X-Git-Url: http://git.ipfire.org/?p=people%2Fpmueller%2Fipfire-2.x.git;a=blobdiff_plain;f=html%2Fcgi-bin%2Fovpnmain.cgi;h=1e074928f29507143d98d40ba0ab5deeec4b0c21;hp=67a91a39eb27e8950592ae85670dbbe1ef93a506;hb=3906cf7e852872556728191a234152acf213db05;hpb=87fe47e9d9502276284340475e9c5208ae406571 diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index 67a91a39eb..1e074928f2 100644 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -70,6 +70,9 @@ my $configgrp="${General::swroot}/fwhosts/customgroups"; my $customnet="${General::swroot}/fwhosts/customnetworks"; my $name; my $col=""; +my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local"; +my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local"; + &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); $cgiparams{'ENABLED'} = 'off'; $cgiparams{'ENABLED_BLUE'} = 'off'; @@ -94,10 +97,33 @@ $cgiparams{'DCIPHER'} = ''; $cgiparams{'DAUTH'} = ''; $cgiparams{'TLSAUTH'} = ''; $routes_push_file = "${General::swroot}/ovpn/routes_push"; -unless (-e $routes_push_file) { system("touch $routes_push_file"); } -unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); } -unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); } -unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); } + +# Add CCD files if not already presant +unless (-e $routes_push_file) { + open(RPF, ">$routes_push_file"); + close(RPF); +} +unless (-e "${General::swroot}/ovpn/ccd.conf") { + open(CCDC, ">${General::swroot}/ovpn/ccd.conf"); + close (CCDC); +} +unless (-e "${General::swroot}/ovpn/ccdroute") { + open(CCDR, ">${General::swroot}/ovpn/ccdroute"); + close (CCDR); +} +unless (-e "${General::swroot}/ovpn/ccdroute2") { + open(CCDRT, ">${General::swroot}/ovpn/ccdroute2"); + close (CCDRT); +} +# Add additional configs if not already presant +unless (-e "$local_serverconf") { + open(LSC, ">$local_serverconf"); + close (LSC); +} +unless (-e "$local_clientconf") { + open(LCC, ">$local_clientconf"); + close (LCC); +} &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'}); @@ -306,7 +332,22 @@ sub writeserverconf { print CONF "verb $sovpnsettings{LOG_VERB}\n"; } else { print CONF "verb 3\n"; - } + } + # Print server.conf.local if entries exist to server.conf + if ( !-z $local_serverconf && $sovpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') { + open (LSC, "$local_serverconf"); + print CONF "\n#---------------------------\n"; + print CONF "# Start of custom directives\n"; + print CONF "# from server.conf.local\n"; + print CONF "#---------------------------\n\n"; + while () { + print CONF $_; + } + print CONF "\n#-----------------------------\n"; + print CONF "# End of custom directives\n"; + print CONF "#-----------------------------\n"; + close (LSC); + } print CONF "\n"; close(CONF); @@ -685,6 +726,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'}; $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'}; $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'}; + $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'}; $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'}; $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'}; $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'}; @@ -1214,8 +1256,7 @@ END unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}"; } # Create Diffie Hellmann Parameter - system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache', - '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}"); + system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}"); if ($?) { $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; unlink ("${General::swroot}/ovpn/ca/dh1024.pem"); @@ -1768,7 +1809,7 @@ END goto ROOTCERT_ERROR; } } else { # child - unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache', + unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-days', '999999', '-newkey', 'rsa:4096', '-sha512', '-keyout', "${General::swroot}/ovpn/ca/cakey.pem", '-out', "${General::swroot}/ovpn/ca/cacert.pem", @@ -1799,7 +1840,7 @@ END goto ROOTCERT_ERROR; } } else { # child - unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache', + unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-newkey', 'rsa:2048', '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem", '-out', "${General::swroot}/ovpn/certs/serverreq.pem", @@ -1851,8 +1892,7 @@ END # &cleanssldatabase(); } # Create Diffie Hellmann Parameter - system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache', - '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}"); + system('/usr/bin/openssl', 'dhparam', '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}"); if ($?) { $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; unlink ("${General::swroot}/ovpn/certs/serverkey.pem"); @@ -2237,6 +2277,21 @@ else print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n"; } } + # Print client.conf.local if entries exist to client.ovpn + if (!-z $local_clientconf && $vpnsettings{'ADDITIONAL_CONFIGS'} eq 'on') { + open (LCC, "$local_clientconf"); + print CLIENTCONF "\n#---------------------------\n"; + print CLIENTCONF "# Start of custom directives\n"; + print CLIENTCONF "# from client.conf.local\n"; + print CLIENTCONF "#---------------------------\n\n"; + while () { + print CLIENTCONF $_; + } + print CLIENTCONF "\n#---------------------------\n"; + print CLIENTCONF "# End of custom directives\n"; + print CLIENTCONF "#---------------------------\n\n"; + close (LCC); + } close(CLIENTCONF); $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n"; @@ -2472,6 +2527,9 @@ ADV_ERROR: $checked{'REDIRECT_GW_DEF1'}{'off'} = ''; $checked{'REDIRECT_GW_DEF1'}{'on'} = ''; $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED'; + $checked{'ADDITIONAL_CONFIGS'}{'off'} = ''; + $checked{'ADDITIONAL_CONFIGS'}{'on'} = ''; + $checked{'ADDITIONAL_CONFIGS'}{$cgiparams{'ADDITIONAL_CONFIGS'}} = 'CHECKED'; $checked{'MSSFIX'}{'off'} = ''; $checked{'MSSFIX'}{'on'} = ''; $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED'; @@ -2552,39 +2610,52 @@ print <
- + - - + + + - - + + + - - + + + - - - - - + + - - - - + + + + + + + + + + + - - - - - - - - + + + + + + + + + + + + + + @@ -4028,6 +4099,10 @@ if ($cgiparams{'TYPE'} eq 'net') { $errormessage = $Lang::tr{'passwords do not match'}; goto VPNCONF_ERROR; } + if ($cgiparams{'DAYS_VALID'} ne '' && $cgiparams{'DAYS_VALID'} !~ /^[0-9]+$/) { + $errormessage = $Lang::tr{'invalid input for valid till days'}; + goto VPNCONF_ERROR; + } # Replace empty strings with a . (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./; @@ -4055,7 +4130,7 @@ if ($cgiparams{'TYPE'} eq 'net') { goto VPNCONF_ERROR; } } else { # child - unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache', + unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-newkey', 'rsa:2048', '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem", '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem", @@ -4298,6 +4373,7 @@ if ($cgiparams{'TYPE'} eq 'net') { $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'}; $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'}; $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'}; + $cgiparams{'DAYS_VALID'} = $vpnsettings{'DAYS_VALID'}; } VPNCONF_ERROR: @@ -4659,27 +4735,28 @@ END if ($cgiparams{'TYPE'} eq 'host') { print < - - - - + + + + - + - - - -
$Lang::tr{'misc-options'}
Client-To-Client
Redirect-Gateway def1
Max-Clients
Keepalive
- (ping/ping-restart)
$Lang::tr{'ovpn add conf'}$Lang::tr{'openvpn default'}: off
mssfix$Lang::tr{'openvpn default'}: off
fragment
mssfix$Lang::tr{'openvpn default'}: off
fragment
Max-Clients
Keepalive
+ (ping/ping-restart)
$Lang::tr{'ovpn mtu-disc'}
 $Lang::tr{'valid till'} (days):
 
 $Lang::tr{'valid till'} (days):
  $Lang::tr{'pkcs12 file password'}:
 $Lang::tr{'pkcs12 file password'}:
($Lang::tr{'confirmation'})
 $Lang::tr{'pkcs12 file password'}:
($Lang::tr{'confirmation'})
 
* $Lang::tr{'this field may be blank'}
+   +
+ * $Lang::tr{'this field may be blank'} + END }else{ print < -     -     -
- * $Lang::tr{'this field may be blank'} + +  $Lang::tr{'valid till'} (days): + +     +     +
+ * $Lang::tr{'this field may be blank'} END