libstatgrab: New package.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT
2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
cd0c0a0d 5# Copyright (C) 2007-2011 IPFire Team <info@ipfire.org> #
70df8302
MT
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
54fd0535
MT
21###
22# Based on IPFireCore 55
23###
6e13d0a5
MT
24use CGI;
25use CGI qw/:standard/;
26use Net::DNS;
ce9abb66 27use Net::Ping;
54fd0535 28use Net::Telnet;
6e13d0a5
MT
29use File::Copy;
30use File::Temp qw/ tempfile tempdir /;
31use strict;
32use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
6e13d0a5 33require '/var/ipfire/general-functions.pl';
6e13d0a5
MT
34require "${General::swroot}/lang.pl";
35require "${General::swroot}/header.pl";
36require "${General::swroot}/countries.pl";
37
38# enable only the following on debugging purpose
54fd0535
MT
39use warnings;
40use CGI::Carp 'fatalsToBrowser';
6e13d0a5
MT
41#workaround to suppress a warning when a variable is used only once
42my @dummy = ( ${Header::colourgreen} );
43undef (@dummy);
44
f2fdd0c1
CS
45my %color = ();
46my %mainsettings = ();
47&General::readhash("${General::swroot}/main/settings", \%mainsettings);
48&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
6e13d0a5
MT
49
50###
51### Initialize variables
52###
53my %netsettings=();
54my %cgiparams=();
55my %vpnsettings=();
56my %checked=();
57my %confighash=();
58my %cahash=();
59my %selected=();
60my $warnmessage = '';
61my $errormessage = '';
62my %settings=();
54fd0535 63my $routes_push_file = '';
6e13d0a5
MT
64&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
65$cgiparams{'ENABLED'} = 'off';
66$cgiparams{'ENABLED_BLUE'} = 'off';
67$cgiparams{'ENABLED_ORANGE'} = 'off';
68$cgiparams{'EDIT_ADVANCED'} = 'off';
69$cgiparams{'NAT'} = 'off';
70$cgiparams{'COMPRESSION'} = 'off';
71$cgiparams{'ONLY_PROPOSED'} = 'off';
72$cgiparams{'ACTION'} = '';
73$cgiparams{'CA_NAME'} = '';
74$cgiparams{'DHCP_DOMAIN'} = '';
75$cgiparams{'DHCP_DNS'} = '';
76$cgiparams{'DHCP_WINS'} = '';
54fd0535 77$cgiparams{'ROUTES_PUSH'} = '';
6e13d0a5 78$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6 79$cgiparams{'MSSFIX'} = '';
54fd0535
MT
80$routes_push_file = "${General::swroot}/ovpn/routes_push";
81unless (-e $routes_push_file) { system("touch $routes_push_file"); }
ce9abb66 82
6e13d0a5
MT
83&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
84
85# prepare openvpn config file
86###
87### Useful functions
88###
c6c9630e
MT
89sub haveOrangeNet
90{
13211b21
CS
91 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
92 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
93 return 0;
94}
95
96sub haveBlueNet
97{
13211b21 98 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 99 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT
100 return 0;
101}
102
103sub sizeformat{
104 my $bytesize = shift;
105 my $i = 0;
106
107 while(abs($bytesize) >= 1024){
108 $bytesize=$bytesize/1024;
109 $i++;
110 last if($i==6);
111 }
112
113 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
114 my $newsize=(int($bytesize*100 +0.5))/100;
115 return("$newsize $units[$i]");
116}
117
118sub valid_dns_host {
119 my $hostname = $_[0];
120 unless ($hostname) { return "No hostname"};
121 my $res = new Net::DNS::Resolver;
122 my $query = $res->search("$hostname");
123 if ($query) {
124 foreach my $rr ($query->answer) {
125 ## Potential bug - we are only looking at A records:
126 return 0 if $rr->type eq "A";
127 }
128 } else {
129 return $res->errorstring;
130 }
131}
132
133sub cleanssldatabase
134{
135 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
136 print FILE "01";
137 close FILE;
138 }
139 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
140 print FILE "";
141 close FILE;
142 }
143 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
144 unlink ("${General::swroot}/ovpn/certs/serial.old");
145 unlink ("${General::swroot}/ovpn/certs/01.pem");
146}
147
148sub newcleanssldatabase
149{
150 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
151 open(FILE, ">${General::swroot}(ovpn/certs/serial");
152 print FILE "01";
153 close FILE;
154 }
155 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
156 system ("touch ${General::swroot}/ovpn/certs/index.txt");
157 }
158 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
159 unlink ("${General::swroot}/ovpn/certs/serial.old");
160}
161
162sub deletebackupcert
163{
164 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
165 my $hexvalue = <FILE>;
166 chomp $hexvalue;
167 close FILE;
168 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
169 }
170}
171
172sub checkportfw {
173 my $KEY2 = $_[0]; # key2
174 my $SRC_PORT = $_[1]; # src_port
175 my $PROTOCOL = $_[2]; # protocol
176 my $SRC_IP = $_[3]; # sourceip
177
178 my $pfwfilename = "${General::swroot}/portfw/config";
179 open(FILE, $pfwfilename) or die 'Unable to open config file.';
180 my @pfwcurrent = <FILE>;
181 close(FILE);
182 my $pfwkey1 = 0; # used for finding last sequence number used
183 foreach my $pfwline (@pfwcurrent)
184 {
185 my @pfwtemp = split(/\,/,$pfwline);
186
187 chomp ($pfwtemp[8]);
188 if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
189 if ( $SRC_PORT eq $pfwtemp[3] &&
190 $PROTOCOL eq $pfwtemp[2] &&
191 $SRC_IP eq $pfwtemp[7])
192 {
193 $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
194 }
195 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
196 if ( $pfwtemp[1] eq "0") {
197 $pfwkey1=$pfwtemp[0];
198 }
199 # Darren Critchley - Duplicate or overlapping Port range check
200 if ($pfwtemp[1] eq "0" &&
201 $PROTOCOL eq $pfwtemp[2] &&
202 $SRC_IP eq $pfwtemp[7] &&
203 $errormessage eq '')
204 {
205 &portchecks($SRC_PORT, $pfwtemp[5]);
206# &portchecks($pfwtemp[3], $pfwtemp[5]);
207# &portchecks($pfwtemp[3], $SRC_IP);
208 }
209 }
210 }
211# $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
212
213 return;
214}
215
216sub checkportoverlap
217{
218 my $portrange1 = $_[0]; # New port range
219 my $portrange2 = $_[1]; # existing port range
220 my @tempr1 = split(/\:/,$portrange1);
221 my @tempr2 = split(/\:/,$portrange2);
222
223 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
224 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
225
226 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
227 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
228
229 return 1; # Everything checks out!
230}
231
232# Darren Critchley - we want to make sure that a port entry is not within an already existing range
233sub checkportinc
234{
235 my $port1 = $_[0]; # Port
236 my $portrange2 = $_[1]; # Port range
237 my @tempr1 = split(/\:/,$portrange2);
238
239 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
240 return 1;
241 } else {
242 return 0;
243 }
244}
245# Darren Critchley - Duplicate or overlapping Port range check
246sub portchecks
247{
248 my $p1 = $_[0]; # New port range
249 my $p2 = $_[1]; # existing port range
250# $_ = $_[0];
251 our ($prtrange1, $prtrange2);
252 $prtrange1 = 0;
253# if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
254# unless (&checkportoverlap($p1,$p2)) {
255# $errormessage = "$Lang::tr{'source port overlaps'} $p1";
256# }
257# }
258 if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
259 unless (&checkportinc($p2,$p1)) {
260 $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
261 }
262 }
263 $prtrange1 = 1;
264 if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
265 unless (&checkportinc($p1,$p2)) {
266 $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
267 }
268 }
269 return;
270}
271
272# Darren Critchley - certain ports are reserved for IPFire
273# TCP 67,68,81,222,445
274# UDP 67,68
275# Params passed in -> port, rangeyn, protocol
276sub disallowreserved
277{
278 # port 67 and 68 same for tcp and udp, don't bother putting in an array
279 my $msg = "";
280 my @tcp_reserved = (81,222,445);
281 my $prt = $_[0]; # the port or range
282 my $ryn = $_[1]; # tells us whether or not it is a port range
283 my $prot = $_[2]; # protocol
284 my $srcdst = $_[3]; # source or destination
285 if ($ryn) { # disect port range
286 if ($srcdst eq "src") {
287 $msg = "$Lang::tr{'rsvd src port overlap'}";
288 } else {
289 $msg = "$Lang::tr{'rsvd dst port overlap'}";
290 }
291 my @tmprng = split(/\:/,$prt);
292 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
293 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
294 if ($prot eq "tcp") {
295 foreach my $prange (@tcp_reserved) {
296 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
297 }
298 }
299 } else {
300 if ($srcdst eq "src") {
301 $msg = "$Lang::tr{'reserved src port'}";
302 } else {
303 $msg = "$Lang::tr{'reserved dst port'}";
304 }
305 if ($prt == 67) { $errormessage="$msg 67"; return; }
306 if ($prt == 68) { $errormessage="$msg 68"; return; }
307 if ($prot eq "tcp") {
308 foreach my $prange (@tcp_reserved) {
309 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
310 }
311 }
312 }
313 return;
314}
315
54fd0535 316
c6c9630e 317sub writeserverconf {
54fd0535
MT
318 my %sovpnsettings = ();
319 my @temp = ();
c6c9630e 320 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
54fd0535
MT
321 &read_routepushfile;
322
c6c9630e
MT
323 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
324 flock CONF, 2;
325 print CONF "#OpenVPN Server conf\n";
326 print CONF "\n";
327 print CONF "daemon openvpnserver\n";
328 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 329 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e
MT
330 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
331 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
332 print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
333 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
334 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
2b29c22e 335 print CONF "script-security 3 system\n";
07675dc3 336 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
6140e7e0 337 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
c6c9630e
MT
338 print CONF "tls-server\n";
339 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
340 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
341 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
342 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
343 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
344 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
345 print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
54fd0535
MT
346
347 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
348 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
349 foreach (@temp)
350 {
351 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
352 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
353 }
354 }
355
c6c9630e
MT
356 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
357 print CONF "client-to-client\n";
358 }
1de5c945
EK
359 if ($sovpnsettings{MSSFIX} eq 'on') {
360 print CONF "mssfix\n";
361 }
362 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
363 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
a79fa1d6 364 }
c6c9630e
MT
365 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
366 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
367 }
368 print CONF "status-version 1\n";
4e17adad 369 print CONF "status /var/log/ovpnserver.log 30\n";
c6c9630e
MT
370 print CONF "cipher $sovpnsettings{DCIPHER}\n";
371 if ($sovpnsettings{DCOMPLZO} eq 'on') {
372 print CONF "comp-lzo\n";
373 }
374 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
375 print CONF "push \"redirect-gateway def1\"\n";
376 }
377 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
378 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
379 }
380
381 if ($sovpnsettings{DHCP_DNS} ne '') {
382 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
383 }
384
385 if ($sovpnsettings{DHCP_WINS} ne '') {
386 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
387 }
388
389 if ($sovpnsettings{DHCP_WINS} eq '') {
390 print CONF "max-clients 100\n";
a79fa1d6 391 }
c6c9630e
MT
392 if ($sovpnsettings{DHCP_WINS} ne '') {
393 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
394 }
395 print CONF "tls-verify /var/ipfire/ovpn/verify\n";
396 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
397 print CONF "user nobody\n";
398 print CONF "group nobody\n";
399 print CONF "persist-key\n";
400 print CONF "persist-tun\n";
401 if ($sovpnsettings{LOG_VERB} ne '') {
402 print CONF "verb $sovpnsettings{LOG_VERB}\n";
403 } else {
404 print CONF "verb 3\n";
405 }
406 print CONF "\n";
407
408 close(CONF);
409}
410#
411sub emptyserverlog{
4e17adad 412 if (open(FILE, ">/var/log/ovpnserver.log")) {
c6c9630e
MT
413 flock FILE, 2;
414 print FILE "";
415 close FILE;
416 }
417
418}
419
7c1d9faf
AH
420###
421# m.a.d net2net
422###
423
424sub validdotmask
425{
426 my $ipdotmask = $_[0];
427 if (&General::validip($ipdotmask)) { return 0; }
428 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
429 my $mask = $2;
430 if (($mask =~ /\./ )) { return 0; }
431 return 1;
432}
54fd0535
MT
433
434# -------------------------------------------------------------------
435
436sub write_routepushfile
437{
438 open(FILE, ">$routes_push_file");
439 flock(FILE, 2);
440 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
441 print FILE $vpnsettings{'ROUTES_PUSH'};
442 }
443 close(FILE);
444}
445
446sub read_routepushfile
447{
448 if (-e "$routes_push_file") {
449 open(FILE,"$routes_push_file");
450 delete $vpnsettings{'ROUTES_PUSH'};
451 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
452 close(FILE);
453 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
454 }
455}
7c1d9faf
AH
456
457
c6c9630e
MT
458#hier die refresh page
459if ( -e "${General::swroot}/ovpn/gencanow") {
460 my $refresh = '';
461 $refresh = "<meta http-equiv='refresh' content='15;' />";
462 &Header::showhttpheaders();
463 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
464 &Header::openbigbox('100%', 'center');
465 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
466 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
467 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
468 &Header::closebox();
469 &Header::closebigbox();
470 &Header::closepage();
471 exit (0);
472}
473##hier die refresh page
474
6e13d0a5
MT
475
476###
477### OpenVPN Server Control
478###
479if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
480 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
481 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT
482 #start openvpn server
483 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 484 &emptyserverlog();
6e13d0a5
MT
485 system('/usr/local/bin/openvpnctrl', '-s');
486 }
487 #stop openvpn server
488 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
6e13d0a5 489 system('/usr/local/bin/openvpnctrl', '-k');
c6c9630e 490 &emptyserverlog();
6e13d0a5
MT
491 }
492# #restart openvpn server
493 if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
494#workarund, till SIGHUP also works when running as nobody
c6c9630e
MT
495 system('/usr/local/bin/openvpnctrl', '-r');
496 &emptyserverlog();
6e13d0a5
MT
497 }
498}
499
500###
501### Save Advanced options
502###
503
504if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
505 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
506 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
507 #DAN this value has to leave.
508#new settings for daemon
509 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
510 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
511 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
512 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
513 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
514 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
515 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
516 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
517 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
54fd0535
MT
518 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
519 my @temp=();
6e13d0a5 520
a79fa1d6
JPT
521 if ($cgiparams{'FRAGMENT'} eq '') {
522 delete $vpnsettings{'FRAGMENT'};
523 } else {
524 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
525 $errormessage = "Incorrect value, please insert only numbers.";
526 goto ADV_ERROR;
527 } else {
528 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
529 }
530 }
531 if ($cgiparams{'MSSFIX'} ne 'on') {
1de5c945 532 delete $vpnsettings{'MSSFIX'};
a79fa1d6
JPT
533 } else {
534 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
535 }
6e13d0a5
MT
536 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
537 unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
538 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
539 goto ADV_ERROR;
540 }
541 }
542 if ($cgiparams{'DHCP_DNS'} ne ''){
543 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
544 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
545 goto ADV_ERROR;
546 }
547 }
548 if ($cgiparams{'DHCP_WINS'} ne ''){
549 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
550 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
54fd0535
MT
551 goto ADV_ERROR;
552 }
553 }
554 if ($cgiparams{'ROUTES_PUSH'} ne ''){
555 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
556 undef $vpnsettings{'ROUTES_PUSH'};
557 foreach (@temp)
558 {
559 s/^\s+//g; s/\s+$//g;
560 if ($_)
561 {
562 unless (&General::validipandmask($_)) {
563 $errormessage = $Lang::tr{'ovpn errmsg invalid ip or mask'};
564 goto ADV_ERROR;
565 }
566 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($_));
567 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
568 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
569 goto ADV_ERROR;
570 }
571 $vpnsettings{'ROUTES_PUSH'} .= $_."\n";
572 }
6e13d0a5 573 }
54fd0535
MT
574 &write_routepushfile;
575 undef $vpnsettings{'ROUTES_PUSH'};
8e148dc3
NP
576 }
577 else {
578 undef $vpnsettings{'ROUTES_PUSH'};
579 &write_routepushfile;
6e13d0a5 580 }
6e13d0a5
MT
581 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
582 $errormessage = $Lang::tr{'invalid input for max clients'};
583 goto ADV_ERROR;
584 }
585 if ($cgiparams{'KEEPALIVE_1'} ne '') {
586 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
587 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
588 goto ADV_ERROR;
589 }
590 }
591 if ($cgiparams{'KEEPALIVE_2'} ne ''){
592 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
593 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
594 goto ADV_ERROR;
595 }
596 }
597 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
598 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
599 goto ADV_ERROR;
600 }
601
602 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 603 &writeserverconf();#hier ok
6e13d0a5
MT
604}
605
ce9abb66 606###
7c1d9faf 607# m.a.d net2net
ce9abb66
AH
608###
609
610if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
611{
c6c9630e 612
ce9abb66
AH
613my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
614my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 615my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
d96c89eb 616my $tunmtu = '';
531f0835
AH
617
618unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
619unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
620
621 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
622
623 flock SERVERCONF, 2;
7c1d9faf 624 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
ce9abb66 625 print SERVERCONF "\n";
b278daf3 626 print SERVERCONF "# User Security\n";
ce9abb66
AH
627 print SERVERCONF "user nobody\n";
628 print SERVERCONF "group nobody\n";
629 print SERVERCONF "persist-tun\n";
630 print SERVERCONF "persist-key\n";
7c1d9faf 631 print SERVERCONF "script-security 2\n";
60f396d7 632 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 633 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 634 print SERVERCONF "float\n";
60f396d7 635 print SERVERCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 636 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
60f396d7 637 print SERVERCONF "# Client Gateway Network\n";
54fd0535 638 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 639 print SERVERCONF "# tun Device\n";
ce9abb66 640 print SERVERCONF "dev tun\n";
60f396d7 641 print SERVERCONF "# Port and Protokol\n";
ce9abb66 642 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
643
644 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
645 print SERVERCONF "proto tcp-server\n";
646 print SERVERCONF "# Packet size\n";
d96c89eb 647 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 648 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb 649 }
60f396d7
AH
650
651 if ($cgiparams{'PROTOCOL'} eq 'udp') {
652 print SERVERCONF "proto udp\n";
653 print SERVERCONF "# Paketsize\n";
654 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
655 print SERVERCONF "tun-mtu $tunmtu\n";
54fd0535
MT
656 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
657 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
d96c89eb 658 }
60f396d7 659 print SERVERCONF "# Auth. Server\n";
ce9abb66
AH
660 print SERVERCONF "tls-server\n";
661 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
662 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
663 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
664 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
b278daf3 665 print SERVERCONF "# Cipher\n";
ce9abb66
AH
666 print SERVERCONF "cipher AES-256-CBC\n";
667 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 668 print SERVERCONF "# Enable Compression\n";
ce9abb66 669 print SERVERCONF "comp-lzo\r\n";
b278daf3 670 }
60f396d7 671 print SERVERCONF "# Debug Level\n";
ce9abb66 672 print SERVERCONF "verb 3\n";
b278daf3 673 print SERVERCONF "# Tunnel check\n";
ce9abb66 674 print SERVERCONF "keepalive 10 60\n";
60f396d7 675 print SERVERCONF "# Start as daemon\n";
ce9abb66
AH
676 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
677 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 678 print SERVERCONF "# Activate Management Interface and Port\n";
54fd0535
MT
679 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
680 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66
AH
681 close(SERVERCONF);
682
683}
684
685###
7c1d9faf 686# m.a.d net2net
ce9abb66 687###
7c1d9faf 688
ce9abb66
AH
689if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
690{
691 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
54fd0535 692 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 693 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb 694 my $tunmtu = '';
54fd0535 695
531f0835
AH
696unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
697unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH
698
699 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
700
701 flock CLIENTCONF, 2;
7c1d9faf 702 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 703 print CLIENTCONF "#\n";
b278daf3 704 print CLIENTCONF "# User Security\n";
ce9abb66
AH
705 print CLIENTCONF "user nobody\n";
706 print CLIENTCONF "group nobody\n";
707 print CLIENTCONF "persist-tun\n";
708 print CLIENTCONF "persist-key\n";
7c1d9faf 709 print CLIENTCONF "script-security 2\n";
60f396d7 710 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
ce9abb66 711 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
b278daf3 712 print CLIENTCONF "float\n";
60f396d7 713 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 714 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
60f396d7 715 print CLIENTCONF "# Server Gateway Network\n";
54fd0535 716 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
60f396d7 717 print CLIENTCONF "# tun Device\n";
ce9abb66 718 print CLIENTCONF "dev tun\n";
60f396d7 719 print CLIENTCONF "# Port and Protokol\n";
ce9abb66 720 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
60f396d7
AH
721
722 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
723 print CLIENTCONF "proto tcp-client\n";
724 print CLIENTCONF "# Packet size\n";
d96c89eb 725 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
60f396d7 726 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 727 }
60f396d7
AH
728
729 if ($cgiparams{'PROTOCOL'} eq 'udp') {
730 print CLIENTCONF "proto udp\n";
731 print CLIENTCONF "# Paketsize\n";
732 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
733 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535
MT
734 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
735 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
d96c89eb 736 }
54fd0535
MT
737
738 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
739 print CLIENTCONF "# Auth. Client\n";
740 print CLIENTCONF "tls-client\n";
b278daf3 741 print CLIENTCONF "# Cipher\n";
ce9abb66
AH
742 print CLIENTCONF "cipher AES-256-CBC\n";
743 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
ce9abb66 744 if ($cgiparams{'COMPLZO'} eq 'on') {
60f396d7 745 print CLIENTCONF "# Enable Compression\n";
ce9abb66 746 print CLIENTCONF "comp-lzo\r\n";
b278daf3 747 }
ce9abb66
AH
748 print CLIENTCONF "# Debug Level\n";
749 print CLIENTCONF "verb 3\n";
b278daf3 750 print CLIENTCONF "# Tunnel check\n";
ce9abb66 751 print CLIENTCONF "keepalive 10 60\n";
60f396d7 752 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
753 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
754 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
60f396d7 755 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
756 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
757 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
ce9abb66 758 close(CLIENTCONF);
c6c9630e 759
ce9abb66
AH
760}
761
6e13d0a5
MT
762###
763### Save main settings
764###
ce9abb66
AH
765
766
6e13d0a5
MT
767if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
768 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT
769 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
770 #DAN this value has to leave.
771 if ($cgiparams{'ENABLED'} eq 'on'){
772 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
773 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 774 goto SETTINGS_ERROR;
6e13d0a5
MT
775 }
776 }
777 if ($cgiparams{'ENABLED'} eq 'on'){
c6c9630e 778 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
6e13d0a5
MT
779 }
780 if ($errormessage) { goto SETTINGS_ERROR; }
781
782
783 if ($cgiparams{'ENABLED'} eq 'on'){
c6c9630e 784 &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
6e13d0a5
MT
785 }
786
787 if ($errormessage) { goto SETTINGS_ERROR; }
788
789 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e
MT
790 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
791 goto SETTINGS_ERROR;
792 }
793 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
794
795 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
796 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
797 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
798 goto SETTINGS_ERROR;
799 }
800
801 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
802 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
803 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
804 goto SETTINGS_ERROR;
805 }
806
807 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
808 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
809 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
810 goto SETTINGS_ERROR;
811 }
812
813 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
814 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
815 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
816 goto SETTINGS_ERROR;
817 }
818 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
819 while (<ALIASES>)
820 {
821 chomp($_);
822 my @tempalias = split(/\,/,$_);
823 if ($tempalias[1] eq 'on') {
824 if (&General::IpInSubnet ($tempalias[0] ,
825 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
826 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
827 }
828 }
829 }
830 close(ALIASES);
6e13d0a5 831 if ($errormessage ne ''){
c6c9630e 832 goto SETTINGS_ERROR;
6e13d0a5
MT
833 }
834 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
835 $errormessage = $Lang::tr{'invalid input'};
836 goto SETTINGS_ERROR;
837 }
838 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
839 $errormessage = $Lang::tr{'invalid mtu input'};
840 goto SETTINGS_ERROR;
841 }
842
843 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT
844 $errormessage = $Lang::tr{'invalid port'};
845 goto SETTINGS_ERROR;
6e13d0a5 846 }
6e13d0a5
MT
847 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
848 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
849 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
850 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
851#new settings for daemon
852 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
853 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
854 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
855 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
856 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
857 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
858 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
3ffee04b
CS
859#wrtie enable
860
861 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
862 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
863 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
6e13d0a5
MT
864#new settings for daemon
865 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 866 &writeserverconf();#hier ok
6e13d0a5
MT
867SETTINGS_ERROR:
868###
869### Reset all step 2
870###
871}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
872 my $file = '';
873 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
874
875 foreach my $key (keys %confighash) {
c6c9630e
MT
876 if ($confighash{$key}[4] eq 'cert') {
877 delete $confighash{$cgiparams{'$key'}};
878 }
6e13d0a5
MT
879 }
880 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
c6c9630e 881 unlink $file
6e13d0a5
MT
882 }
883 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
c6c9630e 884 unlink $file
6e13d0a5
MT
885 }
886 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
c6c9630e 887 unlink $file
6e13d0a5 888 }
c6c9630e 889 &cleanssldatabase();
6e13d0a5
MT
890 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
891 print FILE "";
892 close FILE;
893 }
894 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 895 #&writeserverconf();
6e13d0a5
MT
896###
897### Reset all step 1
898###
899}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
900 &Header::showhttpheaders();
901 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
902 &Header::openbigbox('100%', 'LEFT', '', '');
903 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
904 print <<END
905 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
906 <tr><td align='center'>
907 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
908 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
909 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
910 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
911 </form></table>
912END
913 ;
914 &Header::closebox();
915 &Header::closebigbox();
916 &Header::closepage();
917 exit (0);
918
919###
920### Upload CA Certificate
921###
922} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
923 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
924
925 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
926 $errormessage = $Lang::tr{'name must only contain characters'};
927 goto UPLOADCA_ERROR;
928 }
929
930 if (length($cgiparams{'CA_NAME'}) >60) {
931 $errormessage = $Lang::tr{'name too long'};
932 goto VPNCONF_ERROR;
933 }
934
935 if ($cgiparams{'CA_NAME'} eq 'ca') {
936 $errormessage = $Lang::tr{'name is invalid'};
937 goto UPLOAD_CA_ERROR;
938 }
939
940 # Check if there is no other entry with this name
941 foreach my $key (keys %cahash) {
c6c9630e
MT
942 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
943 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
944 goto UPLOADCA_ERROR;
945 }
6e13d0a5
MT
946 }
947
948 if (ref ($cgiparams{'FH'}) ne 'Fh') {
c6c9630e
MT
949 $errormessage = $Lang::tr{'there was no file upload'};
950 goto UPLOADCA_ERROR;
6e13d0a5
MT
951 }
952 # Move uploaded ca to a temporary file
953 (my $fh, my $filename) = tempfile( );
954 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT
955 $errormessage = $!;
956 goto UPLOADCA_ERROR;
6e13d0a5
MT
957 }
958 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
c6c9630e
MT
959 if ($temp !~ /CA:TRUE/i) {
960 $errormessage = $Lang::tr{'not a valid ca certificate'};
961 unlink ($filename);
962 goto UPLOADCA_ERROR;
6e13d0a5 963 } else {
c6c9630e
MT
964 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
965 if ($? ne 0) {
966 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
967 unlink ($filename);
968 goto UPLOADCA_ERROR;
969 }
6e13d0a5
MT
970 }
971
972 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
973 $casubject =~ /Subject: (.*)[\n]/;
974 $casubject = $1;
975 $casubject =~ s+/Email+, E+;
976 $casubject =~ s/ ST=/ S=/;
977 $casubject = &Header::cleanhtml($casubject);
978
979 my $key = &General::findhasharraykey (\%cahash);
980 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
981 $cahash{$key}[1] = $casubject;
982 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT
983# system('/usr/local/bin/ipsecctrl', 'R');
984
6e13d0a5
MT
985 UPLOADCA_ERROR:
986
987###
988### Display ca certificate
989###
990} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT
991 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
992
993 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
994 &Header::showhttpheaders();
995 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
996 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
997 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
998 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
999 $output = &Header::cleanhtml($output,"y");
1000 print "<pre>$output</pre>\n";
1001 &Header::closebox();
1002 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1003 &Header::closebigbox();
1004 &Header::closepage();
1005 exit(0);
1006 } else {
1007 $errormessage = $Lang::tr{'invalid key'};
1008 }
1009
6e13d0a5
MT
1010###
1011### Download ca certificate
1012###
1013} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1014 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1015
1016 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1017 print "Content-Type: application/octet-stream\r\n";
1018 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1019 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1020 exit(0);
1021 } else {
1022 $errormessage = $Lang::tr{'invalid key'};
1023 }
1024
1025###
1026### Remove ca certificate (step 2)
1027###
1028} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1029 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1030 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1031
1032 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1033 foreach my $key (keys %confighash) {
1034 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1035 if ($test =~ /: OK/) {
c6c9630e
MT
1036 # Delete connection
1037# if ($vpnsettings{'ENABLED'} eq 'on' ||
1038# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1039# system('/usr/local/bin/ipsecctrl', 'D', $key);
1040# }
6e13d0a5
MT
1041 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1042 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1043 delete $confighash{$key};
1044 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 1045# &writeipsecfiles();
6e13d0a5
MT
1046 }
1047 }
1048 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1049 delete $cahash{$cgiparams{'KEY'}};
1050 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 1051# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT
1052 } else {
1053 $errormessage = $Lang::tr{'invalid key'};
1054 }
1055###
1056### Remove ca certificate (step 1)
1057###
1058} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1059 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1060 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1061
1062 my $assignedcerts = 0;
1063 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1064 foreach my $key (keys %confighash) {
1065 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1066 if ($test =~ /: OK/) {
1067 $assignedcerts++;
1068 }
1069 }
1070 if ($assignedcerts) {
1071 &Header::showhttpheaders();
1072 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1073 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1074 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1075 print <<END
1076 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1077 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1078 <tr><td align='center'>
1079 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1080 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1081 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1082 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1083 </form></table>
1084END
1085 ;
1086 &Header::closebox();
1087 &Header::closebigbox();
1088 &Header::closepage();
1089 exit (0);
1090 } else {
1091 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1092 delete $cahash{$cgiparams{'KEY'}};
1093 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1094# system('/usr/local/bin/ipsecctrl', 'R');
1095 }
1096 } else {
1097 $errormessage = $Lang::tr{'invalid key'};
1098 }
1099
1100###
1101### Display root certificate
1102###
c6c9630e
MT
1103}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1104 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1105 my $output;
1106 &Header::showhttpheaders();
1107 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1108 &Header::openbigbox('100%', 'LEFT', '', '');
1109 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1110 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1111 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1112 } else {
1113 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1114 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1115 }
1116 $output = &Header::cleanhtml($output,"y");
1117 print "<pre>$output</pre>\n";
1118 &Header::closebox();
1119 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1120 &Header::closebigbox();
1121 &Header::closepage();
1122 exit(0);
1123
6e13d0a5
MT
1124###
1125### Download root certificate
1126###
1127}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1128 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1129 print "Content-Type: application/octet-stream\r\n";
1130 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1131 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1132 exit(0);
1133 }
1134
1135###
1136### Download host certificate
1137###
1138}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1139 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1140 print "Content-Type: application/octet-stream\r\n";
1141 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1142 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1143 exit(0);
1144 }
1145###
1146### Form for generating a root certificate
1147###
1148}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1149 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1150
1151 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1152 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1153 $errormessage = $Lang::tr{'valid root certificate already exists'};
1154 $cgiparams{'ACTION'} = '';
1155 goto ROOTCERT_ERROR;
1156 }
1157
1158 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1159 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1160 my $ipaddr = <IPADDR>;
1161 close IPADDR;
1162 chomp ($ipaddr);
1163 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1164 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1165 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1166 }
1167 }
1168 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1169
1170 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1171 $errormessage = $Lang::tr{'there was no file upload'};
1172 goto ROOTCERT_ERROR;
1173 }
1174
1175 # Move uploaded certificate request to a temporary file
1176 (my $fh, my $filename) = tempfile( );
1177 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1178 $errormessage = $!;
1179 goto ROOTCERT_ERROR;
1180 }
1181
1182 # Create a temporary dirctory
1183 my $tempdir = tempdir( CLEANUP => 1 );
1184
1185 # Extract the CA certificate from the file
1186 my $pid = open(OPENSSL, "|-");
1187 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1188 if ($pid) { # parent
1189 if ($cgiparams{'P12_PASS'} ne '') {
1190 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1191 }
1192 close (OPENSSL);
1193 if ($?) {
1194 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1195 unlink ($filename);
1196 goto ROOTCERT_ERROR;
1197 }
1198 } else { # child
1199 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1200 '-in', $filename,
1201 '-out', "$tempdir/cacert.pem")) {
1202 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1203 unlink ($filename);
1204 goto ROOTCERT_ERROR;
1205 }
1206 }
1207
1208 # Extract the Host certificate from the file
1209 $pid = open(OPENSSL, "|-");
1210 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1211 if ($pid) { # parent
1212 if ($cgiparams{'P12_PASS'} ne '') {
1213 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1214 }
1215 close (OPENSSL);
1216 if ($?) {
1217 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1218 unlink ($filename);
1219 goto ROOTCERT_ERROR;
1220 }
1221 } else { # child
1222 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1223 '-in', $filename,
1224 '-out', "$tempdir/hostcert.pem")) {
1225 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1226 unlink ($filename);
1227 goto ROOTCERT_ERROR;
1228 }
1229 }
1230
1231 # Extract the Host key from the file
1232 $pid = open(OPENSSL, "|-");
1233 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1234 if ($pid) { # parent
1235 if ($cgiparams{'P12_PASS'} ne '') {
1236 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1237 }
1238 close (OPENSSL);
1239 if ($?) {
1240 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1241 unlink ($filename);
1242 goto ROOTCERT_ERROR;
1243 }
1244 } else { # child
1245 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1246 '-nodes',
1247 '-in', $filename,
1248 '-out', "$tempdir/serverkey.pem")) {
1249 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1250 unlink ($filename);
1251 goto ROOTCERT_ERROR;
1252 }
1253 }
1254
1255 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1256 if ($? ne 0) {
1257 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1258 unlink ($filename);
1259 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1260 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1261 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1262 goto ROOTCERT_ERROR;
1263 }
1264
1265 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1266 if ($? ne 0) {
1267 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1268 unlink ($filename);
1269 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1270 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1271 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1272 goto ROOTCERT_ERROR;
1273 }
1274
1275 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1276 if ($? ne 0) {
1277 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1278 unlink ($filename);
1279 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1280 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1281 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1282 goto ROOTCERT_ERROR;
1283 }
1284
1285 goto ROOTCERT_SUCCESS;
1286
1287 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1288
1289 # Validate input since the form was submitted
1290 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1291 $errormessage = $Lang::tr{'organization cant be empty'};
1292 goto ROOTCERT_ERROR;
1293 }
1294 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1295 $errormessage = $Lang::tr{'organization too long'};
1296 goto ROOTCERT_ERROR;
1297 }
1298 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1299 $errormessage = $Lang::tr{'invalid input for organization'};
1300 goto ROOTCERT_ERROR;
1301 }
1302 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1303 $errormessage = $Lang::tr{'hostname cant be empty'};
1304 goto ROOTCERT_ERROR;
1305 }
1306 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1307 $errormessage = $Lang::tr{'invalid input for hostname'};
1308 goto ROOTCERT_ERROR;
1309 }
1310 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1311 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1312 goto ROOTCERT_ERROR;
1313 }
1314 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1315 $errormessage = $Lang::tr{'e-mail address too long'};
1316 goto ROOTCERT_ERROR;
1317 }
1318 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1319 $errormessage = $Lang::tr{'invalid input for department'};
1320 goto ROOTCERT_ERROR;
1321 }
1322 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1323 $errormessage = $Lang::tr{'invalid input for city'};
1324 goto ROOTCERT_ERROR;
1325 }
1326 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1327 $errormessage = $Lang::tr{'invalid input for state or province'};
1328 goto ROOTCERT_ERROR;
1329 }
1330 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1331 $errormessage = $Lang::tr{'invalid input for country'};
1332 goto ROOTCERT_ERROR;
1333 }
1334
1335 # Copy the cgisettings to vpnsettings and save the configfile
1336 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1337 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1338 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1339 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1340 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1341 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1342 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1343 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1344
1345 # Replace empty strings with a .
1346 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1347 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1348 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1349
1350 # refresh
c6c9630e 1351 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT
1352
1353 # Create the CA certificate
1354 my $pid = open(OPENSSL, "|-");
1355 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1356 if ($pid) { # parent
1357 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1358 print OPENSSL "$state\n";
1359 print OPENSSL "$city\n";
1360 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1361 print OPENSSL "$ou\n";
1362 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1363 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1364 close (OPENSSL);
1365 if ($?) {
1366 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1367 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1368 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1369 goto ROOTCERT_ERROR;
1370 }
1371 } else { # child
1372 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1373 '-days', '999999', '-newkey', 'rsa:2048',
1374 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1375 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1376 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1377 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1378 goto ROOTCERT_ERROR;
1379 }
1380 }
1381
1382 # Create the Host certificate request
1383 $pid = open(OPENSSL, "|-");
1384 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1385 if ($pid) { # parent
1386 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1387 print OPENSSL "$state\n";
1388 print OPENSSL "$city\n";
1389 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1390 print OPENSSL "$ou\n";
1391 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1392 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1393 print OPENSSL ".\n";
1394 print OPENSSL ".\n";
1395 close (OPENSSL);
1396 if ($?) {
1397 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1398 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1399 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1400 goto ROOTCERT_ERROR;
1401 }
1402 } else { # child
1403 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1404 '-newkey', 'rsa:1024',
1405 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1406 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1407 '-extensions', 'server',
1408 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1409 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1410 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1411 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1412 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1413 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1414 goto ROOTCERT_ERROR;
1415 }
1416 }
1417
1418 # Sign the host certificate request
1419 system('/usr/bin/openssl', 'ca', '-days', '999999',
1420 '-batch', '-notext',
1421 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1422 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1423 '-extensions', 'server',
1424 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1425 if ($?) {
1426 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1427 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1428 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1429 unlink ("${General::swroot}/ovpn/serverkey.pem");
1430 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1431 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1432 &newcleanssldatabase();
6e13d0a5
MT
1433 goto ROOTCERT_ERROR;
1434 } else {
1435 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1436 &deletebackupcert();
6e13d0a5
MT
1437 }
1438
1439 # Create an empty CRL
1440 system('/usr/bin/openssl', 'ca', '-gencrl',
1441 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1442 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1443 if ($?) {
1444 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1445 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1446 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1447 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1448 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 1449 &cleanssldatabase();
6e13d0a5 1450 goto ROOTCERT_ERROR;
c6c9630e
MT
1451# } else {
1452# &cleanssldatabase();
6e13d0a5
MT
1453 }
1454 # Create Diffie Hellmann Parameter
1455 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1456 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1457 '1024' );
1458 if ($?) {
1459 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1460 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1461 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1462 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1463 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1464 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 1465 &cleanssldatabase();
6e13d0a5 1466 goto ROOTCERT_ERROR;
c6c9630e
MT
1467# } else {
1468# &cleanssldatabase();
6e13d0a5
MT
1469 }
1470 goto ROOTCERT_SUCCESS;
1471 }
1472 ROOTCERT_ERROR:
1473 if ($cgiparams{'ACTION'} ne '') {
1474 &Header::showhttpheaders();
1475 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1476 &Header::openbigbox('100%', 'LEFT', '', '');
1477 if ($errormessage) {
1478 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1479 print "<class name='base'>$errormessage";
1480 print "&nbsp;</class>";
1481 &Header::closebox();
1482 }
1483 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1484 print <<END
1485 <form method='post' enctype='multipart/form-data'>
1486 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1487 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1488 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1489 <td width='35%' colspan='2'>&nbsp;</td></tr>
1490 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1491 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1492 <td colspan='2'>&nbsp;</td></tr>
1493 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1494 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1495 <td colspan='2'>&nbsp;</td></tr>
1496 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1497 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1498 <td colspan='2'>&nbsp;</td></tr>
1499 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1500 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1501 <td colspan='2'>&nbsp;</td></tr>
1502 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1503 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1504 <td colspan='2'>&nbsp;</td></tr>
1505 <tr><td class='base'>$Lang::tr{'country'}:</td>
1506 <td class='base'><select name='ROOTCERT_COUNTRY'>
1507
1508END
1509 ;
1510 foreach my $country (sort keys %{Countries::countries}) {
1511 print "<option value='$Countries::countries{$country}'";
1512 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1513 print " selected='selected'";
1514 }
1515 print ">$country</option>";
1516 }
1517 print <<END
1518 </select></td>
1519 <td colspan='2'>&nbsp;</td></tr>
1520 <tr><td>&nbsp;</td>
1521 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1522 <td>&nbsp;</td><td>&nbsp;</td></tr>
1523 <tr><td class='base' colspan='4' align='left'>
1524 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1525 <tr><td class='base' colspan='4' align='left'>
1526 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1527 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1528 </td></tr>
1529 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1530 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1531 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1532 <td colspan='2'>&nbsp;</td></tr>
1533 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1534 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1535 <td colspan='2'>&nbsp;</td></tr>
1536 <tr><td>&nbsp;</td>
1537 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1538 <td colspan='2'>&nbsp;</td></tr>
1539 <tr><td class='base' colspan='4' align='left'>
1540 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1541 </form></table>
1542END
1543 ;
1544 &Header::closebox();
1545
1546 &Header::closebigbox();
1547 &Header::closepage();
1548 exit(0)
1549 }
1550
1551 ROOTCERT_SUCCESS:
1552 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT
1553# if ($vpnsettings{'ENABLED'} eq 'on' ||
1554# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1555# system('/usr/local/bin/ipsecctrl', 'S');
1556# }
6e13d0a5
MT
1557
1558###
1559### Enable/Disable connection
1560###
ce9abb66
AH
1561
1562###
7c1d9faf 1563# m.a.d net2net
ce9abb66
AH
1564###
1565
6e13d0a5 1566}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT
1567
1568 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 1569 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH
1570# my $n2nactive = '';
1571 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1572
6e13d0a5 1573 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66
AH
1574
1575
1576 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT
1577 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1578 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH
1579
1580 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1581 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1582 }
1583
1584 } else {
1585
c6c9630e 1586 $confighash{$cgiparams{'KEY'}}[0] = 'off';
ce9abb66
AH
1587 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1588
1589 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1590 if ($n2nactive ne ''){
1591 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1592 }
1593
1594 } else {
1595 $errormessage = $Lang::tr{'invalid key'};
1596 }
1597 }
1598 }
6e13d0a5
MT
1599
1600###
1601### Download OpenVPN client package
1602###
ce9abb66
AH
1603
1604
6e13d0a5
MT
1605} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1606 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1607 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1608 my $file = '';
1609 my $clientovpn = '';
1610 my @fileholder;
1611 my $tempdir = tempdir( CLEANUP => 1 );
1612 my $zippath = "$tempdir/";
ce9abb66
AH
1613
1614###
7c1d9faf
AH
1615# m.a.d net2net
1616###
ce9abb66
AH
1617
1618if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1619
1620 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1621 my $zippathname = "$zippath$zipname";
1622 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1623 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
54fd0535 1624 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
ce9abb66 1625 my $tunmtu = '';
7c1d9faf 1626 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
54fd0535 1627 my $n2nfragment = '';
ce9abb66
AH
1628
1629 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1630 flock CLIENTCONF, 2;
1631
1632 my $zip = Archive::Zip->new();
7c1d9faf 1633 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
ce9abb66 1634 print CLIENTCONF "# \n";
b278daf3 1635 print CLIENTCONF "# User Security\n";
ce9abb66
AH
1636 print CLIENTCONF "user nobody\n";
1637 print CLIENTCONF "group nobody\n";
1638 print CLIENTCONF "persist-tun\n";
1639 print CLIENTCONF "persist-key\n";
7c1d9faf 1640 print CLIENTCONF "script-security 2\n";
60f396d7 1641 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
531f0835 1642 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
b278daf3 1643 print CLIENTCONF "float\n";
60f396d7 1644 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
ce9abb66 1645 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
b278daf3 1646 print CLIENTCONF "# Server Gateway Network\n";
7c1d9faf 1647 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
b278daf3 1648 print CLIENTCONF "# tun Device\n";
ce9abb66 1649 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
60f396d7 1650 print CLIENTCONF "# Port and Protokoll\n";
ce9abb66 1651 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
60f396d7
AH
1652
1653 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1654 print CLIENTCONF "proto tcp-client\n";
1655 print CLIENTCONF "# Packet size\n";
d96c89eb 1656 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
60f396d7 1657 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb 1658 }
60f396d7
AH
1659
1660 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1661 print CLIENTCONF "proto udp\n";
1662 print CLIENTCONF "# Paketsize\n";
1663 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1664 print CLIENTCONF "tun-mtu $tunmtu\n";
54fd0535 1665 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
60f396d7 1666 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
d96c89eb 1667 }
54fd0535 1668 print CLIENTCONF "ns-cert-type server\n";
ce9abb66
AH
1669 print CLIENTCONF "# Auth. Client\n";
1670 print CLIENTCONF "tls-client\n";
b278daf3 1671 print CLIENTCONF "# Cipher\n";
ce9abb66
AH
1672 print CLIENTCONF "cipher AES-256-CBC\n";
1673 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1674 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1675 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1676 }
ce9abb66 1677 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
b278daf3 1678 print CLIENTCONF "# Enable Compression\n";
ce9abb66 1679 print CLIENTCONF "comp-lzo\r\n";
b278daf3 1680 }
ce9abb66
AH
1681 print CLIENTCONF "# Debug Level\n";
1682 print CLIENTCONF "verb 3\n";
b278daf3 1683 print CLIENTCONF "# Tunnel check\n";
ce9abb66 1684 print CLIENTCONF "keepalive 10 60\n";
b278daf3 1685 print CLIENTCONF "# Start as daemon\n";
ce9abb66
AH
1686 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1687 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
b278daf3 1688 print CLIENTCONF "# Activate Management Interface and Port\n";
54fd0535
MT
1689 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
1690 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
ce9abb66 1691 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 1692
ce9abb66
AH
1693
1694 close(CLIENTCONF);
1695
1696 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1697 my $status = $zip->writeToFileNamed($zippathname);
1698
1699 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1700 @fileholder = <DLFILE>;
1701 print "Content-Type:application/x-download\n";
1702 print "Content-Disposition:attachment;filename=$zipname\n\n";
1703 print @fileholder;
1704 exit (0);
1705}
1706else
1707{
1708 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1709 my $zippathname = "$zippath$zipname";
1710 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1711
1712###
7c1d9faf 1713# m.a.d net2net
ce9abb66
AH
1714###
1715
c6c9630e 1716 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT
1717 flock CLIENTCONF, 2;
1718
1719 my $zip = Archive::Zip->new();
1720
c6c9630e 1721 print CLIENTCONF "#OpenVPN Server conf\r\n";
6e13d0a5
MT
1722 print CLIENTCONF "tls-client\r\n";
1723 print CLIENTCONF "client\r\n";
1724 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
c6c9630e 1725 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
6e13d0a5
MT
1726 print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1727 if ( $vpnsettings{'ENABLED'} eq 'on'){
1728 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT
1729 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1730 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1731 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1732 }
1733 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1734 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1735 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1736 }
1737 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1738 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1739 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1740 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1741 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1742 }
1743 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1744 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT
1745 }
1746
1747 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
c6c9630e
MT
1748 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1749 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
6e13d0a5 1750 } else {
c6c9630e
MT
1751 print CLIENTCONF "ca cacert.pem\r\n";
1752 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1753 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1754 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
1755 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT
1756 }
1757 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1758 if ($vpnsettings{DCOMPLZO} eq 'on') {
1759 print CLIENTCONF "comp-lzo\r\n";
1760 }
1761 print CLIENTCONF "verb 3\r\n";
1762 print CLIENTCONF "ns-cert-type server\r\n";
a79fa1d6
JPT
1763 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1764 if ($vpnsettings{MSSFIX} eq 'on') {
1765 print CLIENTCONF "mssfix\r\n";
1766 }
74225cce 1767 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT
1768 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1769 }
6e13d0a5 1770 close(CLIENTCONF);
ce9abb66 1771
6e13d0a5
MT
1772 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1773 my $status = $zip->writeToFileNamed($zippathname);
1774
1775 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1776 @fileholder = <DLFILE>;
1777 print "Content-Type:application/x-download\n";
1778 print "Content-Disposition:attachment;filename=$zipname\n\n";
1779 print @fileholder;
1780 exit (0);
ce9abb66
AH
1781 }
1782
1783
1784
6e13d0a5
MT
1785###
1786### Remove connection
1787###
ce9abb66
AH
1788
1789
6e13d0a5
MT
1790} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1791 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1792 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e
MT
1793
1794 if ($confighash{$cgiparams{'KEY'}}) {
1795# if ($vpnsettings{'ENABLED'} eq 'on' ||
1796# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1797# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1798# }
1799#
1800 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
ce9abb66
AH
1801
1802###
7c1d9faf 1803# m.a.d net2net
ce9abb66 1804###
7c1d9faf 1805
ce9abb66
AH
1806 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1807
1808 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1809 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1810 unlink ($certfile) or die "Removing $certfile fail: $!";
1811 unlink ($conffile) or die "Removing $conffile fail: $!";
1812 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1813
1814}
ce9abb66
AH
1815
1816 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
c6c9630e
MT
1817 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1818 delete $confighash{$cgiparams{'KEY'}};
1819 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1820 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1821 #&writeserverconf();
6e13d0a5 1822 } else {
c6c9630e 1823 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5 1824 }
ce9abb66
AH
1825
1826
6e13d0a5
MT
1827###
1828### Download PKCS12 file
1829###
1830} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1831 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1832
1833 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1834 print "Content-Type: application/octet-stream\r\n\r\n";
1835 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1836 exit (0);
1837
1838###
1839### Display certificate
1840###
1841} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1842 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1843
1844 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
1845 &Header::showhttpheaders();
1846 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1847 &Header::openbigbox('100%', 'LEFT', '', '');
1848 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1849 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1850 $output = &Header::cleanhtml($output,"y");
1851 print "<pre>$output</pre>\n";
1852 &Header::closebox();
1853 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1854 &Header::closebigbox();
1855 &Header::closepage();
1856 exit(0);
6e13d0a5
MT
1857 }
1858###
1859### Display Certificate Revoke List
1860###
1861} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT
1862# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1863
6e13d0a5 1864 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
c6c9630e
MT
1865 &Header::showhttpheaders();
1866 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1867 &Header::openbigbox('100%', 'LEFT', '', '');
1868 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1869 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1870 $output = &Header::cleanhtml($output,"y");
1871 print "<pre>$output</pre>\n";
1872 &Header::closebox();
1873 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1874 &Header::closebigbox();
1875 &Header::closepage();
1876 exit(0);
6e13d0a5
MT
1877 }
1878
1879###
1880### Advanced Server Settings
1881###
1882
1883} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1884 %cgiparams = ();
1885 %cahash = ();
1886 %confighash = ();
1887 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
54fd0535 1888 read_routepushfile;
6e13d0a5 1889
c6c9630e
MT
1890# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1891# $cgiparams{'CLIENT2CLIENT'} = 'on';
1892# }
6e13d0a5
MT
1893ADV_ERROR:
1894 if ($cgiparams{'MAX_CLIENTS'} eq '') {
c6c9630e 1895 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5 1896 }
6e13d0a5 1897 if ($cgiparams{'KEEPALIVE_1'} eq '') {
c6c9630e 1898 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT
1899 }
1900 if ($cgiparams{'KEEPALIVE_2'} eq '') {
c6c9630e 1901 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT
1902 }
1903 if ($cgiparams{'LOG_VERB'} eq '') {
ae9f6139
MT
1904 $cgiparams{'LOG_VERB'} = '3';
1905 }
6e13d0a5
MT
1906 $checked{'CLIENT2CLIENT'}{'off'} = '';
1907 $checked{'CLIENT2CLIENT'}{'on'} = '';
1908 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1909 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1910 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1911 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
a79fa1d6
JPT
1912 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1913 $checked{'MSSFIX'}{'off'} = '';
1914 $checked{'MSSFIX'}{'on'} = '';
1915 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
6e13d0a5
MT
1916 $selected{'LOG_VERB'}{'1'} = '';
1917 $selected{'LOG_VERB'}{'2'} = '';
1918 $selected{'LOG_VERB'}{'3'} = '';
1919 $selected{'LOG_VERB'}{'4'} = '';
1920 $selected{'LOG_VERB'}{'5'} = '';
1921 $selected{'LOG_VERB'}{'6'} = '';
1922 $selected{'LOG_VERB'}{'7'} = '';
1923 $selected{'LOG_VERB'}{'8'} = '';
1924 $selected{'LOG_VERB'}{'9'} = '';
1925 $selected{'LOG_VERB'}{'10'} = '';
1926 $selected{'LOG_VERB'}{'11'} = '';
1927 $selected{'LOG_VERB'}{'0'} = '';
1928 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
a79fa1d6
JPT
1929
1930
6e13d0a5
MT
1931
1932 &Header::showhttpheaders();
1933 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1934 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1935 if ($errormessage) {
c6c9630e
MT
1936 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1937 print "<class name='base'>$errormessage\n";
1938 print "&nbsp;</class>\n";
1939 &Header::closebox();
6e13d0a5
MT
1940 }
1941 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1942 print <<END
1943 <form method='post' enctype='multipart/form-data'>
1944 <table width='100%'>
1945 <tr>
1946 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1947 </tr>
1948 <tr>
1949 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1950 </tr>
1951 <tr>
1952 <td class='base'>Domain</td>
1953 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1954 </tr>
1955 <tr>
1956 <td class='base'>DNS</td>
1957 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1958 </tr>
1959 <tr>
1960 <td class='base'>WINS</td>
1961 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
54fd0535
MT
1962 </tr>
1963 <tr>
1964 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
1965 </tr>
1966 <tr>
1967 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
1968 <td colspan='2'>
1969 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
1970END
1971;
1972
1973if ($cgiparams{'ROUTES_PUSH'} ne '')
1974{
1975 print $cgiparams{'ROUTES_PUSH'};
1976}
1977
1978print <<END
1979</textarea></td>
1980</tr>
6e13d0a5
MT
1981 </tr>
1982</table>
1983<hr size='1'>
6e13d0a5
MT
1984 <table width='100%'>
1985 <tr>
1986 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1987 </tr>
1988 <tr>
a79fa1d6 1989 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
6e13d0a5
MT
1990 </tr>
1991 <tr>
1992 <td class='base'>Client-To-Client</td>
1993 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
1994 </tr>
1995 <tr>
1996 <td class='base'>Redirect-Gateway def1</td>
1997 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
1998 </tr>
1999 <tr>
2000 <td class='base'>Max-Clients</td>
a79fa1d6 2001 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
6e13d0a5 2002 </tr>
a79fa1d6
JPT
2003 <tr>
2004 <td class='base'>Keppalive <br />
2005 (ping/ping-restart)</td>
2006 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2007 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2008 </tr>
2009 <tr>
2010 <td class='base'>fragment <br></td>
2011 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
60f396d7
AH
2012 <td>Default: <span class="base">1300</span></td>
2013 </tr>
a79fa1d6
JPT
2014 <tr>
2015 <td class='base'>mssfix</td>
2016 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2017 <td>Default: on</td>
2018 </tr>
2019</table>
2020
2021<!--
2022<hr size='1'>
2023 <table width='100%'>
2024 <tr>
2025 <td class'base'><b>Crypto-Engines</b></td>
2026 </tr>
2027 <tr>
2028 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5 2029 </tr>
a79fa1d6
JPT
2030 <tr><td class='base'>Engines:</td>
2031 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2032 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2033 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2034 </select>
2035 </td>
6e13d0a5 2036</table>
a79fa1d6 2037-->
6e13d0a5
MT
2038<hr size='1'>
2039 <table width='100%'>
2040 <tr>
2041 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2042 </tr>
2043 <tr>
a79fa1d6 2044 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT
2045 </tr>
2046
2047 <tr><td class='base'>VERB</td>
2048 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2049 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2050 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2051 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2052 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2053 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2054 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2055 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2056 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2057 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2058 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
c6c9630e 2059 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
6e13d0a5
MT
2060</table>
2061<hr size='1'>
2062<table width='100%'>
2063<tr>
2064 <td>&nbsp;</td>
2065 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2066 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2067 <td>&nbsp;</td>
2068</tr>
2069</table>
2070</form>
2071END
2072;
2073
2074 &Header::closebox();
c6c9630e 2075# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT
2076 &Header::closebigbox();
2077 &Header::closepage();
2078 exit(0);
2079
2080###
2081### Openvpn Connections Statistics
2082###
2083} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2084 &Header::showhttpheaders();
2085 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2086 &Header::openbigbox('100%', 'LEFT', '', '');
2087 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2088
2089#
2090# <td><b>$Lang::tr{'protocol'}</b></td>
2091# protocol temp removed
2092 print <<END
2093 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2094 <tr>
2095 <td><b>$Lang::tr{'common name'}</b></td>
2096 <td><b>$Lang::tr{'real address'}</b></td>
2097 <td><b>$Lang::tr{'virtual address'}</b></td>
2098 <td><b>$Lang::tr{'loged in at'}</b></td>
2099 <td><b>$Lang::tr{'bytes sent'}</b></td>
2100 <td><b>$Lang::tr{'bytes received'}</b></td>
2101 <td><b>$Lang::tr{'last activity'}</b></td>
2102 </tr>
2103END
2104;
4e17adad 2105 my $filename = "/var/log/ovpnserver.log";
6e13d0a5
MT
2106 open(FILE, $filename) or die 'Unable to open config file.';
2107 my @current = <FILE>;
2108 close(FILE);
2109 my @users =();
2110 my $status;
2111 my $uid = 0;
2112 my $cn;
2113 my @match = ();
2114 my $proto = "udp";
2115 my $address;
2116 my %userlookup = ();
2117 foreach my $line (@current)
2118 {
2119 chomp($line);
2120 if ( $line =~ /^Updated,(.+)/){
2121 @match = split( /^Updated,(.+)/, $line);
2122 $status = $match[1];
2123 }
c6c9630e 2124#gian
6e13d0a5
MT
2125 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2126 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2127 if ($match[1] ne "Common Name") {
2128 $cn = $match[1];
2129 $userlookup{$match[2]} = $uid;
2130 $users[$uid]{'CommonName'} = $match[1];
2131 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT
2132 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2133 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT
2134 $users[$uid]{'Since'} = $match[5];
2135 $users[$uid]{'Proto'} = $proto;
2136 $uid++;
2137 }
2138 }
2139 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2140 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2141 if ($match[1] ne "Virtual Address") {
2142 $address = $match[3];
2143 #find the uid in the lookup table
2144 $uid = $userlookup{$address};
2145 $users[$uid]{'VirtualAddress'} = $match[1];
2146 $users[$uid]{'LastRef'} = $match[4];
2147 }
2148 }
2149 }
2150 my $user2 = @users;
2151 if ($user2 >= 1){
2152 for (my $idx = 1; $idx <= $user2; $idx++){
2153 if ($idx % 2) {
4e17adad 2154 print "<tr bgcolor='$color{'color20'}'>\n";
6e13d0a5 2155 } else {
4e17adad 2156 print "<tr bgcolor='$color{'color22'}'>\n";
6e13d0a5
MT
2157 }
2158 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2159 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2160 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2161 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2162 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2163 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2164 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2165# print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2166 }
2167 }
2168
2169 print "</table>";
2170 print <<END
2171 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2172 <tr><td></td></tr>
2173 <tr><td></td></tr>
2174 <tr><td></td></tr>
2175 <tr><td></td></tr>
2176 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2177 </table>
2178END
2179;
2180 &Header::closebox();
2181 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2182 &Header::closebigbox();
2183 &Header::closepage();
2184 exit(0);
2185
2186###
2187### Download Certificate
2188###
2189} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2190 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2191
6e13d0a5 2192 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT
2193 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2194 print "Content-Type: application/octet-stream\r\n\r\n";
2195 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2196 exit (0);
2197 }
2198
2199###
2200### Enable/Disable connection
2201###
ce9abb66 2202
c6c9630e
MT
2203} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2204
2205 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2206 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2207
2208 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 2209 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT
2210 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2211 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2212 #&writeserverconf();
2213# if ($vpnsettings{'ENABLED'} eq 'on' ||
2214# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2215# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2216# }
2217 } else {
2218 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2219# if ($vpnsettings{'ENABLED'} eq 'on' ||
2220# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2221# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2222# }
2223 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2224 #&writeserverconf();
2225 }
2226 } else {
2227 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
2228 }
2229
2230###
2231### Restart connection
2232###
2233} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2234 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2235 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2236
2237 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT
2238# if ($vpnsettings{'ENABLED'} eq 'on' ||
2239# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2240# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2241# }
6e13d0a5 2242 } else {
c6c9630e 2243 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT
2244 }
2245
2246###
c6c9630e 2247### Remove connection
6e13d0a5 2248###
c6c9630e
MT
2249} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2250 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2251 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2252
2253 if ($confighash{$cgiparams{'KEY'}}) {
2254# if ($vpnsettings{'ENABLED'} eq 'on' ||
2255# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2256# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2257# }
2258 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2259 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2260 delete $confighash{$cgiparams{'KEY'}};
2261 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2262 #&writeserverconf();
2263 } else {
2264 $errormessage = $Lang::tr{'invalid key'};
2265 }
ce9abb66
AH
2266#test33
2267
2268###
2269### Choose between adding a host-net or net-net connection
2270###
2271
2272###
7c1d9faf 2273# m.a.d net2net
ce9abb66
AH
2274###
2275
2276} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2277 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2278 &Header::showhttpheaders();
2279 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2280 &Header::openbigbox('100%', 'LEFT', '', '');
2281 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
b278daf3
AH
2282
2283if ( -s "${General::swroot}/ovpn/settings") {
2284
ce9abb66
AH
2285 print <<END
2286 <b>$Lang::tr{'connection type'}:</b><br />
2287 <table><form method='post' ENCTYPE="multipart/form-data">
2288 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2289 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2290 <tr><td><input type='radio' name='TYPE' value='net' /></td>
2291 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2292 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2293 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2294 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
54fd0535
MT
2295 <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2296 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'><td class='base'>Default : Client Packagename</td></td></tr>
2297 <tr><td colspan='3'><hr /></td></tr>
2298 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2299 <tr><td>&nbsp;</td></tr>
2300 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
ce9abb66
AH
2301 </form></table>
2302END
2303 ;
2304
b278daf3
AH
2305} else {
2306 print <<END
2307 <b>$Lang::tr{'connection type'}:</b><br />
2308 <table><form method='post' ENCTYPE="multipart/form-data">
2309 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2310 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2311 </form></table>
2312END
2313 ;
2314
2315}
2316
ce9abb66
AH
2317 &Header::closebox();
2318 &Header::closebigbox();
2319 &Header::closepage();
2320 exit (0);
2321
2322###
7c1d9faf 2323# m.a.d net2net
ce9abb66
AH
2324###
2325
2326} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2327
2328 my @firen2nconf;
2329 my @confdetails;
2330 my $uplconffilename ='';
54fd0535 2331 my $uplconffilename2 ='';
ce9abb66 2332 my $uplp12name = '';
54fd0535 2333 my $uplp12name2 = '';
ce9abb66
AH
2334 my @rem_subnet;
2335 my @rem_subnet2;
2336 my @tmposupnet3;
2337 my $key;
54fd0535 2338 my @n2nname;
ce9abb66
AH
2339
2340 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2341
2342# Check if a file is uploaded
2343
2344 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2345 $errormessage = $Lang::tr{'there was no file upload'};
2346 goto N2N_ERROR;
2347 }
2348
2349# Move uploaded IPfire n2n package to temporary file
2350
2351 (my $fh, my $filename) = tempfile( );
2352 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2353 $errormessage = $!;
2354 goto N2N_ERROR;
2355 }
2356
2357 my $zip = Archive::Zip->new();
2358 my $zipName = $filename;
2359 my $status = $zip->read( $zipName );
2360 if ($status != AZ_OK) {
2361 $errormessage = "Read of $zipName failed\n";
2362 goto N2N_ERROR;
2363 }
2364
2365 my $tempdir = tempdir( CLEANUP => 1 );
2366 my @files = $zip->memberNames();
2367 for(@files) {
2368 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2369 }
2370 my $countfiles = @files;
2371
2372# Check if we have not more then 2 files
2373
2374 if ( $countfiles == 2){
2375 foreach (@files){
2376 if ( $_ =~ /.conf$/){
2377 $uplconffilename = $_;
2378 }
2379 if ( $_ =~ /.p12$/){
2380 $uplp12name = $_;
2381 }
2382 }
2383 if (($uplconffilename eq '') || ($uplp12name eq '')){
2384 $errormessage = "Either no *.conf or no *.p12 file found\n";
2385 goto N2N_ERROR;
2386 }
2387
2388 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2389 @firen2nconf = <FILE>;
2390 close (FILE);
2391 chomp(@firen2nconf);
2392
2393 } else {
2394
2395 $errormessage = "Filecount does not match only 2 files are allowed\n";
2396 goto N2N_ERROR;
2397 }
2398
7c1d9faf
AH
2399###
2400# m.a.d net2net
ce9abb66 2401###
54fd0535
MT
2402
2403 if ($cgiparams{'n2nname'} ne ''){
2404
2405 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2406 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2407 $n2nname[0] = $cgiparams{'n2nname'};
2408 my @n2nname2 = split(/\./,$uplconffilename);
2409 $n2nname2[0] =~ s/\n|\r//g;
2410 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2411 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2412 my $input2 = "$n2nname2[0]n2n";
2413 my $output2 = "$n2nname[0]n2n";
2414 my $filename = "$tempdir/$uplconffilename";
2415 open(FILE, "< $filename") or die 'Unable to open config file.';
2416 my @current = <FILE>;
2417 close(FILE);
2418 foreach (@current) {s/$input1/$output1/g;}
2419 foreach (@current) {s/$input2/$output2/g;}
2420 open (OUT, "> $filename") || die 'Unable to open config file.';
2421 print OUT @current;
2422 close OUT;
ce9abb66 2423
54fd0535
MT
2424 }else{
2425 $uplconffilename2 = $uplconffilename;
2426 $uplp12name2 = $uplp12name;
2427 @n2nname = split(/\./,$uplconffilename);
ce9abb66 2428 $n2nname[0] =~ s/\n|\r//g;
54fd0535 2429 }
7c1d9faf
AH
2430 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2431 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
ce9abb66 2432
54fd0535 2433 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
ce9abb66
AH
2434
2435 if ($? ne 0) {
2436 $errormessage = "*.conf move failed: $!";
2437 unlink ($filename);
2438 goto N2N_ERROR;
2439 }
2440
54fd0535 2441 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
b278daf3
AH
2442 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2443
ce9abb66
AH
2444 if ($? ne 0) {
2445 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2446 unlink ($filename);
2447 goto N2N_ERROR;
2448 }
2449
2450my $complzoactive;
d96c89eb
AH
2451my $mssfixactive;
2452my $n2nfragment;
60f396d7 2453my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
54fd0535 2454my @n2nproto = split(/-/, $n2nproto2[1]);
ce9abb66
AH
2455my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2456my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2457my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2458if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH
2459my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
2460if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
54fd0535 2461#my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
d96c89eb 2462my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH
2463my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2464my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2465my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
2466my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
54fd0535 2467my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
ce9abb66
AH
2468my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2469
60f396d7 2470
ce9abb66
AH
2471###
2472# m.a.d delete CR and LF from arrays for this chomp doesnt work
2473###
2474
ce9abb66 2475$n2nremote[1] =~ s/\n|\r//g;
ce9abb66
AH
2476$n2novpnsub[0] =~ s/\n|\r//g;
2477$n2novpnsub[1] =~ s/\n|\r//g;
2478$n2novpnsub[2] =~ s/\n|\r//g;
60f396d7 2479$n2nproto[0] =~ s/\n|\r//g;
ce9abb66
AH
2480$n2nport[1] =~ s/\n|\r//g;
2481$n2ntunmtu[1] =~ s/\n|\r//g;
2482$n2nremsub[1] =~ s/\n|\r//g;
b278daf3 2483$n2nremsub[2] =~ s/\n|\r//g;
ce9abb66 2484$n2nlocalsub[2] =~ s/\n|\r//g;
d96c89eb 2485$n2nfragment[1] =~ s/\n|\r//g;
54fd0535 2486$n2nmgmt[2] =~ s/\n|\r//g;
ce9abb66 2487chomp ($complzoactive);
d96c89eb 2488chomp ($mssfixactive);
ce9abb66
AH
2489
2490###
7c1d9faf 2491# m.a.d net2net
ce9abb66
AH
2492###
2493
2494###
2495# Check if there is no other entry with this name
2496###
2497
2498 foreach my $dkey (keys %confighash) {
2499 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2500 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH
2501 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2502 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2503 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
ce9abb66
AH
2504 goto N2N_ERROR;
2505 }
2506 }
2507
d96c89eb
AH
2508###
2509# Check if OpenVPN Subnet is valid
2510###
2511
2512foreach my $dkey (keys %confighash) {
2513 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2514 $errormessage = 'The OpenVPN Subnet is already in use';
b278daf3
AH
2515 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2516 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2517 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH
2518 goto N2N_ERROR;
2519 }
2520 }
2521
2522###
2523# Check im Dest Port is vaild
2524###
2525
2526foreach my $dkey (keys %confighash) {
2527 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2528 $errormessage = 'The OpenVPN Port is already in use';
b278daf3
AH
2529 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2530 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2531 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
d96c89eb
AH
2532 goto N2N_ERROR;
2533 }
2534 }
2535
2536
2537
ce9abb66
AH
2538 $key = &General::findhasharraykey (\%confighash);
2539
2540 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2541 $confighash{$key}[0] = 'off';
2542 $confighash{$key}[1] = $n2nname[0];
2543 $confighash{$key}[2] = $n2nname[0];
2544 $confighash{$key}[3] = 'net';
2545 $confighash{$key}[4] = 'cert';
2546 $confighash{$key}[6] = 'client';
2547 $confighash{$key}[8] = $n2nlocalsub[2];
2548 $confighash{$key}[10] = $n2nremote[1];
b278daf3 2549 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
54fd0535
MT
2550 $confighash{$key}[22] = $n2nmgmt[2];
2551 $confighash{$key}[23] = $mssfixactive;
d96c89eb
AH
2552 $confighash{$key}[24] = $n2nfragment[1];
2553 $confighash{$key}[25] = 'IPFire n2n Client';
ce9abb66
AH
2554 $confighash{$key}[26] = 'red';
2555 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
60f396d7 2556 $confighash{$key}[28] = $n2nproto[0];
ce9abb66
AH
2557 $confighash{$key}[29] = $n2nport[1];
2558 $confighash{$key}[30] = $complzoactive;
2559 $confighash{$key}[31] = $n2ntunmtu[1];
2560
2561
2562 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
d96c89eb 2563
ce9abb66
AH
2564 N2N_ERROR:
2565
2566 &Header::showhttpheaders();
2567 &Header::openpage('Validate imported configuration', 1, '');
2568 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2569 if ($errormessage) {
2570 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2571 print "<class name='base'>$errormessage";
2572 print "&nbsp;</class>";
2573 &Header::closebox();
2574
2575 } else
2576 {
2577 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2578 }
2579 if ($errormessage eq ''){
2580 print <<END
2581 <!-- ipfire net2net config gui -->
2582 <table width='100%'>
2583 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2584 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2585 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2586 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2587 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2588 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2589 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2590 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2591 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2592 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2593 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
7c1d9faf
AH
2594 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
2595 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
ce9abb66 2596 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
54fd0535 2597 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
ce9abb66
AH
2598 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2599 </table>
2600END
2601;
2602 &Header::closebox();
2603 }
2604
2605 if ($errormessage) {
2606 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2607 } else {
2608 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2609 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2610 print "<input type='hidden' name='KEY' value='$key' />";
2611 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2612 }
2613 &Header::closebigbox();
2614 &Header::closepage();
2615 exit(0);
2616
2617
2618##
2619### Accept IPFire n2n Package Settings
2620###
2621
2622 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2623
2624###
2625### Discard and Rollback IPFire n2n Package Settings
2626###
2627
2628 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2629
2630 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2631
2632if ($confighash{$cgiparams{'KEY'}}) {
2633
2634 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2635 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2636 unlink ($certfile) or die "Removing $certfile fail: $!";
2637 unlink ($conffile) or die "Removing $conffile fail: $!";
2638 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2639 delete $confighash{$cgiparams{'KEY'}};
2640 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2641
2642 } else {
2643 $errormessage = $Lang::tr{'invalid key'};
2644 }
2645
2646
2647###
7c1d9faf 2648# m.a.d net2net
ce9abb66
AH
2649###
2650
2651
2652###
2653### Adding a new connection
2654###
6e13d0a5
MT
2655} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2656 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2657 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2658
2659 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2660 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2661 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2662
2663 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
c6c9630e
MT
2664 if (! $confighash{$cgiparams{'KEY'}}[0]) {
2665 $errormessage = $Lang::tr{'invalid key'};
2666 goto VPNCONF_END;
2667 }
2668 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
2669 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
ce9abb66 2670 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
c6c9630e
MT
2671 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
2672 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
2673 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
2674 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
531f0835
AH
2675 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
2676 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
d96c89eb 2677# n2n m.a.d new fields
54fd0535 2678 $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
d96c89eb
AH
2679 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2680 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
c6c9630e
MT
2681 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
2682 $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
2683#new fields
2684 $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
2685 $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28];
2686 $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29];
2687 $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30];
2688 $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31];
d96c89eb 2689
c6c9630e
MT
2690#new fields
2691#ab hiere error uebernehmen
d96c89eb 2692
c6c9630e
MT
2693 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2694 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
18837a6a
AH
2695
2696 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
c6c9630e 2697 $errormessage = $Lang::tr{'connection type is invalid'};
b278daf3
AH
2698 if ($cgiparams{'TYPE'} eq 'net') {
2699 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2700 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2701 }
c6c9630e
MT
2702 goto VPNCONF_ERROR;
2703 }
2704
2705
2706 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
2707 $errormessage = $Lang::tr{'name must only contain characters'};
b278daf3
AH
2708 if ($cgiparams{'TYPE'} eq 'net') {
2709 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2710 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2711 }
2712 goto VPNCONF_ERROR;
2713 }
c6c9630e
MT
2714
2715 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
2716 $errormessage = $Lang::tr{'name is invalid'};
b278daf3
AH
2717 if ($cgiparams{'TYPE'} eq 'net') {
2718 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2719 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2720 }
c6c9630e
MT
2721 goto VPNCONF_ERROR;
2722 }
2723
2724 if (length($cgiparams{'NAME'}) >60) {
2725 $errormessage = $Lang::tr{'name too long'};
b278daf3
AH
2726 if ($cgiparams{'TYPE'} eq 'net') {
2727 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2728 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2729 }
c6c9630e
MT
2730 goto VPNCONF_ERROR;
2731 }
2732
d96c89eb 2733###
7c1d9faf 2734# m.a.d net2net
d96c89eb
AH
2735###
2736
7c1d9faf
AH
2737if ($cgiparams{'TYPE'} eq 'net') {
2738
2739 if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) {
cd0c0a0d 2740 $errormessage = $Lang::tr{'openvpn destination port used'};
b278daf3
AH
2741 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2742 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2743 goto VPNCONF_ERROR;
d96c89eb 2744 }
54fd0535
MT
2745
2746 if ($cgiparams{'DEST_PORT'} eq '') {
2747 $errormessage = $Lang::tr{'openvpn destination port used'};
2748 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2749 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2750 goto VPNCONF_ERROR;
2751 }
d96c89eb
AH
2752
2753 if ($cgiparams{'OVPN_SUBNET'} eq $vpnsettings{'DOVPN_SUBNET'}) {
cd0c0a0d 2754 $errormessage = $Lang::tr{'openvpn subnet is used'};
b278daf3
AH
2755 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2756 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH
2757 goto VPNCONF_ERROR;
2758 }
2759
2760 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
cd0c0a0d 2761 $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
b278daf3
AH
2762 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2763 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH
2764 goto VPNCONF_ERROR;
2765 }
2766
2767 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
cd0c0a0d 2768 $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
b278daf3
AH
2769 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2770 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
d96c89eb
AH
2771 goto VPNCONF_ERROR;
2772 }
d96c89eb 2773
7c1d9faf 2774 if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) {
cd0c0a0d 2775 $errormessage = $Lang::tr{'openvpn prefix local subnet'};
b278daf3
AH
2776 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2777 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2778 goto VPNCONF_ERROR;
7c1d9faf
AH
2779 }
2780
2781 if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) {
cd0c0a0d 2782 $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
b278daf3
AH
2783 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2784 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2785 goto VPNCONF_ERROR;
7c1d9faf
AH
2786 }
2787
2788 if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) {
cd0c0a0d 2789 $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
b278daf3
AH
2790 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2791 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2792 goto VPNCONF_ERROR;
7c1d9faf 2793 }
54fd0535
MT
2794
2795 if ($cgiparams{'OVPN_MGMT'} eq '') {
2796 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
2797 }
2798
7c1d9faf 2799}
d96c89eb 2800
ce9abb66
AH
2801# if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
2802# $errormessage = $Lang::tr{'ipfire side is invalid'};
2803# goto VPNCONF_ERROR;
2804# }
2805
c6c9630e
MT
2806 # Check if there is no other entry with this name
2807 if (! $cgiparams{'KEY'}) {
2808 foreach my $key (keys %confighash) {
2809 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
2810 $errormessage = $Lang::tr{'a connection with this name already exists'};
b278daf3
AH
2811 if ($cgiparams{'TYPE'} eq 'net') {
2812 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2813 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2814 }
c6c9630e 2815 goto VPNCONF_ERROR;
6e13d0a5 2816 }
c6c9630e
MT
2817 }
2818 }
2819
ce9abb66
AH
2820 if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
2821 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
b278daf3
AH
2822 if ($cgiparams{'TYPE'} eq 'net') {
2823 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2824 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2825 }
ce9abb66
AH
2826 goto VPNCONF_ERROR;
2827 }
2828
c6c9630e
MT
2829 if ($cgiparams{'REMOTE'}) {
2830 if (! &General::validip($cgiparams{'REMOTE'})) {
2831 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
2832 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
b278daf3
AH
2833 if ($cgiparams{'TYPE'} eq 'net') {
2834 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2835 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2836 }
c6c9630e 2837 goto VPNCONF_ERROR;
6e13d0a5 2838 } else {
c6c9630e
MT
2839 if (&valid_dns_host($cgiparams{'REMOTE'})) {
2840 $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
b278daf3 2841 if ($cgiparams{'TYPE'} eq 'net') {
60f396d7 2842
b278daf3 2843 }
c6c9630e 2844 }
6e13d0a5 2845 }
c6c9630e
MT
2846 }
2847 }
2848 if ($cgiparams{'TYPE'} ne 'host') {
2849 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
2850 $errormessage = $Lang::tr{'local subnet is invalid'};
b278daf3
AH
2851 if ($cgiparams{'TYPE'} eq 'net') {
2852 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2853 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2854 }
c6c9630e
MT
2855 goto VPNCONF_ERROR;}
2856 }
2857 # Check if there is no other entry without IP-address and PSK
2858 if ($cgiparams{'REMOTE'} eq '') {
2859 foreach my $key (keys %confighash) {
2860 if(($cgiparams{'KEY'} ne $key) &&
2861 ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
2862 $confighash{$key}[10] eq '') {
2863 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
2864 goto VPNCONF_ERROR;
6e13d0a5 2865 }
c6c9630e
MT
2866 }
2867 }
ce9abb66
AH
2868 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
2869 $errormessage = $Lang::tr{'remote subnet is invalid'};
b278daf3
AH
2870 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2871 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2872 goto VPNCONF_ERROR;
ce9abb66 2873 }
c6c9630e
MT
2874
2875 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
2876 $errormessage = $Lang::tr{'invalid input'};
2877 goto VPNCONF_ERROR;
2878 }
2879 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
2880 $errormessage = $Lang::tr{'invalid input'};
2881 goto VPNCONF_ERROR;
2882 }
2883
2884#fixplausi
2885 if ($cgiparams{'AUTH'} eq 'psk') {
2886# if (! length($cgiparams{'PSK'}) ) {
2887# $errormessage = $Lang::tr{'pre-shared key is too short'};
2888# goto VPNCONF_ERROR;
2889# }
2890# if ($cgiparams{'PSK'} =~ /['",&]/) {
2891# $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
2892# goto VPNCONF_ERROR;
2893# }
2894 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
2895 if ($cgiparams{'KEY'}) {
2896 $errormessage = $Lang::tr{'cant change certificates'};
2897 goto VPNCONF_ERROR;
2898 }
2899 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2900 $errormessage = $Lang::tr{'there was no file upload'};
2901 goto VPNCONF_ERROR;
2902 }
2903
2904 # Move uploaded certificate request to a temporary file
2905 (my $fh, my $filename) = tempfile( );
2906 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2907 $errormessage = $!;
2908 goto VPNCONF_ERROR;
2909 }
6e13d0a5 2910
c6c9630e
MT
2911 # Sign the certificate request and move it
2912 # Sign the host certificate request
f6e12093 2913 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
c6c9630e
MT
2914 '-batch', '-notext',
2915 '-in', $filename,
2916 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2917 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
2918 if ($?) {
2919 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2920 unlink ($filename);
2921 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2922 &newcleanssldatabase();
2923 goto VPNCONF_ERROR;
2924 } else {
2925 unlink ($filename);
2926 &deletebackupcert();
2927 }
2928
2929 my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2930 $temp =~ /Subject:.*CN=(.*)[\n]/;
2931 $temp = $1;
2932 $temp =~ s+/Email+, E+;
2933 $temp =~ s/ ST=/ S=/;
2934 $cgiparams{'CERT_NAME'} = $temp;
2935 $cgiparams{'CERT_NAME'} =~ s/,//g;
2936 $cgiparams{'CERT_NAME'} =~ s/\'//g;
2937 if ($cgiparams{'CERT_NAME'} eq '') {
2938 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2939 goto VPNCONF_ERROR;
2940 }
2941 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
2942 if ($cgiparams{'KEY'}) {
2943 $errormessage = $Lang::tr{'cant change certificates'};
2944 goto VPNCONF_ERROR;
2945 }
2946 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2947 $errormessage = $Lang::tr{'there was no file upload'};
2948 goto VPNCONF_ERROR;
2949 }
2950 # Move uploaded certificate to a temporary file
2951 (my $fh, my $filename) = tempfile( );
2952 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2953 $errormessage = $!;
2954 goto VPNCONF_ERROR;
2955 }
2956
2957 # Verify the certificate has a valid CA and move it
2958 my $validca = 0;
2959 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
2960 if ($test =~ /: OK/) {
2961 $validca = 1;
2962 } else {
2963 foreach my $key (keys %cahash) {
2964 $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
2965 if ($test =~ /: OK/) {
2966 $validca = 1;
2967 }
6e13d0a5 2968 }
c6c9630e
MT
2969 }
2970 if (! $validca) {
2971 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
2972 unlink ($filename);
2973 goto VPNCONF_ERROR;
2974 } else {
2975 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2976 if ($? ne 0) {
2977 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2978 unlink ($filename);
2979 goto VPNCONF_ERROR;
6e13d0a5 2980 }
c6c9630e
MT
2981 }
2982
2983 my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2984 $temp =~ /Subject:.*CN=(.*)[\n]/;
2985 $temp = $1;
2986 $temp =~ s+/Email+, E+;
2987 $temp =~ s/ ST=/ S=/;
2988 $cgiparams{'CERT_NAME'} = $temp;
2989 $cgiparams{'CERT_NAME'} =~ s/,//g;
2990 $cgiparams{'CERT_NAME'} =~ s/\'//g;
2991 if ($cgiparams{'CERT_NAME'} eq '') {
2992 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2993 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2994 goto VPNCONF_ERROR;
2995 }
2996 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
2997 if ($cgiparams{'KEY'}) {
2998 $errormessage = $Lang::tr{'cant change certificates'};
2999 goto VPNCONF_ERROR;
3000 }
3001 # Validate input since the form was submitted
3002 if (length($cgiparams{'CERT_NAME'}) >60) {
3003 $errormessage = $Lang::tr{'name too long'};
3004 goto VPNCONF_ERROR;
3005 }
3006 if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3007 $errormessage = $Lang::tr{'invalid input for name'};
3008 goto VPNCONF_ERROR;
3009 }
3010 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3011 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3012 goto VPNCONF_ERROR;
3013 }
3014 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3015 $errormessage = $Lang::tr{'e-mail address too long'};
3016 goto VPNCONF_ERROR;
3017 }
3018 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3019 $errormessage = $Lang::tr{'invalid input for department'};
3020 goto VPNCONF_ERROR;
3021 }
3022 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3023 $errormessage = $Lang::tr{'organization too long'};
3024 goto VPNCONF_ERROR;
3025 }
3026 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3027 $errormessage = $Lang::tr{'invalid input for organization'};
3028 goto VPNCONF_ERROR;
3029 }
3030 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3031 $errormessage = $Lang::tr{'invalid input for city'};
3032 goto VPNCONF_ERROR;
3033 }
3034 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3035 $errormessage = $Lang::tr{'invalid input for state or province'};
3036 goto VPNCONF_ERROR;
3037 }
3038 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3039 $errormessage = $Lang::tr{'invalid input for country'};
3040 goto VPNCONF_ERROR;
3041 }
3042 if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3043 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3044 $errormessage = $Lang::tr{'password too short'};
3045 goto VPNCONF_ERROR;
6e13d0a5 3046 }
c6c9630e
MT
3047 }
3048 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3049 $errormessage = $Lang::tr{'passwords do not match'};
3050 goto VPNCONF_ERROR;
3051 }
3052
3053 # Replace empty strings with a .
3054 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3055 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3056 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3057
3058 # Create the Host certificate request client
3059 my $pid = open(OPENSSL, "|-");
3060 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3061 if ($pid) { # parent
3062 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3063 print OPENSSL "$state\n";
3064 print OPENSSL "$city\n";
3065 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3066 print OPENSSL "$ou\n";
3067 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3068 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3069 print OPENSSL ".\n";
3070 print OPENSSL ".\n";
3071 close (OPENSSL);
3072 if ($?) {
3073 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3074 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3075 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3076 goto VPNCONF_ERROR;
6e13d0a5 3077 }
c6c9630e
MT
3078 } else { # child
3079 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3080 '-newkey', 'rsa:1024',
3081 '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3082 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3083 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3084 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3085 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3086 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3087 goto VPNCONF_ERROR;
6e13d0a5 3088 }
c6c9630e
MT
3089 }
3090
3091 # Sign the host certificate request
f6e12093 3092 system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
c6c9630e
MT
3093 '-batch', '-notext',
3094 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3095 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3096 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3097 if ($?) {
3098 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3099 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3100 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3101 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3102 &newcleanssldatabase();
3103 goto VPNCONF_ERROR;
3104 } else {
3105 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3106 &deletebackupcert();
3107 }
3108
3109 # Create the pkcs12 file
3110 system('/usr/bin/openssl', 'pkcs12', '-export',
3111 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3112 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3113 '-name', $cgiparams{'NAME'},
3114 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3115 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3116 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3117 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3118 if ($?) {
3119 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3120 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3121 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3122 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3123 goto VPNCONF_ERROR;
3124 } else {
3125 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3126 }
3127 } elsif ($cgiparams{'AUTH'} eq 'cert') {
3128 ;# Nothing, just editing
3129 } else {
3130 $errormessage = $Lang::tr{'invalid input for authentication method'};
3131 goto VPNCONF_ERROR;
3132 }
3133
3134 # Check if there is no other entry with this common name
3135 if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3136 foreach my $key (keys %confighash) {
3137 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3138 $errormessage = $Lang::tr{'a connection with this common name already exists'};
3139 goto VPNCONF_ERROR;
6e13d0a5 3140 }
c6c9630e
MT
3141 }
3142 }
3143
3144 # Save the config
3145 my $key = $cgiparams{'KEY'};
3146 if (! $key) {
3147 $key = &General::findhasharraykey (\%confighash);
3148 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3149 }
3150 $confighash{$key}[0] = $cgiparams{'ENABLED'};
3151 $confighash{$key}[1] = $cgiparams{'NAME'};
3152 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3153 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
3154 }
ce9abb66 3155 $confighash{$key}[3] = $cgiparams{'TYPE'};
c6c9630e
MT
3156 if ($cgiparams{'AUTH'} eq 'psk') {
3157 $confighash{$key}[4] = 'psk';
3158 $confighash{$key}[5] = $cgiparams{'PSK'};
3159 } else {
3160 $confighash{$key}[4] = 'cert';
3161 }
ce9abb66
AH
3162 if ($cgiparams{'TYPE'} eq 'net') {
3163 $confighash{$key}[6] = $cgiparams{'SIDE'};
3164 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
3165 }
c6c9630e
MT
3166 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
3167 $confighash{$key}[10] = $cgiparams{'REMOTE'};
54fd0535
MT
3168 if ($cgiparams{'OVPN_MGMT'} eq '') {
3169 $confighash{$key}[22] = $confighash{$key}[29];
3170 } else {
3171 $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
3172 }
d96c89eb 3173 $confighash{$key}[23] = $cgiparams{'MSSFIX'};
d96c89eb 3174 $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
c6c9630e
MT
3175 $confighash{$key}[25] = $cgiparams{'REMARK'};
3176 $confighash{$key}[26] = $cgiparams{'INTERFACE'};
3177# new fields
3178 $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
3179 $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
3180 $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
3181 $confighash{$key}[30] = $cgiparams{'COMPLZO'};
3182 $confighash{$key}[31] = $cgiparams{'MTU'};
3183# new fileds
3184 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
18837a6a
AH
3185
3186###
3187# m.a.d n2n begin
3188###
3189
3190 if ($cgiparams{'TYPE'} eq 'net') {
3191
3192 if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3193 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);