142         my @tempalias = split(/\,/,$_);
1143         if ($tempalias[1] eq 'on') {
1144             if (&General::IpInSubnet ($tempalias[0] ,
1145                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1146                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1147             }
1148         }
1149     }
1150     close(ALIASES);
1151     if ($errormessage ne ''){
1152         goto SETTINGS_ERROR;
1153     }
1154     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1155         $errormessage = $Lang::tr{'invalid input'};
1156         goto SETTINGS_ERROR;
1157     }
1158     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1159         $errormessage = $Lang::tr{'invalid mtu input'};
1160         goto SETTINGS_ERROR;
1161     }
1162
1163     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1164         $errormessage = $Lang::tr{'invalid port'};
1165         goto SETTINGS_ERROR;
1166     }
1167     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1168     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1169     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1170     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1171 #new settings for daemon
1172     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1173     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1174     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1175     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1176     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1177     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1178     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1179 #wrtie enable
1180
1181   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1182   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1183   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1184 #new settings for daemon
1185     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1186     &writeserverconf();#hier ok
1187 SETTINGS_ERROR:
1188 ###
1189 ### Reset all step 2
1190 ###
1191 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1192     my $file = '';
1193     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1194
1195     foreach my $key (keys %confighash) {
1196         if ($confighash{$key}[4] eq 'cert') {
1197             delete $confighash{$cgiparams{'$key'}};
1198         }
1199     }
1200     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1201         unlink $file
1202     }
1203     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1204         unlink $file
1205     }
1206     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1207         unlink $file
1208     }
1209     &cleanssldatabase();
1210     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1211         print FILE "";
1212         close FILE;
1213     }
1214     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1215     #&writeserverconf();
1216 ###
1217 ### Reset all step 1
1218 ###
1219 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1220     &Header::showhttpheaders();
1221     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1222     &Header::openbigbox('100%', 'LEFT', '', '');
1223     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1224     print <<END
1225         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1226             <tr><td align='center'>
1227                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1228                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1229             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1230                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1231         </form></table>
1232 END
1233     ;
1234     &Header::closebox();
1235     &Header::closebigbox();
1236     &Header::closepage();
1237     exit (0);
1238
1239 ###
1240 ### Upload CA Certificate
1241 ###
1242 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1243     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1244
1245     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1246         $errormessage = $Lang::tr{'name must only contain characters'};
1247         goto UPLOADCA_ERROR;
1248     }
1249
1250     if (length($cgiparams{'CA_NAME'}) >60) {
1251         $errormessage = $Lang::tr{'name too long'};
1252         goto VPNCONF_ERROR;
1253     }
1254
1255     if ($cgiparams{'CA_NAME'} eq 'ca') {
1256         $errormessage = $Lang::tr{'name is invalid'};
1257         goto UPLOAD_CA_ERROR;
1258     }
1259
1260     # Check if there is no other entry with this name
1261     foreach my $key (keys %cahash) {
1262         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1263             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1264             goto UPLOADCA_ERROR;
1265         }
1266     }
1267
1268     if (ref ($cgiparams{'FH'}) ne 'Fh') {
1269         $errormessage = $Lang::tr{'there was no file upload'};
1270         goto UPLOADCA_ERROR;
1271     }
1272     # Move uploaded ca to a temporary file
1273     (my $fh, my $filename) = tempfile( );
1274     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1275         $errormessage = $!;
1276         goto UPLOADCA_ERROR;
1277     }
1278     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1279     if ($temp !~ /CA:TRUE/i) {
1280         $errormessage = $Lang::tr{'not a valid ca certificate'};
1281         unlink ($filename);
1282         goto UPLOADCA_ERROR;
1283     } else {
1284         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1285         if ($? ne 0) {
1286             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1287             unlink ($filename);
1288             goto UPLOADCA_ERROR;
1289         }
1290     }
1291
1292     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1293     $casubject    =~ /Subject: (.*)[\n]/;
1294     $casubject    = $1;
1295     $casubject    =~ s+/Email+, E+;
1296     $casubject    =~ s/ ST=/ S=/;
1297     $casubject    = &Header::cleanhtml($casubject);
1298
1299     my $key = &General::findhasharraykey (\%cahash);
1300     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1301     $cahash{$key}[1] = $casubject;
1302     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1303 #    system('/usr/local/bin/ipsecctrl', 'R');
1304
1305     UPLOADCA_ERROR:
1306
1307 ###
1308 ### Display ca certificate
1309 ###
1310 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1311     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1312
1313     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1314         &Header::showhttpheaders();
1315         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1316         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1317         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1318         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1319         $output = &Header::cleanhtml($output,"y");
1320         print "<pre>$output</pre>\n";
1321         &Header::closebox();
1322         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1323         &Header::closebigbox();
1324         &Header::closepage();
1325         exit(0);
1326     } else {
1327         $errormessage = $Lang::tr{'invalid key'};
1328     }
1329
1330 ###
1331 ### Download ca certificate
1332 ###
1333 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1334     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1335
1336     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1337         print "Content-Type: application/octet-stream\r\n";
1338         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1339         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1340         exit(0);
1341     } else {
1342         $errormessage = $Lang::tr{'invalid key'};
1343     }
1344
1345 ###
1346 ### Remove ca certificate (step 2)
1347 ###
1348 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1349     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1350     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1351
1352     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1353         foreach my $key (keys %confighash) {
1354             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1355             if ($test =~ /: OK/) {
1356                 # Delete connection
1357 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1358 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1359 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1360 #               }
1361                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1362                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1363                 delete $confighash{$key};
1364                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1365 #               &writeipsecfiles();
1366             }
1367         }
1368         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1369         delete $cahash{$cgiparams{'KEY'}};
1370         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1371 #       system('/usr/local/bin/ipsecctrl', 'R');
1372     } else {
1373         $errormessage = $Lang::tr{'invalid key'};
1374     }
1375 ###
1376 ### Remove ca certificate (step 1)
1377 ###
1378 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1379     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1380     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1381
1382     my $assignedcerts = 0;
1383     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1384         foreach my $key (keys %confighash) {
1385             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1386             if ($test =~ /: OK/) {
1387                 $assignedcerts++;
1388             }
1389         }
1390         if ($assignedcerts) {
1391             &Header::showhttpheaders();
1392             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1393             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1394             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1395             print <<END
1396                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1397                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1398                     <tr><td align='center'>
1399                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1400                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1401                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1402                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1403                 </form></table>
1404 END
1405             ;
1406             &Header::closebox();
1407             &Header::closebigbox();
1408             &Header::closepage();
1409             exit (0);
1410         } else {
1411             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1412             delete $cahash{$cgiparams{'KEY'}};
1413             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1414 #           system('/usr/local/bin/ipsecctrl', 'R');
1415         }
1416     } else {
1417         $errormessage = $Lang::tr{'invalid key'};
1418     }
1419
1420 ###
1421 ### Display root certificate
1422 ###
1423 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1424     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1425     my $output;
1426     &Header::showhttpheaders();
1427     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1428     &Header::openbigbox('100%', 'LEFT', '', '');
1429     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1430         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1431         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1432     } else {
1433         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1434         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1435     }
1436     $output = &Header::cleanhtml($output,"y");
1437     print "<pre>$output</pre>\n";
1438     &Header::closebox();
1439     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1440     &Header::closebigbox();
1441     &Header::closepage();
1442     exit(0);
1443
1444 ###
1445 ### Download root certificate
1446 ###
1447 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1448     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1449         print "Content-Type: application/octet-stream\r\n";
1450         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1451         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1452         exit(0);
1453     }
1454
1455 ###
1456 ### Download host certificate
1457 ###
1458 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1459     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1460         print "Content-Type: application/octet-stream\r\n";
1461         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1462         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1463         exit(0);
1464     }
1465 ###
1466 ### Form for generating a root certificate
1467 ###
1468 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1469          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1470
1471     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1472     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1473         $errormessage = $Lang::tr{'valid root certificate already exists'};
1474         $cgiparams{'ACTION'} = '';
1475         goto ROOTCERT_ERROR;
1476     }
1477
1478     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1479         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1480             my $ipaddr = <IPADDR>;
1481             close IPADDR;
1482             chomp ($ipaddr);
1483             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1484             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1485                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1486             }
1487         }
1488     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1489
1490         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1491             $errormessage = $Lang::tr{'there was no file upload'};
1492             goto ROOTCERT_ERROR;
1493         }
1494
1495         # Move uploaded certificate request to a temporary file
1496         (my $fh, my $filename) = tempfile( );
1497         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1498             $errormessage = $!;
1499             goto ROOTCERT_ERROR;
1500         }
1501
1502         # Create a temporary dirctory
1503         my $tempdir = tempdir( CLEANUP => 1 );
1504
1505         # Extract the CA certificate from the file
1506         my $pid = open(OPENSSL, "|-");
1507         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1508         if ($pid) {     # parent
1509             if ($cgiparams{'P12_PASS'} ne '') {
1510                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1511             }
1512             close (OPENSSL);
1513             if ($?) {
1514                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1515                 unlink ($filename);
1516                 goto ROOTCERT_ERROR;
1517             }
1518         } else {        # child
1519             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1520                     '-in', $filename,
1521                     '-out', "$tempdir/cacert.pem")) {
1522                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1523                 unlink ($filename);
1524                 goto ROOTCERT_ERROR;
1525             }
1526         }
1527
1528         # Extract the Host certificate from the file
1529         $pid = open(OPENSSL, "|-");
1530         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1531         if ($pid) {     # parent
1532             if ($cgiparams{'P12_PASS'} ne '') {
1533                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1534             }
1535             close (OPENSSL);
1536             if ($?) {
1537                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1538                 unlink ($filename);
1539                 goto ROOTCERT_ERROR;
1540             }
1541         } else {        # child
1542             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1543                     '-in', $filename,
1544                     '-out', "$tempdir/hostcert.pem")) {
1545                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1546                 unlink ($filename);
1547                 goto ROOTCERT_ERROR;
1548             }
1549         }
1550
1551         # Extract the Host key from the file
1552         $pid = open(OPENSSL, "|-");
1553         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1554         if ($pid) {     # parent
1555             if ($cgiparams{'P12_PASS'} ne '') {
1556                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1557             }
1558             close (OPENSSL);
1559             if ($?) {
1560                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1561                 unlink ($filename);
1562                 goto ROOTCERT_ERROR;
1563             }
1564         } else {        # child
1565             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1566                     '-nodes',
1567                     '-in', $filename,
1568                     '-out', "$tempdir/serverkey.pem")) {
1569                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1570                 unlink ($filename);
1571                 goto ROOTCERT_ERROR;
1572             }
1573         }
1574
1575         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1576         if ($? ne 0) {
1577             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1578             unlink ($filename);
1579             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1580             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1581             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1582             goto ROOTCERT_ERROR;
1583         }
1584
1585         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1586         if ($? ne 0) {
1587             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1588             unlink ($filename);
1589             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1590             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1591             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1592             goto ROOTCERT_ERROR;
1593         }
1594
1595         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1596         if ($? ne 0) {
1597             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1598             unlink ($filename);
1599             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1600             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1601             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1602             goto ROOTCERT_ERROR;
1603         }
1604
1605         goto ROOTCERT_SUCCESS;
1606
1607     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1608
1609         # Validate input since the form was submitted
1610         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1611             $errormessage = $Lang::tr{'organization cant be empty'};
1612             goto ROOTCERT_ERROR;
1613         }
1614         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1615             $errormessage = $Lang::tr{'organization too long'};
1616             goto ROOTCERT_ERROR;
1617         }
1618         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1619             $errormessage = $Lang::tr{'invalid input for organization'};
1620             goto ROOTCERT_ERROR;
1621         }
1622         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1623             $errormessage = $Lang::tr{'hostname cant be empty'};
1624             goto ROOTCERT_ERROR;
1625         }
1626         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1627             $errormessage = $Lang::tr{'invalid input for hostname'};
1628             goto ROOTCERT_ERROR;
1629         }
1630         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1631             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1632             goto ROOTCERT_ERROR;
1633         }
1634         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1635             $errormessage = $Lang::tr{'e-mail address too long'};
1636             goto ROOTCERT_ERROR;
1637         }
1638         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1639             $errormessage = $Lang::tr{'invalid input for department'};
1640             goto ROOTCERT_ERROR;
1641         }
1642         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1643             $errormessage = $Lang::tr{'invalid input for city'};
1644             goto ROOTCERT_ERROR;
1645         }
1646         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1647             $errormessage = $Lang::tr{'invalid input for state or province'};
1648             goto ROOTCERT_ERROR;
1649         }
1650         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1651             $errormessage = $Lang::tr{'invalid input for country'};
1652             goto ROOTCERT_ERROR;
1653         }
1654
1655         # Copy the cgisettings to vpnsettings and save the configfile
1656         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1657         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1658         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1659         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1660         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1661         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1662         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1663         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1664
1665         # Replace empty strings with a .
1666         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1667         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1668         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1669
1670         # refresh
1671         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1672
1673         # Create the CA certificate
1674         my $pid = open(OPENSSL, "|-");
1675         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1676         if ($pid) {     # parent
1677             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1678             print OPENSSL "$state\n";
1679             print OPENSSL "$city\n";
1680             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1681             print OPENSSL "$ou\n";
1682             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1683             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1684             close (OPENSSL);
1685             if ($?) {
1686                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1687                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1688                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1689                 goto ROOTCERT_ERROR;
1690             }
1691         } else {        # child
1692             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1693                         '-days', '999999', '-newkey', 'rsa:2048',
1694                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1695                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1696                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1697                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1698                 goto ROOTCERT_ERROR;
1699             }
1700         }
1701
1702         # Create the Host certificate request
1703         $pid = open(OPENSSL, "|-");
1704         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1705         if ($pid) {     # parent
1706             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1707             print OPENSSL "$state\n";
1708             print OPENSSL "$city\n";
1709             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1710             print OPENSSL "$ou\n";
1711             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1712             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1713             print OPENSSL ".\n";
1714             print OPENSSL ".\n";
1715             close (OPENSSL);
1716             if ($?) {
1717                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1718                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1719                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1720                 goto ROOTCERT_ERROR;
1721             }
1722         } else {        # child
1723             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1724                         '-newkey', 'rsa:1024',
1725                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1726                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1727                         '-extensions', 'server',
1728                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1729                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1730                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1731                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1732                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1733                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1734                 goto ROOTCERT_ERROR;
1735             }
1736         }
1737
1738         # Sign the host certificate request
1739         system('/usr/bin/openssl', 'ca', '-days', '999999',
1740                 '-batch', '-notext',
1741                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1742                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1743                 '-extensions', 'server',
1744                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1745         if ($?) {
1746             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1747             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1748             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1749             unlink ("${General::swroot}/ovpn/serverkey.pem");
1750             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1751             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1752             &newcleanssldatabase();
1753             goto ROOTCERT_ERROR;
1754         } else {
1755             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1756             &deletebackupcert();
1757         }
1758
1759         # Create an empty CRL
1760         system('/usr/bin/openssl', 'ca', '-gencrl',
1761                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1762                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1763         if ($?) {
1764             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1765             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1766             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1767             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1768             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1769             &cleanssldatabase();
1770             goto ROOTCERT_ERROR;
1771 #       } else {
1772 #           &cleanssldatabase();
1773         }
1774         # Create Diffie Hellmann Parameter
1775         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1776                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1777                '1024' );
1778         if ($?) {
1779             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1780             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1781             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1782             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1783             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1784             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1785             &cleanssldatabase();
1786             goto ROOTCERT_ERROR;
1787 #       } else {
1788 #           &cleanssldatabase();
1789         }
1790         goto ROOTCERT_SUCCESS;
1791     }
1792     ROOTCERT_ERROR:
1793     if ($cgiparams{'ACTION'} ne '') {
1794         &Header::showhttpheaders();
1795         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1796         &Header::openbigbox('100%', 'LEFT', '', '');
1797         if ($errormessage) {
1798             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1799             print "<class name='base'>$errormessage";
1800             print "&nbsp;</class>";
1801             &Header::closebox();
1802         }
1803         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1804         print <<END
1805         <form method='post' enctype='multipart/form-data'>
1806         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1807         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1808             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1809             <td width='35%' colspan='2'>&nbsp;</td></tr>
1810         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1811             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1812             <td colspan='2'>&nbsp;</td></tr>
1813         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1814             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1815             <td colspan='2'>&nbsp;</td></tr>
1816         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1817             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1818             <td colspan='2'>&nbsp;</td></tr>
1819         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1820             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1821             <td colspan='2'>&nbsp;</td></tr>
1822         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1823             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1824             <td colspan='2'>&nbsp;</td></tr>
1825         <tr><td class='base'>$Lang::tr{'country'}:</td>
1826             <td class='base'><select name='ROOTCERT_COUNTRY'>
1827
1828 END
1829         ;
1830         foreach my $country (sort keys %{Countries::countries}) {
1831             print "<option value='$Countries::countries{$country}'";
1832             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1833                 print " selected='selected'";
1834             }
1835             print ">$country</option>";
1836         }
1837         print <<END
1838             </select></td>
1839             <td colspan='2'>&nbsp;</td></tr>
1840         <tr><td>&nbsp;</td>
1841             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1842             <td>&nbsp;</td><td>&nbsp;</td></tr>
1843         <tr><td class='base' colspan='4' align='left'>
1844             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1845         <tr><td class='base' colspan='4' align='left'>
1846             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1847             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1848         </td></tr>
1849         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1850         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1851             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1852             <td colspan='2'>&nbsp;</td></tr>
1853         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1854             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1855             <td colspan='2'>&nbsp;</td></tr>
1856         <tr><td>&nbsp;</td>
1857             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1858             <td colspan='2'>&nbsp;</td></tr>
1859         <tr><td class='base' colspan='4' align='left'>
1860             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1861         </form></table>
1862 END
1863         ;
1864         &Header::closebox();
1865
1866         &Header::closebigbox();
1867         &Header::closepage();
1868         exit(0)
1869     }
1870
1871     ROOTCERT_SUCCESS:
1872     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1873 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1874 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1875 #       system('/usr/local/bin/ipsecctrl', 'S');
1876 #    }
1877
1878 ###
1879 ### Enable/Disable connection
1880 ###
1881
1882 ###
1883 # m.a.d net2net
1884 ###
1885
1886 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1887
1888     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1889     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1890 #    my $n2nactive = '';
1891     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1892
1893     if ($confighash{$cgiparams{'KEY'}}) {
1894                 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1895                         $confighash{$cgiparams{'KEY'}}[0] = 'on';
1896                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1897
1898                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1899                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1900                         }
1901                 } else {
1902
1903                         $confighash{$cgiparams{'KEY'}}[0] = 'off';
1904                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1905
1906                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1907                     if ($n2nactive ne ''){
1908                                                 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1909                                         }
1910
1911                         } else {
1912                   $errormessage = $Lang::tr{'invalid key'};
1913                         }
1914       }
1915   }
1916
1917 ###
1918 ### Download OpenVPN client package
1919 ###
1920
1921
1922 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1923     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1924     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1925     my $file = '';
1926     my $clientovpn = '';
1927     my @fileholder;
1928     my $tempdir = tempdir( CLEANUP => 1 );
1929     my $zippath = "$tempdir/";
1930
1931 ###
1932 # m.a.d net2net
1933 ###
1934
1935 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1936
1937         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1938         my $zippathname = "$zippath$zipname";
1939         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1940         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1941         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1942         my $tunmtu = '';
1943         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1944         my $n2nfragment = '';
1945
1946     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1947     flock CLIENTCONF, 2;
1948
1949     my $zip = Archive::Zip->new();
1950    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1951    print CLIENTCONF "# \n";
1952    print CLIENTCONF "# User Security\n";
1953    print CLIENTCONF "user nobody\n";
1954    print CLIENTCONF "group nobody\n";
1955    print CLIENTCONF "persist-tun\n";
1956    print CLIENTCONF "persist-key\n";
1957    print CLIENTCONF "script-security 2\n";
1958    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1959    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1960    print CLIENTCONF "float\n";
1961    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1962    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1963    print CLIENTCONF "# Server Gateway Network\n";
1964    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1965    print CLIENTCONF "# tun Device\n";
1966    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1967    print CLIENTCONF "# Port and Protokoll\n";
1968    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1969
1970    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1971    print CLIENTCONF "proto tcp-client\n";
1972    print CLIENTCONF "# Packet size\n";
1973    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1974    print CLIENTCONF "tun-mtu $tunmtu\n";
1975    }
1976
1977    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1978    print CLIENTCONF "proto udp\n";
1979    print CLIENTCONF "# Paketsize\n";
1980    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1981    print CLIENTCONF "tun-mtu $tunmtu\n";
1982    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1983    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1984    }
1985    print CLIENTCONF "ns-cert-type server\n";
1986    print CLIENTCONF "# Auth. Client\n";
1987    print CLIENTCONF "tls-client\n";
1988    print CLIENTCONF "# Cipher\n";
1989    print CLIENTCONF "cipher AES-256-CBC\n";
1990     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1991          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1992      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1993    }
1994     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1995    print CLIENTCONF "# Enable Compression\n";
1996    print CLIENTCONF "comp-lzo\r\n";
1997      }
1998    print CLIENTCONF "# Debug Level\n";
1999    print CLIENTCONF "verb 3\n";
2000    print CLIENTCONF "# Tunnel check\n";
2001    print CLIENTCONF "keepalive 10 60\n";
2002    print CLIENTCONF "# Start as daemon\n";
2003    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2004    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2005    print CLIENTCONF "# Activate Management Interface and Port\n";
2006    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2007     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2008    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2009
2010
2011     close(CLIENTCONF);
2012
2013     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2014     my $status = $zip->writeToFileNamed($zippathname);
2015
2016     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2017     @fileholder = <DLFILE>;
2018     print "Content-Type:application/x-download\n";
2019     print "Content-Disposition:attachment;filename=$zipname\n\n";
2020     print @fileholder;
2021     exit (0);
2022 }
2023 else
2024 {
2025         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2026         my $zippathname = "$zippath$zipname";
2027         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2028
2029 ###
2030 # m.a.d net2net
2031 ###
2032
2033     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2034     flock CLIENTCONF, 2;
2035
2036     my $zip = Archive::Zip->new();
2037
2038     print CLIENTCONF "#OpenVPN Client conf\r\n";
2039     print CLIENTCONF "tls-client\r\n";
2040     print CLIENTCONF "client\r\n";
2041     print CLIENTCONF "nobind\n";
2042     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2043     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2044     print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
2045     if ( $vpnsettings{'ENABLED'} eq 'on'){
2046         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2047         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2048             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2049             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2050         }
2051         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2052             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2053             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2054         }
2055     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2056         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2057         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2058             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2059             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2060         }
2061     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2062         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2063     }
2064
2065     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2066         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2067         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2068     } else {
2069         print CLIENTCONF "ca cacert.pem\r\n";
2070         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2071         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2072         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2073         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2074     }
2075     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2076     if ($vpnsettings{DCOMPLZO} eq 'on') {
2077         print CLIENTCONF "comp-lzo\r\n";
2078     }
2079     print CLIENTCONF "verb 3\r\n";
2080     print CLIENTCONF "ns-cert-type server\r\n";
2081     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2082     if ($vpnsettings{MSSFIX} eq 'on') {
2083         print CLIENTCONF "mssfix\r\n";
2084     }
2085     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2086         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2087     }
2088     close(CLIENTCONF);
2089
2090     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2091     my $status = $zip->writeToFileNamed($zippathname);
2092
2093     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2094     @fileholder = <DLFILE>;
2095     print "Content-Type:application/x-download\n";
2096     print "Content-Disposition:attachment;filename=$zipname\n\n";
2097     print @fileholder;
2098     exit (0);
2099    }
2100
2101
2102
2103 ###
2104 ### Remove connection
2105 ###
2106
2107
2108 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2109     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2110     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2111
2112     if ($confighash{$cgiparams{'KEY'}}) {
2113 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2114 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2115 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2116 #       }
2117 #
2118         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2119
2120 ###
2121 # m.a.d net2net
2122 ###
2123
2124  if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2125
2126         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2127   my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2128   unlink ($certfile) or die "Removing $certfile fail: $!";
2129   unlink ($conffile) or die "Removing $conffile fail: $!";
2130   rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2131
2132 }
2133
2134   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2135   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2136
2137 # A.Marx CCD delete ccd files and routes
2138
2139
2140         if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2141         {
2142                 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2143         }
2144         my %ccdroutehash=();
2145         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2146         foreach my $key (keys %ccdroutehash) {
2147                 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2148                         delete $ccdroutehash{$key};
2149                 }
2150         }
2151         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2152         my %ccdroute2hash=();
2153         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2154         foreach my $key (keys %ccdroute2hash) {
2155                 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2156                         delete $ccdroute2hash{$key};
2157                 }
2158         }
2159         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2160
2161
2162
2163 # CCD end
2164
2165
2166         delete $confighash{$cgiparams{'KEY'}};
2167         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2168         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2169
2170         #&writeserverconf();
2171     } else {
2172         $errormessage = $Lang::tr{'invalid key'};
2173     }
2174
2175
2176 ###
2177 ### Download PKCS12 file
2178 ###
2179 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2180     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2181
2182     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2183     print "Content-Type: application/octet-stream\r\n\r\n";
2184     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2185     exit (0);
2186
2187 ###
2188 ### Display certificate
2189 ###
2190 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2191     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2192
2193     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2194         &Header::showhttpheaders();
2195         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2196         &Header::openbigbox('100%', 'LEFT', '', '');
2197         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2198         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2199         $output = &Header::cleanhtml($output,"y");
2200         print "<pre>$output</pre>\n";
2201         &Header::closebox();
2202         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2203         &Header::closebigbox();
2204         &Header::closepage();
2205         exit(0);
2206     }
2207 ###
2208 ### Display Certificate Revoke List
2209 ###
2210 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2211 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2212
2213     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
2214         &Header::showhttpheaders();
2215         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2216         &Header::openbigbox('100%', 'LEFT', '', '');
2217         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2218         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2219         $output = &Header::cleanhtml($output,"y");
2220         print "<pre>$output</pre>\n";
2221         &Header::closebox();
2222         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2223         &Header::closebigbox();
2224         &Header::closepage();
2225         exit(0);
2226     }
2227
2228 ###
2229 ### Advanced Server Settings
2230 ###
2231
2232 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2233     %cgiparams = ();
2234     %cahash = ();
2235     %confighash = ();
2236     my $disabled;
2237     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2238     read_routepushfile;
2239
2240
2241 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2242 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
2243 #    }
2244 ADV_ERROR:
2245     if ($cgiparams{'MAX_CLIENTS'} eq '') {
2246         $cgiparams{'MAX_CLIENTS'} =  '100';
2247     }
2248     if ($cgiparams{'KEEPALIVE_1'} eq '') {
2249         $cgiparams{'KEEPALIVE_1'} =  '10';
2250     }
2251     if ($cgiparams{'KEEPALIVE_2'} eq '') {
2252         $cgiparams{'KEEPALIVE_2'} =  '60';
2253     }
2254     if ($cgiparams{'LOG_VERB'} eq '') {
2255         $cgiparams{'LOG_VERB'} =  '3';
2256     }
2257     $checked{'CLIENT2CLIENT'}{'off'} = '';
2258     $checked{'CLIENT2CLIENT'}{'on'} = '';
2259     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2260     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2261     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2262     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2263     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2264     $checked{'MSSFIX'}{'off'} = '';
2265     $checked{'MSSFIX'}{'on'} = '';
2266     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2267     $selected{'LOG_VERB'}{'1'} = '';
2268     $selected{'LOG_VERB'}{'2'} = '';
2269     $selected{'LOG_VERB'}{'3'} = '';
2270     $selected{'LOG_VERB'}{'4'} = '';
2271     $selected{'LOG_VERB'}{'5'} = '';
2272     $selected{'LOG_VERB'}{'6'} = '';
2273     $selected{'LOG_VERB'}{'7'} = '';
2274     $selected{'LOG_VERB'}{'8'} = '';
2275     $selected{'LOG_VERB'}{'9'} = '';
2276     $selected{'LOG_VERB'}{'10'} = '';
2277     $selected{'LOG_VERB'}{'11'} = '';
2278     $selected{'LOG_VERB'}{'0'} = '';
2279     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2280
2281     &Header::showhttpheaders();
2282     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2283     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2284     if ($errormessage) {
2285         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2286         print "<class name='base'>$errormessage\n";
2287         print "&nbsp;</class>\n";
2288         &Header::closebox();
2289     }
2290     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2291     print <<END
2292     <form method='post' enctype='multipart/form-data' disabled>
2293     <table width='100%' border=0>
2294     <tr>
2295         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2296     </tr>
2297     <tr>
2298         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2299     </tr>
2300     <tr>
2301         <td class='base'>Domain</td>
2302         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30'  /></td>
2303     </tr>
2304     <tr>
2305         <td class='base'>DNS</td>
2306         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2307     </tr>
2308     <tr>
2309         <td class='base'>WINS</td>
2310         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2311        </tr>
2312     <tr>
2313         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2314     </tr>
2315     <tr>
2316         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2317   <td colspan='2'>
2318        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2319 END
2320 ;
2321
2322 if ($cgiparams{'ROUTES_PUSH'} ne '')
2323 {
2324         print $cgiparams{'ROUTES_PUSH'};
2325 }
2326
2327 print <<END;
2328 </textarea></td>
2329 </tr>
2330     </tr>
2331 </table>
2332 <hr size='1'>
2333     <table width='100%'>
2334     <tr>
2335         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2336     </tr>
2337     <tr>
2338         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
2339     </tr>
2340     <tr>
2341         <td class='base'>Client-To-Client</td>
2342         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2343     </tr>
2344     <tr>
2345         <td class='base'>Redirect-Gateway def1</td>
2346         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2347     </tr>
2348     <tr>
2349         <td class='base'>Max-Clients</td>
2350         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2351     </tr>
2352         <tr>
2353           <td class='base'>Keppalive <br />
2354             (ping/ping-restart)</td>
2355           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2356           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2357     </tr>
2358         <tr>
2359           <td class='base'>fragment <br></td>
2360           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2361         <td>Default: <span class="base">1300</span></td>
2362       </tr>
2363         <tr>
2364           <td class='base'>mssfix</td>
2365           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2366           <td>Default: on</td>
2367           </tr>
2368 </table>
2369
2370 <!--
2371 <hr size='1'>
2372     <table width='100%'>
2373     <tr>
2374  <td class'base'><b>Crypto-Engines</b></td>
2375     </tr>
2376     <tr>
2377         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2378     </tr>
2379     <tr><td class='base'>Engines:</td>
2380         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2381                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2382                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2383                         </select>
2384                 </td>
2385 </table>
2386 -->
2387 <hr size='1'>
2388     <table width='100%'>
2389     <tr>
2390         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2391     </tr>
2392     <tr>
2393         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2394     </tr>
2395
2396     <tr><td class='base'>VERB</td>
2397         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2398                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2399                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2400                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2401                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2402                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2403                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2404                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2405                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2406                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2407                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2408                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2409 </table><hr>
2410 END
2411
2412 if ( -e "/var/run/openvpn.pid"){
2413 print"  <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2414                 $Lang::tr{'server restart'}<br><br>
2415                 <hr>";
2416 }
2417
2418 print<<END
2419 <table width='100%'>
2420 <tr>
2421     <td>&nbsp;</td>
2422     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2423     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2424     <td>&nbsp;</td>
2425 </tr>
2426 </table>
2427 </form>
2428 END
2429 ;
2430
2431     &Header::closebox();
2432 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2433     &Header::closebigbox();
2434     &Header::closepage();
2435     exit(0);
2436
2437
2438 # A.Marx CCD   Add,delete or edit CCD net
2439
2440 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2441                 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2442                 $cgiparams{'ACTION'} eq "kill" ||
2443                 $cgiparams{'ACTION'} eq "edit" ||
2444                 $cgiparams{'ACTION'} eq 'editsave'){
2445         &Header::showhttpheaders();
2446         &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2447         &Header::openbigbox('100%', 'LEFT', '', '');
2448
2449         if ($cgiparams{'ACTION'} eq "kill"){
2450                 &delccdnet($cgiparams{'net'});
2451         }
2452
2453         if ($cgiparams{'ACTION'} eq 'editsave'){
2454                 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2455                 if ( $a ne $b){ &modccdnet($a,$b);}
2456         }
2457
2458         if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
2459                 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'},$cgiparams{'DOVPN_SUBNET'});
2460         }
2461         if ($errormessage) {
2462             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2463             print "<class name='base'>$errormessage";
2464             print "&nbsp;</class>";
2465             &Header::closebox();
2466         }
2467 if ($cgiparams{'ACTION'} eq "edit"){
2468
2469         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2470
2471         print <<END
2472     <table width='100%' border=0>
2473     <tr><form method='post'>
2474         <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2475         <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
2476         <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2477         <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2478         </td></tr>
2479         </table></form>
2480 END
2481 ;
2482         &Header::closebox();
2483
2484         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2485         print <<END
2486     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2487     <tr>
2488         <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2489 END
2490 ;
2491 }
2492 else{
2493         if (! -e "/var/run/openvpn.pid"){
2494         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2495                 print <<END;
2496             <table width='100%' border='0'>
2497             <tr><form method='post'>
2498                 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2499                 <tr>
2500                 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2501                 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2502                 <tr><td colspan=4><hr /></td></tr><tr>
2503                 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2504                 </table></form>
2505 END
2506
2507         &Header::closebox();
2508 }
2509         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2510         print <<END
2511     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2512     <tr>
2513         <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2514 END
2515 ;
2516 }
2517         my %ccdconfhash=();
2518         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2519         my @ccdconf=();
2520         my $count=0;
2521         foreach my $key (keys %ccdconfhash) {
2522                 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2523                 $count++;
2524                 my $ccdhosts = &hostsinnet($ccdconf[0]);
2525                 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2526                 else{            print" <tr bgcolor='$color{'color20'}'>";}
2527                 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
2528 print <<END
2529                 <form method='post' />
2530                 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
2531                 <input type='hidden' name='ACTION' value='edit'/>
2532                 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2533                 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2534                 </form></td>
2535                 <form method='post' />
2536                 <td><input type='hidden' name='ACTION' value='kill'/>
2537                 <input type='hidden' name='number' value='$count' />
2538                 <input type='hidden' name='net' value='$ccdconf[0]' />
2539                 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
2540 END
2541 ;
2542         }
2543         print "</table></form>";
2544         &Header::closebox();
2545         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2546         &Header::closebigbox();
2547         &Header::closepage();
2548         exit(0);
2549
2550 #END CCD
2551
2552 ###
2553 ### Openvpn Connections Statistics
2554 ###
2555 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2556         &Header::showhttpheaders();
2557         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2558         &Header::openbigbox('100%', 'LEFT', '', '');
2559     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2560
2561 #
2562 #       <td><b>$Lang::tr{'protocol'}</b></td>
2563 # protocol temp removed
2564     print <<END
2565     <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2566     <tr>
2567         <td><b>$Lang::tr{'common name'}</b></td>
2568         <td><b>$Lang::tr{'real address'}</b></td>
2569         <td><b>$Lang::tr{'virtual address'}</b></td>
2570         <td><b>$Lang::tr{'loged in at'}</b></td>
2571         <td><b>$Lang::tr{'bytes sent'}</b></td>
2572         <td><b>$Lang::tr{'bytes received'}</b></td>
2573         <td><b>$Lang::tr{'last activity'}</b></td>
2574     </tr>
2575 END
2576 ;
2577         my $filename = "/var/log/ovpnserver.log";
2578         open(FILE, $filename) or die 'Unable to open config file.';
2579         my @current = <FILE>;
2580         close(FILE);
2581         my @users =();
2582         my $status;
2583         my $uid = 0;
2584         my $cn;
2585         my @match = ();
2586         my $proto = "udp";
2587         my $address;
2588         my %userlookup = ();
2589         foreach my $line (@current)
2590         {
2591             chomp($line);
2592             if ( $line =~ /^Updated,(.+)/){
2593                 @match = split( /^Updated,(.+)/, $line);
2594                 $status = $match[1];
2595             }
2596 #gian
2597             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2598                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2599                 if ($match[1] ne "Common Name") {
2600                     $cn = $match[1];
2601                     $userlookup{$match[2]} = $uid;
2602                     $users[$uid]{'CommonName'} = $match[1];
2603                     $users[$uid]{'RealAddress'} = $match[2];
2604                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2605                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2606                     $users[$uid]{'Since'} = $match[5];
2607                     $users[$uid]{'Proto'} = $proto;
2608                     $uid++;
2609                 }
2610             }
2611             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2612                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2613                 if ($match[1] ne "Virtual Address") {
2614                     $address = $match[3];
2615                     #find the uid in the lookup table
2616                     $uid = $userlookup{$address};
2617                     $users[$uid]{'VirtualAddress'} = $match[1];
2618                     $users[$uid]{'LastRef'} = $match[4];
2619                 }
2620             }
2621         }
2622         my $user2 = @users;
2623         if ($user2 >= 1){
2624             for (my $idx = 1; $idx <= $user2; $idx++){
2625                                                 if ($idx % 2) {
2626                                         print "<tr bgcolor='$color{'color20'}'>\n";
2627                                 } else {
2628                                         print "<tr bgcolor='$color{'color22'}'>\n";
2629                                                 }
2630                                                 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2631                                                 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2632                                                 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2633                                                 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2634                                                 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2635                                                 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2636                                                 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2637 #                       print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2638             }
2639         }
2640
2641         print "</table>";
2642         print <<END
2643         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2644         <tr><td></td></tr>
2645         <tr><td></td></tr>
2646         <tr><td></td></tr>
2647         <tr><td></td></tr>
2648         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2649         </table>
2650 END
2651 ;
2652         &Header::closebox();
2653         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2654         &Header::closebigbox();
2655         &Header::closepage();
2656         exit(0);
2657
2658 ###
2659 ### Download Certificate
2660 ###
2661 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2662     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2663
2664     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2665         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2666         print "Content-Type: application/octet-stream\r\n\r\n";
2667         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2668         exit (0);
2669     }
2670
2671 ###
2672 ### Enable/Disable connection
2673 ###
2674
2675 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2676
2677     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2678     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2679
2680     if ($confighash{$cgiparams{'KEY'}}) {
2681            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2682             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2683             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2684             #&writeserverconf();
2685 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2686 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2687 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2688 #           }
2689         } else {
2690             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2691 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2692 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2693 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2694 #           }
2695             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2696             #&writeserverconf();
2697         }
2698     } else {
2699         $errormessage = $Lang::tr{'invalid key'};
2700     }
2701
2702 ###
2703 ### Restart connection
2704 ###
2705 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2706     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2707     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2708
2709     if ($confighash{$cgiparams{'KEY'}}) {
2710 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2711 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2712 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2713 #       }
2714     } else {
2715         $errormessage = $Lang::tr{'invalid key'};
2716     }
2717
2718 ###
2719 ### Remove connection
2720 ###
2721 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2722     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2723     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2724
2725     if ($confighash{$cgiparams{'KEY'}}) {
2726 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2727 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2728 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2729 #       }
2730         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2731         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2732         delete $confighash{$cgiparams{'KEY'}};
2733         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2734         #&writeserverconf();
2735     } else {
2736         $errormessage = $Lang::tr{'invalid key'};
2737     }
2738 #test33
2739
2740 ###
2741 ### Choose between adding a host-net or net-net connection
2742 ###
2743
2744 ###
2745 # m.a.d net2net
2746 ###
2747
2748 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2749         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2750         &Header::showhttpheaders();
2751         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2752         &Header::openbigbox('100%', 'LEFT', '', '');
2753         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2754
2755 if ( -s "${General::swroot}/ovpn/settings") {
2756
2757         print <<END
2758             <b>$Lang::tr{'connection type'}:</b><br />
2759             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2760             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2761                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2762             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2763                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2764                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2765                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2766           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2767           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2768     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr>
2769           <tr><td colspan='3'><hr /></td></tr>
2770     <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2771           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2772             </form></table>
2773 END
2774         ;
2775
2776
2777 } else {
2778         print <<END
2779                     <b>$Lang::tr{'connection type'}:</b><br />
2780             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2781             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2782             <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2783             </form></table>
2784 END
2785         ;
2786
2787 }
2788
2789         &Header::closebox();
2790         &Header::closebigbox();
2791         &Header::closepage();
2792         exit (0);
2793
2794 ###
2795 # m.a.d net2net
2796 ###
2797
2798 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2799
2800         my @firen2nconf;
2801         my @confdetails;
2802         my $uplconffilename ='';
2803         my $uplconffilename2 ='';
2804         my $uplp12name = '';
2805         my $uplp12name2 = '';
2806         my @rem_subnet;
2807         my @rem_subnet2;
2808         my @tmposupnet3;
2809         my $key;
2810         my @n2nname;
2811
2812         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2813
2814 # Check if a file is uploaded
2815
2816         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2817                 $errormessage = $Lang::tr{'there was no file upload'};
2818                 goto N2N_ERROR;
2819     }
2820
2821 # Move uploaded IPfire n2n package to temporary file
2822
2823     (my $fh, my $filename) = tempfile( );
2824     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2825                 $errormessage = $!;
2826                 goto N2N_ERROR;
2827     }
2828
2829         my $zip = Archive::Zip->new();
2830         my $zipName = $filename;
2831         my $status = $zip->read( $zipName );
2832         if ($status != AZ_OK) {
2833                 $errormessage = "Read of $zipName failed\n";
2834                 goto N2N_ERROR;
2835         }
2836
2837         my $tempdir = tempdir( CLEANUP => 1 );
2838         my @files = $zip->memberNames();
2839         for(@files) {
2840         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2841         }
2842         my $countfiles = @files;
2843
2844 # Check if we have not more then 2 files
2845
2846         if ( $countfiles == 2){
2847                 foreach (@files){
2848                         if ( $_ =~ /.conf$/){
2849                                 $uplconffilename = $_;
2850                         }
2851                         if ( $_ =~ /.p12$/){
2852                                 $uplp12name = $_;
2853                         }
2854                 }
2855                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2856                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2857                         goto N2N_ERROR;
2858                 }
2859
2860                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2861                 @firen2nconf = <FILE>;
2862                 close (FILE);
2863                 chomp(@firen2nconf);
2864
2865         } else {
2866
2867                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2868                 goto N2N_ERROR;
2869         }
2870
2871 ###
2872 # m.a.d net2net
2873 ###
2874
2875  if ($cgiparams{'n2nname'} ne ''){
2876
2877   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2878   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2879   $n2nname[0] = $cgiparams{'n2nname'};
2880   my @n2nname2 = split(/\./,$uplconffilename);
2881   $n2nname2[0] =~ s/\n|\r//g;
2882   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2883         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2884         my $input2 = "$n2nname2[0]n2n";
2885   my $output2 = "$n2nname[0]n2n";
2886   my $filename = "$tempdir/$uplconffilename";
2887   open(FILE, "< $filename") or die 'Unable to open config file.';
2888         my @current = <FILE>;
2889         close(FILE);
2890         foreach (@current) {s/$input1/$output1/g;}
2891         foreach (@current) {s/$input2/$output2/g;}
2892   open (OUT, "> $filename") || die 'Unable to open config file.';
2893   print OUT @current;
2894   close OUT;
2895
2896     }else{
2897     $uplconffilename2 =  $uplconffilename;
2898     $uplp12name2 = $uplp12name;
2899     @n2nname = split(/\./,$uplconffilename);
2900     $n2nname[0] =~ s/\n|\r//g;
2901    }
2902     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2903     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2904
2905         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
2906
2907         if ($? ne 0) {
2908             $errormessage = "*.conf move failed: $!";
2909             unlink ($filename);
2910             goto N2N_ERROR;
2911         }
2912
2913         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
2914         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2915
2916         if ($? ne 0) {
2917             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2918             unlink ($filename);
2919             goto N2N_ERROR;
2920         }
2921
2922 my $complzoactive;
2923 my $mssfixactive;
2924 my $n2nfragment;
2925 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2926 my @n2nproto = split(/-/, $n2nproto2[1]);
2927 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2928 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2929 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2930 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2931 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
2932 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2933 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
2934 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
2935 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2936 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2937 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
2938 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2939 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
2940 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2941
2942
2943 ###
2944 # m.a.d delete CR and LF from arrays for this chomp doesnt work
2945 ###
2946
2947 $n2nremote[1] =~ s/\n|\r//g;
2948 $n2novpnsub[0] =~ s/\n|\r//g;
2949 $n2novpnsub[1] =~ s/\n|\r//g;
2950 $n2novpnsub[2] =~ s/\n|\r//g;
2951 $n2nproto[0] =~ s/\n|\r//g;
2952 $n2nport[1] =~ s/\n|\r//g;
2953 $n2ntunmtu[1] =~ s/\n|\r//g;
2954 $n2nremsub[1] =~ s/\n|\r//g;
2955 $n2nremsub[2] =~ s/\n|\r//g;
2956 $n2nlocalsub[2] =~ s/\n|\r//g;
2957 $n2nfragment[1] =~ s/\n|\r//g;
2958 $n2nmgmt[2] =~ s/\n|\r//g;
2959 chomp ($complzoactive);
2960 chomp ($mssfixactive);
2961
2962 ###
2963 # m.a.d net2net
2964 ###
2965
2966 ###
2967 # Check if there is no other entry with this name
2968 ###
2969
2970         foreach my $dkey (keys %confighash) {
2971                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2972                         $errormessage = $Lang::tr{'a connection with this name already exists'};
2973                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2974             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2975       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2976                         goto N2N_ERROR;
2977                 }
2978         }
2979
2980 ###
2981 # Check if OpenVPN Subnet is valid
2982 ###
2983
2984 foreach my $dkey (keys %confighash) {
2985                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2986                         $errormessage = 'The OpenVPN Subnet is already in use';
2987                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2988             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2989       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2990                         goto N2N_ERROR;
2991                 }
2992         }
2993
2994 ###
2995 # Check im Dest Port is vaild
2996 ###
2997
2998 foreach my $dkey (keys %confighash) {
2999                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3000                         $errormessage = 'The OpenVPN Port is already in use';
3001                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3002             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3003       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3004                         goto N2N_ERROR;
3005                 }
3006         }
3007
3008
3009
3010   $key = &General::findhasharraykey (\%confighash);
3011
3012         foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";}
3013         $confighash{$key}[0] = 'off';
3014         $confighash{$key}[1] = $n2nname[0];
3015     $confighash{$key}[2] = $n2nname[0];
3016         $confighash{$key}[3] = 'net';
3017         $confighash{$key}[4] = 'cert';
3018         $confighash{$key}[6] = 'client';
3019         $confighash{$key}[8] =  $n2nlocalsub[2];
3020     $confighash{$key}[10] = $n2nremote[1];
3021     $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3022         $confighash{$key}[22] = $n2nmgmt[2];
3023     $confighash{$key}[23] = $mssfixactive;
3024         $confighash{$key}[24] = $n2nfragment[1];
3025     $confighash{$key}[25] = 'IPFire n2n Client';
3026         $confighash{$key}[26] = 'red';
3027     $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3028     $confighash{$key}[28] = $n2nproto[0];
3029     $confighash{$key}[29] = $n2nport[1];
3030     $confighash{$key}[30] = $complzoactive;
3031     $confighash{$key}[31] = $n2ntunmtu[1];
3032
3033
3034   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3035
3036   N2N_ERROR:
3037
3038         &Header::showhttpheaders();
3039         &Header::openpage('Validate imported configuration', 1, '');
3040         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3041         if ($errormessage) {
3042             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3043             print "<class name='base'>$errormessage";
3044             print "&nbsp;</class>";
3045             &Header::closebox();
3046
3047         } else
3048   {
3049                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3050         }
3051         if ($errormessage eq ''){
3052                 print <<END
3053                 <!-- ipfire net2net config gui -->
3054                 <table width='100%'>
3055                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3056     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3057     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3058                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3059                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3060                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3061                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
3062                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3063                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3064                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3065                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3066                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
3067                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
3068                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3069                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3070                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3071     </table>
3072 END
3073 ;
3074                 &Header::closebox();
3075         }
3076
3077         if ($errormessage) {
3078                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3079         } else {
3080                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3081                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3082                 print "<input type='hidden' name='KEY' value='$key' />";
3083                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3084         }
3085         &Header::closebigbox();
3086         &Header::closepage();
3087         exit(0);
3088
3089
3090 ##
3091 ### Accept IPFire n2n Package Settings
3092 ###
3093
3094   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3095
3096 ###
3097 ### Discard and Rollback IPFire n2n Package Settings
3098 ###
3099
3100   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3101
3102      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3103
3104 if ($confighash{$cgiparams{'KEY'}}) {
3105
3106      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3107      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3108      unlink ($certfile) or die "Removing $certfile fail: $!";
3109      unlink ($conffile) or die "Removing $conffile fail: $!";
3110      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3111      delete $confighash{$cgiparams{'KEY'}};
3112     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3113
3114      } else {
3115                 $errormessage = $Lang::tr{'invalid key'};
3116    }
3117
3118
3119 ###
3120 # m.a.d net2net
3121 ###
3122
3123
3124 ###
3125 ### Adding a new connection
3126 ###
3127 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3128          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3129          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3130
3131     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3132     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3133     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3134
3135     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3136                 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3137                     $errormessage = $Lang::tr{'invalid key'};
3138                     goto VPNCONF_END;
3139                 }
3140                 $cgiparams{'ENABLED'}                   = $confighash{$cgiparams{'KEY'}}[0];
3141                 $cgiparams{'NAME'}                              = $confighash{$cgiparams{'KEY'}}[1];
3142                 $cgiparams{'TYPE'}                              = $confighash{$cgiparams{'KEY'}}[3];
3143                 $cgiparams{'AUTH'}                      = $confighash{$cgiparams{'KEY'}}[4];
3144                 $cgiparams{'PSK'}                               = $confighash{$cgiparams{'KEY'}}[5];
3145                 $cgiparams{'SIDE'}                              = $confighash{$cgiparams{'KEY'}}[6];
3146                 $cgiparams{'LOCAL_SUBNET'}              = $confighash{$cgiparams{'KEY'}}[8];
3147                 $cgiparams{'REMOTE'}                    = $confighash{$cgiparams{'KEY'}}[10];
3148                 $cgiparams{'REMOTE_SUBNET'}     = $confighash{$cgiparams{'KEY'}}[11];
3149                 $cgiparams{'OVPN_MGMT'}                 = $confighash{$cgiparams{'KEY'}}[22];
3150                 $cgiparams{'MSSFIX'}                    = $confighash{$cgiparams{'KEY'}}[23];
3151                 $cgiparams{'FRAGMENT'}          = $confighash{$cgiparams{'KEY'}}[24];
3152                 $cgiparams{'REMARK'}                    = $confighash{$cgiparams{'KEY'}}[25];
3153                 $cgiparams{'INTERFACE'}         = $confighash{$cgiparams{'KEY'}}[26];
3154                 $cgiparams{'OVPN_SUBNET'}               = $confighash{$cgiparams{'KEY'}}[27];
3155                 $cgiparams{'PROTOCOL'}                  = $confighash{$cgiparams{'KEY'}}[28];
3156                 $cgiparams{'DEST_PORT'}         = $confighash{$cgiparams{'KEY'}}[29];
3157                 $cgiparams{'COMPLZO'}                   = $confighash{$cgiparams{'KEY'}}[30];
3158                 $cgiparams{'MTU'}                               = $confighash{$cgiparams{'KEY'}}[31];
3159                 $cgiparams{'CHECK1'}            = $confighash{$cgiparams{'KEY'}}[32];
3160                 my $name=$cgiparams{'CHECK1'}   ;
3161                 $cgiparams{$name}                               = $confighash{$cgiparams{'KEY'}}[33];
3162                 $cgiparams{'RG'}                                = $confighash{$cgiparams{'KEY'}}[34];
3163                 $cgiparams{'CCD_DNS1'}                  = $confighash{$cgiparams{'KEY'}}[35];
3164                 $cgiparams{'CCD_DNS2'}                  = $confighash{$cgiparams{'KEY'}}[36];
3165                 $cgiparams{'CCD_WINS'}                  = $confighash{$cgiparams{'KEY'}}[37];
3166         } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3167         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3168
3169 #A.Marx CCD check iroute field and convert it to decimal
3170
3171         my @temp=();
3172         my %ccdroutehash=();
3173         my $keypoint=0;
3174         if ($cgiparams{'IR'} ne ''){
3175                 @temp = split("\n",$cgiparams{'IR'});
3176                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3177                 #find key to use
3178                 foreach my $key (keys %ccdroutehash) {
3179                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3180                                 $keypoint=$key;
3181                                 delete $ccdroutehash{$key};
3182                         }else{
3183                                 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3184                         }
3185                 }
3186                 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3187                 my $i=1;
3188                 my $val=0;
3189                 foreach $val (@temp){
3190                         chomp($val);
3191                         $val=~s/\s*$//g;
3192                         my($ip,$cidr) = split(/\//,$val);
3193                         $cidr=&General::iporsubtodec($cidr);
3194
3195                         #check if iroute exists in ccdroute
3196                         foreach my $key (keys %ccdroutehash) {
3197                                 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3198                                         if ($ccdroutehash{$key}[$oldiroute] eq "$ip/$cidr") {
3199                                                 $errormessage=$Lang::tr{'ccd err irouteexist'};
3200                                                 goto VPNCONF_ERROR;
3201                                         }
3202                                 }
3203                         }
3204
3205                         #check for existing network IP's
3206                         if ((&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')||
3207                                 (&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')||
3208                                 (&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')||
3209                                 (&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )){
3210                                 $errormessage="$ip USED FOR SYSTEM!";
3211                                 goto VPNCONF_ERROR;
3212                         }
3213
3214
3215
3216                         if (&General::validipandmask($val)){
3217                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3218                         }else{
3219                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3220                                 goto VPNCONF_ERROR;
3221                         }
3222                         $i++;
3223                 }
3224                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3225                 &writeserverconf;
3226         }else{
3227                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3228                 foreach my $key (keys %ccdroutehash) {
3229                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3230                                 delete $ccdroutehash{$key};
3231                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3232                                 &writeserverconf;
3233                         }
3234                 }
3235         }
3236         undef @temp;
3237         #check route field and convert it to decimal
3238         my %ccdroute2hash=();
3239         my $val=0;
3240         my $i=1;
3241
3242         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3243         if($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} || $cgiparams{'IFROUTE'} eq '') {
3244                         undef $cgiparams{'IFROUTE'};
3245                         foreach my $key (keys %ccdroute2hash){
3246                                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3247                                         delete $ccdroute2hash{$key};
3248                                 }
3249                         }
3250                         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3251         }else{
3252                 #find key to use
3253                 foreach my $key (keys %ccdroute2hash) {
3254                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3255                                 $keypoint=$key;
3256                                 delete $ccdroute2hash{$key};
3257                         }else{
3258                                 $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3259                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3260                                 &writeserverconf;
3261                         }
3262                 }
3263                 $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3264                 @temp = split(/\|/,$cgiparams{'IFROUTE'});
3265                 my %ownnet=();
3266                 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3267                 foreach $val (@temp){
3268                         chomp($val);
3269                         $val=~s/\s*$//g;
3270                         if ($val eq $Lang::tr{'green'})
3271                         {
3272                                 $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3273                         }
3274                         if ($val eq $Lang::tr{'blue'})
3275                         {
3276                                 $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3277                         }
3278                         if ($val eq $Lang::tr{'orange'})
3279                         {
3280                                 $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3281                         }
3282                         my ($ip,$cidr) = split (/\//, $val);
3283                         if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3284                         if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3285                         if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3286                         if (&General::validipandmask($val)){
3287                                 $val=$ip."/".&General::iporsubtodec($cidr);
3288                                 $ccdroute2hash{$keypoint}[$i] = $val;
3289                         }else{
3290                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3291                                 goto VPNCONF_ERROR;
3292                         }
3293                         $i++;
3294                 }
3295                 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3296         }
3297         #check dns1 ip
3298         if ($cgiparams{'CCD_DNS1'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS1'})) {
3299                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3300                         goto VPNCONF_ERROR;
3301         }
3302         #check dns2 ip
3303         if ($cgiparams{'CCD_DNS2'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS2'})) {
3304                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3305                         goto VPNCONF_ERROR;
3306         }
3307         #check wins ip
3308         if ($cgiparams{'CCD_WINS'} ne '' &&  ! &General::validip($cgiparams{'CCD_WINS'})) {
3309                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3310                         goto VPNCONF_ERROR;
3311         }
3312
3313
3314 #CCD End
3315
3316
3317  if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3318             $errormessage = $Lang::tr{'connection type is invalid'};
3319             if ($cgiparams{'TYPE'} eq 'net') {
3320       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3321             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3322       }
3323             goto VPNCONF_ERROR;
3324         }
3325
3326
3327         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3328             $errormessage = $Lang::tr{'name must only contain characters'};
3329       if ($cgiparams{'TYPE'} eq 'net') {
3330       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3331             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3332       }
3333       goto VPNCONF_ERROR;
3334   }
3335
3336         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3337             $errormessage = $Lang::tr{'name is invalid'};
3338             if ($cgiparams{'TYPE'} eq 'net') {
3339       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3340             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3341       }
3342             goto VPNCONF_ERROR;
3343         }
3344
3345         if (length($cgiparams{'NAME'}) >60) {
3346             $errormessage = $Lang::tr{'name too long'};
3347             if ($cgiparams{'TYPE'} eq 'net') {
3348       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3349             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3350       }
3351             goto VPNCONF_ERROR;
3352         }
3353
3354 ###
3355 # m.a.d net2net
3356 ###
3357
3358 if ($cgiparams{'TYPE'} eq 'net') {
3359
3360     if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
3361                         $errormessage = $Lang::tr{'openvpn destination port used'};
3362                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3363             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3364       goto VPNCONF_ERROR;
3365                 }
3366
3367     if ($cgiparams{'DEST_PORT'} eq  '') {
3368                         $errormessage = $Lang::tr{'openvpn destination port used'};
3369                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3370             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3371       goto VPNCONF_ERROR;
3372                 }
3373
3374     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
3375                         $errormessage = $Lang::tr{'openvpn subnet is used'};
3376                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3377             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3378                         goto VPNCONF_ERROR;
3379                 }
3380
3381           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3382             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3383             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3384             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3385             goto VPNCONF_ERROR;
3386     }
3387
3388     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3389             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3390             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3391             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3392             goto VPNCONF_ERROR;
3393     }
3394
3395     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
3396                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3397                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3398             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3399                   goto VPNCONF_ERROR;
3400                 }
3401
3402     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
3403                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3404                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3405             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3406                   goto VPNCONF_ERROR;
3407                 }
3408
3409     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
3410                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
3411                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3412             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3413                   goto VPNCONF_ERROR;
3414                 }
3415
3416     if ($cgiparams{'OVPN_MGMT'} eq  '') {
3417                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
3418                 }
3419
3420 }
3421
3422 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
3423 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
3424 #           goto VPNCONF_ERROR;
3425 #       }
3426
3427         # Check if there is no other entry with this name
3428         if (! $cgiparams{'KEY'}) {
3429             foreach my $key (keys %confighash) {
3430                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
3431                     $errormessage = $Lang::tr{'a connection with this name already exists'};
3432                     if ($cgiparams{'TYPE'} eq 'net') {
3433         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3434               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3435         }
3436                     goto VPNCONF_ERROR;
3437                 }
3438             }
3439         }
3440
3441         if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
3442             $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3443             if ($cgiparams{'TYPE'} eq 'net') {
3444       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3445             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3446       }
3447             goto VPNCONF_ERROR;
3448         }
3449
3450         if ($cgiparams{'REMOTE'}) {
3451             if (! &General::validip($cgiparams{'REMOTE'})) {
3452                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
3453                     $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3454                     if ($cgiparams{'TYPE'} eq 'net') {
3455         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3456               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3457         }
3458                     goto VPNCONF_ERROR;
3459                 } else {
3460                     if (&valid_dns_host($cgiparams{'REMOTE'})) {
3461                         $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
3462                         if ($cgiparams{'TYPE'} eq 'net') {
3463
3464       }
3465                     }
3466                 }
3467             }
3468         }
3469         if ($cgiparams{'TYPE'} ne 'host') {
3470             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
3471                     $errormessage = $Lang::tr{'local subnet is invalid'};
3472                     if ($cgiparams{'TYPE'} eq 'net') {
3473               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3474                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3475               }
3476                         goto VPNCONF_ERROR;}
3477         }
3478         # Check if there is no other entry without IP-address and PSK
3479         if ($cgiparams{'REMOTE'} eq '') {
3480             foreach my $key (keys %confighash) {
3481                 if(($cgiparams{'KEY'} ne $key) &&
3482                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
3483                     $confighash{$key}[10] eq '') {
3484                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
3485                         goto VPNCONF_ERROR;
3486                 }
3487             }
3488         }
3489         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
3490                 $errormessage = $Lang::tr{'remote subnet is invalid'};
3491                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3492                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3493                 goto VPNCONF_ERROR;
3494         }
3495
3496         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
3497             $errormessage = $Lang::tr{'invalid input'};
3498             goto VPNCONF_ERROR;
3499         }
3500         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
3501             $errormessage = $Lang::tr{'invalid input'};
3502             goto VPNCONF_ERROR;
3503         }
3504
3505 #fixplausi
3506         if ($cgiparams{'AUTH'} eq 'psk')  {
3507 #           if (! length($cgiparams{'PSK'}) ) {
3508 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
3509 #               goto VPNCONF_ERROR;
3510 #           }
3511 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
3512 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
3513 #               goto VPNCONF_ERROR;
3514 #           }
3515         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
3516             if ($cgiparams{'KEY'}) {
3517                 $errormessage = $Lang::tr{'cant change certificates'};
3518                 goto VPNCONF_ERROR;
3519             }
3520             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3521                 $errormessage = $Lang::tr{'there was no file upload'};
3522                 goto VPNCONF_ERROR;
3523             }
3524
3525             # Move uploaded certificate request to a temporary file
3526             (my $fh, my $filename) = tempfile( );
3527             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3528                 $errormessage = $!;
3529                 goto VPNCONF_ERROR;
3530             }
3531
3532             # Sign the certificate request and move it
3533             # Sign the host certificate request
3534             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3535                 '-batch', '-notext',
3536                 '-in', $filename,
3537                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3538                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3539             if ($?) {
3540                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3541                 unlink ($filename);
3542                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3543                 &newcleanssldatabase();
3544                 goto VPNCONF_ERROR;
3545             } else {
3546                 unlink ($filename);
3547                 &deletebackupcert();
3548             }
3549
3550             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3551             $temp =~ /Subject:.*CN=(.*)[\n]/;
3552             $temp = $1;
3553             $temp =~ s+/Email+, E+;
3554             $temp =~ s/ ST=/ S=/;
3555             $cgiparams{'CERT_NAME'} = $temp;
3556             $cgiparams{'CERT_NAME'} =~ s/,//g;
3557             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3558             if ($cgiparams{'CERT_NAME'} eq '') {
3559                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3560                 goto VPNCONF_ERROR;
3561             }
3562         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
3563             if ($cgiparams{'KEY'}) {
3564                 $errormessage = $Lang::tr{'cant change certificates'};
3565                 goto VPNCONF_ERROR;
3566             }
3567             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3568                 $errormessage = $Lang::tr{'there was no file upload'};
3569                 goto VPNCONF_ERROR;
3570             }
3571             # Move uploaded certificate to a temporary file
3572             (my $fh, my $filename) = tempfile( );
3573             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3574                 $errormessage = $!;
3575                 goto VPNCONF_ERROR;
3576             }
3577
3578             # Verify the certificate has a valid CA and move it
3579             my $validca = 0;
3580             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
3581             if ($test =~ /: OK/) {
3582                 $validca = 1;
3583             } else {
3584                 foreach my $key (keys %cahash) {
3585                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
3586                     if ($test =~ /: OK/) {
3587                         $validca = 1;
3588                     }
3589                 }
3590             }
3591             if (! $validca) {
3592                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
3593                 unlink ($filename);
3594                 goto VPNCONF_ERROR;
3595             } else {
3596                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3597                 if ($? ne 0) {
3598                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3599                     unlink ($filename);
3600                     goto VPNCONF_ERROR;
3601                 }
3602             }
3603
3604             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3605             $temp =~ /Subject:.*CN=(.*)[\n]/;
3606             $temp = $1;
3607             $temp =~ s+/Email+, E+;
3608             $temp =~ s/ ST=/ S=/;
3609             $cgiparams{'CERT_NAME'} = $temp;
3610             $cgiparams{'CERT_NAME'} =~ s/,//g;
3611             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3612             if ($cgiparams{'CERT_NAME'} eq '') {
3613                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3614                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3615                 goto VPNCONF_ERROR;
3616             }
3617         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
3618             if ($cgiparams{'KEY'}) {
3619                 $errormessage = $Lang::tr{'cant change certificates'};
3620                 goto VPNCONF_ERROR;
3621             }
3622             # Validate input since the form was submitted
3623             if (length($cgiparams{'CERT_NAME'}) >60) {
3624                 $errormessage = $Lang::tr{'name too long'};
3625                 goto VPNCONF_ERROR;
3626             }
3627             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3628                 $errormessage = $Lang::tr{'invalid input for name'};
3629                 goto VPNCONF_ERROR;
3630             }
3631             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3632                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3633                 goto VPNCONF_ERROR;
3634             }
3635             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3636                 $errormessage = $Lang::tr{'e-mail address too long'};
3637                 goto VPNCONF_ERROR;
3638             }
3639             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3640                 $errormessage = $Lang::tr{'invalid input for department'};
3641                 goto VPNCONF_ERROR;
3642             }
3643             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3644                 $errormessage = $Lang::tr{'organization too long'};
3645                 goto VPNCONF_ERROR;
3646             }
3647             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3648                 $errormessage = $Lang::tr{'invalid input for organization'};
3649                 goto VPNCONF_ERROR;
3650             }
3651             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3652                 $errormessage = $Lang::tr{'invalid input for city'};
3653                 goto VPNCONF_ERROR;
3654             }
3655             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3656                 $errormessage = $Lang::tr{'invalid input for state or province'};
3657                 goto VPNCONF_ERROR;
3658             }
3659             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3660                 $errormessage = $Lang::tr{'invalid input for country'};
3661                 goto VPNCONF_ERROR;
3662             }
3663             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3664                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3665                     $errormessage = $Lang::tr{'password too short'};
3666                     goto VPNCONF_ERROR;
3667                 }
3668             }
3669             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3670                 $errormessage = $Lang::tr{'passwords do not match'};
3671                 goto VPNCONF_ERROR;
3672             }
3673
3674             # Replace empty strings with a .
3675             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3676             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3677             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3678
3679             # Create the Host certificate request client
3680             my $pid = open(OPENSSL, "|-");
3681             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3682             if ($pid) { # parent
3683                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3684                 print OPENSSL "$state\n";
3685                 print OPENSSL "$city\n";
3686                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3687                 print OPENSSL "$ou\n";
3688                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3689                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3690                 print OPENSSL ".\n";
3691                 print OPENSSL ".\n";
3692                 close (OPENSSL);
3693                 if ($?) {
3694                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3695                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3696                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3697                     goto VPNCONF_ERROR;
3698                 }
3699             } else {    # child
3700                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3701                         '-newkey', 'rsa:1024',
3702                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3703                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3704                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3705                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3706                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3707                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3708                     goto VPNCONF_ERROR;
3709                 }
3710             }
3711
3712             # Sign the host certificate request
3713             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3714                 '-batch', '-notext',
3715                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3716                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3717                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3718             if ($?) {
3719                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3720                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3721                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3722                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3723                 &newcleanssldatabase();
3724                 goto VPNCONF_ERROR;
3725             } else {
3726                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3727                 &deletebackupcert();
3728             }
3729
3730             # Create the pkcs12 file
3731             system('/usr/bin/openssl', 'pkcs12', '-export',
3732                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3733                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3734                 '-name', $cgiparams{'NAME'},
3735                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3736                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3737                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3738                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3739             if ($?) {
3740                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3741                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3742                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3743                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3744                 goto VPNCONF_ERROR;
3745             } else {
3746                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3747             }
3748         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3749             ;# Nothing, just editing
3750         } else {
3751             $errormessage = $Lang::tr{'invalid input for authentication method'};
3752             goto VPNCONF_ERROR;
3753         }
3754
3755         # Check if there is no other entry with this common name
3756         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3757             foreach my $key (keys %confighash) {
3758                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3759                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3760                     goto VPNCONF_ERROR;
3761                 }
3762             }
3763         }
3764
3765         # Save the config
3766         my $key = $cgiparams{'KEY'};
3767
3768         if (! $key) {
3769             $key = &General::findhasharraykey (\%confighash);
3770             foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";}
3771         }
3772         $confighash{$key}[0]            = $cgiparams{'ENABLED'};
3773         $confighash{$key}[1]            = $cgiparams{'NAME'};
3774         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3775             $confighash{$key}[2]        = $cgiparams{'CERT_NAME'};
3776         }
3777
3778         $confighash{$key}[3]            = $cgiparams{'TYPE'};
3779         if ($cgiparams{'AUTH'} eq 'psk') {
3780             $confighash{$key}[4]        = 'psk';
3781             $confighash{$key}[5]        = $cgiparams{'PSK'};
3782         } else {
3783             $confighash{$key}[4]        = 'cert';
3784         }
3785         if ($cgiparams{'TYPE'} eq 'net') {
3786             $confighash{$key}[6]        = $cgiparams{'SIDE'};
3787             $confighash{$key}[11]       = $cgiparams{'REMOTE_SUBNET'};
3788         }
3789         $confighash{$key}[8]            = $cgiparams{'LOCAL_SUBNET'};
3790         $confighash{$key}[10]           = $cgiparams{'REMOTE'};
3791   if ($cgiparams{'OVPN_MGMT'} eq '') {
3792         $confighash{$key}[22]           = $confighash{$key}[29];
3793   } else {
3794         $confighash{$key}[22]           = $cgiparams{'OVPN_MGMT'};
3795   }
3796         $confighash{$key}[23]           = $cgiparams{'MSSFIX'};
3797         $confighash{$key}[24]           = $cgiparams{'FRAGMENT'};
3798         $confighash{$key}[25]           = $cgiparams{'REMARK'};
3799         $confighash{$key}[26]           = $cgiparams{'INTERFACE'};
3800 # new fields
3801         $confighash{$key}[27]           = $cgiparams{'OVPN_SUBNET'};
3802         $confighash{$key}[28]           = $cgiparams{'PROTOCOL'};
3803         $confighash{$key}[29]           = $cgiparams{'DEST_PORT'};
3804         $confighash{$key}[30]           = $cgiparams{'COMPLZO'};
3805         $confighash{$key}[31]           = $cgiparams{'MTU'};
3806         $confighash{$key}[32]           = $cgiparams{'CHECK1'};
3807         my $name=$cgiparams{'CHECK1'};
3808         $confighash{$key}[33]           = $cgiparams{$name};
3809         $confighash{$key}[34]           = $cgiparams{'RG'};
3810         $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
3811         $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
3812         $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
3813
3814
3815         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3816
3817         if ($cgiparams{'CHECK1'} ){
3818
3819                 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
3820                 my ($a,$b,$c,$d) = split (/\./,$ccdip);
3821                         if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";}
3822                         open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
3823                         print CCDRWCONF "# OpenVPN Clientconfig from CCD extension by Copymaster#\n\n";
3824                         if($cgiparams{'CHECK1'} eq 'dynamic'){
3825                                 print CCDRWCONF "#This client uses the dynamic pool\n";
3826                         }else{
3827                                 print CCDRWCONF "#Ip address client and Server\n";
3828                                 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
3829                         }
3830                         if ($confighash{$key}[34] eq 'on'){
3831                                 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
3832                                 print CCDRWCONF "push redirect-gateway\n";
3833                         }
3834                         if ($cgiparams{'IR'} ne ''){
3835                                 print CCDRWCONF "\n#Client routes these Networks (behind Client)\n";
3836                                 foreach my $key (keys %ccdroutehash){
3837                                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
3838                                                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
3839                                                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
3840                                                         print CCDRWCONF "iroute $a $b\n";
3841                                                 }
3842                                         }
3843                                 }
3844                         }
3845                         if ($cgiparams{'IFROUTE'} ne ''){
3846                                 print CCDRWCONF "\n#Client gets routes to these Networks (behind IPFIRE)\n";
3847                                 foreach my $key (keys %ccdroute2hash){
3848                                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
3849                                                 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
3850                                                         if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
3851                                                                 my %blue=();
3852                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
3853                                                                 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS}  $blue{BLUE_NETMASK}\n";
3854                                                         }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
3855                                                                 my %orange=();
3856                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
3857                                                                 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS}  $orange{ORANGE_NETMASK}\n";
3858                                                         }else{
3859                                                                 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
3860                                                                 print CCDRWCONF "push \"route $a $b\"\n";
3861                                                         }
3862                                                 }
3863                                         }
3864                                 }
3865                         }
3866                         if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
3867                         if($cgiparams{'CCD_DNS1'} ne ''){
3868                                 print CCDRWCONF "\n#Client gets these Nameservers\n";
3869                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
3870                         }
3871                         if($cgiparams{'CCD_DNS2'} ne ''){
3872                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
3873                         }
3874                         if($cgiparams{'CCD_WINS'} ne ''){
3875                                 print CCDRWCONF "\n#Client gets this WINS server\n";
3876                                 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
3877                         }
3878                         close CCDRWCONF;
3879         }
3880
3881 ###
3882 # m.a.d n2n begin
3883 ###
3884
3885         if ($cgiparams{'TYPE'} eq 'net') {
3886
3887         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3888   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
3889
3890   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3891         my $key = $cgiparams{'KEY'};
3892         if (! $key) {
3893             $key = &General::findhasharraykey (\%confighash);
3894             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3895             }
3896   $confighash{$key}[0] = 'on';
3897   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3898
3899   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
3900          }
3901   }
3902
3903 ###
3904 # m.a.d n2n end
3905 ###
3906
3907         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
3908             $cgiparams{'KEY'} = $key;
3909             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
3910         }
3911         goto VPNCONF_END;
3912     } else {
3913         $cgiparams{'ENABLED'} = 'on';
3914 ###
3915 # m.a.d n2n begin
3916 ###
3917         $cgiparams{'MSSFIX'} = 'on';
3918         $cgiparams{'FRAGMENT'} = '1300';
3919 ###
3920 # m.a.d n2n end
3921 ###
3922         $cgiparams{'SIDE'} = 'left';
3923         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
3924             $cgiparams{'AUTH'} = 'psk';
3925         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3926             $cgiparams{'AUTH'} = 'certfile';
3927         } else {
3928             $cgiparams{'AUTH'} = 'certgen';
3929         }
3930         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
3931         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
3932         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
3933         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
3934         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
3935     }
3936
3937     VPNCONF_ERROR:
3938     $checked{'ENABLED'}{'off'} = '';
3939     $checked{'ENABLED'}{'on'} = '';
3940     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3941     $checked{'ENABLED_BLUE'}{'off'} = '';
3942     $checked{'ENABLED_BLUE'}{'on'} = '';
3943     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3944     $checked{'ENABLED_ORANGE'}{'off'} = '';
3945     $checked{'ENABLED_ORANGE'}{'on'} = '';
3946     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3947
3948
3949     $checked{'EDIT_ADVANCED'}{'off'} = '';
3950     $checked{'EDIT_ADVANCED'}{'on'} = '';
3951     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
3952
3953     $selected{'SIDE'}{'server'} = '';
3954     $selected{'SIDE'}{'client'} = '';
3955     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
3956
3957     $selected{'PROTOCOL'}{'udp'} = '';
3958     $selected{'PROTOCOL'}{'tcp'} = '';
3959     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
3960
3961
3962     $checked{'AUTH'}{'psk'} = '';
3963     $checked{'AUTH'}{'certreq'} = '';
3964     $checked{'AUTH'}{'certgen'} = '';
3965     $checked{'AUTH'}{'certfile'} = '';
3966     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
3967
3968     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
3969
3970     $checked{'COMPLZO'}{'off'} = '';
3971     $checked{'COMPLZO'}{'on'} = '';
3972     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
3973
3974     $checked{'MSSFIX'}{'off'} = '';
3975     $checked{'MSSFIX'}{'on'} = '';
3976     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3977
3978
3979     if (1) {
3980         &Header::showhttpheaders();
3981         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
3982         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3983         if ($errormessage) {
3984             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3985             print "<class name='base'>$errormessage";
3986             print "&nbsp;</class>";
3987             &Header::closebox();
3988         }
3989
3990         if ($warnmessage) {
3991             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
3992             print "<class name='base'>$warnmessage";
3993             print "&nbsp;</class>";
3994             &Header::closebox();
3995         }
3996
3997         print "<form method='post' enctype='multipart/form-data'>";
3998         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
3999
4000         if ($cgiparams{'KEY'}) {
4001             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4002             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4003         }
4004
4005         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4006         print "<table width='100%'  border='0'>\n";
4007
4008
4009
4010         print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}: </td>";
4011
4012         if ($cgiparams{'TYPE'} eq 'host') {
4013             if ($cgiparams{'KEY'}) {
4014                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4015             } else {
4016
4017                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4018             }
4019 #           print "<tr><td>$Lang::tr{'interface'}</td>";
4020 #           print "<td><select name='INTERFACE'>";
4021 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4022 #           if ($netsettings{'BLUE_DEV'} ne '') {
4023 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4024 #           }
4025 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4026 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4027 #           print "</select></td></tr>";
4028 #           print <<END
4029         } else {
4030             print "<input type='hidden' name='INTERFACE' value='red' />";
4031             if ($cgiparams{'KEY'}) {
4032                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4033             } else {
4034                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4035             }
4036
4037
4038
4039             print <<END
4040                     <td width='25%'>&nbsp;</td>
4041                     <td width='25%'>&nbsp;</td></tr>
4042                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4043                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4044                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
4045                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4046                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
4047                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
4048                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4049                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
4050                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
4051                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
4052                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
4053                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4054
4055      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4056                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4057
4058         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4059                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
4060                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
4061                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4062
4063                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
4064                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4065         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4066
4067           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
4068                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4069                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4070
4071                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
4072                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4073         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4074
4075         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
4076                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4077         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
4078
4079 END
4080 ;
4081         }
4082
4083         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
4084         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4085
4086         if ($cgiparams{'TYPE'} eq 'host') {
4087       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4088     }
4089
4090                 print"</tr></table><br><br>";
4091 #A.Marx CCD new client
4092
4093             print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4094             my %ccdconfhash=();
4095             my %ccdroutehash=();
4096             my %ccdroute2hash=();
4097             my %vpnnet=();
4098             my $vpnip;
4099             &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4100             $vpnip=$vpnnet{'DOVPN_SUBNET'};
4101             &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4102             my @ccdconf=();
4103                 my $count=0;
4104                 my $checked;
4105                 $checked{'check1'}{'off'} = '';
4106             $checked{'check1'}{'on'} = '';
4107             $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4108             print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4109             print"</td></tr></table><br><br>";
4110                 my $name=$cgiparams{'CHECK1'};
4111                 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4112
4113         if (! -z "${General::swroot}/ovpn/ccd.conf"){
4114                 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4115                 foreach my $key (keys %ccdconfhash) {
4116                         $count++;
4117                         @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4118                         if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4119                         print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4120                         &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4121                         print"</td></tr>";
4122                 }
4123                 print "</table><br><br><hr><br><br>";
4124         }
4125 # ccd end
4126         &Header::closebox();
4127         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4128
4129                 } elsif (! $cgiparams{'KEY'}) {
4130
4131
4132             my $disabled='';
4133             my $cakeydisabled='';
4134             my $cacrtdisabled='';
4135             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4136             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4137
4138             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4139
4140
4141  if ($cgiparams{'TYPE'} eq 'host') {
4142
4143 print <<END
4144             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4145
4146             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4147             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4148             <tr><td colspan='3'>&nbsp;</td></tr>
4149       <tr><td colspan='3'><hr /></td></tr>
4150       <tr><td colspan='3'>&nbsp;</td></tr>
4151             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4152             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4153             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4154             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4155             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4156             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4157             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4158             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4159 END
4160 ;
4161
4162 ###
4163 # m.a.d net2net
4164 ###
4165
4166 } else {
4167
4168 print <<END
4169             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4170
4171             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4172             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4173             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4174             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4175             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4176             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4177             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4178             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4179
4180
4181 END
4182 ;
4183
4184 }
4185
4186 ###
4187 # m.a.d net2net
4188 ###
4189
4190             foreach my $country (sort keys %{Countries::countries}) {
4191                 print "<option value='$Countries::countries{$country}'";
4192                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4193                     print " selected='selected'";
4194                 }
4195                 print ">$country</option>";
4196             }
4197 ###
4198 # m.a.d net2net
4199 ###
4200
4201 if ($cgiparams{'TYPE'} eq 'host') {
4202             print <<END
4203             </select></td></tr>
4204
4205         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
4206         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4207    <tr><td>&nbsp;</td>
4208                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
4209                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
4210             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
4211                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
4212      <tr><td colspan='3'>&nbsp;</td></tr>
4213      <tr><td colspan='3'><hr /></td></tr>
4214      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4215      </table>
4216 END
4217 }else{
4218             print <<END
4219             </select></td></tr>
4220    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4221          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4222          <tr><td colspan='3'><hr /></td></tr>
4223          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4224        </table>
4225
4226 END
4227 }
4228
4229 ###
4230 # m.a.d net2net
4231 ###
4232             ;
4233             &Header::closebox();
4234
4235         }
4236             print"<br><br>";
4237             &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
4238
4239 #A.Marx CCD new client
4240
4241         print <<END;
4242         <table border='0' width='100%'>
4243         <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
4244         <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
4245         <tr><td colspan='4'>&nbsp</td></tr>
4246         <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
4247 END
4248
4249         if ($cgiparams{'IR'} ne ''){
4250                 print $cgiparams{'IR'};
4251         }else{
4252                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4253                 foreach my $key (keys %ccdroutehash) {
4254                         if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
4255                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
4256                                                 if ($ccdroutehash{$key}[$i] ne ''){
4257                                                         print $ccdroutehash{$key}[$i]."\n";
4258                                                 }
4259                                                 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
4260                                 }
4261                         }
4262                 }
4263         }
4264
4265         print <<END;
4266 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
4267         <tr><td colspan='4'><br></td></tr>
4268         <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
4269 END
4270
4271         our @current = ();
4272                 open(FILE, "${General::swroot}/main/routing") ;
4273             @current = <FILE>;
4274             close (FILE);
4275                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
4276                 my $set=0;
4277                 my $selorange=0;
4278                 my $selblue=0;
4279                 my $helpblue=0;
4280                 my $helporange=0;
4281                 print"<option>$Lang::tr{'ccd none'}</option>";
4282                 print"<option selected>$Lang::tr{'green'}</option>";
4283
4284                 foreach my $line (@current) {
4285                         chomp($line);                           # remove newline
4286                         my @temp=split(/\,/,$line);
4287                         $temp[1] = '' unless defined $temp[1]; # not always populated
4288                         my ($a,$b) = split(/\//,$temp[1]);
4289                         $temp[1] = $a."/".&General::iporsubtocidr($b);
4290                         foreach my $key (keys %ccdroute2hash) {
4291                                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4292                                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4293
4294                                                         if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
4295                                                                 $set=1;
4296                                                         }
4297                                                         if (&haveBlueNet()){
4298                                                                 if($netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'} eq $ccdroute2hash{$key}[$i])) {
4299                                                                 $selblue=1;
4300
4301                                                                 }
4302                                                         }
4303                                                         if (&haveOrangeNet()){
4304                                                                 if($netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) eq $ccdroute2hash{$key}[$i]) {
4305                                                                         $selorange=1;
4306                                                                 }
4307                                                         }
4308                                                 }
4309                                         }
4310                                 }
4311                                 if ($set == '1'){ print"<option selected>$temp[1]</option>";$set=0;}else{print"<option>$temp[1]</option>";}
4312                                 if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
4313                                 if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
4314                         }
4315         print<<END
4316         </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
4317         <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
4318         <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
4319
4320 END
4321 ;
4322      &Header::closebox();
4323
4324         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4325         if ($cgiparams{'KEY'}) {
4326 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
4327         }
4328         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
4329         &Header::closebigbox();
4330         &Header::closepage();
4331         exit (0);
4332     }
4333     VPNCONF_END:
4334 }
4335
4336 #    SETTINGS_ERROR:
4337 ###
4338 ### Default status page
4339 ###
4340     %cgiparams = ();
4341     %cahash = ();
4342     %confighash = ();
4343     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
4344     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
4345     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4346
4347     my @status = `/bin/cat /var/log/ovpnserver.log`;
4348
4349     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
4350                 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
4351                     my $ipaddr = <IPADDR>;
4352                     close IPADDR;
4353                     chomp ($ipaddr);
4354                     $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
4355                     if ($cgiparams{'VPN_IP'} eq '') {
4356                                 $cgiparams{'VPN_IP'} = $ipaddr;
4357                     }
4358                 }
4359     }
4360
4361 #default setzen
4362     if ($cgiparams{'DCIPHER'} eq '') {
4363         $cgiparams{'DCIPHER'} =  'BF-CBC';
4364     }
4365     if ($cgiparams{'DDEST_PORT'} eq '') {
4366         $cgiparams{'DDEST_PORT'} =  '1194';
4367     }
4368     if ($cgiparams{'DMTU'} eq '') {
4369         $cgiparams{'DMTU'} =  '1400';
4370     }
4371     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
4372         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
4373     }
4374         $checked{'ENABLED'}{'off'} = '';
4375     $checked{'ENABLED'}{'on'} = '';
4376     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4377     $checked{'ENABLED_BLUE'}{'off'} = '';
4378     $checked{'ENABLED_BLUE'}{'on'} = '';
4379     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4380     $checked{'ENABLED_ORANGE'}{'off'} = '';
4381     $checked{'ENABLED_ORANGE'}{'on'} = '';
4382     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4383     $selected{'DDEVICE'}{'tun'} = '';
4384     $selected{'DDEVICE'}{'tap'} = '';
4385     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
4386
4387     $selected{'DPROTOCOL'}{'udp'} = '';
4388     $selected{'DPROTOCOL'}{'tcp'} = '';
4389     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
4390
4391     $selected{'DCIPHER'}{'DES-CBC'} = '';
4392     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4393     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4394     $selected{'DCIPHER'}{'DESX-CBC'} = '';
4395     $selected{'DCIPHER'}{'RC2-CBC'} = '';
4396     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
4397     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
4398     $selected{'DCIPHER'}{'BF-CBC'} = '';
4399     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4400     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4401     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4402     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4403     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4404     $checked{'DCOMPLZO'}{'off'} = '';
4405     $checked{'DCOMPLZO'}{'on'} = '';
4406     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
4407 # m.a.d
4408     $checked{'MSSFIX'}{'off'} = '';
4409     $checked{'MSSFIX'}{'on'} = '';
4410     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4411 #new settings
4412     &Header::showhttpheaders();
4413     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
4414     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4415
4416     if ($errormessage) {
4417         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4418         print "<class name='base'>$errormessage\n";
4419         print "&nbsp;</class>\n";
4420         &Header::closebox();
4421     }
4422
4423     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
4424     my $srunning = "no";
4425     my $activeonrun = "";
4426     if ( -e "/var/run/openvpn.pid"){
4427         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
4428         $srunning ="yes";
4429         $activeonrun = "";
4430     } else {
4431         $activeonrun = "disabled='disabled'";
4432     }
4433     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
4434         print <<END
4435     <table width='100%' border=0>
4436     <form method='post'>
4437     <td width='25%'>&nbsp;</td>
4438     <td width='25%'>&nbsp;</td>
4439     <td width='25%'>&nbsp;</td></tr>
4440     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
4441     <td align='left'>$sactive</td>
4442     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
4443     <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
4444 END
4445 ;
4446     if (&haveBlueNet()) {
4447         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
4448         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
4449     }
4450     if (&haveOrangeNet()) {
4451         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
4452         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
4453     }
4454     print <<END
4455     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
4456         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
4457     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
4458         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
4459                                 <!-- this is still not working
4460                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
4461     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4462         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
4463                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
4464         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4465         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
4466     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
4467         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
4468     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4469         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
4470         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
4471         <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
4472                                    <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
4473                                    <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
4474                                    <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
4475                                    <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
4476                                    <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
4477                                    <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
4478                                    <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
4479                                    <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
4480                                    <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
4481                                    <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
4482                                    <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td></tr>
4483                                    <tr><td colspan='4'><hr /></td></tr>
4484 END
4485 ;
4486
4487     if ( $srunning eq "yes" ) {
4488         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
4489         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4490         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4491         print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
4492     } else{
4493         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4494         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4495         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4496         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
4497              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
4498              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
4499              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
4500             (( $cgiparams{'ENABLED'} eq 'on') ||
4501             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4502             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
4503             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
4504         } else {
4505             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
4506         }
4507     }
4508     print "</form></table>";
4509     &Header::closebox();
4510     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
4511     print <<EOF#'
4512     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
4513     <tr>
4514         <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
4515         <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
4516         <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
4517     </tr>
4518 EOF
4519     ;
4520     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
4521         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
4522         $casubject    =~ /Subject: (.*)[\n]/;
4523         $casubject    = $1;
4524         $casubject    =~ s+/Email+, E+;
4525         $casubject    =~ s/ ST=/ S=/;
4526
4527         print <<END
4528         <tr bgcolor='$color{'color22'}'>
4529         <td class='base'>$Lang::tr{'root certificate'}</td>
4530         <td class='base'>$casubject</td>
4531         <form method='post' name='frmrootcrta'><td width='3%' align='center'>
4532             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
4533             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
4534         </td></form>
4535         <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
4536             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
4537             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
4538         </td></form>
4539         <td width='4%'>&nbsp;</td></tr>
4540 END
4541         ;
4542     } else {
4543         # display rootcert generation buttons
4544         print <<END
4545         <tr bgcolor='$color{'color22'}'>
4546         <td class='base'>$Lang::tr{'root certificate'}:</td>
4547         <td class='base'>$Lang::tr{'not present'}</td>
4548         <td colspan='3'>&nbsp;</td></tr>
4549 END
4550         ;
4551     }
4552
4553     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
4554         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
4555         $hostsubject    =~ /Subject: (.*)[\n]/;
4556         $hostsubject    = $1;
4557         $hostsubject    =~ s+/Email+, E+;
4558         $hostsubject    =~ s/ ST=/ S=/;
4559
4560         print <<END
4561         <tr bgcolor='$color{'color20'}'>
4562         <td class='base'>$Lang::tr{'host certificate'}</td>
4563         <td class='base'>$hostsubject</td>
4564         <form method='post' name='frmhostcrta'><td width='3%' align='center'>
4565             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
4566             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
4567         </td></form>
4568         <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
4569             <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
4570             <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
4571         </td></form>
4572         <td width='4%'>&nbsp;</td></tr>
4573 END
4574         ;
4575     } else {
4576         # Nothing
4577         print <<END
4578         <tr bgcolor='$color{'color20'}'>
4579         <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
4580         <td class='base'>$Lang::tr{'not present'}</td>
4581         </td><td colspan='3'>&nbsp;</td></tr>
4582 END
4583         ;
4584     }
4585
4586     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4587         print "<tr><td colspan='5' align='center'><form method='post'>";
4588         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
4589         print "</form></td></tr>\n";
4590     }
4591
4592     if (keys %cahash > 0) {
4593         foreach my $key (keys %cahash) {
4594             if (($key + 1) % 2) {
4595                 print "<tr bgcolor='$color{'color20'}'>\n";
4596             } else {
4597                 print "<tr bgcolor='$color{'color22'}'>\n";
4598             }
4599             print "<td class='base'>$cahash{$key}[0]</td>\n";
4600             print "<td class='base'>$cahash{$key}[1]</td>\n";
4601             print <<END
4602             <form method='post' name='cafrm${key}a'><td align='center'>
4603                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
4604                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
4605                 <input type='hidden' name='KEY' value='$key' />
4606             </td></form>
4607             <form method='post' name='cafrm${key}b'><td align='center'>
4608                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
4609                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
4610                 <input type='hidden' name='KEY' value='$key' />
4611             </td></form>
4612             <form method='post' name='cafrm${key}c'><td align='center'>
4613                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
4614                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
4615                 <input type='hidden' name='KEY' value='$key' />
4616             </td></form></tr>
4617 END
4618             ;
4619         }
4620     }
4621
4622     print "</table>";
4623
4624     # If the file contains entries, print Key to action icons
4625     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
4626     print <<END
4627     <table>
4628     <tr>
4629         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4630         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4631         <td class='base'>$Lang::tr{'show certificate'}</td>
4632         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
4633         <td class='base'>$Lang::tr{'download certificate'}</td>
4634     </tr>
4635     </table>
4636 END
4637 ;
4638     }
4639
4640 print <<END
4641 <form method='post' enctype='multipart/form-data'>
4642 <table width='100%' border='0'>
4643 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td><td nowrap='nowrap' width='8%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'/></td><td nowrap='nowrap' align='right'><input type='file' name='FH' size='25' /><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td></tr>
4644 <tr><td colspan='4'><hr /></td></tr>
4645 <tr align='right'><td colspan='4' align='right' width='80%'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td></tr>
4646 </table>
4647 END
4648 ;
4649
4650
4651     &Header::closebox();
4652     if ( $srunning eq "yes" ) {
4653         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
4654     }else{
4655         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
4656     }
4657     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
4658
4659 ###
4660 # m.a.d net2net
4661 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
4662 ###
4663
4664     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
4665     print <<END
4666
4667
4668     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
4669 <tr>
4670     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
4671     <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
4672     <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'network'}</b></td>
4673     <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
4674     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
4675     <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
4676 </tr>
4677 END
4678         ;
4679         my $id = 0;
4680         my $gif;
4681          foreach my $key (sort { uc($confighash{$a}[1]) cmp uc($confighash{$b}[1]) } keys %confighash) {
4682         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
4683
4684         if ($id % 2) {
4685             print "<tr bgcolor='$color{'color20'}'>\n";
4686         } else {
4687             print "<tr bgcolor='$color{'color22'}'>\n";
4688         }
4689         print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
4690         print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
4691         #if ($confighash{$key}[4] eq 'cert') {
4692             #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
4693         #} else {
4694             #print "<td align='left'>&nbsp;</td>";
4695         #}
4696         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
4697         $cavalid    =~ /Not After : (.*)[\n]/;
4698         $cavalid    = $1;
4699         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]="net-2-net";}
4700         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'host' ){$confighash{$key}[32]="dynamic";}
4701         print "<td align='center'>$confighash{$key}[32]</td>";
4702         print "<td align='center'>$confighash{$key}[25]</td>";
4703
4704         my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
4705
4706         if ($confighash{$key}[0] eq 'off') {
4707          $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
4708         } else {
4709
4710 ###
4711 # m.a.d net2net
4712 ###
4713
4714        if ($confighash{$key}[3] eq 'net') {
4715
4716         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4717           my @output = "";
4718           my @tustate = "";
4719           my $tport = $confighash{$key}[22];
4720           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
4721           if ($tport ne '') {
4722           $tnet->open('127.0.0.1');
4723           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
4724           @tustate = split(/\,/, $output[1]);
4725 ###
4726 #CONNECTING    -- OpenVPN's initial state.
4727 #WAIT          -- (Client only) Waiting for initial response from server.
4728 #AUTH          -- (Client only) Authenticating with server.
4729 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
4730 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
4731 #ADD_ROUTES    -- Adding routes to system.
4732 #CONNECTED     -- Initialization Sequence Completed.
4733 #RECONNECTING  -- A restart has occurred.
4734 #EXITING       -- A graceful exit is in progress.
4735 ####
4736
4737         if ( $tustate[1] eq 'CONNECTED') {
4738           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></tr></td></table>";
4739                           } else {
4740           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$tustate[1]</font></b></td></tr></table>";
4741            }
4742            }
4743            }
4744         }       else {
4745
4746                 my $cn;
4747             my @match = ();
4748           foreach my $line (@status) {
4749                 chomp($line);
4750                 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
4751                     @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
4752                     if ($match[1] ne "Common Name") {
4753                         $cn = $match[1];
4754                     }
4755                 $cn =~ s/[_]/ /g;
4756                     if ($cn eq "$confighash{$key}[2]") {
4757                         $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
4758                     }
4759    }
4760
4761         }
4762 }
4763 }
4764
4765
4766         my $disable_clientdl = "disabled='disabled'";
4767         if (( $cgiparams{'ENABLED'} eq 'on') ||
4768             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4769             ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
4770             $disable_clientdl = "";
4771         }
4772         print <<END
4773         <td align='center'>$active</td>
4774
4775         <form method='post' name='frm${key}a'><td align='center'>
4776             <input type='image'  name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
4777             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
4778             <input type='hidden' name='KEY' value='$key' $disable_clientdl />
4779         </td></form>
4780 END
4781         ;
4782         if ($confighash{$key}[4] eq 'cert') {
4783             print <<END
4784             <form method='post' name='frm${key}b'><td align='center'>
4785                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
4786                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
4787                 <input type='hidden' name='KEY' value='$key' />
4788             </td></form>
4789 END
4790         ; } else {
4791             print "<td>&nbsp;</td>";
4792         }
4793         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
4794             print <<END
4795             <form method='post' name='frm${key}c'><td align='center'>
4796                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
4797                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
4798                 <input type='hidden' name='KEY' value='$key' />
4799             </td></form>
4800 END
4801         ; } elsif ($confighash{$key}[4] eq 'cert') {
4802             print <<END
4803             <form method='post' name='frm${key}c'><td align='center'>
4804                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
4805                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
4806                 <input type='hidden' name='KEY' value='$key' />
4807             </td></form>
4808 END
4809         ; } else {
4810             print "<td>&nbsp;</td>";
4811         }
4812         print <<END
4813         <form method='post' name='frm${key}d'><td align='center'>
4814             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
4815             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
4816             <input type='hidden' name='KEY' value='$key' />
4817         </td></form>
4818
4819         <form method='post' name='frm${key}e'><td align='center'>
4820             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
4821             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
4822             <input type='hidden' name='KEY' value='$key' />
4823         </td></form>
4824         <form method='post' name='frm${key}f'><td align='center'>
4825             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
4826             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
4827             <input type='hidden' name='KEY' value='$key' />
4828         </td></form>
4829         </tr>
4830 END
4831         ;
4832         $id++;
4833     }
4834     ;
4835
4836     # If the config file contains entries, print Key to action icons
4837     if ( $id ) {
4838     print <<END
4839     <table border='0'>
4840     <tr>
4841         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4842         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
4843         <td class='base'>$Lang::tr{'click to disable'}</td>
4844         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4845         <td class='base'>$Lang::tr{'show certificate'}</td>
4846         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
4847         <td class='base'>$Lang::tr{'edit'}</td>
4848         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
4849         <td class='base'>$Lang::tr{'remove'}</td>
4850     </tr>
4851     <tr>
4852         <td>&nbsp; </td>
4853         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
4854         <td class='base'>$Lang::tr{'click to enable'}</td>
4855         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
4856         <td class='base'>$Lang::tr{'download certificate'}</td>
4857         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
4858         <td class='base'>$Lang::tr{'dl client arch'}</td>
4859     </tr>
4860     </table><hr>
4861 END
4862     ;
4863     }
4864
4865     print <<END
4866     <table width='100%'>
4867     <form method='post'>
4868     <tr><td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
4869     <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
4870     </form>
4871     </table>
4872 END
4873     ;
4874     &Header::closebox();
4875 }
4876 &Header::closepage();
4877
4878
4879