openvpn: Remove RC2 as a cipher option.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
49abe7af 5# Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535 21###
f527e53f 22# Based on IPFireCore 77
54fd0535 23###
6e13d0a5
MT
24use CGI;
25use CGI qw/:standard/;
26use Net::DNS;
ce9abb66 27use Net::Ping;
54fd0535 28use Net::Telnet;
6e13d0a5
MT
29use File::Copy;
30use File::Temp qw/ tempfile tempdir /;
31use strict;
32use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
eff2dbf8 33use Sort::Naturally;
6e13d0a5 34require '/var/ipfire/general-functions.pl';
6e13d0a5
MT
35require "${General::swroot}/lang.pl";
36require "${General::swroot}/header.pl";
37require "${General::swroot}/countries.pl";
38
39# enable only the following on debugging purpose
8c877a82
AM
40#use warnings;
41#use CGI::Carp 'fatalsToBrowser';
6e13d0a5 42#workaround to suppress a warning when a variable is used only once
8c877a82 43my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
6e13d0a5
MT
44undef (@dummy);
45
f2fdd0c1
CS
46my %color = ();
47my %mainsettings = ();
48&General::readhash("${General::swroot}/main/settings", \%mainsettings);
49&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
6e13d0a5
MT
50
51###
52### Initialize variables
53###
e81be1e1
AM
54my %ccdconfhash=();
55my %ccdroutehash=();
56my %ccdroute2hash=();
6e13d0a5
MT
57my %netsettings=();
58my %cgiparams=();
59my %vpnsettings=();
60my %checked=();
61my %confighash=();
62my %cahash=();
63my %selected=();
64my $warnmessage = '';
65my $errormessage = '';
66my %settings=();
54fd0535 67my $routes_push_file = '';
df9b48b7
AM
68my $confighost="${General::swroot}/fwhosts/customhosts";
69my $configgrp="${General::swroot}/fwhosts/customgroups";
70my $customnet="${General::swroot}/fwhosts/customnetworks";
71my $name;
99bfa85c 72my $col="";
6e13d0a5
MT
73&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
74$cgiparams{'ENABLED'} = 'off';
75$cgiparams{'ENABLED_BLUE'} = 'off';
76$cgiparams{'ENABLED_ORANGE'} = 'off';
77$cgiparams{'EDIT_ADVANCED'} = 'off';
78$cgiparams{'NAT'} = 'off';
79$cgiparams{'COMPRESSION'} = 'off';
80$cgiparams{'ONLY_PROPOSED'} = 'off';
81$cgiparams{'ACTION'} = '';
82$cgiparams{'CA_NAME'} = '';
4c962356
EK
83$cgiparams{'DH_NAME'} = 'dh1024.pem';
84$cgiparams{'DHLENGHT'} = '';
6e13d0a5
MT
85$cgiparams{'DHCP_DOMAIN'} = '';
86$cgiparams{'DHCP_DNS'} = '';
87$cgiparams{'DHCP_WINS'} = '';
54fd0535 88$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 89$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 90$cgiparams{'MSSFIX'} = '';
8c877a82 91$cgiparams{'number'} = '';
2ee746be 92$cgiparams{'PMTU_DISCOVERY'} = '';
4c962356 93$cgiparams{'DCIPHER'} = '';
49abe7af
EK
94$cgiparams{'DAUTH'} = '';
95$cgiparams{'TLSAUTH'} = '';
54fd0535
MT
96$routes_push_file = "${General::swroot}/ovpn/routes_push";
97unless (-e $routes_push_file) { system("touch $routes_push_file"); }
8c877a82
AM
98unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
99unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
100unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
ce9abb66 101
6e13d0a5
MT
102&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
103
104# prepare openvpn config file
105###
106### Useful functions
107###
c6c9630e
MT
108sub haveOrangeNet
109{
13211b21
CS
110 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
111 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
112 return 0;
113}
114
115sub haveBlueNet
116{
13211b21 117 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 118 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
119 return 0;
120}
121
122sub sizeformat{
123 my $bytesize = shift;
124 my $i = 0;
125
126 while(abs($bytesize) >= 1024){
127 $bytesize=$bytesize/1024;
128 $i++;
129 last if($i==6);
130 }
131
132 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
133 my $newsize=(int($bytesize*100 +0.5))/100;
134 return("$newsize $units[$i]");
135}
136
c6c9630e
MT
137sub cleanssldatabase
138{
139 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
140 print FILE "01";
141 close FILE;
142 }
143 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
144 print FILE "";
145 close FILE;
146 }
147 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
148 unlink ("${General::swroot}/ovpn/certs/serial.old");
149 unlink ("${General::swroot}/ovpn/certs/01.pem");
150}
151
152sub newcleanssldatabase
153{
154 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
155 open(FILE, ">${General::swroot}(ovpn/certs/serial");
156 print FILE "01";
157 close FILE;
158 }
159 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
160 system ("touch ${General::swroot}/ovpn/certs/index.txt");
161 }
162 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
163 unlink ("${General::swroot}/ovpn/certs/serial.old");
164}
165
166sub deletebackupcert
167{
168 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
169 my $hexvalue = <FILE>;
170 chomp $hexvalue;
171 close FILE;
172 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
173 }
174}
c6c9630e 175sub checkportfw {
6945e463
AM
176 my $DPORT = shift;
177 my $DPROT = shift;
178 my %natconfig =();
6d8eb5de 179 my $confignat = "${General::swroot}/firewall/config";
6945e463
AM
180 $DPROT= uc ($DPROT);
181 &General::readhasharray($confignat, \%natconfig);
182 foreach my $key (sort keys %natconfig){
6945e463
AM
183 my @portarray = split (/\|/,$natconfig{$key}[30]);
184 foreach my $value (@portarray){
6945e463
AM
185 if ($value =~ /:/i){
186 my ($a,$b) = split (":",$value);
187 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
188 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
189 }
190 }else{
191 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
192 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
193 }
194 }
c6c9630e
MT
195 }
196 }
6945e463 197 return;
c6c9630e
MT
198}
199
200sub checkportoverlap
201{
202 my $portrange1 = $_[0]; # New port range
203 my $portrange2 = $_[1]; # existing port range
204 my @tempr1 = split(/\:/,$portrange1);
205 my @tempr2 = split(/\:/,$portrange2);
206
207 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
208 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
209
210 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
211 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
212
213 return 1; # Everything checks out!
214}
215
216# Darren Critchley - we want to make sure that a port entry is not within an already existing range
217sub checkportinc
218{
219 my $port1 = $_[0]; # Port
220 my $portrange2 = $_[1]; # Port range
221 my @tempr1 = split(/\:/,$portrange2);
222
223 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
224 return 1;
225 } else {
226 return 0;
227 }
228}
c6c9630e 229
b2e75449
MT
230# Darren Critchley - certain ports are reserved for IPFire
231# TCP 67,68,81,222,444
232# UDP 67,68
233# Params passed in -> port, rangeyn, protocol
234sub disallowreserved
235{
236 # port 67 and 68 same for tcp and udp, don't bother putting in an array
237 my $msg = "";
238 my @tcp_reserved = (81,222,444);
239 my $prt = $_[0]; # the port or range
240 my $ryn = $_[1]; # tells us whether or not it is a port range
241 my $prot = $_[2]; # protocol
242 my $srcdst = $_[3]; # source or destination
243 if ($ryn) { # disect port range
244 if ($srcdst eq "src") {
245 $msg = "$Lang::tr{'rsvd src port overlap'}";
246 } else {
247 $msg = "$Lang::tr{'rsvd dst port overlap'}";
248 }
249 my @tmprng = split(/\:/,$prt);
250 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
251 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
252 if ($prot eq "tcp") {
253 foreach my $prange (@tcp_reserved) {
254 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
255 }
256 }
257 } else {
258 if ($srcdst eq "src") {
259 $msg = "$Lang::tr{'reserved src port'}";
260 } else {
261 $msg = "$Lang::tr{'reserved dst port'}";
262 }
263 if ($prt == 67) { $errormessage="$msg 67"; return; }
264 if ($prt == 68) { $errormessage="$msg 68"; return; }
265 if ($prot eq "tcp") {
266 foreach my $prange (@tcp_reserved) {
267 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
268 }
269 }
270 }
271 return;
272}
273
4c962356 274
c6c9630e 275sub writeserverconf {
54fd0535
MT
276 my %sovpnsettings = ();
277 my @temp = ();
c6c9630e 278 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535
MT
279 &read_routepushfile;
280
c6c9630e
MT
281 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
282 flock CONF, 2;
283 print CONF "#OpenVPN Server conf\n";
284 print CONF "\n";
285 print CONF "daemon openvpnserver\n";
286 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 287 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e
MT
288 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
289 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
c6c9630e
MT
290 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
291 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
2b29c22e 292 print CONF "script-security 3 system\n";
07675dc3 293 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 294 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e 295 print CONF "tls-server\n";
4c962356
EK
296 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
297 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
298 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 299 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
c6c9630e
MT
300 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
301 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
8c877a82 302 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
4c962356 303
2ee746be
SS
304 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
305 # If we doesn't use one of them, we can use the configured mtu value.
306 if ($sovpnsettings{'MSSFIX'} eq 'on')
307 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
308 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
309 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
1647059d 310 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
4c962356
EK
311 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
312 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2ee746be
SS
313 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
314 else
315 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
316
54fd0535 317 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
8c877a82
AM
318 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
319 foreach (@temp)
320 {
321 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
322 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
323 }
54fd0535 324 }
8c877a82
AM
325# a.marx ccd
326 my %ccdconfhash=();
327 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
328 foreach my $key (keys %ccdconfhash) {
329 my $a=$ccdconfhash{$key}[1];
330 my ($b,$c) = split (/\//, $a);
331 print CONF "route $b ".&General::cidrtosub($c)."\n";
332 }
333 my %ccdroutehash=();
334 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
335 foreach my $key (keys %ccdroutehash) {
336 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
337 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
338 print CONF "route $a $b\n";
339 }
340 }
341# ccd end
54fd0535 342
8c877a82 343 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
c6c9630e
MT
344 print CONF "client-to-client\n";
345 }
1de5c945 346 if ($sovpnsettings{MSSFIX} eq 'on') {
4c962356 347 print CONF "mssfix\n";
1de5c945
EK
348 }
349 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
4c962356 350 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 351 }
2ee746be 352
1647059d
SS
353 # Check if a valid operating mode has been choosen and use it.
354 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
355 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
356 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
357 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
2ee746be
SS
358 }
359
c6c9630e
MT
360 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
361 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
362 }
363 print CONF "status-version 1\n";
4e17adad 364 print CONF "status /var/log/ovpnserver.log 30\n";
c6c9630e 365 print CONF "cipher $sovpnsettings{DCIPHER}\n";
49abe7af
EK
366 if ($sovpnsettings{'DAUTH'} eq '') {
367 print CONF "";
368 } else {
369 print CONF "auth $sovpnsettings{'DAUTH'}\n";
370 }
371 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
372 print CONF "tls-auth ${General::swroot}/ovpn/ca/ta.key 0\n";
373 }
c6c9630e
MT
374 if ($sovpnsettings{DCOMPLZO} eq 'on') {
375 print CONF "comp-lzo\n";
376 }
377 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
378 print CONF "push \"redirect-gateway def1\"\n";
379 }
380 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
381 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
382 }
383
384 if ($sovpnsettings{DHCP_DNS} ne '') {
385 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
386 }
387
388 if ($sovpnsettings{DHCP_WINS} ne '') {
389 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
390 }
391
392 if ($sovpnsettings{DHCP_WINS} eq '') {
393 print CONF "max-clients 100\n";
a79fa1d6 394 }
c6c9630e
MT
395 if ($sovpnsettings{DHCP_WINS} ne '') {
396 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
397 }
1d0a260a 398 print CONF "tls-verify /usr/lib/openvpn/verify\n";
c6c9630e
MT
399 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
400 print CONF "user nobody\n";
401 print CONF "group nobody\n";
402 print CONF "persist-key\n";
403 print CONF "persist-tun\n";
404 if ($sovpnsettings{LOG_VERB} ne '') {
405 print CONF "verb $sovpnsettings{LOG_VERB}\n";
406 } else {
407 print CONF "verb 3\n";
408 }
409 print CONF "\n";
410
411 close(CONF);
412}
8c877a82 413
c6c9630e 414sub emptyserverlog{
4e17adad 415 if (open(FILE, ">/var/log/ovpnserver.log")) {
c6c9630e
MT
416 flock FILE, 2;
417 print FILE "";
418 close FILE;
419 }
420
421}
422
8c877a82
AM
423sub delccdnet
424{
425 my %ccdconfhash = ();
426 my %ccdhash = ();
427 my $ccdnetname=$_[0];
428 if (-f "${General::swroot}/ovpn/ovpnconfig"){
429 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
430 foreach my $key (keys %ccdhash) {
431 if ($ccdhash{$key}[32] eq $ccdnetname) {
432 $errormessage=$Lang::tr{'ccd err hostinnet'};
433 return;
434 }
435 }
436 }
437 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
438 foreach my $key (keys %ccdconfhash) {
439 if ($ccdconfhash{$key}[0] eq $ccdnetname){
440 delete $ccdconfhash{$key};
441 }
442 }
443 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
444
445 &writeserverconf;
446 return 0;
447}
448
449sub addccdnet
450{
451 my %ccdconfhash=();
452 my @ccdconf=();
453 my $ccdname=$_[0];
454 my $ccdnet=$_[1];
8c877a82
AM
455 my $subcidr;
456 my @ip2=();
457 my $checkup;
458 my $ccdip;
459 my $baseaddress;
290007b3
AM
460
461
462 #check name
463 if ($ccdname eq '')
464 {
465 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
466 return
467 }
468
469 if(!&General::validhostname($ccdname))
470 {
8c877a82
AM
471 $errormessage=$Lang::tr{'ccd err invalidname'};
472 return;
473 }
290007b3
AM
474
475 ($ccdip,$subcidr) = split (/\//,$ccdnet);
476 $subcidr=&General::iporsubtocidr($subcidr);
477 #check subnet
478 if ($subcidr > 30)
479 {
8c877a82
AM
480 $errormessage=$Lang::tr{'ccd err invalidnet'};
481 return;
482 }
290007b3
AM
483 #check ip
484 if (!&General::validipandmask($ccdnet)){
485 $errormessage=$Lang::tr{'ccd err invalidnet'};
486 return;
8c877a82 487 }
290007b3 488
e2429e8d 489 $errormessage=&General::checksubnets($ccdname,$ccdnet);
290007b3 490
8c877a82
AM
491
492 if (!$errormessage) {
493 my %ccdconfhash=();
494 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
495 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
496 my $key = &General::findhasharraykey (\%ccdconfhash);
497 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
498 $ccdconfhash{$key}[0] = $ccdname;
499 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
500 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
501 &writeserverconf;
502 $cgiparams{'ccdname'}='';
503 $cgiparams{'ccdsubnet'}='';
504 return 1;
505 }
506}
507
508sub modccdnet
509{
510
511 my $newname=$_[0];
512 my $oldname=$_[1];
513 my %ccdconfhash=();
514 my %ccdhash=();
515 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
516 foreach my $key (keys %ccdconfhash) {
517 if ($ccdconfhash{$key}[0] eq $oldname) {
518 foreach my $key1 (keys %ccdconfhash) {
519 if ($ccdconfhash{$key1}[0] eq $newname){
520 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
521 return;
522 }else{
523 $ccdconfhash{$key}[0]= $newname;
524 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
525 last;
526 }
527 }
528 }
529 }
530
531 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
532 foreach my $key (keys %ccdhash) {
533 if ($ccdhash{$key}[32] eq $oldname) {
534 $ccdhash{$key}[32]=$newname;
535 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
536 last;
537 }
538 }
539
540 return 0;
541}
542sub ccdmaxclients
543{
544 my $ccdnetwork=$_[0];
545 my @octets=();
546 my @subnet=();
547 @octets=split("\/",$ccdnetwork);
548 @subnet= split /\./, &General::cidrtosub($octets[1]);
549 my ($a,$b,$c,$d,$e);
550 $a=256-$subnet[0];
551 $b=256-$subnet[1];
552 $c=256-$subnet[2];
553 $d=256-$subnet[3];
554 $e=($a*$b*$c*$d)/4;
555 return $e-1;
556}
557
558sub getccdadresses
559{
560 my $ipin=$_[0];
561 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
562 my $cidr=$_[1];
563 chomp($cidr);
564 my $count=$_[2];
565 my $hasip=$_[3];
566 chomp($hasip);
567 my @iprange=();
568 my %ccdhash=();
569 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
b2e75449 570 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
ac87f371 571 for (my $i=1;$i<=$count;$i++) {
8c877a82
AM
572 my $tmpip=$iprange[$i-1];
573 my $stepper=$i*4;
574 $iprange[$i]= &General::getnextip($tmpip,4);
575 }
576 my $r=0;
577 foreach my $key (keys %ccdhash) {
578 $r=0;
579 foreach my $tmp (@iprange){
580 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
581 if ($net eq $tmp) {
582 if ( $hasip ne $ccdhash{$key}[33] ){
583 splice (@iprange,$r,1);
584 }
585 }
586 $r++;
587 }
588 }
589 return @iprange;
590}
591
592sub fillselectbox
593{
594 my $boxname=$_[1];
595 my ($ccdip,$subcidr) = split("/",$_[0]);
596 my $tz=$_[2];
597 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
598 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
599 foreach (@allccdips) {
600 my $ip=$_."/30";
601 chomp($ip);
602 print "<option value='$ip' ";
603 if ( $ip eq $cgiparams{$boxname} ){
604 print"selected";
605 }
606 print ">$ip</option>";
607 }
608 print "</select>";
609}
610
611sub hostsinnet
612{
613 my $name=$_[0];
614 my %ccdhash=();
615 my $i=0;
616 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
617 foreach my $key (keys %ccdhash) {
618 if ($ccdhash{$key}[32] eq $name){ $i++;}
619 }
620 return $i;
621}
622
623sub check_routes_push
624{
625 my $val=$_[0];
626 my ($ip,$cidr) = split (/\//, $val);
627 ##check for existing routes in routes_push
628 if (-e "${General::swroot}/ovpn/routes_push") {
629 open(FILE,"${General::swroot}/ovpn/routes_push");
630 while (<FILE>) {
631 $_=~s/\s*$//g;
632
633 my ($ip2,$cidr2) = split (/\//,"$_");
634 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
635
636 if($val eq $val2){
637 return 0;
638 }
639 #subnetcheck
640 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
641 return 0;
642 }
643 };
644 close(FILE);
645 }
646 return 1;
647}
648
649sub check_ccdroute
650{
651 my %ccdroutehash=();
652 my $val=$_[0];
653 my ($ip,$cidr) = split (/\//, $val);
654 #check for existing routes in ccdroute
655 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
656 foreach my $key (keys %ccdroutehash) {
657 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
658 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
659 return 0;
660 }
661 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
662 #subnetcheck
663 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
664 return 0;
665 }
666 }
667 }
668 return 1;
669}
670sub check_ccdconf
671{
672 my %ccdconfhash=();
673 my $val=$_[0];
674 my ($ip,$cidr) = split (/\//, $val);
675 #check for existing routes in ccdroute
676 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
677 foreach my $key (keys %ccdconfhash) {
678 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
679 return 0;
680 }
681 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
682 #subnetcheck
683 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
684 return 0;
685 }
686
687 }
688 return 1;
689}
690
7c1d9faf
AH
691###
692# m.a.d net2net
693###
694
695sub validdotmask
696{
697 my $ipdotmask = $_[0];
698 if (&General::validip($ipdotmask)) { return 0; }
699 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
700 my $mask = $2;
701 if (($mask =~ /\./ )) { return 0; }
702 return 1;
703}
54fd0535
MT
704
705# -------------------------------------------------------------------
706
707sub write_routepushfile
708{
709 open(FILE, ">$routes_push_file");
710 flock(FILE, 2);
711 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
712 print FILE $vpnsettings{'ROUTES_PUSH'};
713 }
714 close(FILE);
715}
716
717sub read_routepushfile
718{
719 if (-e "$routes_push_file") {
720 open(FILE,"$routes_push_file");
721 delete $vpnsettings{'ROUTES_PUSH'};
722 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
723 close(FILE);
724 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
8c877a82 725
54fd0535
MT
726 }
727}
7c1d9faf
AH
728
729
c6c9630e
MT
730#hier die refresh page
731if ( -e "${General::swroot}/ovpn/gencanow") {
732 my $refresh = '';
733 $refresh = "<meta http-equiv='refresh' content='15;' />";
734 &Header::showhttpheaders();
735 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
736 &Header::openbigbox('100%', 'center');
737 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
738 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
739 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
740 &Header::closebox();
741 &Header::closebigbox();
742 &Header::closepage();
743 exit (0);
744}
745##hier die refresh page
746
6e13d0a5
MT
747
748###
749### OpenVPN Server Control
750###
751if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
752 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
753 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT
754 #start openvpn server
755 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 756 &emptyserverlog();
6e13d0a5
MT
757 system('/usr/local/bin/openvpnctrl', '-s');
758 }
759 #stop openvpn server
760 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
6e13d0a5 761 system('/usr/local/bin/openvpnctrl', '-k');
c6c9630e 762 &emptyserverlog();
6e13d0a5
MT
763 }
764# #restart openvpn server
8c877a82 765# if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
6e13d0a5 766#workarund, till SIGHUP also works when running as nobody
8c877a82
AM
767# system('/usr/local/bin/openvpnctrl', '-r');
768# &emptyserverlog();
769# }
6e13d0a5
MT
770}
771
772###
773### Save Advanced options
774###
775
776if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
777 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
778 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
779 #DAN this value has to leave.
780#new settings for daemon
781 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
782 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
783 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
784 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
785 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
786 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
787 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
788 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
789 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535 790 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
2ee746be 791 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
4c962356 792 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
49abe7af 793 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
54fd0535 794 my @temp=();
6e13d0a5 795
a79fa1d6
JPT
796 if ($cgiparams{'FRAGMENT'} eq '') {
797 delete $vpnsettings{'FRAGMENT'};
798 } else {
799 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
800 $errormessage = "Incorrect value, please insert only numbers.";
801 goto ADV_ERROR;
802 } else {
803 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
804 }
805 }
49abe7af 806
a79fa1d6 807 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 808 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT
809 } else {
810 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
811 }
2ee746be 812
49abe7af
EK
813 # Create ta.key for tls-auth if not presant
814 if ($cgiparams{'TLSAUTH'} eq 'on') {
815 if ( ! -e "${General::swroot}/ovpn/ca/ta.key") {
816 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/ca/ta.key")
817 }
818 }
819
1647059d
SS
820 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
821 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
822 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
823
2ee746be
SS
824 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
825 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
826 goto ADV_ERROR;
827 }
828 }
829
6e13d0a5 830 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
81da1b01 831 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
6e13d0a5
MT
832 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
833 goto ADV_ERROR;
834 }
835 }
836 if ($cgiparams{'DHCP_DNS'} ne ''){
837 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
838 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
839 goto ADV_ERROR;
840 }
841 }
842 if ($cgiparams{'DHCP_WINS'} ne ''){
843 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
844 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT
845 goto ADV_ERROR;
846 }
847 }
848 if ($cgiparams{'ROUTES_PUSH'} ne ''){
849 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
850 undef $vpnsettings{'ROUTES_PUSH'};
8c877a82
AM
851
852 foreach my $tmpip (@temp)
54fd0535
MT
853 {
854 s/^\s+//g; s/\s+$//g;
8c877a82
AM
855
856 if ($tmpip)
54fd0535 857 {
8c877a82
AM
858 $tmpip=~s/\s*$//g;
859 unless (&General::validipandmask($tmpip)) {
860 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
861 goto ADV_ERROR;
54fd0535 862 }
8c877a82
AM
863 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
864
54fd0535
MT
865 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
866 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
8c877a82
AM
867 goto ADV_ERROR;
868 }
869# a.marx ccd
870 my %ccdroutehash=();
871 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
872 foreach my $key (keys %ccdroutehash) {
873 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
874 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
875 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
876 goto ADV_ERROR;
877 }
878 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
879 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
880 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
881 goto ADV_ERROR;
882 }
883 }
54fd0535 884 }
8c877a82
AM
885
886# ccd end
887
888 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
54fd0535 889 }
8c877a82
AM
890 }
891 &write_routepushfile;
54fd0535 892 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP
893 }
894 else {
895 undef $vpnsettings{'ROUTES_PUSH'};
896 &write_routepushfile;
6e13d0a5 897 }
6e13d0a5
MT
898 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
899 $errormessage = $Lang::tr{'invalid input for max clients'};
900 goto ADV_ERROR;
901 }
902 if ($cgiparams{'KEEPALIVE_1'} ne '') {
903 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
904 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
905 goto ADV_ERROR;
906 }
907 }
908 if ($cgiparams{'KEEPALIVE_2'} ne ''){
909 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
910 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
911 goto ADV_ERROR;
912 }
913 }
914 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
915 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
916 goto ADV_ERROR;
917 }
918
919 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 920 &writeserverconf();#hier ok
6e13d0a5
MT
921}
922
ce9abb66 923###
7c1d9faf 924# m.a.d net2net
ce9abb66
AH
925###
926
927if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
928{
c6c9630e 929
ce9abb66
AH
930my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
931my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 932my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 933my $tunmtu = '';
531f0835
AH
934
935unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
936unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
937
938 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
939
940 flock SERVERCONF, 2;
7c1d9faf 941 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
ce9abb66 942 print SERVERCONF "\n";
b278daf3 943 print SERVERCONF "# User Security\n";
ce9abb66
AH
944 print SERVERCONF "user nobody\n";
945 print SERVERCONF "group nobody\n";
946 print SERVERCONF "persist-tun\n";
947 print SERVERCONF "persist-key\n";
7c1d9faf 948 print SERVERCONF "script-security 2\n";
60f396d7 949 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
c125d8a2
SS
950
951 if ($cgiparams{'REMOTE'} ne '') {
ce9abb66 952 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
c125d8a2
SS
953 }
954
b278daf3 955 print SERVERCONF "float\n";
60f396d7 956 print SERVERCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 957 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
60f396d7 958 print SERVERCONF "# Client Gateway Network\n";
54fd0535 959 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 960 print SERVERCONF "# tun Device\n";
ce9abb66 961 print SERVERCONF "dev tun\n";
60f396d7 962 print SERVERCONF "# Port and Protokol\n";
ce9abb66 963 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
964
965 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
966 print SERVERCONF "proto tcp-server\n";
967 print SERVERCONF "# Packet size\n";
d96c89eb 968 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 969 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 970 }
60f396d7
AH
971
972 if ($cgiparams{'PROTOCOL'} eq 'udp') {
973 print SERVERCONF "proto udp\n";
974 print SERVERCONF "# Paketsize\n";
975 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
976 print SERVERCONF "tun-mtu $tunmtu\n";
54fd0535
MT
977 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
978 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
d96c89eb 979 }
1647059d
SS
980
981 # Check if a valid operating mode has been choosen and use it.
982 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
983 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
984 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
985 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
986 if($cgiparams{'MTU'} eq '1500') {
987 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
988 }
989 }
990 }
60f396d7 991 print SERVERCONF "# Auth. Server\n";
ce9abb66
AH
992 print SERVERCONF "tls-server\n";
993 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
994 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
995 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
49abe7af 996 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
b278daf3 997 print SERVERCONF "# Cipher\n";
4c962356 998 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
49abe7af
EK
999 if ($cgiparams{'DAUTH'} eq '') {
1000 print SERVERCONF "auth SHA1\n";
1001 } else {
1002 print SERVERCONF "# HMAC algorithm\n";
1003 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
1004 }
ce9abb66 1005 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1006 print SERVERCONF "# Enable Compression\n";
ce9abb66 1007 print SERVERCONF "comp-lzo\r\n";
b278daf3 1008 }
60f396d7 1009 print SERVERCONF "# Debug Level\n";
ce9abb66 1010 print SERVERCONF "verb 3\n";
b278daf3 1011 print SERVERCONF "# Tunnel check\n";
ce9abb66 1012 print SERVERCONF "keepalive 10 60\n";
60f396d7 1013 print SERVERCONF "# Start as daemon\n";
ce9abb66
AH
1014 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1015 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1016 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT
1017 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1018 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH
1019 close(SERVERCONF);
1020
1021}
1022
1023###
7c1d9faf 1024# m.a.d net2net
ce9abb66 1025###
7c1d9faf 1026
ce9abb66
AH
1027if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1028{
4c962356 1029
ce9abb66 1030 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 1031 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1032 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 1033 my $tunmtu = '';
54fd0535 1034
531f0835
AH
1035unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1036unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
1037
1038 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1039
1040 flock CLIENTCONF, 2;
7c1d9faf 1041 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 1042 print CLIENTCONF "#\n";
b278daf3 1043 print CLIENTCONF "# User Security\n";
ce9abb66
AH
1044 print CLIENTCONF "user nobody\n";
1045 print CLIENTCONF "group nobody\n";
1046 print CLIENTCONF "persist-tun\n";
1047 print CLIENTCONF "persist-key\n";
7c1d9faf 1048 print CLIENTCONF "script-security 2\n";
60f396d7 1049 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 1050 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 1051 print CLIENTCONF "float\n";
60f396d7 1052 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1053 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
60f396d7 1054 print CLIENTCONF "# Server Gateway Network\n";
54fd0535 1055 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 1056 print CLIENTCONF "# tun Device\n";
ce9abb66 1057 print CLIENTCONF "dev tun\n";
60f396d7 1058 print CLIENTCONF "# Port and Protokol\n";
ce9abb66 1059 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
1060
1061 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1062 print CLIENTCONF "proto tcp-client\n";
1063 print CLIENTCONF "# Packet size\n";
d96c89eb 1064 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 1065 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1066 }
60f396d7
AH
1067
1068 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1069 print CLIENTCONF "proto udp\n";
1070 print CLIENTCONF "# Paketsize\n";
1071 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1072 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535
MT
1073 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1074 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
d96c89eb 1075 }
1647059d
SS
1076
1077 # Check if a valid operating mode has been choosen and use it.
1078 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1079 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1080 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be
SS
1081 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1082 if ($cgiparams{'MTU'} eq '1500') {
1083 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1084 }
1085 }
1647059d
SS
1086 }
1087
54fd0535 1088 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
1089 print CLIENTCONF "# Auth. Client\n";
1090 print CLIENTCONF "tls-client\n";
b278daf3 1091 print CLIENTCONF "# Cipher\n";
4c962356 1092 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
ce9abb66 1093 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
49abe7af
EK
1094 if ($cgiparams{'DAUTH'} eq '') {
1095 print CLIENTCONF "auth SHA1\n";
1096 } else {
1097 print CLIENTCONF "# HMAC algorithm\n";
1098 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1099 }
ce9abb66 1100 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 1101 print CLIENTCONF "# Enable Compression\n";
ce9abb66 1102 print CLIENTCONF "comp-lzo\r\n";
4c962356 1103 }
ce9abb66
AH
1104 print CLIENTCONF "# Debug Level\n";
1105 print CLIENTCONF "verb 3\n";
b278daf3 1106 print CLIENTCONF "# Tunnel check\n";
ce9abb66 1107 print CLIENTCONF "keepalive 10 60\n";
60f396d7 1108 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
1109 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1110 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 1111 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
1112 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1113 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 1114 close(CLIENTCONF);
c6c9630e 1115
ce9abb66
AH
1116}
1117
6e13d0a5
MT
1118###
1119### Save main settings
1120###
ce9abb66
AH
1121
1122
6e13d0a5
MT
1123if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1124 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT
1125 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1126 #DAN this value has to leave.
1127 if ($cgiparams{'ENABLED'} eq 'on'){
1128 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1129 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 1130 goto SETTINGS_ERROR;
6e13d0a5
MT
1131 }
1132 }
6e13d0a5 1133 if ($errormessage) { goto SETTINGS_ERROR; }
48cc0e12 1134
6e13d0a5 1135 if ($cgiparams{'ENABLED'} eq 'on'){
6945e463 1136 &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
6e13d0a5 1137 }
6e13d0a5
MT
1138 if ($errormessage) { goto SETTINGS_ERROR; }
1139
1140 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e 1141 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
4c962356 1142 goto SETTINGS_ERROR;
c6c9630e
MT
1143 }
1144 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1145
1146 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1147 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1148 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1149 goto SETTINGS_ERROR;
1150 }
1151
1152 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1153 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1154 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1155 goto SETTINGS_ERROR;
1156 }
1157
1158 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1159 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1160 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1161 goto SETTINGS_ERROR;
1162 }
1163
1164 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1165 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1166 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1167 goto SETTINGS_ERROR;
1168 }
1169 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1170 while (<ALIASES>)
1171 {
1172 chomp($_);
1173 my @tempalias = split(/\,/,$_);
1174 if ($tempalias[1] eq 'on') {
1175 if (&General::IpInSubnet ($tempalias[0] ,
1176 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1177 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1178 }
1179 }
1180 }
1181 close(ALIASES);
6e13d0a5 1182 if ($errormessage ne ''){
c6c9630e 1183 goto SETTINGS_ERROR;
6e13d0a5
MT
1184 }
1185 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1186 $errormessage = $Lang::tr{'invalid input'};
1187 goto SETTINGS_ERROR;
1188 }
1189 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1190 $errormessage = $Lang::tr{'invalid mtu input'};
1191 goto SETTINGS_ERROR;
1192 }
1193
1194 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT
1195 $errormessage = $Lang::tr{'invalid port'};
1196 goto SETTINGS_ERROR;
6e13d0a5 1197 }
8c252e6a 1198
6e13d0a5
MT
1199 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1200 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1201 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1202 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1203#new settings for daemon
1204 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1205 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1206 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1207 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1208 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1209 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1210 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
3ffee04b
CS
1211#wrtie enable
1212
1213 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1214 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1215 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
6e13d0a5
MT
1216#new settings for daemon
1217 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 1218 &writeserverconf();#hier ok
6e13d0a5
MT
1219SETTINGS_ERROR:
1220###
1221### Reset all step 2
1222###
4c962356 1223}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
6e13d0a5
MT
1224 my $file = '';
1225 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1226
1227 foreach my $key (keys %confighash) {
c6c9630e
MT
1228 if ($confighash{$key}[4] eq 'cert') {
1229 delete $confighash{$cgiparams{'$key'}};
1230 }
6e13d0a5
MT
1231 }
1232 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
49abe7af 1233 unlink $file;
6e13d0a5
MT
1234 }
1235 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
49abe7af 1236 unlink $file;
6e13d0a5
MT
1237 }
1238 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
49abe7af 1239 unlink $file;
6e13d0a5 1240 }
4c962356 1241 &cleanssldatabase();
6e13d0a5
MT
1242 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1243 print FILE "";
1244 close FILE;
1245 }
49abe7af
EK
1246 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1247 print FILE "";
1248 close FILE;
1249 }
1250 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1251 print FILE "";
1252 close FILE;
1253 }
1254 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1255 unlink $file
1256 }
1257 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1258 print FILE "";
1259 close FILE;
1260 }
1261 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1262 print FILE "";
1263 close FILE;
1264 }
1265 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1266 system ("rm -rf $file");
1267 }
1268
c6c9630e 1269 #&writeserverconf();
6e13d0a5
MT
1270###
1271### Reset all step 1
1272###
4c962356 1273}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
6e13d0a5 1274 &Header::showhttpheaders();
4c962356
EK
1275 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1276 &Header::openbigbox('100%', 'left', '', '');
1277 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1278 print <<END;
1279 <form method='post'>
1280 <table width='100%'>
1281 <tr>
1282 <td align='center'>
1283 <input type='hidden' name='AREUSURE' value='yes' />
49abe7af 1284 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
4c962356
EK
1285 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1286 </tr>
1287 <tr>
1288 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1289 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1290 </tr>
1291 </table>
1292 </form>
6e13d0a5
MT
1293END
1294 ;
1295 &Header::closebox();
1296 &Header::closebigbox();
1297 &Header::closepage();
1298 exit (0);
1299
4c962356
EK
1300###
1301### Generate DH key step 2
1302###
1303} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
49abe7af 1304 # Delete if old key exists
4c962356
EK
1305 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1306 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1307 }
1308 # Create Diffie Hellmann Parameter
1309 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1310 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1311 if ($?) {
1312 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1313 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1314 }
1315
1316###
1317### Generate DH key step 1
1318###
1319} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1320 &Header::showhttpheaders();
1321 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1322 &Header::openbigbox('100%', 'LEFT', '', '');
1323 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1324 print <<END;
1325 <table width='100%'>
1326 <tr>
f527e53f 1327 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
49abe7af 1328 </tr>
4c962356
EK
1329 <tr>
1330 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1331 <td align='center'>
1332 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1333 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1334 <select name='DHLENGHT'>
1335 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1336 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1337 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1338 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1339 </select>
1340 </td>
1341 </tr>
1342 <tr><td colspan='4'><br></td></tr>
1343 </table>
1344 <table width='100%'>
1345 <tr>
49abe7af 1346 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
4c962356 1347 </tr>
49abe7af
EK
1348 <tr>
1349 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1350 </tr>
1351 <tr><td colspan='2'><br></td></tr>
4c962356
EK
1352 <tr>
1353 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1354 </form>
1355 </tr>
1356 </table>
1357
1358END
1359 ;
1360 &Header::closebox();
1361 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1362 &Header::closebigbox();
1363 &Header::closepage();
1364 exit (0);
1365
1366###
1367### Upload DH key
1368###
1369} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
4c962356
EK
1370 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1371 $errormessage = $Lang::tr{'there was no file upload'};
1372 goto UPLOADCA_ERROR;
1373 }
49abe7af 1374 # Move uploaded dh key to a temporary file
4c962356
EK
1375 (my $fh, my $filename) = tempfile( );
1376 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1377 $errormessage = $!;
49abe7af 1378 goto UPLOADCA_ERROR;
4c962356 1379 }
49abe7af 1380 my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
4c962356
EK
1381 if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
1382 $errormessage = $Lang::tr{'not a valid dh key'};
1383 unlink ($filename);
1384 goto UPLOADCA_ERROR;
1385 } else {
1386 # Delete if old key exists
1387 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1388 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1389 }
1390 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
49abe7af
EK
1391 if ($? ne 0) {
1392 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1393 unlink ($filename);
1394 goto UPLOADCA_ERROR;
1395 }
4c962356
EK
1396 }
1397
6e13d0a5
MT
1398###
1399### Upload CA Certificate
1400###
1401} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1402 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1403
1404 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1405 $errormessage = $Lang::tr{'name must only contain characters'};
1406 goto UPLOADCA_ERROR;
1407 }
1408
1409 if (length($cgiparams{'CA_NAME'}) >60) {
1410 $errormessage = $Lang::tr{'name too long'};
1411 goto VPNCONF_ERROR;
1412 }
1413
1414 if ($cgiparams{'CA_NAME'} eq 'ca') {
1415 $errormessage = $Lang::tr{'name is invalid'};
4c962356 1416 goto UPLOADCA_ERROR;
6e13d0a5
MT
1417 }
1418
1419 # Check if there is no other entry with this name
1420 foreach my $key (keys %cahash) {
c6c9630e
MT
1421 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1422 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1423 goto UPLOADCA_ERROR;
1424 }
6e13d0a5
MT
1425 }
1426
1427 if (ref ($cgiparams{'FH'}) ne 'Fh') {
c6c9630e
MT
1428 $errormessage = $Lang::tr{'there was no file upload'};
1429 goto UPLOADCA_ERROR;
6e13d0a5
MT
1430 }
1431 # Move uploaded ca to a temporary file
1432 (my $fh, my $filename) = tempfile( );
1433 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT
1434 $errormessage = $!;
1435 goto UPLOADCA_ERROR;
6e13d0a5
MT
1436 }
1437 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
c6c9630e
MT
1438 if ($temp !~ /CA:TRUE/i) {
1439 $errormessage = $Lang::tr{'not a valid ca certificate'};
1440 unlink ($filename);
1441 goto UPLOADCA_ERROR;
6e13d0a5 1442 } else {
c6c9630e
MT
1443 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1444 if ($? ne 0) {
1445 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1446 unlink ($filename);
1447 goto UPLOADCA_ERROR;
1448 }
6e13d0a5
MT
1449 }
1450
1451 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1452 $casubject =~ /Subject: (.*)[\n]/;
1453 $casubject = $1;
1454 $casubject =~ s+/Email+, E+;
1455 $casubject =~ s/ ST=/ S=/;
1456 $casubject = &Header::cleanhtml($casubject);
1457
1458 my $key = &General::findhasharraykey (\%cahash);
1459 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1460 $cahash{$key}[1] = $casubject;
1461 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT
1462# system('/usr/local/bin/ipsecctrl', 'R');
1463
6e13d0a5
MT
1464 UPLOADCA_ERROR:
1465
1466###
1467### Display ca certificate
1468###
1469} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT
1470 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1471
1472 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1473 &Header::showhttpheaders();
4c962356 1474 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
1475 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1476 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1477 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1478 $output = &Header::cleanhtml($output,"y");
1479 print "<pre>$output</pre>\n";
1480 &Header::closebox();
1481 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1482 &Header::closebigbox();
1483 &Header::closepage();
1484 exit(0);
1485 } else {
1486 $errormessage = $Lang::tr{'invalid key'};
1487 }
1488
6e13d0a5
MT
1489###
1490### Download ca certificate
1491###
1492} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1493 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1494
1495 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1496 print "Content-Type: application/octet-stream\r\n";
1497 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1498 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1499 exit(0);
1500 } else {
1501 $errormessage = $Lang::tr{'invalid key'};
1502 }
1503
1504###
1505### Remove ca certificate (step 2)
1506###
1507} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1508 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1509 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1510
1511 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1512 foreach my $key (keys %confighash) {
1513 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1514 if ($test =~ /: OK/) {
c6c9630e
MT
1515 # Delete connection
1516# if ($vpnsettings{'ENABLED'} eq 'on' ||
1517# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1518# system('/usr/local/bin/ipsecctrl', 'D', $key);
1519# }
6e13d0a5
MT
1520 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1521 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1522 delete $confighash{$key};
1523 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1524# &writeipsecfiles();
6e13d0a5
MT
1525 }
1526 }
1527 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1528 delete $cahash{$cgiparams{'KEY'}};
1529 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1530# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT
1531 } else {
1532 $errormessage = $Lang::tr{'invalid key'};
1533 }
1534###
1535### Remove ca certificate (step 1)
1536###
1537} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1538 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1539 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1540
1541 my $assignedcerts = 0;
1542 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1543 foreach my $key (keys %confighash) {
1544 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1545 if ($test =~ /: OK/) {
1546 $assignedcerts++;
1547 }
1548 }
1549 if ($assignedcerts) {
1550 &Header::showhttpheaders();
4c962356 1551 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT
1552 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1553 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
4c962356 1554 print <<END;
6e13d0a5
MT
1555 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1556 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1557 <tr><td align='center'>
1558 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1559 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1560 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1561 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1562 </form></table>
1563END
1564 ;
1565 &Header::closebox();
1566 &Header::closebigbox();
1567 &Header::closepage();
1568 exit (0);
1569 } else {
1570 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1571 delete $cahash{$cgiparams{'KEY'}};
1572 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1573# system('/usr/local/bin/ipsecctrl', 'R');
1574 }
1575 } else {
1576 $errormessage = $Lang::tr{'invalid key'};
1577 }
1578
1579###
1580### Display root certificate
1581###
c6c9630e
MT
1582}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1583 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1584 my $output;
1585 &Header::showhttpheaders();
4c962356 1586 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
1587 &Header::openbigbox('100%', 'LEFT', '', '');
1588 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1589 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1590 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1591 } else {
1592 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1593 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1594 }
1595 $output = &Header::cleanhtml($output,"y");
1596 print "<pre>$output</pre>\n";
1597 &Header::closebox();
1598 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1599 &Header::closebigbox();
1600 &Header::closepage();
1601 exit(0);
1602
6e13d0a5
MT
1603###
1604### Download root certificate
1605###
1606}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1607 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1608 print "Content-Type: application/octet-stream\r\n";
1609 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1610 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1611 exit(0);
1612 }
1613
1614###
1615### Download host certificate
1616###
1617}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1618 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1619 print "Content-Type: application/octet-stream\r\n";
1620 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1621 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1622 exit(0);
1623 }
1624###
1625### Form for generating a root certificate
1626###
1627}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1628 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1629
1630 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1631 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1632 $errormessage = $Lang::tr{'valid root certificate already exists'};
1633 $cgiparams{'ACTION'} = '';
1634 goto ROOTCERT_ERROR;
1635 }
1636
1637 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1638 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1639 my $ipaddr = <IPADDR>;
1640 close IPADDR;
1641 chomp ($ipaddr);
1642 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1643 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1644 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1645 }
1646 }
1647 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1648
1649 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1650 $errormessage = $Lang::tr{'there was no file upload'};
1651 goto ROOTCERT_ERROR;
1652 }
1653
1654 # Move uploaded certificate request to a temporary file
1655 (my $fh, my $filename) = tempfile( );
1656 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1657 $errormessage = $!;
1658 goto ROOTCERT_ERROR;
1659 }
1660
1661 # Create a temporary dirctory
1662 my $tempdir = tempdir( CLEANUP => 1 );
1663
1664 # Extract the CA certificate from the file
1665 my $pid = open(OPENSSL, "|-");
1666 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1667 if ($pid) { # parent
1668 if ($cgiparams{'P12_PASS'} ne '') {
1669 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1670 }
1671 close (OPENSSL);
1672 if ($?) {
1673 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1674 unlink ($filename);
1675 goto ROOTCERT_ERROR;
1676 }
1677 } else { # child
1678 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1679 '-in', $filename,
1680 '-out', "$tempdir/cacert.pem")) {
1681 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1682 unlink ($filename);
1683 goto ROOTCERT_ERROR;
1684 }
1685 }
1686
1687 # Extract the Host certificate from the file
1688 $pid = open(OPENSSL, "|-");
1689 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1690 if ($pid) { # parent
1691 if ($cgiparams{'P12_PASS'} ne '') {
1692 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1693 }
1694 close (OPENSSL);
1695 if ($?) {
1696 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1697 unlink ($filename);
1698 goto ROOTCERT_ERROR;
1699 }
1700 } else { # child
1701 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1702 '-in', $filename,
1703 '-out', "$tempdir/hostcert.pem")) {
1704 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1705 unlink ($filename);
1706 goto ROOTCERT_ERROR;
1707 }
1708 }
1709
1710 # Extract the Host key from the file
1711 $pid = open(OPENSSL, "|-");
1712 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1713 if ($pid) { # parent
1714 if ($cgiparams{'P12_PASS'} ne '') {
1715 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1716 }
1717 close (OPENSSL);
1718 if ($?) {
1719 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1720 unlink ($filename);
1721 goto ROOTCERT_ERROR;
1722 }
1723 } else { # child
1724 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1725 '-nodes',
1726 '-in', $filename,
1727 '-out', "$tempdir/serverkey.pem")) {
1728 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1729 unlink ($filename);
1730 goto ROOTCERT_ERROR;
1731 }
1732 }
1733
1734 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1735 if ($? ne 0) {
1736 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1737 unlink ($filename);
1738 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1739 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1740 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1741 goto ROOTCERT_ERROR;
1742 }
1743
1744 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1745 if ($? ne 0) {
1746 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1747 unlink ($filename);
1748 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1749 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1750 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1751 goto ROOTCERT_ERROR;
1752 }
1753
1754 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1755 if ($? ne 0) {
1756 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1757 unlink ($filename);
1758 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1759 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1760 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1761 goto ROOTCERT_ERROR;
1762 }
1763
1764 goto ROOTCERT_SUCCESS;
1765
1766 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1767
1768 # Validate input since the form was submitted
1769 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1770 $errormessage = $Lang::tr{'organization cant be empty'};
1771 goto ROOTCERT_ERROR;
1772 }
1773 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1774 $errormessage = $Lang::tr{'organization too long'};
1775 goto ROOTCERT_ERROR;
1776 }
1777 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1778 $errormessage = $Lang::tr{'invalid input for organization'};
1779 goto ROOTCERT_ERROR;
1780 }
1781 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1782 $errormessage = $Lang::tr{'hostname cant be empty'};
1783 goto ROOTCERT_ERROR;
1784 }
1785 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1786 $errormessage = $Lang::tr{'invalid input for hostname'};
1787 goto ROOTCERT_ERROR;
1788 }
1789 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1790 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1791 goto ROOTCERT_ERROR;
1792 }
1793 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1794 $errormessage = $Lang::tr{'e-mail address too long'};
1795 goto ROOTCERT_ERROR;
1796 }
1797 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1798 $errormessage = $Lang::tr{'invalid input for department'};
1799 goto ROOTCERT_ERROR;
1800 }
1801 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1802 $errormessage = $Lang::tr{'invalid input for city'};
1803 goto ROOTCERT_ERROR;
1804 }
1805 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1806 $errormessage = $Lang::tr{'invalid input for state or province'};
1807 goto ROOTCERT_ERROR;
1808 }
1809 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1810 $errormessage = $Lang::tr{'invalid input for country'};
1811 goto ROOTCERT_ERROR;
1812 }
1813
1814 # Copy the cgisettings to vpnsettings and save the configfile
1815 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1816 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1817 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1818 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1819 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1820 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1821 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1822 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1823
1824 # Replace empty strings with a .
1825 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1826 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1827 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1828
1829 # refresh
c6c9630e 1830 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT
1831
1832 # Create the CA certificate
1833 my $pid = open(OPENSSL, "|-");
1834 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1835 if ($pid) { # parent
1836 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1837 print OPENSSL "$state\n";
1838 print OPENSSL "$city\n";
1839 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1840 print OPENSSL "$ou\n";
1841 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1842 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1843 close (OPENSSL);
1844 if ($?) {
1845 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1846 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1847 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1848 goto ROOTCERT_ERROR;
1849 }
1850 } else { # child
1851 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
49abe7af 1852 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
6e13d0a5
MT
1853 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1854 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1855 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1856 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1857 goto ROOTCERT_ERROR;
1858 }
1859 }
1860
1861 # Create the Host certificate request
1862 $pid = open(OPENSSL, "|-");
1863 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1864 if ($pid) { # parent
1865 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1866 print OPENSSL "$state\n";
1867 print OPENSSL "$city\n";
1868 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1869 print OPENSSL "$ou\n";
1870 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1871 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1872 print OPENSSL ".\n";
1873 print OPENSSL ".\n";
1874 close (OPENSSL);
1875 if ($?) {
1876 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1877 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1878 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1879 goto ROOTCERT_ERROR;
1880 }
1881 } else { # child
1882 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
4c962356 1883 '-newkey', 'rsa:2048',
6e13d0a5
MT
1884 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1885 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1886 '-extensions', 'server',
1887 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1888 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1889 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1890 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1891 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1892 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1893 goto ROOTCERT_ERROR;
1894 }
1895 }
1896
1897 # Sign the host certificate request
1898 system('/usr/bin/openssl', 'ca', '-days', '999999',
1899 '-batch', '-notext',
1900 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1901 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1902 '-extensions', 'server',
1903 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1904 if ($?) {
1905 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1906 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1907 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1908 unlink ("${General::swroot}/ovpn/serverkey.pem");
1909 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1910 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1911 &newcleanssldatabase();
6e13d0a5
MT
1912 goto ROOTCERT_ERROR;
1913 } else {
1914 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1915 &deletebackupcert();
6e13d0a5
MT
1916 }
1917
1918 # Create an empty CRL
1919 system('/usr/bin/openssl', 'ca', '-gencrl',
1920 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1921 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1922 if ($?) {
1923 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1924 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1925 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1926 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1927 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 1928 &cleanssldatabase();
6e13d0a5 1929 goto ROOTCERT_ERROR;
c6c9630e
MT
1930# } else {
1931# &cleanssldatabase();
6e13d0a5
MT
1932 }
1933 # Create Diffie Hellmann Parameter
1934 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
4c962356 1935 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
6e13d0a5
MT
1936 if ($?) {
1937 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1938 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1939 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1940 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1941 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1942 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 1943 &cleanssldatabase();
6e13d0a5 1944 goto ROOTCERT_ERROR;
c6c9630e
MT
1945# } else {
1946# &cleanssldatabase();
6e13d0a5
MT
1947 }
1948 goto ROOTCERT_SUCCESS;
1949 }
1950 ROOTCERT_ERROR:
1951 if ($cgiparams{'ACTION'} ne '') {
1952 &Header::showhttpheaders();
4c962356 1953 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
6e13d0a5
MT
1954 &Header::openbigbox('100%', 'LEFT', '', '');
1955 if ($errormessage) {
1956 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1957 print "<class name='base'>$errormessage";
1958 print "&nbsp;</class>";
1959 &Header::closebox();
1960 }
1961 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
49abe7af 1962 print <<END;
6e13d0a5
MT
1963 <form method='post' enctype='multipart/form-data'>
1964 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1965 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1966 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1967 <td width='35%' colspan='2'>&nbsp;</td></tr>
1968 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1969 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1970 <td colspan='2'>&nbsp;</td></tr>
1971 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1972 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1973 <td colspan='2'>&nbsp;</td></tr>
1974 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1975 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1976 <td colspan='2'>&nbsp;</td></tr>
1977 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1978 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1979 <td colspan='2'>&nbsp;</td></tr>
1980 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1981 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1982 <td colspan='2'>&nbsp;</td></tr>
1983 <tr><td class='base'>$Lang::tr{'country'}:</td>
1984 <td class='base'><select name='ROOTCERT_COUNTRY'>
1985
1986END
1987 ;
1988 foreach my $country (sort keys %{Countries::countries}) {
1989 print "<option value='$Countries::countries{$country}'";
1990 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1991 print " selected='selected'";
1992 }
1993 print ">$country</option>";
1994 }
49abe7af 1995 print <<END;
6e13d0a5 1996 </select></td>
4c962356
EK
1997 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
1998 <td class='base'><select name='DHLENGHT'>
1999 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
2000 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2001 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2002 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2003 </select>
2004 </td>
2005 </tr>
2006
6e13d0a5
MT
2007 <tr><td>&nbsp;</td>
2008 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
2009 <td>&nbsp;</td><td>&nbsp;</td></tr>
2010 <tr><td class='base' colspan='4' align='left'>
2011 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
49abe7af
EK
2012 <tr><td colspan='2'><br></td></tr>
2013 <table width='100%'>
2014 <tr>
2015 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2016 <td class='base'>$Lang::tr{'dh key warn'}</td>
4c962356 2017 </tr>
49abe7af
EK
2018 <tr>
2019 <td class='base'>$Lang::tr{'dh key warn1'}</td>
4c962356 2020 </tr>
49abe7af
EK
2021 <tr><td colspan='2'><br></td></tr>
2022 <tr>
2023 </table>
4c962356 2024
49abe7af 2025 <table width='100%'>
4c962356 2026 <tr><td colspan='4'><hr></td></tr>
6e13d0a5
MT
2027 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
2028 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2029 <td colspan='2'>&nbsp;</td></tr>
2030 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
2031 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2032 <td colspan='2'>&nbsp;</td></tr>
2033 <tr><td>&nbsp;</td>
2034 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2035 <td colspan='2'>&nbsp;</td></tr>
2036 <tr><td class='base' colspan='4' align='left'>
4c962356
EK
2037 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td>
2038 </tr>
6e13d0a5
MT
2039 </form></table>
2040END
2041 ;
2042 &Header::closebox();
4c962356 2043 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2044 &Header::closebigbox();
2045 &Header::closepage();
2046 exit(0)
2047 }
2048
2049 ROOTCERT_SUCCESS:
2050 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT
2051# if ($vpnsettings{'ENABLED'} eq 'on' ||
2052# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2053# system('/usr/local/bin/ipsecctrl', 'S');
2054# }
6e13d0a5
MT
2055
2056###
2057### Enable/Disable connection
2058###
ce9abb66
AH
2059
2060###
7c1d9faf 2061# m.a.d net2net
ce9abb66
AH
2062###
2063
6e13d0a5 2064}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT
2065
2066 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 2067 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH
2068# my $n2nactive = '';
2069 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
2070
6e13d0a5 2071 if ($confighash{$cgiparams{'KEY'}}) {
8c877a82
AM
2072 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2073 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2074 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2075
8c877a82 2076 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 2077 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
8c877a82
AM
2078 }
2079 } else {
ce9abb66 2080
8c877a82
AM
2081 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2082 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66 2083
8c877a82 2084 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
ce9abb66 2085 if ($n2nactive ne ''){
8c877a82
AM
2086 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
2087 }
ce9abb66 2088
8c877a82 2089 } else {
ce9abb66 2090 $errormessage = $Lang::tr{'invalid key'};
8c877a82 2091 }
ce9abb66
AH
2092 }
2093 }
6e13d0a5
MT
2094
2095###
2096### Download OpenVPN client package
2097###
ce9abb66
AH
2098
2099
6e13d0a5
MT
2100} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2101 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2102 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2103 my $file = '';
2104 my $clientovpn = '';
2105 my @fileholder;
2106 my $tempdir = tempdir( CLEANUP => 1 );
2107 my $zippath = "$tempdir/";
ce9abb66
AH
2108
2109###
7c1d9faf
AH
2110# m.a.d net2net
2111###
ce9abb66
AH
2112
2113if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2114
2115 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2116 my $zippathname = "$zippath$zipname";
2117 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2118 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 2119 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 2120 my $tunmtu = '';
7c1d9faf 2121 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 2122 my $n2nfragment = '';
ce9abb66
AH
2123
2124 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2125 flock CLIENTCONF, 2;
2126
2127 my $zip = Archive::Zip->new();
7c1d9faf 2128 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 2129 print CLIENTCONF "# \n";
b278daf3 2130 print CLIENTCONF "# User Security\n";
ce9abb66
AH
2131 print CLIENTCONF "user nobody\n";
2132 print CLIENTCONF "group nobody\n";
2133 print CLIENTCONF "persist-tun\n";
2134 print CLIENTCONF "persist-key\n";
7c1d9faf 2135 print CLIENTCONF "script-security 2\n";
60f396d7 2136 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 2137 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 2138 print CLIENTCONF "float\n";
60f396d7 2139 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 2140 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
b278daf3 2141 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 2142 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
b278daf3 2143 print CLIENTCONF "# tun Device\n";
ce9abb66 2144 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
60f396d7 2145 print CLIENTCONF "# Port and Protokoll\n";
ce9abb66 2146 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
60f396d7
AH
2147
2148 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2149 print CLIENTCONF "proto tcp-client\n";
2150 print CLIENTCONF "# Packet size\n";
d96c89eb 2151 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 2152 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 2153 }
60f396d7
AH
2154
2155 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2156 print CLIENTCONF "proto udp\n";
2157 print CLIENTCONF "# Paketsize\n";
2158 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2159 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 2160 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
60f396d7 2161 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
d96c89eb 2162 }
1647059d
SS
2163 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2164 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2165 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2ee746be
SS
2166 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2167 if ($tunmtu eq '1500' ) {
350f2980 2168 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2ee746be
SS
2169 }
2170 }
2171 }
54fd0535 2172 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
2173 print CLIENTCONF "# Auth. Client\n";
2174 print CLIENTCONF "tls-client\n";
49abe7af 2175 print CLIENTCONF "# Cipher\n";
4c962356 2176 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
ce9abb66
AH
2177 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2178 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2179 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
49abe7af
EK
2180 }
2181 if ($confighash{$cgiparams{'KEY'}}[39] eq '') {
2182 print CLIENTCONF "# HMAC algorithm\n";
2183 print CLIENTCONF "auth SHA1\n";
2184 } else {
2185 print CLIENTCONF "# HMAC algorithm\n";
2186 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2187 }
4c962356 2188 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 2189 print CLIENTCONF "# Enable Compression\n";
ce9abb66 2190 print CLIENTCONF "comp-lzo\r\n";
b278daf3 2191 }
ce9abb66
AH
2192 print CLIENTCONF "# Debug Level\n";
2193 print CLIENTCONF "verb 3\n";
b278daf3 2194 print CLIENTCONF "# Tunnel check\n";
ce9abb66 2195 print CLIENTCONF "keepalive 10 60\n";
b278daf3 2196 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
2197 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2198 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
b278daf3 2199 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
2200 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2201 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 2202 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 2203
ce9abb66
AH
2204
2205 close(CLIENTCONF);
2206
2207 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2208 my $status = $zip->writeToFileNamed($zippathname);
2209
2210 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2211 @fileholder = <DLFILE>;
2212 print "Content-Type:application/x-download\n";
2213 print "Content-Disposition:attachment;filename=$zipname\n\n";
2214 print @fileholder;
2215 exit (0);
2216}
2217else
2218{
2219 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2220 my $zippathname = "$zippath$zipname";
2221 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2222
2223###
7c1d9faf 2224# m.a.d net2net
ce9abb66
AH
2225###
2226
c6c9630e 2227 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT
2228 flock CLIENTCONF, 2;
2229
2230 my $zip = Archive::Zip->new();
2231
8c877a82 2232 print CLIENTCONF "#OpenVPN Client conf\r\n";
6e13d0a5
MT
2233 print CLIENTCONF "tls-client\r\n";
2234 print CLIENTCONF "client\r\n";
4f6e3ae3 2235 print CLIENTCONF "nobind\r\n";
6e13d0a5 2236 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
c6c9630e 2237 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2ee746be
SS
2238
2239 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2240 # or use configured value.
2241 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
4f6e3ae3 2242 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be 2243 elsif ($vpnsettings{MSSFIX} eq 'on')
4f6e3ae3 2244 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
1647059d
SS
2245 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2246 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2247 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
4f6e3ae3 2248 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2ee746be
SS
2249 else
2250 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2251
6e13d0a5
MT
2252 if ( $vpnsettings{'ENABLED'} eq 'on'){
2253 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT
2254 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2255 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2256 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2257 }
2258 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2259 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2260 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2261 }
2262 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2263 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2264 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2265 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2266 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2267 }
2268 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2269 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT
2270 }
2271
2272 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
c6c9630e
MT
2273 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2274 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
6e13d0a5 2275 } else {
c6c9630e
MT
2276 print CLIENTCONF "ca cacert.pem\r\n";
2277 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2278 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2279 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2280 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT
2281 }
2282 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
49abe7af
EK
2283 if ($vpnsettings{'DAUTH'} eq '') {
2284 print CLIENTCONF "";
2285 } else {
2286 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2287 }
2288 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2289 print CLIENTCONF "tls-auth ta.key 1\r\n";
2290 $zip->addFile( "${General::swroot}/ovpn/ca/ta.key", "ta.key") or die "Can't add file ta.key\n";
2291 }
6e13d0a5
MT
2292 if ($vpnsettings{DCOMPLZO} eq 'on') {
2293 print CLIENTCONF "comp-lzo\r\n";
2294 }
2295 print CLIENTCONF "verb 3\r\n";
2296 print CLIENTCONF "ns-cert-type server\r\n";
a79fa1d6
JPT
2297 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2298 if ($vpnsettings{MSSFIX} eq 'on') {
2299 print CLIENTCONF "mssfix\r\n";
2300 }
74225cce 2301 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT
2302 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2303 }
1647059d
SS
2304
2305 # Check if a valid operating mode has been choosen and use it.
2306 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2307 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2308 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2ee746be 2309 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
4f6e3ae3 2310 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2ee746be
SS
2311 }
2312 }
6e13d0a5 2313 close(CLIENTCONF);
ce9abb66 2314
6e13d0a5
MT
2315 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2316 my $status = $zip->writeToFileNamed($zippathname);
2317
2318 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2319 @fileholder = <DLFILE>;
2320 print "Content-Type:application/x-download\n";
2321 print "Content-Disposition:attachment;filename=$zipname\n\n";
2322 print @fileholder;
2323 exit (0);
ce9abb66
AH
2324 }
2325
2326
2327
6e13d0a5
MT
2328###
2329### Remove connection
2330###
ce9abb66
AH
2331
2332
6e13d0a5
MT
2333} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2334 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2335 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e
MT
2336
2337 if ($confighash{$cgiparams{'KEY'}}) {
2338# if ($vpnsettings{'ENABLED'} eq 'on' ||
2339# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2340# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2341# }
2342#
2343 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
ce9abb66
AH
2344
2345###
7c1d9faf 2346# m.a.d net2net
ce9abb66 2347###
7c1d9faf 2348
8e6a8fd5 2349if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
ce9abb66 2350 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
8e6a8fd5
MT
2351 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2352 unlink ($certfile);
2353 unlink ($conffile);
2354
2355 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2356 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2357 }
ce9abb66 2358}
ce9abb66
AH
2359
2360 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
8c877a82
AM
2361 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2362
2363# A.Marx CCD delete ccd files and routes
2364
2365
2366 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2367 {
2368 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2369 }
e81be1e1 2370
8c877a82
AM
2371 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2372 foreach my $key (keys %ccdroutehash) {
2373 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2374 delete $ccdroutehash{$key};
2375 }
2376 }
2377 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
e81be1e1 2378
8c877a82
AM
2379 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2380 foreach my $key (keys %ccdroute2hash) {
2381 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2382 delete $ccdroute2hash{$key};
2383 }
2384 }
2385 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
52d08bcb 2386 &writeserverconf;
8c877a82
AM
2387
2388
2389# CCD end
2390
2391
c6c9630e
MT
2392 delete $confighash{$cgiparams{'KEY'}};
2393 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2394 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
8c877a82 2395
c6c9630e 2396 #&writeserverconf();
6e13d0a5 2397 } else {
c6c9630e 2398 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5 2399 }
b2e75449 2400 &General::firewall_reload();
ce9abb66 2401
6e13d0a5
MT
2402###
2403### Download PKCS12 file
2404###
2405} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2406 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2407
2408 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2409 print "Content-Type: application/octet-stream\r\n\r\n";
2410 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2411 exit (0);
2412
2413###
2414### Display certificate
2415###
2416} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2417 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2418
2419 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e 2420 &Header::showhttpheaders();
4c962356 2421 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
c6c9630e
MT
2422 &Header::openbigbox('100%', 'LEFT', '', '');
2423 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2424 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2425 $output = &Header::cleanhtml($output,"y");
2426 print "<pre>$output</pre>\n";
2427 &Header::closebox();
2428 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2429 &Header::closebigbox();
2430 &Header::closepage();
2431 exit(0);
6e13d0a5 2432 }
4c962356
EK
2433
2434###
2435### Display Diffie-Hellman key
2436###
2437} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2438
2439 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
49abe7af 2440 $errormessage = $Lang::tr{'not present'};
4c962356
EK
2441 } else {
2442 &Header::showhttpheaders();
2443 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2444 &Header::openbigbox('100%', 'LEFT', '', '');
2445 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2446 my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
2447 $output = &Header::cleanhtml($output,"y");
2448 print "<pre>$output</pre>\n";
2449 &Header::closebox();
2450 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2451 &Header::closebigbox();
2452 &Header::closepage();
2453 exit(0);
2454 }
2455
6e13d0a5
MT
2456###
2457### Display Certificate Revoke List
2458###
2459} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT
2460# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2461
49abe7af
EK
2462 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2463 $errormessage = $Lang::tr{'not present'};
2464 } else {
b2e75449
MT
2465 &Header::showhttpheaders();
2466 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2467 &Header::openbigbox('100%', 'LEFT', '', '');
2468 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2469 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2470 $output = &Header::cleanhtml($output,"y");
2471 print "<pre>$output</pre>\n";
2472 &Header::closebox();
2473 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2474 &Header::closebigbox();
2475 &Header::closepage();
2476 exit(0);
6e13d0a5
MT
2477 }
2478
2479###
2480### Advanced Server Settings
2481###
2482
2483} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2484 %cgiparams = ();
2485 %cahash = ();
2486 %confighash = ();
8c877a82 2487 my $disabled;
6e13d0a5 2488 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 2489 read_routepushfile;
8c877a82
AM
2490
2491
c6c9630e
MT
2492# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2493# $cgiparams{'CLIENT2CLIENT'} = 'on';
2494# }
6e13d0a5
MT
2495ADV_ERROR:
2496 if ($cgiparams{'MAX_CLIENTS'} eq '') {
4c962356 2497 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 2498 }
6e13d0a5 2499 if ($cgiparams{'KEEPALIVE_1'} eq '') {
4c962356 2500 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT
2501 }
2502 if ($cgiparams{'KEEPALIVE_2'} eq '') {
4c962356 2503 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT
2504 }
2505 if ($cgiparams{'LOG_VERB'} eq '') {
4c962356 2506 $cgiparams{'LOG_VERB'} = '3';
ae9f6139 2507 }
92b87e17 2508 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
4c962356
EK
2509 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2510 }
2511 if ($cgiparams{'DAUTH'} eq '') {
2512 $cgiparams{'DAUTH'} = 'SHA1';
92b87e17 2513 }
49abe7af
EK
2514 if ($cgiparams{'DAUTH'} eq '') {
2515 $cgiparams{'DAUTH'} = 'SHA1';
2516 }
2517 if ($cgiparams{'ENGINES'} eq '') {
2518 $cgiparams{'ENGINES'} = 'disabled';
2519 }
2520 if ($cgiparams{'TLSAUTH'} eq '') {
2521 $cgiparams{'TLSAUTH'} = 'off';
2522 }
f527e53f
EK
2523 if ($cgiparams{'DAUTH'} eq '') {
2524 $cgiparams{'DAUTH'} = 'SHA1';
2525 }
2526 if ($cgiparams{'TLSAUTH'} eq '') {
2527 $cgiparams{'TLSAUTH'} = 'off';
2528 }
6e13d0a5
MT
2529 $checked{'CLIENT2CLIENT'}{'off'} = '';
2530 $checked{'CLIENT2CLIENT'}{'on'} = '';
2531 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2532 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2533 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2534 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
a79fa1d6
JPT
2535 $checked{'MSSFIX'}{'off'} = '';
2536 $checked{'MSSFIX'}{'on'} = '';
2537 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2ee746be 2538 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
49abe7af 2539 $selected{'LOG_VERB'}{'0'} = '';
6e13d0a5
MT
2540 $selected{'LOG_VERB'}{'1'} = '';
2541 $selected{'LOG_VERB'}{'2'} = '';
2542 $selected{'LOG_VERB'}{'3'} = '';
2543 $selected{'LOG_VERB'}{'4'} = '';
2544 $selected{'LOG_VERB'}{'5'} = '';
2545 $selected{'LOG_VERB'}{'6'} = '';
2546 $selected{'LOG_VERB'}{'7'} = '';
2547 $selected{'LOG_VERB'}{'8'} = '';
2548 $selected{'LOG_VERB'}{'9'} = '';
2549 $selected{'LOG_VERB'}{'10'} = '';
2550 $selected{'LOG_VERB'}{'11'} = '';
6e13d0a5 2551 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
4c962356
EK
2552 $selected{'DAUTH'}{'whirlpool'} = '';
2553 $selected{'DAUTH'}{'SHA512'} = '';
2554 $selected{'DAUTH'}{'SHA384'} = '';
2555 $selected{'DAUTH'}{'SHA256'} = '';
4c962356
EK
2556 $selected{'DAUTH'}{'SHA1'} = '';
2557 $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED';
49abe7af
EK
2558 $checked{'TLSAUTH'}{'off'} = '';
2559 $checked{'TLSAUTH'}{'on'} = '';
2560 $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED';
f527e53f 2561
6e13d0a5
MT
2562 &Header::showhttpheaders();
2563 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2564 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2565 if ($errormessage) {
c6c9630e
MT
2566 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2567 print "<class name='base'>$errormessage\n";
2568 print "&nbsp;</class>\n";
2569 &Header::closebox();
6e13d0a5
MT
2570 }
2571 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
4c962356 2572 print <<END;
b376fae4 2573 <form method='post' enctype='multipart/form-data'>
b2e75449 2574<table width='100%' border=0>
4c962356
EK
2575 <tr>
2576 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
6e13d0a5
MT
2577 </tr>
2578 <tr>
4c962356 2579 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT
2580 </tr>
2581 <tr>
4c962356 2582 <td class='base'>Domain</td>
8c877a82 2583 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
6e13d0a5
MT
2584 </tr>
2585 <tr>
4c962356
EK
2586 <td class='base'>DNS</td>
2587 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
6e13d0a5
MT
2588 </tr>
2589 <tr>
4c962356
EK
2590 <td class='base'>WINS</td>
2591 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2592 </tr>
54fd0535 2593 <tr>
4c962356 2594 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
54fd0535
MT
2595 </tr>
2596 <tr>
4c962356
EK
2597 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2598 <td colspan='2'>
2599 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
54fd0535
MT
2600END
2601;
2602
2603if ($cgiparams{'ROUTES_PUSH'} ne '')
2604{
2605 print $cgiparams{'ROUTES_PUSH'};
2606}
2607
8c877a82 2608print <<END;
54fd0535
MT
2609</textarea></td>
2610</tr>
6e13d0a5
MT
2611 </tr>
2612</table>
2613<hr size='1'>
4c962356 2614<table width='100%'>
6e13d0a5 2615 <tr>
4c962356 2616 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
6e13d0a5
MT
2617 </tr>
2618 <tr>
4c962356 2619 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
6e13d0a5
MT
2620 </tr>
2621 <tr>
4c962356
EK
2622 <td class='base'>Client-To-Client</td>
2623 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
6e13d0a5
MT
2624 </tr>
2625 <tr>
4c962356
EK
2626 <td class='base'>Redirect-Gateway def1</td>
2627 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
6e13d0a5
MT
2628 </tr>
2629 <tr>
2630 <td class='base'>Max-Clients</td>
a79fa1d6 2631 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
6e13d0a5 2632 </tr>
4c962356 2633 <tr>
f0ccae18 2634 <td class='base'>Keepalive <br />
a79fa1d6
JPT
2635 (ping/ping-restart)</td>
2636 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2637 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2638 </tr>
4c962356 2639 <tr>
a79fa1d6
JPT
2640 <td class='base'>fragment <br></td>
2641 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
60f396d7 2642 </tr>
a79fa1d6
JPT
2643 <tr>
2644 <td class='base'>mssfix</td>
2645 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
49abe7af 2646 <td>$Lang::tr{'openvpn default'}: off</td>
2ee746be
SS
2647 </tr>
2648
2649 <tr>
2650 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2651 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2652 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2653 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2654 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2655 </tr>
a79fa1d6
JPT
2656</table>
2657
a79fa1d6 2658<hr size='1'>
4c962356 2659<table width='100%'>
a79fa1d6 2660 <tr>
49abe7af 2661 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
a79fa1d6
JPT
2662 </tr>
2663 <tr>
49abe7af 2664 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
4c962356
EK
2665 </tr>
2666
2667 <tr><td class='base'>VERB</td>
2668 <td><select name='LOG_VERB'>
49abe7af
EK
2669 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option>
2670 <option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2671 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2672 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2673 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2674 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2675 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2676 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2677 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2678 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2679 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2680 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2681 </td></select>
2682 </table>
4c962356 2683
6e13d0a5 2684<hr size='1'>
4c962356 2685<table width='100%'>
6e13d0a5 2686 <tr>
4c962356
EK
2687 <td class'base'><b>$Lang::tr{'ovpn crypt options'}</b></td>
2688 </tr>
2689 <tr>
2690 <td width='20%'></td> <td width='30%'> </td><td width='25%'> </td><td width='25%'></td>
6e13d0a5 2691 </tr>
4c962356
EK
2692 <tr><td class='base'>$Lang::tr{'ovpn ha'}</td>
2693 <td><select name='DAUTH'>
b2e75449
MT
2694 <option value='whirlpool' $selected{'DAUTH'}{'whirlpool'}>Whirlpool (512 $Lang::tr{'bit'})</option>
2695 <option value='SHA512' $selected{'DAUTH'}{'SHA512'}>SHA2 (512 $Lang::tr{'bit'})</option>
2696 <option value='SHA384' $selected{'DAUTH'}{'SHA384'}>SHA2 (384 $Lang::tr{'bit'})</option>
2697 <option value='SHA256' $selected{'DAUTH'}{'SHA256'}>SHA2 (256 $Lang::tr{'bit'})</option>
b2e75449 2698 <option value='SHA1' $selected{'DAUTH'}{'SHA1'}>SHA1 (160 $Lang::tr{'bit'})</option>
4c962356
EK
2699 </select>
2700 </td>
2701 <td>Default: <span class="base">SHA1 (160 $Lang::tr{'bit'})</span></td>
49abe7af 2702 </tr>
6e13d0a5 2703</table>
49abe7af
EK
2704
2705<table width='100%'>
6e13d0a5 2706 <tr>
49abe7af 2707 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
6e13d0a5 2708 </tr>
4c962356 2709
6e13d0a5 2710 <tr>
49abe7af
EK
2711 <td class='base'>HMAC tls-auth</td>
2712 <td><input type='checkbox' name='TLSAUTH' $checked{'TLSAUTH'}{'on'} /></td>
2713 </tr>
2714 </table><hr>
8c877a82
AM
2715END
2716
2717if ( -e "/var/run/openvpn.pid"){
2718print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2719 $Lang::tr{'server restart'}<br><br>
2720 <hr>";
49abe7af 2721 print<<END;
52d08bcb
AM
2722<table width='100%'>
2723<tr>
2724 <td>&nbsp;</td>
2725 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2726 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2727 <td>&nbsp;</td>
2728</tr>
2729</table>
2730</form>
2731END
2732;
2733
2734
2735}else{
8c877a82 2736
49abe7af 2737 print<<END;
6e13d0a5
MT
2738<table width='100%'>
2739<tr>
2740 <td>&nbsp;</td>
2741 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2742 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2743 <td>&nbsp;</td>
2744</tr>
2745</table>
2746</form>
2747END
2748;
52d08bcb 2749}
6e13d0a5 2750 &Header::closebox();
c6c9630e 2751# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2752 &Header::closebigbox();
2753 &Header::closepage();
2754 exit(0);
2755
8c877a82
AM
2756
2757# A.Marx CCD Add,delete or edit CCD net
2758
2759} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2760 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2761 $cgiparams{'ACTION'} eq "kill" ||
2762 $cgiparams{'ACTION'} eq "edit" ||
2763 $cgiparams{'ACTION'} eq 'editsave'){
2764 &Header::showhttpheaders();
2765 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2766 &Header::openbigbox('100%', 'LEFT', '', '');
2767
2768 if ($cgiparams{'ACTION'} eq "kill"){
2769 &delccdnet($cgiparams{'net'});
2770 }
2771
2772 if ($cgiparams{'ACTION'} eq 'editsave'){
2773 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2774 if ( $a ne $b){ &modccdnet($a,$b);}
5068ac38
AM
2775 $cgiparams{'ccdname'}='';
2776 $cgiparams{'ccdsubnet'}='';
8c877a82
AM
2777 }
2778
2779 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
e2429e8d 2780 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
8c877a82
AM
2781 }
2782 if ($errormessage) {
2783 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2784 print "<class name='base'>$errormessage";
2785 print "&nbsp;</class>";
2786 &Header::closebox();
2787 }
2788if ($cgiparams{'ACTION'} eq "edit"){
2789
2790 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2791
49abe7af 2792 print <<END;
631b67b7 2793 <table width='100%' border='0'>
8c877a82
AM
2794 <tr><form method='post'>
2795 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
b2e75449 2796 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
8c877a82
AM
2797 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2798 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2799 </td></tr>
2800 </table></form>
2801END
2802;
2803 &Header::closebox();
2804
2805 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
49abe7af 2806 print <<END;
8c877a82
AM
2807 <table width='100%' border='0' cellpadding='0' cellspacing='1'>
2808 <tr>
2809 <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2810END
2811;
2812}
2813else{
2814 if (! -e "/var/run/openvpn.pid"){
2815 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
49abe7af 2816 print <<END;
8c877a82
AM
2817 <table width='100%' border='0'>
2818 <tr><form method='post'>
2819 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2820 <tr>
2821 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2822 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2823 <tr><td colspan=4><hr /></td></tr><tr>
2824 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2825 </table></form>
2826END
2827
2828 &Header::closebox();
2829}
2830 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
5068ac38
AM
2831 if ( -e "/var/run/openvpn.pid"){
2832 print "<b>$Lang::tr{'attention'}:</b><br>";
2833 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2834 }
2835
4c962356 2836 print <<END;
99bfa85c 2837 <table width='100%' cellpadding='0' cellspacing='1'>
8c877a82
AM
2838 <tr>
2839 <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2840END
2841;
2842}
2843 my %ccdconfhash=();
2844 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2845 my @ccdconf=();
2846 my $count=0;
df9b48b7 2847 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
8c877a82
AM
2848 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2849 $count++;
2850 my $ccdhosts = &hostsinnet($ccdconf[0]);
2851 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2852 else{ print" <tr bgcolor='$color{'color20'}'>";}
2853 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
4c962356 2854 print <<END;
8c877a82 2855 <form method='post' />
b2e75449 2856 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
8c877a82
AM
2857 <input type='hidden' name='ACTION' value='edit'/>
2858 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2859 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2860 </form></td>
2861 <form method='post' />
2862 <td><input type='hidden' name='ACTION' value='kill'/>
2863 <input type='hidden' name='number' value='$count' />
2864 <input type='hidden' name='net' value='$ccdconf[0]' />
b2e75449 2865 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
8c877a82
AM
2866END
2867;
2868 }
2869 print "</table></form>";
2870 &Header::closebox();
2871 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2872 &Header::closebigbox();
2873 &Header::closepage();
2874 exit(0);
2875
2876#END CCD
2877
6e13d0a5
MT
2878###
2879### Openvpn Connections Statistics
2880###
2881} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2882 &Header::showhttpheaders();
2883 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2884 &Header::openbigbox('100%', 'LEFT', '', '');
2885 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2886
2887#
2888# <td><b>$Lang::tr{'protocol'}</b></td>
2889# protocol temp removed
4c962356 2890 print <<END;
99bfa85c 2891 <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
6e13d0a5 2892 <tr>
99bfa85c
AM
2893 <th><b>$Lang::tr{'common name'}</b></th>
2894 <th><b>$Lang::tr{'real address'}</b></th>
2895 <th><b>$Lang::tr{'virtual address'}</b></th>
2896 <th><b>$Lang::tr{'loged in at'}</b></th>
2897 <th><b>$Lang::tr{'bytes sent'}</b></th>
2898 <th><b>$Lang::tr{'bytes received'}</b></th>
2899 <th><b>$Lang::tr{'last activity'}</b></th>
6e13d0a5
MT
2900 </tr>
2901END
2902;
4e17adad 2903 my $filename = "/var/log/ovpnserver.log";
6e13d0a5
MT
2904 open(FILE, $filename) or die 'Unable to open config file.';
2905 my @current = <FILE>;
2906 close(FILE);
2907 my @users =();
2908 my $status;
2909 my $uid = 0;
2910 my $cn;
2911 my @match = ();
2912 my $proto = "udp";
2913 my $address;
2914 my %userlookup = ();
2915 foreach my $line (@current)
2916 {
2917 chomp($line);
2918 if ( $line =~ /^Updated,(.+)/){
2919 @match = split( /^Updated,(.+)/, $line);
2920 $status = $match[1];
2921 }
c6c9630e 2922#gian
6e13d0a5
MT
2923 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2924 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2925 if ($match[1] ne "Common Name") {
2926 $cn = $match[1];
2927 $userlookup{$match[2]} = $uid;
2928 $users[$uid]{'CommonName'} = $match[1];
2929 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT
2930 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2931 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT
2932 $users[$uid]{'Since'} = $match[5];
2933 $users[$uid]{'Proto'} = $proto;
2934 $uid++;
2935 }
2936 }
2937 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2938 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2939 if ($match[1] ne "Virtual Address") {
2940 $address = $match[3];
2941 #find the uid in the lookup table
2942 $uid = $userlookup{$address};
2943 $users[$uid]{'VirtualAddress'} = $match[1];
2944 $users[$uid]{'LastRef'} = $match[4];
2945 }
2946 }
2947 }
2948 my $user2 = @users;
2949 if ($user2 >= 1){
99bfa85c 2950 for (my $idx = 1; $idx <= $user2; $idx++){
6e13d0a5 2951 if ($idx % 2) {
99bfa85c
AM
2952 print "<tr>";
2953 $col="bgcolor='$color{'color22'}'";
2954 } else {
2955 print "<tr>";
2956 $col="bgcolor='$color{'color20'}'";
6e13d0a5 2957 }
99bfa85c
AM
2958 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
2959 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
2960 print "<td align='left' $col>$users[$idx-1]{'VirtualAddress'}</td>";
2961 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
2962 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
2963 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
2964 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
2965 }
2966 }
6e13d0a5
MT
2967
2968 print "</table>";
49abe7af 2969 print <<END;
6e13d0a5
MT
2970 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2971 <tr><td></td></tr>
2972 <tr><td></td></tr>
2973 <tr><td></td></tr>
2974 <tr><td></td></tr>
2975 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2976 </table>
2977END
2978;
2979 &Header::closebox();
2980 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2981 &Header::closebigbox();
2982 &Header::closepage();
2983 exit(0);
2984
2985###
2986### Download Certificate
2987###
2988} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2989 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2990
6e13d0a5 2991 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
2992 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2993 print "Content-Type: application/octet-stream\r\n\r\n";
2994 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2995 exit (0);
2996 }
2997
2998###
2999### Enable/Disable connection
3000###
ce9abb66 3001
c6c9630e
MT
3002} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
3003
3004 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3005 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3006
3007 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 3008 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT
3009 $confighash{$cgiparams{'KEY'}}[0] = 'on';
3010 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3011 #&writeserverconf();
3012# if ($vpnsettings{'ENABLED'} eq 'on' ||
3013# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3014# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3015# }
3016 } else {
3017 $confighash{$cgiparams{'KEY'}}[0] = 'off';
3018# if ($vpnsettings{'ENABLED'} eq 'on' ||
3019# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3020# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3021# }
3022 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3023 #&writeserverconf();
3024 }
3025 } else {
3026 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
3027 }
3028
3029###
3030### Restart connection
3031###
3032} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
3033 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3034 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3035
3036 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT
3037# if ($vpnsettings{'ENABLED'} eq 'on' ||
3038# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3039# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
3040# }
6e13d0a5 3041 } else {
c6c9630e 3042 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
3043 }
3044
3045###
c6c9630e 3046### Remove connection
6e13d0a5 3047###
c6c9630e
MT
3048} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
3049 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3050 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3051
3052 if ($confighash{$cgiparams{'KEY'}}) {
3053# if ($vpnsettings{'ENABLED'} eq 'on' ||
3054# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
3055# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
3056# }
3057 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
3058 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3059 delete $confighash{$cgiparams{'KEY'}};
3060 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3061 #&writeserverconf();
3062 } else {
3063 $errormessage = $Lang::tr{'invalid key'};
3064 }
ce9abb66
AH
3065#test33
3066
3067###
3068### Choose between adding a host-net or net-net connection
3069###
3070
3071###
7c1d9faf 3072# m.a.d net2net
ce9abb66
AH
3073###
3074
3075} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
3076 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3077 &Header::showhttpheaders();
4c962356 3078 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
ce9abb66
AH
3079 &Header::openbigbox('100%', 'LEFT', '', '');
3080 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH
3081
3082if ( -s "${General::swroot}/ovpn/settings") {
3083
49abe7af 3084 print <<END;
ce9abb66 3085 <b>$Lang::tr{'connection type'}:</b><br />
8c877a82 3086 <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
ce9abb66
AH
3087 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
3088 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
3089 <tr><td><input type='radio' name='TYPE' value='net' /></td>
3090 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
3091 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>