Forward Firewall: deleted configfile "nat" in ovpnmain.cgi for portfw check. File...
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
ab4cf06c 5# Copyright (C) 2007-2013 IPFire Team <info@ipfire.org> #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535
MT
21###
22# Based on IPFireCore 55
23###
6e13d0a5
MT
24use CGI;
25use CGI qw/:standard/;
26use Net::DNS;
ce9abb66 27use Net::Ping;
54fd0535 28use Net::Telnet;
6e13d0a5
MT
29use File::Copy;
30use File::Temp qw/ tempfile tempdir /;
31use strict;
32use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
eff2dbf8 33use Sort::Naturally;
6e13d0a5 34require '/var/ipfire/general-functions.pl';
6e13d0a5
MT
35require "${General::swroot}/lang.pl";
36require "${General::swroot}/header.pl";
37require "${General::swroot}/countries.pl";
38
39# enable only the following on debugging purpose
8c877a82
AM
40#use warnings;
41#use CGI::Carp 'fatalsToBrowser';
6e13d0a5 42#workaround to suppress a warning when a variable is used only once
8c877a82 43my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
6e13d0a5
MT
44undef (@dummy);
45
f2fdd0c1
CS
46my %color = ();
47my %mainsettings = ();
48&General::readhash("${General::swroot}/main/settings", \%mainsettings);
49&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
6e13d0a5
MT
50
51###
52### Initialize variables
53###
e81be1e1
AM
54my %ccdconfhash=();
55my %ccdroutehash=();
56my %ccdroute2hash=();
6e13d0a5
MT
57my %netsettings=();
58my %cgiparams=();
59my %vpnsettings=();
60my %checked=();
61my %confighash=();
62my %cahash=();
63my %selected=();
64my $warnmessage = '';
65my $errormessage = '';
66my %settings=();
54fd0535 67my $routes_push_file = '';
df9b48b7
AM
68my $confighost="${General::swroot}/fwhosts/customhosts";
69my $configgrp="${General::swroot}/fwhosts/customgroups";
70my $customnet="${General::swroot}/fwhosts/customnetworks";
71my $name;
6e13d0a5
MT
72&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
73$cgiparams{'ENABLED'} = 'off';
74$cgiparams{'ENABLED_BLUE'} = 'off';
75$cgiparams{'ENABLED_ORANGE'} = 'off';
76$cgiparams{'EDIT_ADVANCED'} = 'off';
77$cgiparams{'NAT'} = 'off';
78$cgiparams{'COMPRESSION'} = 'off';
79$cgiparams{'ONLY_PROPOSED'} = 'off';
80$cgiparams{'ACTION'} = '';
81$cgiparams{'CA_NAME'} = '';
82$cgiparams{'DHCP_DOMAIN'} = '';
83$cgiparams{'DHCP_DNS'} = '';
84$cgiparams{'DHCP_WINS'} = '';
54fd0535 85$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 86$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 87$cgiparams{'MSSFIX'} = '';
8c877a82 88$cgiparams{'number'} = '';
2ee746be 89$cgiparams{'PMTU_DISCOVERY'} = '';
54fd0535
MT
90$routes_push_file = "${General::swroot}/ovpn/routes_push";
91unless (-e $routes_push_file) { system("touch $routes_push_file"); }
8c877a82
AM
92unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
93unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
94unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
ce9abb66 95
6e13d0a5
MT
96&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
97
98# prepare openvpn config file
99###
100### Useful functions
101###
c6c9630e
MT
102sub haveOrangeNet
103{
13211b21
CS
104 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
105 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
106 return 0;
107}
108
109sub haveBlueNet
110{
13211b21 111 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 112 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
113 return 0;
114}
115
116sub sizeformat{
117 my $bytesize = shift;
118 my $i = 0;
119
120 while(abs($bytesize) >= 1024){
121 $bytesize=$bytesize/1024;
122 $i++;
123 last if($i==6);
124 }
125
126 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
127 my $newsize=(int($bytesize*100 +0.5))/100;
128 return("$newsize $units[$i]");
129}
130
c6c9630e
MT
131sub cleanssldatabase
132{
133 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
134 print FILE "01";
135 close FILE;
136 }
137 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
138 print FILE "";
139 close FILE;
140 }
141 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
142 unlink ("${General::swroot}/ovpn/certs/serial.old");
143 unlink ("${General::swroot}/ovpn/certs/01.pem");
144}
145
146sub newcleanssldatabase
147{
148 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
149 open(FILE, ">${General::swroot}(ovpn/certs/serial");
150 print FILE "01";
151 close FILE;
152 }
153 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
154 system ("touch ${General::swroot}/ovpn/certs/index.txt");
155 }
156 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
157 unlink ("${General::swroot}/ovpn/certs/serial.old");
158}
159
160sub deletebackupcert
161{
162 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
163 my $hexvalue = <FILE>;
164 chomp $hexvalue;
165 close FILE;
166 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
167 }
168}
c6c9630e 169sub checkportfw {
6945e463
AM
170 my $DPORT = shift;
171 my $DPROT = shift;
172 my %natconfig =();
1ca54612 173 my $confignat = "${General::swroot}/forward/config";
6945e463
AM
174 $DPROT= uc ($DPROT);
175 &General::readhasharray($confignat, \%natconfig);
176 foreach my $key (sort keys %natconfig){
6945e463
AM
177 my @portarray = split (/\|/,$natconfig{$key}[30]);
178 foreach my $value (@portarray){
6945e463
AM
179 if ($value =~ /:/i){
180 my ($a,$b) = split (":",$value);
181 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
182 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
183 }
184 }else{
185 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
186 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
187 }
188 }
c6c9630e
MT
189 }
190 }
6945e463 191 return;
c6c9630e
MT
192}
193
194sub checkportoverlap
195{
196 my $portrange1 = $_[0]; # New port range
197 my $portrange2 = $_[1]; # existing port range
198 my @tempr1 = split(/\:/,$portrange1);
199 my @tempr2 = split(/\:/,$portrange2);
200
201 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
202 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
203
204 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
205 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
206
207 return 1; # Everything checks out!
208}
209
210# Darren Critchley - we want to make sure that a port entry is not within an already existing range
211sub checkportinc
212{
213 my $port1 = $_[0]; # Port
214 my $portrange2 = $_[1]; # Port range
215 my @tempr1 = split(/\:/,$portrange2);
216
217 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
218 return 1;
219 } else {
220 return 0;
221 }
222}
c6c9630e
MT
223
224# Darren Critchley - certain ports are reserved for IPFire
225# TCP 67,68,81,222,445
226# UDP 67,68
227# Params passed in -> port, rangeyn, protocol
228sub disallowreserved
229{
230 # port 67 and 68 same for tcp and udp, don't bother putting in an array
231 my $msg = "";
232 my @tcp_reserved = (81,222,445);
233 my $prt = $_[0]; # the port or range
234 my $ryn = $_[1]; # tells us whether or not it is a port range
235 my $prot = $_[2]; # protocol
236 my $srcdst = $_[3]; # source or destination
237 if ($ryn) { # disect port range
238 if ($srcdst eq "src") {
239 $msg = "$Lang::tr{'rsvd src port overlap'}";
240 } else {
241 $msg = "$Lang::tr{'rsvd dst port overlap'}";
242 }
243 my @tmprng = split(/\:/,$prt);
244 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
245 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
246 if ($prot eq "tcp") {
247 foreach my $prange (@tcp_reserved) {
248 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
249 }
250 }
251 } else {
252 if ($srcdst eq "src") {
253 $msg = "$Lang::tr{'reserved src port'}";
254 } else {
255 $msg = "$Lang::tr{'reserved dst port'}";
256 }
257 if ($prt == 67) { $errormessage="$msg 67"; return; }
258 if ($prt == 68) { $errormessage="$msg 68"; return; }
259 if ($prot eq "tcp") {
260 foreach my $prange (@tcp_reserved) {
261 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
262 }
263 }
264 }
265 return;
266}
267
268sub writeserverconf {
54fd0535
MT
269 my %sovpnsettings = ();
270 my @temp = ();
c6c9630e 271 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535
MT
272 &read_routepushfile;
273
c6c9630e
MT
274 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
275 flock CONF, 2;
276 print CONF "#OpenVPN Server conf\n";
277 print CONF "\n";
278 print CONF "daemon openvpnserver\n";
279 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 280 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e
MT
281 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
282 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
c6c9630e
MT
283 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
284 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
2b29c22e 285 print CONF "script-security 3 system\n";
07675dc3 286 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 287 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e
MT
288 print CONF "tls-server\n";
289 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
290 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
291 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
292 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
293 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
294 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
8c877a82 295 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
2ee746be
SS
296
297 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
298 # If we doesn't use one of them, we can use the configured mtu value.
299 if ($sovpnsettings{'MSSFIX'} eq 'on')
300 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
301 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
302 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
1647059d
SS
303 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
304 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
305 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2ee746be
SS
306 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
307 else
308 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
309
54fd0535 310 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
8c877a82
AM
311 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
312 foreach (@temp)
313 {
314 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
315 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
316 }
54fd0535 317 }
8c877a82
AM
318# a.marx ccd
319 my %ccdconfhash=();
320 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
321 foreach my $key (keys %ccdconfhash) {
322 my $a=$ccdconfhash{$key}[1];
323 my ($b,$c) = split (/\//, $a);
324 print CONF "route $b ".&General::cidrtosub($c)."\n";
325 }
326 my %ccdroutehash=();
327 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
328 foreach my $key (keys %ccdroutehash) {
329 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
330 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
331 print CONF "route $a $b\n";
332 }
333 }
334# ccd end
54fd0535 335
8c877a82 336 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
c6c9630e
MT
337 print CONF "client-to-client\n";
338 }
1de5c945
EK
339 if ($sovpnsettings{MSSFIX} eq 'on') {
340 print CONF "mssfix\n";
341 }
342 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
343 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 344 }
2ee746be 345
1647059d
SS
346 # Check if a valid operating mode has been choosen and use it.
347 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
348 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
349 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
350 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
2ee746be
SS
351 }
352
c6c9630e
MT
353 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
354 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
355 }
356 print CONF "status-version 1\n";
4e17adad 357 print CONF "status /var/log/ovpnserver.log 30\n";
c6c9630e
MT
358 print CONF "cipher $sovpnsettings{DCIPHER}\n";
359 if ($sovpnsettings{DCOMPLZO} eq 'on') {
360 print CONF "comp-lzo\n";
361 }
362 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
363 print CONF "push \"redirect-gateway def1\"\n";
364 }
365 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
366 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
367 }
368
369 if ($sovpnsettings{DHCP_DNS} ne '') {
370 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
371 }
372
373 if ($sovpnsettings{DHCP_WINS} ne '') {
374 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
375 }
376
377 if ($sovpnsettings{DHCP_WINS} eq '') {
378 print CONF "max-clients 100\n";
a79fa1d6 379 }
c6c9630e
MT
380 if ($sovpnsettings{DHCP_WINS} ne '') {
381 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
382 }
383 print CONF "tls-verify /var/ipfire/ovpn/verify\n";
384 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
385 print CONF "user nobody\n";
386 print CONF "group nobody\n";
387 print CONF "persist-key\n";
388 print CONF "persist-tun\n";
389 if ($sovpnsettings{LOG_VERB} ne '') {
390 print CONF "verb $sovpnsettings{LOG_VERB}\n";
391 } else {
392 print CONF "verb 3\n";
393 }
394 print CONF "\n";
395
396 close(CONF);
397}
8c877a82 398
c6c9630e 399sub emptyserverlog{
4e17adad 400 if (open(FILE, ">/var/log/ovpnserver.log")) {
c6c9630e
MT
401 flock FILE, 2;
402 print FILE "";
403 close FILE;
404 }
405
406}
407
8c877a82
AM
408sub delccdnet
409{
410 my %ccdconfhash = ();
411 my %ccdhash = ();
412 my $ccdnetname=$_[0];
413 if (-f "${General::swroot}/ovpn/ovpnconfig"){
414 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
415 foreach my $key (keys %ccdhash) {
416 if ($ccdhash{$key}[32] eq $ccdnetname) {
417 $errormessage=$Lang::tr{'ccd err hostinnet'};
418 return;
419 }
420 }
421 }
422 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
423 foreach my $key (keys %ccdconfhash) {
424 if ($ccdconfhash{$key}[0] eq $ccdnetname){
425 delete $ccdconfhash{$key};
426 }
427 }
428 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
429
430 &writeserverconf;
431 return 0;
432}
433
434sub addccdnet
435{
436 my %ccdconfhash=();
437 my @ccdconf=();
438 my $ccdname=$_[0];
439 my $ccdnet=$_[1];
8c877a82
AM
440 my $subcidr;
441 my @ip2=();
442 my $checkup;
443 my $ccdip;
444 my $baseaddress;
290007b3
AM
445
446
447 #check name
448 if ($ccdname eq '')
449 {
450 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
451 return
452 }
453
454 if(!&General::validhostname($ccdname))
455 {
8c877a82
AM
456 $errormessage=$Lang::tr{'ccd err invalidname'};
457 return;
458 }
290007b3
AM
459
460 ($ccdip,$subcidr) = split (/\//,$ccdnet);
461 $subcidr=&General::iporsubtocidr($subcidr);
462 #check subnet
463 if ($subcidr > 30)
464 {
8c877a82
AM
465 $errormessage=$Lang::tr{'ccd err invalidnet'};
466 return;
467 }
290007b3
AM
468 #check ip
469 if (!&General::validipandmask($ccdnet)){
470 $errormessage=$Lang::tr{'ccd err invalidnet'};
471 return;
8c877a82 472 }
290007b3 473
e2429e8d 474 $errormessage=&General::checksubnets($ccdname,$ccdnet);
290007b3 475
8c877a82
AM
476
477 if (!$errormessage) {
478 my %ccdconfhash=();
479 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
480 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
481 my $key = &General::findhasharraykey (\%ccdconfhash);
482 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
483 $ccdconfhash{$key}[0] = $ccdname;
484 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
485 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
486 &writeserverconf;
487 $cgiparams{'ccdname'}='';
488 $cgiparams{'ccdsubnet'}='';
489 return 1;
490 }
491}
492
493sub modccdnet
494{
495
496 my $newname=$_[0];
497 my $oldname=$_[1];
498 my %ccdconfhash=();
499 my %ccdhash=();
500 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
501 foreach my $key (keys %ccdconfhash) {
502 if ($ccdconfhash{$key}[0] eq $oldname) {
503 foreach my $key1 (keys %ccdconfhash) {
504 if ($ccdconfhash{$key1}[0] eq $newname){
505 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
506 return;
507 }else{
508 $ccdconfhash{$key}[0]= $newname;
509 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
510 last;
511 }
512 }
513 }
514 }
515
516 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
517 foreach my $key (keys %ccdhash) {
518 if ($ccdhash{$key}[32] eq $oldname) {
519 $ccdhash{$key}[32]=$newname;
520 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
521 last;
522 }
523 }
524
525 return 0;
526}
527sub ccdmaxclients
528{
529 my $ccdnetwork=$_[0];
530 my @octets=();
531 my @subnet=();
532 @octets=split("\/",$ccdnetwork);
533 @subnet= split /\./, &General::cidrtosub($octets[1]);
534 my ($a,$b,$c,$d,$e);
535 $a=256-$subnet[0];
536 $b=256-$subnet[1];
537 $c=256-$subnet[2];
538 $d=256-$subnet[3];
539 $e=($a*$b*$c*$d)/4;
540 return $e-1;
541}
542
543sub getccdadresses
544{
545 my $ipin=$_[0];
546 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
547 my $cidr=$_[1];
548 chomp($cidr);
549 my $count=$_[2];
550 my $hasip=$_[3];
551 chomp($hasip);
552 my @iprange=();
553 my %ccdhash=();
554 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
555 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
ac87f371 556 for (my $i=1;$i<=$count;$i++) {
8c877a82
AM
557 my $tmpip=$iprange[$i-1];
558 my $stepper=$i*4;
559 $iprange[$i]= &General::getnextip($tmpip,4);
560 }
561 my $r=0;
562 foreach my $key (keys %ccdhash) {
563 $r=0;
564 foreach my $tmp (@iprange){
565 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
566 if ($net eq $tmp) {
567 if ( $hasip ne $ccdhash{$key}[33] ){
568 splice (@iprange,$r,1);
569 }
570 }
571 $r++;
572 }
573 }
574 return @iprange;
575}
576
577sub fillselectbox
578{
579 my $boxname=$_[1];
580 my ($ccdip,$subcidr) = split("/",$_[0]);
581 my $tz=$_[2];
582 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
583 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
584 foreach (@allccdips) {
585 my $ip=$_."/30";
586 chomp($ip);
587 print "<option value='$ip' ";
588 if ( $ip eq $cgiparams{$boxname} ){
589 print"selected";
590 }
591 print ">$ip</option>";
592 }
593 print "</select>";
594}
595
596sub hostsinnet
597{
598 my $name=$_[0];
599 my %ccdhash=();
600 my $i=0;
601 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
602 foreach my $key (keys %ccdhash) {
603 if ($ccdhash{$key}[32] eq $name){ $i++;}
604 }
605 return $i;
606}
607
608sub check_routes_push
609{
610 my $val=$_[0];
611 my ($ip,$cidr) = split (/\//, $val);
612 ##check for existing routes in routes_push
613 if (-e "${General::swroot}/ovpn/routes_push") {
614 open(FILE,"${General::swroot}/ovpn/routes_push");
615 while (<FILE>) {
616 $_=~s/\s*$//g;
617
618 my ($ip2,$cidr2) = split (/\//,"$_");
619 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
620
621 if($val eq $val2){
622 return 0;
623 }
624 #subnetcheck
625 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
626 return 0;
627 }
628 };
629 close(FILE);
630 }
631 return 1;
632}
633
634sub check_ccdroute
635{
636 my %ccdroutehash=();
637 my $val=$_[0];
638 my ($ip,$cidr) = split (/\//, $val);
639 #check for existing routes in ccdroute
640 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
641 foreach my $key (keys %ccdroutehash) {
642 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
643 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
644 return 0;
645 }
646 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
647 #subnetcheck
648 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
649 return 0;
650 }
651 }
652 }
653 return 1;
654}
655sub check_ccdconf
656{
657 my %ccdconfhash=();
658 my $val=$_[0];
659 my ($ip,$cidr) = split (/\//, $val);
660 #check for existing routes in ccdroute
661 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
662 foreach my $key (keys %ccdconfhash) {
663 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
664 return 0;
665 }
666 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
667 #subnetcheck
668 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
669 return 0;
670 }
671
672 }
673 return 1;
674}
675
7c1d9faf
AH
676###
677# m.a.d net2net
678###
679
680sub validdotmask
681{
682 my $ipdotmask = $_[0];
683 if (&General::validip($ipdotmask)) { return 0; }
684 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
685 my $mask = $2;
686 if (($mask =~ /\./ )) { return 0; }
687 return 1;
688}
54fd0535
MT
689
690# -------------------------------------------------------------------
691
692sub write_routepushfile
693{
694 open(FILE, ">$routes_push_file");
695 flock(FILE, 2);
696 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
697 print FILE $vpnsettings{'ROUTES_PUSH'};
698 }
699 close(FILE);
700}
701
702sub read_routepushfile
703{
704 if (-e "$routes_push_file") {
705 open(FILE,"$routes_push_file");
706 delete $vpnsettings{'ROUTES_PUSH'};
707 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
708 close(FILE);
709 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
8c877a82 710
54fd0535
MT
711 }
712}
7c1d9faf
AH
713
714
c6c9630e
MT
715#hier die refresh page
716if ( -e "${General::swroot}/ovpn/gencanow") {
717 my $refresh = '';
718 $refresh = "<meta http-equiv='refresh' content='15;' />";
719 &Header::showhttpheaders();
720 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
721 &Header::openbigbox('100%', 'center');
722 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
723 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
724 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
725 &Header::closebox();
726 &Header::closebigbox();
727 &Header::closepage();
728 exit (0);
729}
730##hier die refresh page
731
6e13d0a5
MT
732
733###
734### OpenVPN Server Control
735###
736if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
737 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
738 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT
739 #start openvpn server
740 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 741 &emptyserverlog();
6e13d0a5
MT
742 system('/usr/local/bin/openvpnctrl', '-s');
743 }
744 #stop openvpn server
745 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
6e13d0a5 746 system('/usr/local/bin/openvpnctrl', '-k');
c6c9630e 747 &emptyserverlog();
6e13d0a5
MT
748 }
749# #restart openvpn server
8c877a82 750# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
6e13d0a5 751#workarund, till SIGHUP also works when running as nobody
8c877a82
AM
752# system('/usr/local/bin/openvpnctrl', '-r');
753# &emptyserverlog();
754# }
6e13d0a5
MT
755}
756
757###
758### Save Advanced options
759###
760
761if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
762 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
763 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
764 #DAN this value has to leave.
765#new settings for daemon
766 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
767 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
768 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
769 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
770 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
771 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
772 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
773 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
774 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535 775 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
2ee746be 776 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
54fd0535 777 my @temp=();
6e13d0a5 778
a79fa1d6
JPT
779 if ($cgiparams{'FRAGMENT'} eq '') {
780 delete $vpnsettings{'FRAGMENT'};
781 } else {
782 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
783 $errormessage = "Incorrect value, please insert only numbers.";
784 goto ADV_ERROR;
785 } else {
786 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
787 }
788 }
789 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 790 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT
791 } else {
792 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
793 }
2ee746be 794
1647059d
SS
795 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
796 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
797 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
798
2ee746be
SS
799 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
800 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
801 goto ADV_ERROR;
802 }
803 }
804
6e13d0a5 805 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
81da1b01 806 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
6e13d0a5
MT
807 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
808 goto ADV_ERROR;
809 }
810 }
811 if ($cgiparams{'DHCP_DNS'} ne ''){
812 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
813 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
814 goto ADV_ERROR;
815 }
816 }
817 if ($cgiparams{'DHCP_WINS'} ne ''){
818 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
819 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT
820 goto ADV_ERROR;
821 }
822 }
823 if ($cgiparams{'ROUTES_PUSH'} ne ''){
824 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
825 undef $vpnsettings{'ROUTES_PUSH'};
8c877a82
AM
826
827 foreach my $tmpip (@temp)
54fd0535
MT
828 {
829 s/^\s+//g; s/\s+$//g;
8c877a82
AM
830
831 if ($tmpip)
54fd0535 832 {
8c877a82
AM
833 $tmpip=~s/\s*$//g;
834 unless (&General::validipandmask($tmpip)) {
835 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
836 goto ADV_ERROR;
54fd0535 837 }
8c877a82
AM
838 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
839
54fd0535
MT
840 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
841 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
8c877a82
AM
842 goto ADV_ERROR;
843 }
844# a.marx ccd
845 my %ccdroutehash=();
846 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
847 foreach my $key (keys %ccdroutehash) {
848 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
849 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
850 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
851 goto ADV_ERROR;
852 }
853 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
854 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
855 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
856 goto ADV_ERROR;
857 }
858 }
54fd0535 859 }
8c877a82
AM
860
861# ccd end
862
863 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
54fd0535 864 }
8c877a82
AM
865 }
866 &write_routepushfile;
54fd0535 867 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP
868 }
869 else {
870 undef $vpnsettings{'ROUTES_PUSH'};
871 &write_routepushfile;
6e13d0a5 872 }
6e13d0a5
MT
873 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
874 $errormessage = $Lang::tr{'invalid input for max clients'};
875 goto ADV_ERROR;
876 }
877 if ($cgiparams{'KEEPALIVE_1'} ne '') {
878 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
879 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
880 goto ADV_ERROR;
881 }
882 }
883 if ($cgiparams{'KEEPALIVE_2'} ne ''){
884 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
885 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
886 goto ADV_ERROR;
887 }
888 }
889 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
890 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
891 goto ADV_ERROR;
892 }
893
894 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 895 &writeserverconf();#hier ok
6e13d0a5
MT
896}
897
ce9abb66 898###
7c1d9faf 899# m.a.d net2net
ce9abb66
AH
900###
901
902if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
903{
c6c9630e 904
ce9abb66
AH
905my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
906my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 907my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 908my $tunmtu = '';
531f0835
AH
909
910unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
911unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
912
913 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
914
915 flock SERVERCONF, 2;
7c1d9faf 916 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
ce9abb66 917 print SERVERCONF "\n";
b278daf3 918 print SERVERCONF "# User Security\n";
ce9abb66
AH
919 print SERVERCONF "user nobody\n";
920 print SERVERCONF "group nobody\n";
921 print SERVERCONF "persist-tun\n";
922 print SERVERCONF "persist-key\n";
7c1d9faf 923 print SERVERCONF "script-security 2\n";
60f396d7 924 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
c125d8a2
SS
925
926 if ($cgiparams{'REMOTE'} ne '') {
ce9abb66 927 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
c125d8a2
SS
928 }
929
b278daf3 930 print SERVERCONF "float\n";
60f396d7 931 print SERVERCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 932 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
60f396d7 933 print SERVERCONF "# Client Gateway Network\n";
54fd0535 934 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 935 print SERVERCONF "# tun Device\n";
ce9abb66 936 print SERVERCONF "dev tun\n";
60f396d7 937 print SERVERCONF "# Port and Protokol\n";
ce9abb66 938 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
939
940 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
941 print SERVERCONF "proto tcp-server\n";
942 print SERVERCONF "# Packet size\n";
d96c89eb 943 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 944 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 945 }
60f396d7
AH
946
947 if ($cgiparams{'PROTOCOL'} eq 'udp') {
948 print SERVERCONF "proto udp\n";
949 print SERVERCONF "# Paketsize\n";
950 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
951 print SERVERCONF "tun-mtu $tunmtu\n";
54fd0535
MT
952 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
953 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
d96c89eb 954 }
1647059d
SS
955
956 # Check if a valid operating mode has been choosen and use it.
957 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
958 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
959 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
960 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
961 if($cgiparams{'MTU'} eq '1500') {
962 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
963 }
964 }
965 }
60f396d7 966 print SERVERCONF "# Auth. Server\n";
ce9abb66
AH
967 print SERVERCONF "tls-server\n";
968 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
969 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
970 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
971 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
b278daf3 972 print SERVERCONF "# Cipher\n";
ce9abb66
AH
973 print SERVERCONF "cipher AES-256-CBC\n";
974 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 975 print SERVERCONF "# Enable Compression\n";
ce9abb66 976 print SERVERCONF "comp-lzo\r\n";
b278daf3 977 }
60f396d7 978 print SERVERCONF "# Debug Level\n";
ce9abb66 979 print SERVERCONF "verb 3\n";
b278daf3 980 print SERVERCONF "# Tunnel check\n";
ce9abb66 981 print SERVERCONF "keepalive 10 60\n";
60f396d7 982 print SERVERCONF "# Start as daemon\n";
ce9abb66
AH
983 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
984 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 985 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT
986 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
987 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH
988 close(SERVERCONF);
989
990}
991
992###
7c1d9faf 993# m.a.d net2net
ce9abb66 994###
7c1d9faf 995
ce9abb66
AH
996if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
997{
998 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 999 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1000 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 1001 my $tunmtu = '';
54fd0535 1002
531f0835
AH
1003unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1004unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
1005
1006 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1007
1008 flock CLIENTCONF, 2;
7c1d9faf 1009 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 1010 print CLIENTCONF "#\n";
b278daf3 1011 print CLIENTCONF "# User Security\n";
ce9abb66
AH
1012 print CLIENTCONF "user nobody\n";
1013 print CLIENTCONF "group nobody\n";
1014 print CLIENTCONF "persist-tun\n";
1015 print CLIENTCONF "persist-key\n";
7c1d9faf 1016 print CLIENTCONF "script-security 2\n";
60f396d7 1017 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 1018 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 1019 print CLIENTCONF "float\n";
60f396d7 1020 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1021 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
60f396d7 1022 print CLIENTCONF "# Server Gateway Network\n";
54fd0535 1023 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 1024 print CLIENTCONF "# tun Device\n";
ce9abb66 1025 print CLIENTCONF "dev tun\n";
60f396d7 1026 print CLIENTCONF "# Port and Protokol\n";
ce9abb66 1027 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
1028
1029 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1030 print CLIENTCONF "proto tcp-client\n";
1031 print CLIENTCONF "# Packet size\n";
d96c89eb 1032 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 1033 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1034 }
60f396d7
AH
1035
1036 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1037 print CLIENTCONF "proto udp\n";
1038 print CLIENTCONF "# Paketsize\n";
1039 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1040 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535
MT
1041 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1042 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
d96c89eb 1043 }
1647059d
SS
1044
1045 # Check if a valid operating mode has been choosen and use it.
1046 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1047 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1048 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
1049 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1050 if ($cgiparams{'MTU'} eq '1500') {
1051 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1052 }
1053 }
1647059d
SS
1054 }
1055
54fd0535 1056 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
1057 print CLIENTCONF "# Auth. Client\n";
1058 print CLIENTCONF "tls-client\n";
b278daf3 1059 print CLIENTCONF "# Cipher\n";
ce9abb66
AH
1060 print CLIENTCONF "cipher AES-256-CBC\n";
1061 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
ce9abb66 1062 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1063 print CLIENTCONF "# Enable Compression\n";
ce9abb66 1064 print CLIENTCONF "comp-lzo\r\n";
b278daf3 1065 }
ce9abb66
AH
1066 print CLIENTCONF "# Debug Level\n";
1067 print CLIENTCONF "verb 3\n";
b278daf3 1068 print CLIENTCONF "# Tunnel check\n";
ce9abb66 1069 print CLIENTCONF "keepalive 10 60\n";
60f396d7 1070 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
1071 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1072 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1073 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
1074 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1075 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 1076 close(CLIENTCONF);
c6c9630e 1077
ce9abb66
AH
1078}
1079
6e13d0a5
MT
1080###
1081### Save main settings
1082###
ce9abb66
AH
1083
1084
6e13d0a5
MT
1085if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1086 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT
1087 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1088 #DAN this value has to leave.
1089 if ($cgiparams{'ENABLED'} eq 'on'){
1090 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1091 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 1092 goto SETTINGS_ERROR;
6e13d0a5
MT
1093 }
1094 }
1095 if ($cgiparams{'ENABLED'} eq 'on'){
c6c9630e 1096 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
6e13d0a5
MT
1097 }
1098 if ($errormessage) { goto SETTINGS_ERROR; }
1099
1100
1101 if ($cgiparams{'ENABLED'} eq 'on'){
6945e463 1102 &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
6e13d0a5
MT
1103 }
1104
1105 if ($errormessage) { goto SETTINGS_ERROR; }
1106
1107 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e
MT
1108 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1109 goto SETTINGS_ERROR;
1110 }
1111 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1112
1113 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1114 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1115 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1116 goto SETTINGS_ERROR;
1117 }
1118
1119 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1120 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1121 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1122 goto SETTINGS_ERROR;
1123 }
1124
1125 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1126 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1127 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1128 goto SETTINGS_ERROR;
1129 }
1130
1131 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1132 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1133 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1134 goto SETTINGS_ERROR;
1135 }
1136 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1137 while (<ALIASES>)
1138 {
1139 chomp($_);
1140 my @tempalias = split(/\,/,$_);
1141 if ($tempalias[1] eq 'on') {
1142 if (&General::IpInSubnet ($tempalias[0] ,
1143 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1144 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1145 }
1146 }
1147 }
1148 close(ALIASES);
6e13d0a5 1149 if ($errormessage ne ''){
c6c9630e 1150 goto SETTINGS_ERROR;
6e13d0a5
MT
1151 }
1152 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1153 $errormessage = $Lang::tr{'invalid input'};
1154 goto SETTINGS_ERROR;
1155 }
1156 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1157 $errormessage = $Lang::tr{'invalid mtu input'};
1158 goto SETTINGS_ERROR;
1159 }
1160
1161 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT
1162 $errormessage = $Lang::tr{'invalid port'};
1163 goto SETTINGS_ERROR;
6e13d0a5 1164 }
6e13d0a5
MT
1165 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1166 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1167 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1168 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1169#new settings for daemon
1170 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1171 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1172 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1173 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1174 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1175 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1176 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
3ffee04b
CS
1177#wrtie enable
1178
1179 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1180 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1181 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
6e13d0a5
MT
1182#new settings for daemon
1183 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 1184 &writeserverconf();#hier ok
6e13d0a5
MT
1185SETTINGS_ERROR:
1186###
1187### Reset all step 2
1188###
1189}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1190 my $file = '';
1191 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1192
1193 foreach my $key (keys %confighash) {
c6c9630e
MT
1194 if ($confighash{$key}[4] eq 'cert') {
1195 delete $confighash{$cgiparams{'$key'}};
1196 }
6e13d0a5
MT
1197 }
1198 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
c6c9630e 1199 unlink $file
6e13d0a5
MT
1200 }
1201 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
c6c9630e 1202 unlink $file
6e13d0a5
MT
1203 }
1204 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
c6c9630e 1205 unlink $file
6e13d0a5 1206 }
c6c9630e 1207 &cleanssldatabase();
6e13d0a5
MT
1208 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1209 print FILE "";
1210 close FILE;
1211 }
1212 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1213 #&writeserverconf();
6e13d0a5
MT
1214###
1215### Reset all step 1
1216###
1217}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1218 &Header::showhttpheaders();
1219 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1220 &Header::openbigbox('100%', 'LEFT', '', '');
1221 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1222 print <<END
1223 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1224 <tr><td align='center'>
1225 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1226 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1227 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1228 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1229 </form></table>
1230END
1231 ;
1232 &Header::closebox();
1233 &Header::closebigbox();
1234 &Header::closepage();
1235 exit (0);
1236
1237###
1238### Upload CA Certificate
1239###
1240} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1241 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1242
1243 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1244 $errormessage = $Lang::tr{'name must only contain characters'};
1245 goto UPLOADCA_ERROR;
1246 }
1247
1248 if (length($cgiparams{'CA_NAME'}) >60) {
1249 $errormessage = $Lang::tr{'name too long'};
1250 goto VPNCONF_ERROR;
1251 }
1252
1253 if ($cgiparams{'CA_NAME'} eq 'ca') {
1254 $errormessage = $Lang::tr{'name is invalid'};
1255 goto UPLOAD_CA_ERROR;
1256 }
1257
1258 # Check if there is no other entry with this name
1259 foreach my $key (keys %cahash) {
c6c9630e
MT
1260 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1261 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1262 goto UPLOADCA_ERROR;
1263 }
6e13d0a5
MT
1264 }
1265
1266 if (ref ($cgiparams{'FH'}) ne 'Fh') {
c6c9630e
MT
1267 $errormessage = $Lang::tr{'there was no file upload'};
1268 goto UPLOADCA_ERROR;
6e13d0a5
MT
1269 }
1270 # Move uploaded ca to a temporary file
1271 (my $fh, my $filename) = tempfile( );
1272 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT
1273 $errormessage = $!;
1274 goto UPLOADCA_ERROR;
6e13d0a5
MT
1275 }
1276 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
c6c9630e
MT
1277 if ($temp !~ /CA:TRUE/i) {
1278 $errormessage = $Lang::tr{'not a valid ca certificate'};
1279 unlink ($filename);
1280 goto UPLOADCA_ERROR;
6e13d0a5 1281 } else {
c6c9630e
MT
1282 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1283 if ($? ne 0) {
1284 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1285 unlink ($filename);
1286 goto UPLOADCA_ERROR;
1287 }
6e13d0a5
MT
1288 }
1289
1290 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1291 $casubject =~ /Subject: (.*)[\n]/;
1292 $casubject = $1;
1293 $casubject =~ s+/Email+, E+;
1294 $casubject =~ s/ ST=/ S=/;
1295 $casubject = &Header::cleanhtml($casubject);
1296
1297 my $key = &General::findhasharraykey (\%cahash);
1298 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1299 $cahash{$key}[1] = $casubject;
1300 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT
1301# system('/usr/local/bin/ipsecctrl', 'R');
1302
6e13d0a5
MT
1303 UPLOADCA_ERROR:
1304
1305###
1306### Display ca certificate
1307###
1308} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT
1309 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1310
1311 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1312 &Header::showhttpheaders();
1313 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1314 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1315 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1316 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1317 $output = &Header::cleanhtml($output,"y");
1318 print "<pre>$output</pre>\n";
1319 &Header::closebox();
1320 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1321 &Header::closebigbox();
1322 &Header::closepage();
1323 exit(0);
1324 } else {
1325 $errormessage = $Lang::tr{'invalid key'};
1326 }
1327
6e13d0a5
MT
1328###
1329### Download ca certificate
1330###
1331} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1332 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1333
1334 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1335 print "Content-Type: application/octet-stream\r\n";
1336 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1337 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1338 exit(0);
1339 } else {
1340 $errormessage = $Lang::tr{'invalid key'};
1341 }
1342
1343###
1344### Remove ca certificate (step 2)
1345###
1346} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1347 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1348 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1349
1350 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1351 foreach my $key (keys %confighash) {
1352 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1353 if ($test =~ /: OK/) {
c6c9630e
MT
1354 # Delete connection
1355# if ($vpnsettings{'ENABLED'} eq 'on' ||
1356# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1357# system('/usr/local/bin/ipsecctrl', 'D', $key);
1358# }
6e13d0a5
MT
1359 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1360 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1361 delete $confighash{$key};
1362 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1363# &writeipsecfiles();
6e13d0a5
MT
1364 }
1365 }
1366 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1367 delete $cahash{$cgiparams{'KEY'}};
1368 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1369# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT
1370 } else {
1371 $errormessage = $Lang::tr{'invalid key'};
1372 }
1373###
1374### Remove ca certificate (step 1)
1375###
1376} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1377 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1378 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1379
1380 my $assignedcerts = 0;
1381 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1382 foreach my $key (keys %confighash) {
1383 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1384 if ($test =~ /: OK/) {
1385 $assignedcerts++;
1386 }
1387 }
1388 if ($assignedcerts) {
1389 &Header::showhttpheaders();
1390 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1391 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1392 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1393 print <<END
1394 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1395 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1396 <tr><td align='center'>
1397 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1398 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1399 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1400 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1401 </form></table>
1402END
1403 ;
1404 &Header::closebox();
1405 &Header::closebigbox();
1406 &Header::closepage();
1407 exit (0);
1408 } else {
1409 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1410 delete $cahash{$cgiparams{'KEY'}};
1411 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1412# system('/usr/local/bin/ipsecctrl', 'R');
1413 }
1414 } else {
1415 $errormessage = $Lang::tr{'invalid key'};
1416 }
1417
1418###
1419### Display root certificate
1420###
c6c9630e
MT
1421}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1422 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1423 my $output;
1424 &Header::showhttpheaders();
1425 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1426 &Header::openbigbox('100%', 'LEFT', '', '');
1427 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1428 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1429 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1430 } else {
1431 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1432 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1433 }
1434 $output = &Header::cleanhtml($output,"y");
1435 print "<pre>$output</pre>\n";
1436 &Header::closebox();
1437 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1438 &Header::closebigbox();
1439 &Header::closepage();
1440 exit(0);
1441
6e13d0a5
MT
1442###
1443### Download root certificate
1444###
1445}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1446 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1447 print "Content-Type: application/octet-stream\r\n";
1448 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1449 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1450 exit(0);
1451 }
1452
1453###
1454### Download host certificate
1455###
1456}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1457 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1458 print "Content-Type: application/octet-stream\r\n";
1459 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1460 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1461 exit(0);
1462 }
1463###
1464### Form for generating a root certificate
1465###
1466}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1467 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1468
1469 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1470 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1471 $errormessage = $Lang::tr{'valid root certificate already exists'};
1472 $cgiparams{'ACTION'} = '';
1473 goto ROOTCERT_ERROR;
1474 }
1475
1476 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1477 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1478 my $ipaddr = <IPADDR>;
1479 close IPADDR;
1480 chomp ($ipaddr);
1481 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1482 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1483 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1484 }
1485 }
1486 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1487
1488 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1489 $errormessage = $Lang::tr{'there was no file upload'};
1490 goto ROOTCERT_ERROR;
1491 }
1492
1493 # Move uploaded certificate request to a temporary file
1494 (my $fh, my $filename) = tempfile( );
1495 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1496 $errormessage = $!;
1497 goto ROOTCERT_ERROR;
1498 }
1499
1500 # Create a temporary dirctory
1501 my $tempdir = tempdir( CLEANUP => 1 );
1502
1503 # Extract the CA certificate from the file
1504 my $pid = open(OPENSSL, "|-");
1505 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1506 if ($pid) { # parent
1507 if ($cgiparams{'P12_PASS'} ne '') {
1508 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1509 }
1510 close (OPENSSL);
1511 if ($?) {
1512 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1513 unlink ($filename);
1514 goto ROOTCERT_ERROR;
1515 }
1516 } else { # child
1517 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1518 '-in', $filename,
1519 '-out', "$tempdir/cacert.pem")) {
1520 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1521 unlink ($filename);
1522 goto ROOTCERT_ERROR;
1523 }
1524 }
1525
1526 # Extract the Host certificate from the file
1527 $pid = open(OPENSSL, "|-");
1528 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1529 if ($pid) { # parent
1530 if ($cgiparams{'P12_PASS'} ne '') {
1531 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1532 }
1533 close (OPENSSL);
1534 if ($?) {
1535 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1536 unlink ($filename);
1537 goto ROOTCERT_ERROR;
1538 }
1539 } else { # child
1540 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1541 '-in', $filename,
1542 '-out', "$tempdir/hostcert.pem")) {
1543 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1544 unlink ($filename);
1545 goto ROOTCERT_ERROR;
1546 }
1547 }
1548
1549 # Extract the Host key from the file
1550 $pid = open(OPENSSL, "|-");
1551 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1552 if ($pid) { # parent
1553 if ($cgiparams{'P12_PASS'} ne '') {
1554 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1555 }
1556 close (OPENSSL);
1557 if ($?) {
1558 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1559 unlink ($filename);
1560 goto ROOTCERT_ERROR;
1561 }
1562 } else { # child
1563 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1564 '-nodes',
1565 '-in', $filename,
1566 '-out', "$tempdir/serverkey.pem")) {
1567 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1568 unlink ($filename);
1569 goto ROOTCERT_ERROR;
1570 }
1571 }
1572
1573 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1574 if ($? ne 0) {
1575 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1576 unlink ($filename);
1577 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1578 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1579 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1580 goto ROOTCERT_ERROR;
1581 }
1582
1583 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1584 if ($? ne 0) {
1585 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1586 unlink ($filename);
1587 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1588 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1589 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1590 goto ROOTCERT_ERROR;
1591 }
1592
1593 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1594 if ($? ne 0) {
1595 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1596 unlink ($filename);
1597 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1598 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1599 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1600 goto ROOTCERT_ERROR;
1601 }
1602
1603 goto ROOTCERT_SUCCESS;
1604
1605 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1606
1607 # Validate input since the form was submitted
1608 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1609 $errormessage = $Lang::tr{'organization cant be empty'};
1610 goto ROOTCERT_ERROR;
1611 }
1612 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1613 $errormessage = $Lang::tr{'organization too long'};
1614 goto ROOTCERT_ERROR;
1615 }
1616 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1617 $errormessage = $Lang::tr{'invalid input for organization'};
1618 goto ROOTCERT_ERROR;
1619 }
1620 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1621 $errormessage = $Lang::tr{'hostname cant be empty'};
1622 goto ROOTCERT_ERROR;
1623 }
1624 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1625 $errormessage = $Lang::tr{'invalid input for hostname'};
1626 goto ROOTCERT_ERROR;
1627 }
1628 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1629 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1630 goto ROOTCERT_ERROR;
1631 }
1632 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1633 $errormessage = $Lang::tr{'e-mail address too long'};
1634 goto ROOTCERT_ERROR;
1635 }
1636 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1637 $errormessage = $Lang::tr{'invalid input for department'};
1638 goto ROOTCERT_ERROR;
1639 }
1640 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1641 $errormessage = $Lang::tr{'invalid input for city'};
1642 goto ROOTCERT_ERROR;
1643 }
1644 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1645 $errormessage = $Lang::tr{'invalid input for state or province'};
1646 goto ROOTCERT_ERROR;
1647 }
1648 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1649 $errormessage = $Lang::tr{'invalid input for country'};
1650 goto ROOTCERT_ERROR;
1651 }
1652
1653 # Copy the cgisettings to vpnsettings and save the configfile
1654 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1655 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1656 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1657 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1658 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1659 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1660 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1661 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1662
1663 # Replace empty strings with a .
1664 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1665 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1666 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1667
1668 # refresh
c6c9630e 1669 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT
1670
1671 # Create the CA certificate
1672 my $pid = open(OPENSSL, "|-");
1673 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1674 if ($pid) { # parent
1675 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1676 print OPENSSL "$state\n";
1677 print OPENSSL "$city\n";
1678 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1679 print OPENSSL "$ou\n";
1680 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1681 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1682 close (OPENSSL);
1683 if ($?) {
1684 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1685 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1686 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1687 goto ROOTCERT_ERROR;
1688 }
1689 } else { # child
1690 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1691 '-days', '999999', '-newkey', 'rsa:2048',
1692 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1693 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1694 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1695 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1696 goto ROOTCERT_ERROR;
1697 }
1698 }
1699
1700 # Create the Host certificate request
1701 $pid = open(OPENSSL, "|-");
1702 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1703 if ($pid) { # parent
1704 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1705 print OPENSSL "$state\n";
1706 print OPENSSL "$city\n";
1707 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1708 print OPENSSL "$ou\n";
1709 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1710 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1711 print OPENSSL ".\n";
1712 print OPENSSL ".\n";
1713 close (OPENSSL);
1714 if ($?) {
1715 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1716 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1717 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1718 goto ROOTCERT_ERROR;
1719 }
1720 } else { # child
1721 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1722 '-newkey', 'rsa:1024',
1723 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1724 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1725 '-extensions', 'server',
1726 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1727 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1728 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1729 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1730 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1731 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1732 goto ROOTCERT_ERROR;
1733 }
1734 }
1735
1736 # Sign the host certificate request
1737 system('/usr/bin/openssl', 'ca', '-days', '999999',
1738 '-batch', '-notext',
1739 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1740 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1741 '-extensions', 'server',
1742 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1743 if ($?) {
1744 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1745 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1746 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1747 unlink ("${General::swroot}/ovpn/serverkey.pem");
1748 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1749 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1750 &newcleanssldatabase();
6e13d0a5
MT
1751 goto ROOTCERT_ERROR;
1752 } else {
1753 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1754 &deletebackupcert();
6e13d0a5
MT
1755 }
1756
1757 # Create an empty CRL
1758 system('/usr/bin/openssl', 'ca', '-gencrl',
1759 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1760 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1761 if ($?) {
1762 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1763 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1764 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1765 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1766 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 1767 &cleanssldatabase();
6e13d0a5 1768 goto ROOTCERT_ERROR;
c6c9630e
MT
1769# } else {
1770# &cleanssldatabase();
6e13d0a5
MT
1771 }
1772 # Create Diffie Hellmann Parameter
1773 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1774 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1775 '1024' );
1776 if ($?) {
1777 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1778 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1779 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1780 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1781 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1782 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 1783 &cleanssldatabase();
6e13d0a5 1784 goto ROOTCERT_ERROR;
c6c9630e
MT
1785# } else {
1786# &cleanssldatabase();
6e13d0a5
MT
1787 }
1788 goto ROOTCERT_SUCCESS;
1789 }
1790 ROOTCERT_ERROR:
1791 if ($cgiparams{'ACTION'} ne '') {
1792 &Header::showhttpheaders();
1793 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1794 &Header::openbigbox('100%', 'LEFT', '', '');
1795 if ($errormessage) {
1796 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1797 print "<class name='base'>$errormessage";
1798 print "&nbsp;</class>";
1799 &Header::closebox();
1800 }
1801 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1802 print <<END
1803 <form method='post' enctype='multipart/form-data'>
1804 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1805 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1806 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1807 <td width='35%' colspan='2'>&nbsp;</td></tr>
1808 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1809 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1810 <td colspan='2'>&nbsp;</td></tr>
1811 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1812 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1813 <td colspan='2'>&nbsp;</td></tr>
1814 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1815 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1816 <td colspan='2'>&nbsp;</td></tr>
1817 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1818 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1819 <td colspan='2'>&nbsp;</td></tr>
1820 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1821 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1822 <td colspan='2'>&nbsp;</td></tr>
1823 <tr><td class='base'>$Lang::tr{'country'}:</td>
1824 <td class='base'><select name='ROOTCERT_COUNTRY'>
1825
1826END
1827 ;
1828 foreach my $country (sort keys %{Countries::countries}) {
1829 print "<option value='$Countries::countries{$country}'";
1830 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1831 print " selected='selected'";
1832 }
1833 print ">$country</option>";
1834 }
1835 print <<END
1836 </select></td>
1837 <td colspan='2'>&nbsp;</td></tr>
1838 <tr><td>&nbsp;</td>
1839 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1840 <td>&nbsp;</td><td>&nbsp;</td></tr>
1841 <tr><td class='base' colspan='4' align='left'>
1842 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1843 <tr><td class='base' colspan='4' align='left'>
1844 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1845 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1846 </td></tr>
1847 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1848 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1849 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1850 <td colspan='2'>&nbsp;</td></tr>
1851 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1852 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1853 <td colspan='2'>&nbsp;</td></tr>
1854 <tr><td>&nbsp;</td>
1855 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1856 <td colspan='2'>&nbsp;</td></tr>
1857 <tr><td class='base' colspan='4' align='left'>
1858 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1859 </form></table>
1860END
1861 ;
1862 &Header::closebox();
1863
1864 &Header::closebigbox();
1865 &Header::closepage();
1866 exit(0)
1867 }
1868
1869 ROOTCERT_SUCCESS:
1870 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT
1871# if ($vpnsettings{'ENABLED'} eq 'on' ||
1872# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1873# system('/usr/local/bin/ipsecctrl', 'S');
1874# }
6e13d0a5
MT
1875
1876###
1877### Enable/Disable connection
1878###
ce9abb66
AH
1879
1880###
7c1d9faf 1881# m.a.d net2net
ce9abb66
AH
1882###
1883
6e13d0a5 1884}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT
1885
1886 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 1887 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH
1888# my $n2nactive = '';
1889 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1890
6e13d0a5 1891 if ($confighash{$cgiparams{'KEY'}}) {
8c877a82
AM
1892 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1893 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1894 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 1895
8c877a82 1896 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 1897 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
8c877a82
AM
1898 }
1899 } else {
ce9abb66 1900
8c877a82
AM
1901 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1902 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 1903
8c877a82 1904 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 1905 if ($n2nactive ne ''){
8c877a82
AM
1906 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1907 }
ce9abb66 1908
8c877a82 1909 } else {
ce9abb66 1910 $errormessage = $Lang::tr{'invalid key'};
8c877a82 1911 }
ce9abb66
AH
1912 }
1913 }
6e13d0a5
MT
1914
1915###
1916### Download OpenVPN client package
1917###
ce9abb66
AH
1918
1919
6e13d0a5
MT
1920} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1921 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1922 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1923 my $file = '';
1924 my $clientovpn = '';
1925 my @fileholder;
1926 my $tempdir = tempdir( CLEANUP => 1 );
1927 my $zippath = "$tempdir/";
ce9abb66
AH
1928
1929###
7c1d9faf
AH
1930# m.a.d net2net
1931###
ce9abb66
AH
1932
1933if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1934
1935 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1936 my $zippathname = "$zippath$zipname";
1937 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1938 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 1939 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1940 my $tunmtu = '';
7c1d9faf 1941 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 1942 my $n2nfragment = '';
ce9abb66
AH
1943
1944 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1945 flock CLIENTCONF, 2;
1946
1947 my $zip = Archive::Zip->new();
7c1d9faf 1948 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 1949 print CLIENTCONF "# \n";
b278daf3 1950 print CLIENTCONF "# User Security\n";
ce9abb66
AH
1951 print CLIENTCONF "user nobody\n";
1952 print CLIENTCONF "group nobody\n";
1953 print CLIENTCONF "persist-tun\n";
1954 print CLIENTCONF "persist-key\n";
7c1d9faf 1955 print CLIENTCONF "script-security 2\n";
60f396d7 1956 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 1957 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 1958 print CLIENTCONF "float\n";
60f396d7 1959 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1960 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
b278daf3 1961 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 1962 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
b278daf3 1963 print CLIENTCONF "# tun Device\n";
ce9abb66 1964 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
60f396d7 1965 print CLIENTCONF "# Port and Protokoll\n";
ce9abb66 1966 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
60f396d7
AH
1967
1968 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1969 print CLIENTCONF "proto tcp-client\n";
1970 print CLIENTCONF "# Packet size\n";
d96c89eb 1971 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 1972 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1973 }
60f396d7
AH
1974
1975 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1976 print CLIENTCONF "proto udp\n";
1977 print CLIENTCONF "# Paketsize\n";
1978 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1979 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 1980 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
60f396d7 1981 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
d96c89eb 1982 }
1647059d
SS
1983 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
1984 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
1985 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2ee746be
SS
1986 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
1987 if ($tunmtu eq '1500' ) {
350f2980 1988 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2ee746be
SS
1989 }
1990 }
1991 }
54fd0535 1992 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
1993 print CLIENTCONF "# Auth. Client\n";
1994 print CLIENTCONF "tls-client\n";
b278daf3 1995 print CLIENTCONF "# Cipher\n";
ce9abb66
AH
1996 print CLIENTCONF "cipher AES-256-CBC\n";
1997 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1998 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1999 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2000 }
ce9abb66 2001 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 2002 print CLIENTCONF "# Enable Compression\n";
ce9abb66 2003 print CLIENTCONF "comp-lzo\r\n";
b278daf3 2004 }
ce9abb66
AH
2005 print CLIENTCONF "# Debug Level\n";
2006 print CLIENTCONF "verb 3\n";
b278daf3 2007 print CLIENTCONF "# Tunnel check\n";
ce9abb66 2008 print CLIENTCONF "keepalive 10 60\n";
b278daf3 2009 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
2010 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2011 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
b278daf3 2012 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
2013 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2014 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 2015 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 2016
ce9abb66
AH
2017
2018 close(CLIENTCONF);
2019
2020 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2021 my $status = $zip->writeToFileNamed($zippathname);
2022
2023 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2024 @fileholder = <DLFILE>;
2025 print "Content-Type:application/x-download\n";
2026 print "Content-Disposition:attachment;filename=$zipname\n\n";
2027 print @fileholder;
2028 exit (0);
2029}
2030else
2031{
2032 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2033 my $zippathname = "$zippath$zipname";
2034 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2035
2036###
7c1d9faf 2037# m.a.d net2net
ce9abb66
AH
2038###
2039
c6c9630e 2040 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT
2041 flock CLIENTCONF, 2;
2042
2043 my $zip = Archive::Zip->new();
2044
8c877a82 2045 print CLIENTCONF "#OpenVPN Client conf\r\n";
6e13d0a5
MT
2046 print CLIENTCONF "tls-client\r\n";
2047 print CLIENTCONF "client\r\n";
4f6e3ae3 2048 print CLIENTCONF "nobind\r\n";
6e13d0a5 2049 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
c6c9630e 2050 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2ee746be
SS
2051
2052 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2053 # or use configured value.
2054 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
4f6e3ae3 2055 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be 2056 elsif ($vpnsettings{MSSFIX} eq 'on')
4f6e3ae3 2057 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
1647059d
SS
2058 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2059 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2060 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
4f6e3ae3 2061 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be
SS
2062 else
2063 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2064
6e13d0a5
MT
2065 if ( $vpnsettings{'ENABLED'} eq 'on'){
2066 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT
2067 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2068 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2069 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2070 }
2071 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2072 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2073 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2074 }
2075 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2076 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2077 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2078 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2079 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2080 }
2081 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2082 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT
2083 }
2084
2085 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
c6c9630e
MT
2086 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2087 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
6e13d0a5 2088 } else {
c6c9630e
MT
2089 print CLIENTCONF "ca cacert.pem\r\n";
2090 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2091 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2092 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2093 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT
2094 }
2095 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2096 if ($vpnsettings{DCOMPLZO} eq 'on') {
2097 print CLIENTCONF "comp-lzo\r\n";
2098 }
2099 print CLIENTCONF "verb 3\r\n";
2100 print CLIENTCONF "ns-cert-type server\r\n";
a79fa1d6
JPT
2101 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2102 if ($vpnsettings{MSSFIX} eq 'on') {
2103 print CLIENTCONF "mssfix\r\n";
2104 }
74225cce 2105 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT
2106 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2107 }
1647059d
SS
2108
2109 # Check if a valid operating mode has been choosen and use it.
2110 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2111 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2112 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be 2113 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
4f6e3ae3 2114 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2ee746be
SS
2115 }
2116 }
6e13d0a5 2117 close(CLIENTCONF);
ce9abb66 2118
6e13d0a5
MT
2119 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2120 my $status = $zip->writeToFileNamed($zippathname);
2121
2122 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2123 @fileholder = <DLFILE>;
2124 print "Content-Type:application/x-download\n";
2125 print "Content-Disposition:attachment;filename=$zipname\n\n";
2126 print @fileholder;
2127 exit (0);
ce9abb66
AH
2128 }
2129
2130
2131
6e13d0a5
MT
2132###
2133### Remove connection
2134###
ce9abb66
AH
2135
2136
6e13d0a5
MT
2137} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2138 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2139 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e
MT
2140
2141 if ($confighash{$cgiparams{'KEY'}}) {
2142# if ($vpnsettings{'ENABLED'} eq 'on' ||
2143# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2144# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2145# }
2146#
2147 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
ce9abb66
AH
2148
2149###
7c1d9faf 2150# m.a.d net2net
ce9abb66 2151###
7c1d9faf 2152
ce9abb66
AH
2153 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2154
2155 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2156 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2157 unlink ($certfile) or die "Removing $certfile fail: $!";
2158 unlink ($conffile) or die "Removing $conffile fail: $!";
2159 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2160
2161}
ce9abb66
AH
2162
2163 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
8c877a82
AM
2164 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2165
2166# A.Marx CCD delete ccd files and routes
2167
2168
2169 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2170 {
2171 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2172 }
e81be1e1 2173
8c877a82
AM
2174 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2175 foreach my $key (keys %ccdroutehash) {
2176 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2177 delete $ccdroutehash{$key};
2178 }
2179 }
2180 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
e81be1e1 2181
8c877a82
AM
2182 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2183 foreach my $key (keys %ccdroute2hash) {
2184 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2185 delete $ccdroute2hash{$key};
2186 }
2187 }
2188 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
52d08bcb 2189 &writeserverconf;
8c877a82
AM
2190
2191
2192# CCD end
2193
2194
c6c9630e
MT
2195 delete $confighash{$cgiparams{'KEY'}};
2196 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2197 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
8c877a82 2198
c6c9630e 2199 #&writeserverconf();
6e13d0a5 2200 } else {
c6c9630e 2201 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5 2202 }
ce9abb66
AH
2203
2204
6e13d0a5
MT
2205###
2206### Download PKCS12 file
2207###
2208} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2209 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2210
2211 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2212 print "Content-Type: application/octet-stream\r\n\r\n";
2213 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2214 exit (0);
2215
2216###
2217### Display certificate
2218###
2219} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2220 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2221
2222 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
2223 &Header::showhttpheaders();
2224 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2225 &Header::openbigbox('100%', 'LEFT', '', '');
2226 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2227 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2228 $output = &Header::cleanhtml($output,"y");
2229 print "<pre>$output</pre>\n";
2230 &Header::closebox();
2231 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2232 &Header::closebigbox();
2233 &Header::closepage();
2234 exit(0);
6e13d0a5
MT
2235 }
2236###
2237### Display Certificate Revoke List
2238###
2239} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT
2240# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2241
6e13d0a5 2242 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
c6c9630e
MT
2243 &Header::showhttpheaders();
2244 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2245 &Header::openbigbox('100%', 'LEFT', '', '');
2246 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2247 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2248 $output = &Header::cleanhtml($output,"y");
2249 print "<pre>$output</pre>\n";
2250 &Header::closebox();
2251 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2252 &Header::closebigbox();
2253 &Header::closepage();
2254 exit(0);
6e13d0a5
MT
2255 }
2256
2257###
2258### Advanced Server Settings
2259###
2260
2261} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2262 %cgiparams = ();
2263 %cahash = ();
2264 %confighash = ();
8c877a82 2265 my $disabled;
6e13d0a5 2266 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 2267 read_routepushfile;
8c877a82
AM
2268
2269
c6c9630e
MT
2270# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2271# $cgiparams{'CLIENT2CLIENT'} = 'on';
2272# }
6e13d0a5
MT
2273ADV_ERROR:
2274 if ($cgiparams{'MAX_CLIENTS'} eq '') {
c6c9630e 2275 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 2276 }
6e13d0a5 2277 if ($cgiparams{'KEEPALIVE_1'} eq '') {
c6c9630e 2278 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT
2279 }
2280 if ($cgiparams{'KEEPALIVE_2'} eq '') {
c6c9630e 2281 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT
2282 }
2283 if ($cgiparams{'LOG_VERB'} eq '') {
ae9f6139
MT
2284 $cgiparams{'LOG_VERB'} = '3';
2285 }
92b87e17
SS
2286 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
2287 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2288 }
6e13d0a5
MT
2289 $checked{'CLIENT2CLIENT'}{'off'} = '';
2290 $checked{'CLIENT2CLIENT'}{'on'} = '';
2291 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2292 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2293 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2294 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
a79fa1d6
JPT
2295 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2296 $checked{'MSSFIX'}{'off'} = '';
2297 $checked{'MSSFIX'}{'on'} = '';
2298 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2ee746be 2299 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
6e13d0a5
MT
2300 $selected{'LOG_VERB'}{'1'} = '';
2301 $selected{'LOG_VERB'}{'2'} = '';
2302 $selected{'LOG_VERB'}{'3'} = '';
2303 $selected{'LOG_VERB'}{'4'} = '';
2304 $selected{'LOG_VERB'}{'5'} = '';
2305 $selected{'LOG_VERB'}{'6'} = '';
2306 $selected{'LOG_VERB'}{'7'} = '';
2307 $selected{'LOG_VERB'}{'8'} = '';
2308 $selected{'LOG_VERB'}{'9'} = '';
2309 $selected{'LOG_VERB'}{'10'} = '';
2310 $selected{'LOG_VERB'}{'11'} = '';
2311 $selected{'LOG_VERB'}{'0'} = '';
2312 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
8c877a82 2313
6e13d0a5
MT
2314 &Header::showhttpheaders();
2315 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2316 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2317 if ($errormessage) {
c6c9630e
MT
2318 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2319 print "<class name='base'>$errormessage\n";
2320 print "&nbsp;</class>\n";
2321 &Header::closebox();
6e13d0a5
MT
2322 }
2323 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2324 print <<END
b376fae4 2325 <form method='post' enctype='multipart/form-data'>
8c877a82 2326 <table width='100%' border=0>
6e13d0a5
MT
2327 <tr>
2328 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2329 </tr>
2330 <tr>
2331 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2332 </tr>
2333 <tr>
2334 <td class='base'>Domain</td>
8c877a82 2335 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
6e13d0a5
MT
2336 </tr>
2337 <tr>
2338 <td class='base'>DNS</td>
2339 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2340 </tr>
2341 <tr>
2342 <td class='base'>WINS</td>
2343 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
54fd0535
MT
2344 </tr>
2345 <tr>
2346 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2347 </tr>
2348 <tr>
2349 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2350 <td colspan='2'>
2351 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2352END
2353;
2354
2355if ($cgiparams{'ROUTES_PUSH'} ne '')
2356{
2357 print $cgiparams{'ROUTES_PUSH'};
2358}
2359
8c877a82 2360print <<END;
54fd0535
MT
2361</textarea></td>
2362</tr>
6e13d0a5
MT
2363 </tr>
2364</table>
2365<hr size='1'>
6e13d0a5
MT
2366 <table width='100%'>
2367 <tr>
2368 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2369 </tr>
2370 <tr>
2ee746be 2371 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
6e13d0a5
MT
2372 </tr>
2373 <tr>
2374 <td class='base'>Client-To-Client</td>
2375 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2376 </tr>
2377 <tr>
2378 <td class='base'>Redirect-Gateway def1</td>
2379 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2380 </tr>
2381 <tr>
2382 <td class='base'>Max-Clients</td>
a79fa1d6 2383 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
6e13d0a5 2384 </tr>
a79fa1d6 2385 <tr>
f0ccae18 2386 <td class='base'>Keepalive <br />
a79fa1d6
JPT
2387 (ping/ping-restart)</td>
2388 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2389 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2390 </tr>
2391 <tr>
2392 <td class='base'>fragment <br></td>
2393 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
60f396d7
AH
2394 <td>Default: <span class="base">1300</span></td>
2395 </tr>
a79fa1d6
JPT
2396 <tr>
2397 <td class='base'>mssfix</td>
2398 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2399 <td>Default: on</td>
2ee746be
SS
2400 </tr>
2401
2402 <tr>
2403 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2404 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2405 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2406 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2407 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2408 </tr>
a79fa1d6
JPT
2409</table>
2410
2411<!--
2412<hr size='1'>
2413 <table width='100%'>
2414 <tr>
2415 <td class'base'><b>Crypto-Engines</b></td>
2416 </tr>
2417 <tr>
2418 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5 2419 </tr>
a79fa1d6
JPT
2420 <tr><td class='base'>Engines:</td>
2421 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2422 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2423 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2424 </select>
2425 </td>
6e13d0a5 2426</table>
a79fa1d6 2427-->
6e13d0a5
MT
2428<hr size='1'>
2429 <table width='100%'>
2430 <tr>
2431 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2432 </tr>
2433 <tr>
a79fa1d6 2434 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT
2435 </tr>
2436
2437 <tr><td class='base'>VERB</td>
2438 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2439 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2440 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2441 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2442 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2443 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2444 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2445 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2446 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2447 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2448 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
c6c9630e 2449 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
8c877a82
AM
2450</table><hr>
2451END
2452
2453if ( -e "/var/run/openvpn.pid"){
2454print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2455 $Lang::tr{'server restart'}<br><br>
2456 <hr>";
52d08bcb
AM
2457 print<<END
2458<table width='100%'>
2459<tr>
2460 <td>&nbsp;</td>
2461 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2462 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2463 <td>&nbsp;</td>
2464</tr>
2465</table>
2466</form>
2467END
2468;
2469
2470
2471}else{
8c877a82
AM
2472
2473print<<END
6e13d0a5
MT
2474<table width='100%'>
2475<tr>
2476 <td>&nbsp;</td>
2477 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2478 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2479 <td>&nbsp;</td>
2480</tr>
2481</table>
2482</form>
2483END
2484;
52d08bcb 2485}
6e13d0a5 2486 &Header::closebox();
c6c9630e 2487# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2488 &Header::closebigbox();
2489 &Header::closepage();
2490 exit(0);
2491
8c877a82
AM
2492
2493# A.Marx CCD Add,delete or edit CCD net
2494
2495} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2496 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2497 $cgiparams{'ACTION'} eq "kill" ||
2498 $cgiparams{'ACTION'} eq "edit" ||
2499 $cgiparams{'ACTION'} eq 'editsave'){
2500 &Header::showhttpheaders();
2501 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2502 &Header::openbigbox('100%', 'LEFT', '', '');
2503
2504 if ($cgiparams{'ACTION'} eq "kill"){
2505 &delccdnet($cgiparams{'net'});
2506 }
2507
2508 if ($cgiparams{'ACTION'} eq 'editsave'){
2509 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2510 if ( $a ne $b){ &modccdnet($a,$b);}
5068ac38
AM
2511 $cgiparams{'ccdname'}='';
2512 $cgiparams{'ccdsubnet'}='';
8c877a82
AM
2513 }
2514
2515 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
e2429e8d 2516 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
8c877a82
AM
2517 }
2518 if ($errormessage) {
2519 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2520 print "<class name='base'>$errormessage";
2521 print "&nbsp;</class>";
2522 &Header::closebox();
2523 }
2524if ($cgiparams{'ACTION'} eq "edit"){
2525
2526 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2527
2528 print <<END
2529 <table width='100%' border=0>
2530 <tr><form method='post'>
2531 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2532 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
2533 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2534 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2535 </td></tr>
2536 </table></form>
2537END
2538;
2539 &Header::closebox();
2540
2541 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2542 print <<END
2543 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2544 <tr>
2545 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2546END
2547;
2548}
2549else{
2550 if (! -e "/var/run/openvpn.pid"){
2551 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2552 print <<END;
2553 <table width='100%' border='0'>
2554 <tr><form method='post'>
2555 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2556 <tr>
2557 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2558 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2559 <tr><td colspan=4><hr /></td></tr><tr>
2560 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2561 </table></form>
2562END
2563
2564 &Header::closebox();
2565}
2566 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
5068ac38
AM
2567 if ( -e "/var/run/openvpn.pid"){
2568 print "<b>$Lang::tr{'attention'}:</b><br>";
2569 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2570 }
2571
8c877a82
AM
2572 print <<END
2573 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2574 <tr>
2575 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2576END
2577;
2578}
2579 my %ccdconfhash=();
2580 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2581 my @ccdconf=();
2582 my $count=0;
df9b48b7 2583 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM
2584 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2585 $count++;
2586 my $ccdhosts = &hostsinnet($ccdconf[0]);
2587 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2588 else{ print" <tr bgcolor='$color{'color20'}'>";}
2589 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
2590print <<END
2591 <form method='post' />
2592 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
2593 <input type='hidden' name='ACTION' value='edit'/>
2594 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2595 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2596 </form></td>
2597 <form method='post' />
2598 <td><input type='hidden' name='ACTION' value='kill'/>
2599 <input type='hidden' name='number' value='$count' />
2600 <input type='hidden' name='net' value='$ccdconf[0]' />
2601 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
2602END
2603;
2604 }
2605 print "</table></form>";
2606 &Header::closebox();
2607 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2608 &Header::closebigbox();
2609 &Header::closepage();
2610 exit(0);
2611
2612#END CCD
2613
6e13d0a5
MT
2614###
2615### Openvpn Connections Statistics
2616###
2617} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2618 &Header::showhttpheaders();
2619 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2620 &Header::openbigbox('100%', 'LEFT', '', '');
2621 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2622
2623#
2624# <td><b>$Lang::tr{'protocol'}</b></td>
2625# protocol temp removed
2626 print <<END
2627 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2628 <tr>
2629 <td><b>$Lang::tr{'common name'}</b></td>
2630 <td><b>$Lang::tr{'real address'}</b></td>
2631 <td><b>$Lang::tr{'virtual address'}</b></td>
2632 <td><b>$Lang::tr{'loged in at'}</b></td>
2633 <td><b>$Lang::tr{'bytes sent'}</b></td>
2634 <td><b>$Lang::tr{'bytes received'}</b></td>
2635 <td><b>$Lang::tr{'last activity'}</b></td>
2636 </tr>
2637END
2638;
4e17adad 2639 my $filename = "/var/log/ovpnserver.log";
6e13d0a5
MT
2640 open(FILE, $filename) or die 'Unable to open config file.';
2641 my @current = <FILE>;
2642 close(FILE);
2643 my @users =();
2644 my $status;
2645 my $uid = 0;
2646 my $cn;
2647 my @match = ();
2648 my $proto = "udp";
2649 my $address;
2650 my %userlookup = ();
2651 foreach my $line (@current)
2652 {
2653 chomp($line);
2654 if ( $line =~ /^Updated,(.+)/){
2655 @match = split( /^Updated,(.+)/, $line);
2656 $status = $match[1];
2657 }
c6c9630e 2658#gian
6e13d0a5
MT
2659 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2660 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2661 if ($match[1] ne "Common Name") {
2662 $cn = $match[1];
2663 $userlookup{$match[2]} = $uid;
2664 $users[$uid]{'CommonName'} = $match[1];
2665 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT
2666 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2667 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT
2668 $users[$uid]{'Since'} = $match[5];
2669 $users[$uid]{'Proto'} = $proto;
2670 $uid++;
2671 }
2672 }
2673 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2674 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2675 if ($match[1] ne "Virtual Address") {
2676 $address = $match[3];
2677 #find the uid in the lookup table
2678 $uid = $userlookup{$address};
2679 $users[$uid]{'VirtualAddress'} = $match[1];
2680 $users[$uid]{'LastRef'} = $match[4];
2681 }
2682 }
2683 }
2684 my $user2 = @users;
2685 if ($user2 >= 1){
2686 for (my $idx = 1; $idx <= $user2; $idx++){
2687 if ($idx % 2) {
4e17adad 2688 print "<tr bgcolor='$color{'color20'}'>\n";
6e13d0a5 2689 } else {
4e17adad 2690 print "<tr bgcolor='$color{'color22'}'>\n";
6e13d0a5
MT
2691 }
2692 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2693 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2694 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2695 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2696 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2697 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2698 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2699# print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2700 }
2701 }
2702
2703 print "</table>";
2704 print <<END
2705 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2706 <tr><td></td></tr>
2707 <tr><td></td></tr>
2708 <tr><td></td></tr>
2709 <tr><td></td></tr>
2710 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2711 </table>
2712END
2713;
2714 &Header::closebox();
2715 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2716 &Header::closebigbox();
2717 &Header::closepage();
2718 exit(0);
2719
2720###
2721### Download Certificate
2722###
2723} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2724 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2725
6e13d0a5 2726 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
2727 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2728 print "Content-Type: application/octet-stream\r\n\r\n";
2729 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2730 exit (0);
2731 }
2732
2733###
2734### Enable/Disable connection
2735###
ce9abb66 2736
c6c9630e
MT
2737} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2738
2739 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2740 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2741
2742 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 2743 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT
2744 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2745 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2746 #&writeserverconf();
2747# if ($vpnsettings{'ENABLED'} eq 'on' ||
2748# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2749# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2750# }
2751 } else {
2752 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2753# if ($vpnsettings{'ENABLED'} eq 'on' ||
2754# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2755# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2756# }
2757 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2758 #&writeserverconf();
2759 }
2760 } else {
2761 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
2762 }
2763
2764###
2765### Restart connection
2766###
2767} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2768 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2769 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2770
2771 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT
2772# if ($vpnsettings{'ENABLED'} eq 'on' ||
2773# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2774# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2775# }
6e13d0a5 2776 } else {
c6c9630e 2777 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
2778 }
2779
2780###
c6c9630e 2781### Remove connection
6e13d0a5 2782###
c6c9630e
MT
2783} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2784 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2785 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2786
2787 if ($confighash{$cgiparams{'KEY'}}) {
2788# if ($vpnsettings{'ENABLED'} eq 'on' ||
2789# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2790# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2791# }
2792 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2793 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2794 delete $confighash{$cgiparams{'KEY'}};
2795 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2796 #&writeserverconf();
2797 } else {
2798 $errormessage = $Lang::tr{'invalid key'};
2799 }
ce9abb66
AH
2800#test33
2801
2802###
2803### Choose between adding a host-net or net-net connection
2804###
2805
2806###
7c1d9faf 2807# m.a.d net2net
ce9abb66
AH
2808###
2809
2810} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2811 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2812 &Header::showhttpheaders();
2813 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2814 &Header::openbigbox('100%', 'LEFT', '', '');
2815 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH
2816
2817if ( -s "${General::swroot}/ovpn/settings") {
2818
ce9abb66
AH
2819 print <<END
2820 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 2821 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
ce9abb66
AH
2822 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2823 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2824 <tr><td><input type='radio' name='TYPE' value='net' /></td>
2825 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2826 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2827 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2828 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
54fd0535 2829 <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
8c877a82 2830 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr>
54fd0535 2831 <tr><td colspan='3'><hr /></td></tr>
8c877a82 2832 <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
54fd0535 2833 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
ce9abb66
AH
2834 </form></table>
2835END
2836 ;
8c877a82 2837
ce9abb66 2838
b278daf3
AH
2839} else {
2840 print <<END
2841 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 2842 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
b278daf3 2843 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
8c877a82 2844 <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
b278daf3
AH
2845 </form></table>
2846END
2847 ;
2848
2849}
2850
ce9abb66
AH
2851 &Header::closebox();
2852 &Header::closebigbox();
2853 &Header::closepage();
2854 exit (0);
2855
2856###
7c1d9faf 2857# m.a.d net2net
ce9abb66
AH
2858###
2859
2860} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2861
2862 my @firen2nconf;
2863 my @confdetails;
2864 my $uplconffilename ='';
54fd0535 2865 my $uplconffilename2 ='';
ce9abb66 2866 my $uplp12name = '';
54fd0535 2867 my $uplp12name2 = '';
ce9abb66
AH
2868 my @rem_subnet;
2869 my @rem_subnet2;
2870 my @tmposupnet3;
2871 my $key;
54fd0535 2872 my @n2nname;
ce9abb66
AH
2873
2874 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2875
2876# Check if a file is uploaded
2877
2878 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2879 $errormessage = $Lang::tr{'there was no file upload'};
2880 goto N2N_ERROR;
2881 }
2882
2883# Move uploaded IPfire n2n package to temporary file
2884
2885 (my $fh, my $filename) = tempfile( );
2886 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2887 $errormessage = $!;
2888 goto N2N_ERROR;
2889 }
2890
2891 my $zip = Archive::Zip->new();
2892 my $zipName = $filename;
2893 my $status = $zip->read( $zipName );
2894 if ($status != AZ_OK) {
2895 $errormessage = "Read of $zipName failed\n";
2896 goto N2N_ERROR;
2897 }
2898
2899 my $tempdir = tempdir( CLEANUP => 1 );
2900 my @files = $zip->memberNames();
2901 for(@files) {
2902 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2903 }
2904 my $countfiles = @files;
2905
2906# Check if we have not more then 2 files
2907
2908 if ( $countfiles == 2){
2909 foreach (@files){
2910 if ( $_ =~ /.conf$/){
2911 $uplconffilename = $_;
2912 }
2913 if ( $_ =~ /.p12$/){
2914 $uplp12name = $_;
2915 }
2916 }
2917 if (($uplconffilename eq '') || ($uplp12name eq '')){
2918 $errormessage = "Either no *.conf or no *.p12 file found\n";
2919 goto N2N_ERROR;
2920 }
2921
2922 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2923 @firen2nconf = <FILE>;
2924 close (FILE);
2925 chomp(@firen2nconf);
2926
2927 } else {
2928
2929 $errormessage = "Filecount does not match only 2 files are allowed\n";
2930 goto N2N_ERROR;
2931 }
2932
7c1d9faf
AH
2933###
2934# m.a.d net2net
ce9abb66 2935###
54fd0535
MT
2936
2937 if ($cgiparams{'n2nname'} ne ''){
2938
2939 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2940 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2941 $n2nname[0] = $cgiparams{'n2nname'};
2942 my @n2nname2 = split(/\./,$uplconffilename);
2943 $n2nname2[0] =~ s/\n|\r//g;
2944 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2945 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2946 my $input2 = "$n2nname2[0]n2n";
2947 my $output2 = "$n2nname[0]n2n";
2948 my $filename = "$tempdir/$uplconffilename";
2949 open(FILE, "< $filename") or die 'Unable to open config file.';
2950 my @current = <FILE>;
2951 close(FILE);
2952 foreach (@current) {s/$input1/$output1/g;}
2953 foreach (@current) {s/$input2/$output2/g;}
2954 open (OUT, "> $filename") || die 'Unable to open config file.';
2955 print OUT @current;
2956 close OUT;
ce9abb66 2957
54fd0535
MT
2958 }else{
2959 $uplconffilename2 = $uplconffilename;
2960 $uplp12name2 = $uplp12name;
2961 @n2nname = split(/\./,$uplconffilename);
ce9abb66 2962 $n2nname[0] =~ s/\n|\r//g;
54fd0535 2963 }
7c1d9faf
AH
2964 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2965 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
ce9abb66 2966
54fd0535 2967 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
ce9abb66
AH
2968
2969 if ($? ne 0) {
2970 $errormessage = "*.conf move failed: $!";
2971 unlink ($filename);
2972 goto N2N_ERROR;
2973 }
2974
54fd0535 2975 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
b278daf3
AH
2976 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2977
ce9abb66
AH
2978 if ($? ne 0) {
2979 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2980 unlink ($filename);
2981 goto N2N_ERROR;
2982 }
2983
2984my $complzoactive;
d96c89eb
AH
2985my $mssfixactive;
2986my $n2nfragment;
2ee746be 2987my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);;
60f396d7 2988my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
54fd0535 2989my @n2nproto = split(/-/, $n2nproto2[1]);
ce9abb66
AH
2990my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2991my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2992my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2993if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH
2994my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
2995if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
54fd0535 2996#my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
d96c89eb 2997my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH
2998my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2999my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3000my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
3001my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
54fd0535 3002my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
ce9abb66
AH
3003my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3004
60f396d7 3005
ce9abb66
AH
3006###
3007# m.a.d delete CR and LF from arrays for this chomp doesnt work
3008###
3009
ce9abb66 3010$n2nremote[1] =~ s/\n|\r//g;
ce9abb66
AH
3011$n2novpnsub[0] =~ s/\n|\r//g;
3012$n2novpnsub[1] =~ s/\n|\r//g;
3013$n2novpnsub[2] =~ s/\n|\r//g;
60f396d7 3014$n2nproto[0] =~ s/\n|\r//g;
ce9abb66
AH
3015$n2nport[1] =~ s/\n|\r//g;
3016$n2ntunmtu[1] =~ s/\n|\r//g;
3017$n2nremsub[1] =~ s/\n|\r//g;
b278daf3 3018$n2nremsub[2] =~ s/\n|\r//g;
ce9abb66 3019$n2nlocalsub[2] =~ s/\n|\r//g;
d96c89eb 3020$n2nfragment[1] =~ s/\n|\r//g;
54fd0535 3021$n2nmgmt[2] =~ s/\n|\r//g;
2ee746be 3022$n2nmtudisc[1] =~ s/\n|\r//g;
ce9abb66 3023chomp ($complzoactive);
d96c89eb 3024chomp ($mssfixactive);
ce9abb66
AH
3025
3026###
7c1d9faf 3027# m.a.d net2net
ce9abb66
AH
3028###
3029
3030###
3031# Check if there is no other entry with this name
3032###
3033
3034 foreach my $dkey (keys %confighash) {
3035 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3036 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH
3037 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3038 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3039 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
ce9abb66
AH
3040 goto N2N_ERROR;
3041 }
3042 }
3043
d96c89eb
AH
3044###
3045# Check if OpenVPN Subnet is valid
3046###
3047
3048foreach my $dkey (keys %confighash) {
3049 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3050 $errormessage = 'The OpenVPN Subnet is already in use';
b278daf3
AH
3051 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3052 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3053 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH
3054 goto N2N_ERROR;
3055 }
3056 }
3057
3058###
3059# Check im Dest Port is vaild
3060###
3061
3062foreach my $dkey (keys %confighash) {
3063 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3064 $errormessage = 'The OpenVPN Port is already in use';
b278daf3
AH
3065 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3066 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3067 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH
3068 goto N2N_ERROR;
3069 }
3070 }
3071
3072
3073
ce9abb66
AH
3074 $key = &General::findhasharraykey (\%confighash);
3075
350f2980
SS
3076 foreach my $i (0 .. 39) { $confighash{$key}[$i] = "";}
3077
ce9abb66
AH
3078 $confighash{$key}[0] = 'off';
3079 $confighash{$key}[1] = $n2nname[0];
350f2980 3080 $confighash{$key}[2] = $n2nname[0];
ce9abb66
AH
3081 $confighash{$key}[3] = 'net';
3082 $confighash{$key}[4] = 'cert';
3083 $confighash{$key}[6] = 'client';
3084 $confighash{$key}[8] = $n2nlocalsub[2];
350f2980
SS
3085 $confighash{$key}[10] = $n2nremote[1];
3086 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
54fd0535 3087 $confighash{$key}[22] = $n2nmgmt[2];
350f2980 3088 $confighash{$key}[23] = $mssfixactive;
d96c89eb 3089 $confighash{$key}[24] = $n2nfragment[1];
350f2980 3090 $confighash{$key}[25] = 'IPFire n2n Client';
ce9abb66 3091 $confighash{$key}[26] = 'red';
350f2980
SS
3092 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3093 $confighash{$key}[28] = $n2nproto[0];
3094 $confighash{$key}[29] = $n2nport[1];
3095 $confighash{$key}[30] = $complzoactive;
3096 $confighash{$key}[31] = $n2ntunmtu[1];
3097 $confighash{$key}[38] = $n2nmtudisc[1];
ce9abb66
AH
3098
3099
3100 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
d96c89eb 3101
ce9abb66
AH
3102 N2N_ERROR:
3103
3104 &Header::showhttpheaders();
3105 &Header::openpage('Validate imported configuration', 1, '');
3106 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3107 if ($errormessage) {
3108 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3109 print "<class name='base'>$errormessage";
3110 print "&nbsp;</class>";
3111 &Header::closebox();
3112
3113 } else
3114 {
3115 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3116 }
3117 if ($errormessage eq ''){
3118 print <<END
3119 <!-- ipfire net2net config gui -->
3120 <table width='100%'>
3121 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3122 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3123 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3124 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3125 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3126 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3127 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
3128 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3129 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3130 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3131 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
7c1d9faf
AH
3132 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
3133 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
ce9abb66 3134 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
350f2980 3135 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td><b>$confighash{$key}[38]</b></td></tr>
54fd0535 3136 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
ce9abb66
AH
3137 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3138 </table>
3139END
3140;
3141 &Header::closebox();
3142 }
3143
3144 if ($errormessage) {
3145 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3146 } else {
3147 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3148 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3149 print "<input type='hidden' name='KEY' value='$key' />";
3150 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3151 }
3152 &Header::closebigbox();
3153 &Header::closepage();
3154 exit(0);
3155
3156
3157##
3158### Accept IPFire n2n Package Settings
3159###
3160
3161 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3162
3163###
3164### Discard and Rollback IPFire n2n Package Settings
3165###
3166
3167 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3168