]> git.ipfire.org Git - people/teissler/ipfire-2.x.git/blame - html/cgi-bin/ovpnmain.cgi
projects / people / teissler / ipfire-2.x.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Update of openvpn CGI scripts.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
CommitLineData
6e13d0a5 1#!/usr/bin/perl
70df8302
MT		 2###############################################################################
3# #
4# IPFire.org - A linux based firewall #
5# Copyright (C) 2007 Michael Tremer & Christian Schmidt #
6# #
7# This program is free software: you can redistribute it and/or modify #
8# it under the terms of the GNU General Public License as published by #
9# the Free Software Foundation, either version 3 of the License, or #
10# (at your option) any later version. #
11# #
12# This program is distributed in the hope that it will be useful, #
13# but WITHOUT ANY WARRANTY; without even the implied warranty of #
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15# GNU General Public License for more details. #
16# #
17# You should have received a copy of the GNU General Public License #
18# along with this program. If not, see <http://www.gnu.org/licenses/>. #
19# #
20###############################################################################
6e13d0a5
MT		 21
22use CGI;
23use CGI qw/:standard/;
24use Net::DNS;
ce9abb66 25use Net::Ping;
6e13d0a5
MT		 26use File::Copy;
27use File::Temp qw/ tempfile tempdir /;
28use strict;
29use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
6e13d0a5 30require '/var/ipfire/general-functions.pl';
6e13d0a5
MT		 31require "${General::swroot}/lang.pl";
32require "${General::swroot}/header.pl";
33require "${General::swroot}/countries.pl";
34
35# enable only the following on debugging purpose
ce9abb66
AH		 36use warnings;
37use CGI::Carp 'fatalsToBrowser';
6e13d0a5
MT		 38#workaround to suppress a warning when a variable is used only once
39my @dummy = ( ${Header::colourgreen} );
40undef (@dummy);
41
f2fdd0c1
CS		 42my %color = ();
43my %mainsettings = ();
44&General::readhash("${General::swroot}/main/settings", \%mainsettings);
45&General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
6e13d0a5
MT		 46
47###
48### Initialize variables
49###
50my %netsettings=();
51my %cgiparams=();
52my %vpnsettings=();
53my %checked=();
54my %confighash=();
55my %cahash=();
56my %selected=();
57my $warnmessage = '';
58my $errormessage = '';
59my %settings=();
6e13d0a5
MT		 60&General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
61$cgiparams{'ENABLED'} = 'off';
62$cgiparams{'ENABLED_BLUE'} = 'off';
63$cgiparams{'ENABLED_ORANGE'} = 'off';
64$cgiparams{'EDIT_ADVANCED'} = 'off';
65$cgiparams{'NAT'} = 'off';
66$cgiparams{'COMPRESSION'} = 'off';
67$cgiparams{'ONLY_PROPOSED'} = 'off';
68$cgiparams{'ACTION'} = '';
69$cgiparams{'CA_NAME'} = '';
70$cgiparams{'DHCP_DOMAIN'} = '';
71$cgiparams{'DHCP_DNS'} = '';
72$cgiparams{'DHCP_WINS'} = '';
73$cgiparams{'DCOMPLZO'} = 'off';
a79fa1d6
JPT		 74$cgiparams{'MSSFIX'} = '';
75
ce9abb66 76
6e13d0a5
MT		 77&Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
78
79# prepare openvpn config file
80###
81### Useful functions
82###
c6c9630e
MT		 83sub haveOrangeNet
84{
13211b21
CS		 85 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
86 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT		 87 return 0;
88}
89
90sub haveBlueNet
91{
13211b21 92 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
c6c9630e 93 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
c6c9630e
MT		 94 return 0;
95}
96
97sub sizeformat{
98 my $bytesize = shift;
99 my $i = 0;
100
101 while(abs($bytesize) >= 1024){
102 $bytesize=$bytesize/1024;
103 $i++;
104 last if($i==6);
105 }
106
107 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
108 my $newsize=(int($bytesize*100 +0.5))/100;
109 return("$newsize $units[$i]");
110}
111
112sub valid_dns_host {
113 my $hostname = $_[0];
114 unless ($hostname) { return "No hostname"};
115 my $res = new Net::DNS::Resolver;
116 my $query = $res->search("$hostname");
117 if ($query) {
118 foreach my $rr ($query->answer) {
119 ## Potential bug - we are only looking at A records:
120 return 0 if $rr->type eq "A";
121 }
122 } else {
123 return $res->errorstring;
124 }
125}
126
127sub cleanssldatabase
128{
129 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
130 print FILE "01";
131 close FILE;
132 }
133 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
134 print FILE "";
135 close FILE;
136 }
137 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
138 unlink ("${General::swroot}/ovpn/certs/serial.old");
139 unlink ("${General::swroot}/ovpn/certs/01.pem");
140}
141
142sub newcleanssldatabase
143{
144 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
145 open(FILE, ">${General::swroot}(ovpn/certs/serial");
146 print FILE "01";
147 close FILE;
148 }
149 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
150 system ("touch ${General::swroot}/ovpn/certs/index.txt");
151 }
152 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
153 unlink ("${General::swroot}/ovpn/certs/serial.old");
154}
155
156sub deletebackupcert
157{
158 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
159 my $hexvalue = <FILE>;
160 chomp $hexvalue;
161 close FILE;
162 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
163 }
164}
165
166sub checkportfw {
167 my $KEY2 = $_[0]; # key2
168 my $SRC_PORT = $_[1]; # src_port
169 my $PROTOCOL = $_[2]; # protocol
170 my $SRC_IP = $_[3]; # sourceip
171
172 my $pfwfilename = "${General::swroot}/portfw/config";
173 open(FILE, $pfwfilename) or die 'Unable to open config file.';
174 my @pfwcurrent = <FILE>;
175 close(FILE);
176 my $pfwkey1 = 0; # used for finding last sequence number used
177 foreach my $pfwline (@pfwcurrent)
178 {
179 my @pfwtemp = split(/\,/,$pfwline);
180
181 chomp ($pfwtemp[8]);
182 if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
183 if ( $SRC_PORT eq $pfwtemp[3] &&
184 $PROTOCOL eq $pfwtemp[2] &&
185 $SRC_IP eq $pfwtemp[7])
186 {
187 $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
188 }
189 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
190 if ( $pfwtemp[1] eq "0") {
191 $pfwkey1=$pfwtemp[0];
192 }
193 # Darren Critchley - Duplicate or overlapping Port range check
194 if ($pfwtemp[1] eq "0" &&
195 $PROTOCOL eq $pfwtemp[2] &&
196 $SRC_IP eq $pfwtemp[7] &&
197 $errormessage eq '')
198 {
199 &portchecks($SRC_PORT, $pfwtemp[5]);
200# &portchecks($pfwtemp[3], $pfwtemp[5]);
201# &portchecks($pfwtemp[3], $SRC_IP);
202 }
203 }
204 }
205# $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
206
207 return;
208}
209
210sub checkportoverlap
211{
212 my $portrange1 = $_[0]; # New port range
213 my $portrange2 = $_[1]; # existing port range
214 my @tempr1 = split(/\:/,$portrange1);
215 my @tempr2 = split(/\:/,$portrange2);
216
217 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
218 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
219
220 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
221 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
222
223 return 1; # Everything checks out!
224}
225
226# Darren Critchley - we want to make sure that a port entry is not within an already existing range
227sub checkportinc
228{
229 my $port1 = $_[0]; # Port
230 my $portrange2 = $_[1]; # Port range
231 my @tempr1 = split(/\:/,$portrange2);
232
233 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
234 return 1;
235 } else {
236 return 0;
237 }
238}
239# Darren Critchley - Duplicate or overlapping Port range check
240sub portchecks
241{
242 my $p1 = $_[0]; # New port range
243 my $p2 = $_[1]; # existing port range
244# $_ = $_[0];
245 our ($prtrange1, $prtrange2);
246 $prtrange1 = 0;
247# if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
248# unless (&checkportoverlap($p1,$p2)) {
249# $errormessage = "$Lang::tr{'source port overlaps'} $p1";
250# }
251# }
252 if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
253 unless (&checkportinc($p2,$p1)) {
254 $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
255 }
256 }
257 $prtrange1 = 1;
258 if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
259 unless (&checkportinc($p1,$p2)) {
260 $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
261 }
262 }
263 return;
264}
265
266# Darren Critchley - certain ports are reserved for IPFire
267# TCP 67,68,81,222,445
268# UDP 67,68
269# Params passed in -> port, rangeyn, protocol
270sub disallowreserved
271{
272 # port 67 and 68 same for tcp and udp, don't bother putting in an array
273 my $msg = "";
274 my @tcp_reserved = (81,222,445);
275 my $prt = $_[0]; # the port or range
276 my $ryn = $_[1]; # tells us whether or not it is a port range
277 my $prot = $_[2]; # protocol
278 my $srcdst = $_[3]; # source or destination
279 if ($ryn) { # disect port range
280 if ($srcdst eq "src") {
281 $msg = "$Lang::tr{'rsvd src port overlap'}";
282 } else {
283 $msg = "$Lang::tr{'rsvd dst port overlap'}";
284 }
285 my @tmprng = split(/\:/,$prt);
286 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
287 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
288 if ($prot eq "tcp") {
289 foreach my $prange (@tcp_reserved) {
290 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
291 }
292 }
293 } else {
294 if ($srcdst eq "src") {
295 $msg = "$Lang::tr{'reserved src port'}";
296 } else {
297 $msg = "$Lang::tr{'reserved dst port'}";
298 }
299 if ($prt == 67) { $errormessage="$msg 67"; return; }
300 if ($prt == 68) { $errormessage="$msg 68"; return; }
301 if ($prot eq "tcp") {
302 foreach my $prange (@tcp_reserved) {
303 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
304 }
305 }
306 }
307 return;
308}
309
310sub writeserverconf {
311 my %sovpnsettings = ();
312 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
313
314 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
315 flock CONF, 2;
316 print CONF "#OpenVPN Server conf\n";
317 print CONF "\n";
318 print CONF "daemon openvpnserver\n";
319 print CONF "writepid /var/run/openvpn.pid\n";
afabe9f7 320 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
c6c9630e
MT		 321 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
322 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
323 print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
324 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
325 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
2b29c22e 326 print CONF "script-security 3 system\n";
07675dc3 327 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
c6c9630e
MT		 328 print CONF "tls-server\n";
329 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
330 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
331 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
332 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
333 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
334 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
335 print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
336 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
337 print CONF "client-to-client\n";
338 }
a79fa1d6
JPT		 339 if ($sovpnsettings{MSSFIX} eq 'on') {
340 print CONF "mssfix\n";
341 }
74225cce 342 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
a79fa1d6
JPT		 343 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
344 }
c6c9630e
MT		 345 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
346 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
347 }
348 print CONF "status-version 1\n";
4e17adad 349 print CONF "status /var/log/ovpnserver.log 30\n";
c6c9630e
MT		 350 print CONF "cipher $sovpnsettings{DCIPHER}\n";
351 if ($sovpnsettings{DCOMPLZO} eq 'on') {
352 print CONF "comp-lzo\n";
353 }
354 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
355 print CONF "push \"redirect-gateway def1\"\n";
356 }
357 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
358 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
359 }
360
361 if ($sovpnsettings{DHCP_DNS} ne '') {
362 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
363 }
364
365 if ($sovpnsettings{DHCP_WINS} ne '') {
366 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
367 }
368
369 if ($sovpnsettings{DHCP_WINS} eq '') {
370 print CONF "max-clients 100\n";
a79fa1d6 371 }
c6c9630e
MT		 372 if ($sovpnsettings{DHCP_WINS} ne '') {
373 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
374 }
375 print CONF "tls-verify /var/ipfire/ovpn/verify\n";
376 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
377 print CONF "user nobody\n";
378 print CONF "group nobody\n";
379 print CONF "persist-key\n";
380 print CONF "persist-tun\n";
381 if ($sovpnsettings{LOG_VERB} ne '') {
382 print CONF "verb $sovpnsettings{LOG_VERB}\n";
383 } else {
384 print CONF "verb 3\n";
385 }
386 print CONF "\n";
387
388 close(CONF);
389}
390#
391sub emptyserverlog{
4e17adad 392 if (open(FILE, ">/var/log/ovpnserver.log")) {
c6c9630e
MT		 393 flock FILE, 2;
394 print FILE "";
395 close FILE;
396 }
397
398}
399
400#hier die refresh page
401if ( -e "${General::swroot}/ovpn/gencanow") {
402 my $refresh = '';
403 $refresh = "<meta http-equiv='refresh' content='15;' />";
404 &Header::showhttpheaders();
405 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
406 &Header::openbigbox('100%', 'center');
407 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
408 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
409 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
410 &Header::closebox();
411 &Header::closebigbox();
412 &Header::closepage();
413 exit (0);
414}
415##hier die refresh page
416
6e13d0a5
MT		 417
418###
419### OpenVPN Server Control
420###
421if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
422 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
423 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
6e13d0a5
MT		 424 #start openvpn server
425 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
c6c9630e 426 &emptyserverlog();
6e13d0a5
MT		 427 system('/usr/local/bin/openvpnctrl', '-s');
428 }
429 #stop openvpn server
430 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
6e13d0a5 431 system('/usr/local/bin/openvpnctrl', '-k');
c6c9630e 432 &emptyserverlog();
6e13d0a5
MT		 433 }
434# #restart openvpn server
435 if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
436#workarund, till SIGHUP also works when running as nobody
c6c9630e
MT		 437 system('/usr/local/bin/openvpnctrl', '-r');
438 &emptyserverlog();
6e13d0a5
MT		 439 }
440}
441
442###
443### Save Advanced options
444###
445
446if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
447 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
448 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
449 #DAN this value has to leave.
450#new settings for daemon
451 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
452 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
453 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
454 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
455 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
456 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
457 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
458 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
459 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
6e13d0a5 460
a79fa1d6
JPT		 461 if ($cgiparams{'FRAGMENT'} eq '') {
462 delete $vpnsettings{'FRAGMENT'};
463 } else {
464 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
465 $errormessage = "Incorrect value, please insert only numbers.";
466 goto ADV_ERROR;
467 } else {
468 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
469 }
470 }
471 if ($cgiparams{'MSSFIX'} ne 'on') {
472 delete $vpnsettings{'MSSFIX'};
473 } else {
474 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
475 }
6e13d0a5
MT		 476 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
477 unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
478 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
479 goto ADV_ERROR;
480 }
481 }
482 if ($cgiparams{'DHCP_DNS'} ne ''){
483 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
484 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
485 goto ADV_ERROR;
486 }
487 }
488 if ($cgiparams{'DHCP_WINS'} ne ''){
489 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
490 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
491 goto ADV_ERROR;
492 }
493 }
6e13d0a5
MT		 494 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
495 $errormessage = $Lang::tr{'invalid input for max clients'};
496 goto ADV_ERROR;
497 }
498 if ($cgiparams{'KEEPALIVE_1'} ne '') {
499 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
500 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
501 goto ADV_ERROR;
502 }
503 }
504 if ($cgiparams{'KEEPALIVE_2'} ne ''){
505 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
506 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
507 goto ADV_ERROR;
508 }
509 }
510 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
511 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
512 goto ADV_ERROR;
513 }
514
515 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 516 &writeserverconf();#hier ok
6e13d0a5
MT		 517}
518
ce9abb66
AH		 519###
520# m.a.d Save net2net server config
521###
522
523if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
524{
c6c9630e 525
ce9abb66
AH		 526my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
527my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
528my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]";
d96c89eb 529my $tunmtu = '';
531f0835
AH		 530
531unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
532unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH		 533
534 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
535
536 flock SERVERCONF, 2;
537 print SERVERCONF "# n2n Open VPN Server Config by ummeegge und m.a.d\n";
538 print SERVERCONF "\n";
539 print SERVERCONF "# User Sicherheit\n";
540 print SERVERCONF "user nobody\n";
541 print SERVERCONF "group nobody\n";
542 print SERVERCONF "persist-tun\n";
543 print SERVERCONF "persist-key\n";
544 print SERVERCONF "\n";
545 print SERVERCONF "# IP/DNS fuer das Server Gateway - g2g Mode\n";
546 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
547 print SERVERCONF "\n";
548 print SERVERCONF "# IP Adressen des VPN Tunnels\n";
549 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
550 print SERVERCONF "\n";
551 print SERVERCONF "# Netzwerk auf dem Client Gateway\n";
552 print SERVERCONF "route @remsubnet[0] @remsubnet[1]\n";
553 print SERVERCONF "# Device fuer den Tunnel\n";
554 print SERVERCONF "dev tun\n";
555 print SERVERCONF "\n";
556 print SERVERCONF "#Port und Protokoll\n";
557 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
558 print SERVERCONF "proto $cgiparams{'PROTOCOL'}\n";
559 print SERVERCONF "\n";
560 print SERVERCONF "# Paketgroessen\n";
d96c89eb 561 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
ce9abb66 562 print SERVERCONF "tun-mtu $tunmtu\n";
d96c89eb
AH		 563 if ($cgiparams{'PROTOCOL'} eq 'udp') {
564 if ($cgiparams{'FRAGMENT'} eq '') {
565 print SERVERCONF "fragment 1300\r\n";
566 } else {
567 print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n"
568 }
569 if ($cgiparams{'MSSFIX'} eq 'on') {
ce9abb66 570 print SERVERCONF "mssfix\n";
d96c89eb
AH		 571 }
572 }
ce9abb66
AH		 573 print SERVERCONF "\n";
574 print SERVERCONF "# Auth Server\n";
575 print SERVERCONF "tls-server\n";
576 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
577 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
578 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
579 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
580 print SERVERCONF "\n";
581 print SERVERCONF "# Verschluesselung\n";
582 print SERVERCONF "cipher AES-256-CBC\n";
583 if ($cgiparams{'COMPLZO'} eq 'on') {
584 print SERVERCONF "# Kompression einschalten\n";
585 print SERVERCONF "comp-lzo\r\n";
586 print SERVERCONF "#\n";
587 }
588 print SERVERCONF "# Debug Level setzen\n";
589 print SERVERCONF "verb 3\n";
590 print SERVERCONF "\n";
591 print SERVERCONF "# Tunnel Ueberwachung\n";
592 print SERVERCONF "keepalive 10 60\n";
593 print SERVERCONF "\n";
594 print SERVERCONF "# Als Daemon starten mit Namen ovpnn2n\n";
595 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
596 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
597 print SERVERCONF "\n";
598 print SERVERCONF "# Management Interface aktivieren\n";
599 print SERVERCONF "#management localhost 4711\n";
600 close(SERVERCONF);
601
602}
603
604###
605# m.a.d Save net2net client config
606###
607if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
608{
609 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
610 my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]";
611 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
d96c89eb
AH		 612 my $tunmtu = '';
613
531f0835
AH		 614unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
615unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
ce9abb66
AH		 616
617 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
618
619 flock CLIENTCONF, 2;
620 print CLIENTCONF "# rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
621 print CLIENTCONF "#\n";
622 print CLIENTCONF "# User Sicherheit\n";
623 print CLIENTCONF "user nobody\n";
624 print CLIENTCONF "group nobody\n";
625 print CLIENTCONF "persist-tun\n";
626 print CLIENTCONF "persist-key\n";
627 print CLIENTCONF "#\n";
628 print CLIENTCONF "# IP/DNS fuer das Server Gateway - g2g Mode\n";
629 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
630 print CLIENTCONF "#\n";
631 print CLIENTCONF "# IP Adressen des VPN Tunnels\n";
632 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
633 print CLIENTCONF "#\n";
634 print CLIENTCONF "# Netzwerk auf dem Server Gateway\n";
635 print CLIENTCONF "route @remsubnet[0]/@remsubnet[1]\n";
636 print CLIENTCONF "# Device fuer den Tunnel\n";
637 print CLIENTCONF "dev tun\n";
638 print CLIENTCONF "#\n";
639 print CLIENTCONF "#Port und Protokoll\n";
640 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
641 print CLIENTCONF "proto $cgiparams{'PROTOCOL'}\n";
642 print CLIENTCONF "#\n";
643 print CLIENTCONF "# Paketgroessen\n";
d96c89eb 644 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
ce9abb66 645 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb
AH		 646 if ($cgiparams{'PROTOCOL'} eq 'udp') {
647 if ($cgiparams{'FRAGMENT'} eq '') {
648 print CLIENTCONF "fragment 1300\r\n";
649 } else {
650 print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n"
651 }
652 if ($cgiparams{'MSSFIX'} eq 'on') {
ce9abb66 653 print CLIENTCONF "mssfix\n";
d96c89eb
AH		 654 }
655 }
ce9abb66
AH		 656 print CLIENTCONF "#\n";
657 print CLIENTCONF "# Auth. Client\n";
658 print CLIENTCONF "tls-client\n";
659 print CLIENTCONF "#\n";
660 print CLIENTCONF "# Verschluesselung\n";
661 print CLIENTCONF "cipher AES-256-CBC\n";
662 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
663 print CLIENTCONF "#\n";
664 if ($cgiparams{'COMPLZO'} eq 'on') {
665 print CLIENTCONF "# Kompression einschalten\n";
666 print CLIENTCONF "comp-lzo\r\n";
667 print CLIENTCONF "#\n";
668 }
669 print CLIENTCONF "#\n";
670 print CLIENTCONF "# Debug Level\n";
671 print CLIENTCONF "verb 3\n";
672 print CLIENTCONF "#\n";
673 print CLIENTCONF "# Tunnel Ueberwachung\n";
674 print CLIENTCONF "keepalive 10 60\n";
675 print CLIENTCONF "#\n";
676 print CLIENTCONF "# Als Daemon starten\n";
677 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
678 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
679 print CLIENTCONF "#\n";
680 print CLIENTCONF "# Management Interface aktivieren\n";
681 print CLIENTCONF "# management localhost 4711\n";
682 close(CLIENTCONF);
c6c9630e 683
ce9abb66
AH		 684}
685
686###
687# m.a.d Save net2net config end
688###
c6c9630e 689
6e13d0a5
MT		 690###
691### Save main settings
692###
ce9abb66
AH		 693
694
6e13d0a5
MT		 695if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
696 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5
MT		 697 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
698 #DAN this value has to leave.
699 if ($cgiparams{'ENABLED'} eq 'on'){
700 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
701 $errormessage = $Lang::tr{'invalid input for hostname'};
c6c9630e 702 goto SETTINGS_ERROR;
6e13d0a5
MT		 703 }
704 }
705 if ($cgiparams{'ENABLED'} eq 'on'){
c6c9630e 706 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
6e13d0a5
MT		 707 }
708 if ($errormessage) { goto SETTINGS_ERROR; }
709
710
711 if ($cgiparams{'ENABLED'} eq 'on'){
c6c9630e 712 &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
6e13d0a5
MT		 713 }
714
715 if ($errormessage) { goto SETTINGS_ERROR; }
716
717 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
c6c9630e
MT		 718 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
719 goto SETTINGS_ERROR;
720 }
721 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
722
723 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
724 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
725 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
726 goto SETTINGS_ERROR;
727 }
728
729 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
730 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
731 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
732 goto SETTINGS_ERROR;
733 }
734
735 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
736 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
737 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
738 goto SETTINGS_ERROR;
739 }
740
741 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
742 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
743 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
744 goto SETTINGS_ERROR;
745 }
746 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
747 while (<ALIASES>)
748 {
749 chomp($_);
750 my @tempalias = split(/\,/,$_);
751 if ($tempalias[1] eq 'on') {
752 if (&General::IpInSubnet ($tempalias[0] ,
753 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
754 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
755 }
756 }
757 }
758 close(ALIASES);
6e13d0a5 759 if ($errormessage ne ''){
c6c9630e 760 goto SETTINGS_ERROR;
6e13d0a5
MT		 761 }
762 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
763 $errormessage = $Lang::tr{'invalid input'};
764 goto SETTINGS_ERROR;
765 }
766 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
767 $errormessage = $Lang::tr{'invalid mtu input'};
768 goto SETTINGS_ERROR;
769 }
770
771 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
c6c9630e
MT		 772 $errormessage = $Lang::tr{'invalid port'};
773 goto SETTINGS_ERROR;
6e13d0a5 774 }
6e13d0a5
MT		 775 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
776 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
777 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
778 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
779#new settings for daemon
780 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
781 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
782 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
783 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
784 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
785 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
786 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
3ffee04b
CS		 787#wrtie enable
788
789 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
790 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
791 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
6e13d0a5
MT		 792#new settings for daemon
793 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
c6c9630e 794 &writeserverconf();#hier ok
6e13d0a5
MT		 795SETTINGS_ERROR:
796###
797### Reset all step 2
798###
799}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
800 my $file = '';
801 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
802
803 foreach my $key (keys %confighash) {
c6c9630e
MT		 804 if ($confighash{$key}[4] eq 'cert') {
805 delete $confighash{$cgiparams{'$key'}};
806 }
6e13d0a5
MT		 807 }
808 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
c6c9630e 809 unlink $file
6e13d0a5
MT		 810 }
811 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
c6c9630e 812 unlink $file
6e13d0a5
MT		 813 }
814 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
c6c9630e 815 unlink $file
6e13d0a5 816 }
c6c9630e 817 &cleanssldatabase();
6e13d0a5
MT		 818 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
819 print FILE "";
820 close FILE;
821 }
822 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 823 #&writeserverconf();
6e13d0a5
MT		 824###
825### Reset all step 1
826###
827}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
828 &Header::showhttpheaders();
829 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
830 &Header::openbigbox('100%', 'LEFT', '', '');
831 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
832 print <<END
833 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
834 <tr><td align='center'>
835 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
836 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
837 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
838 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
839 </form></table>
840END
841 ;
842 &Header::closebox();
843 &Header::closebigbox();
844 &Header::closepage();
845 exit (0);
846
847###
848### Upload CA Certificate
849###
850} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
851 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
852
853 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
854 $errormessage = $Lang::tr{'name must only contain characters'};
855 goto UPLOADCA_ERROR;
856 }
857
858 if (length($cgiparams{'CA_NAME'}) >60) {
859 $errormessage = $Lang::tr{'name too long'};
860 goto VPNCONF_ERROR;
861 }
862
863 if ($cgiparams{'CA_NAME'} eq 'ca') {
864 $errormessage = $Lang::tr{'name is invalid'};
865 goto UPLOAD_CA_ERROR;
866 }
867
868 # Check if there is no other entry with this name
869 foreach my $key (keys %cahash) {
c6c9630e
MT		 870 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
871 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
872 goto UPLOADCA_ERROR;
873 }
6e13d0a5
MT		 874 }
875
876 if (ref ($cgiparams{'FH'}) ne 'Fh') {
c6c9630e
MT		 877 $errormessage = $Lang::tr{'there was no file upload'};
878 goto UPLOADCA_ERROR;
6e13d0a5
MT		 879 }
880 # Move uploaded ca to a temporary file
881 (my $fh, my $filename) = tempfile( );
882 if (copy ($cgiparams{'FH'}, $fh) != 1) {
c6c9630e
MT		 883 $errormessage = $!;
884 goto UPLOADCA_ERROR;
6e13d0a5
MT		 885 }
886 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
c6c9630e
MT		 887 if ($temp !~ /CA:TRUE/i) {
888 $errormessage = $Lang::tr{'not a valid ca certificate'};
889 unlink ($filename);
890 goto UPLOADCA_ERROR;
6e13d0a5 891 } else {
c6c9630e
MT		 892 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
893 if ($? ne 0) {
894 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
895 unlink ($filename);
896 goto UPLOADCA_ERROR;
897 }
6e13d0a5
MT		 898 }
899
900 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
901 $casubject =~ /Subject: (.*)[\n]/;
902 $casubject = $1;
903 $casubject =~ s+/Email+, E+;
904 $casubject =~ s/ ST=/ S=/;
905 $casubject = &Header::cleanhtml($casubject);
906
907 my $key = &General::findhasharraykey (\%cahash);
908 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
909 $cahash{$key}[1] = $casubject;
910 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e
MT		 911# system('/usr/local/bin/ipsecctrl', 'R');
912
6e13d0a5
MT		 913 UPLOADCA_ERROR:
914
915###
916### Display ca certificate
917###
918} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
c6c9630e
MT		 919 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
920
921 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
922 &Header::showhttpheaders();
923 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
924 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
925 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
926 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
927 $output = &Header::cleanhtml($output,"y");
928 print "<pre>$output</pre>\n";
929 &Header::closebox();
930 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
931 &Header::closebigbox();
932 &Header::closepage();
933 exit(0);
934 } else {
935 $errormessage = $Lang::tr{'invalid key'};
936 }
937
6e13d0a5
MT		 938###
939### Download ca certificate
940###
941} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
942 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
943
944 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
945 print "Content-Type: application/octet-stream\r\n";
946 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
947 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
948 exit(0);
949 } else {
950 $errormessage = $Lang::tr{'invalid key'};
951 }
952
953###
954### Remove ca certificate (step 2)
955###
956} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
957 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
958 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
959
960 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
961 foreach my $key (keys %confighash) {
962 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
963 if ($test =~ /: OK/) {
c6c9630e
MT		 964 # Delete connection
965# if ($vpnsettings{'ENABLED'} eq 'on' ||
966# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
967# system('/usr/local/bin/ipsecctrl', 'D', $key);
968# }
6e13d0a5
MT		 969 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
970 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
971 delete $confighash{$key};
972 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 973# &writeipsecfiles();
6e13d0a5
MT		 974 }
975 }
976 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
977 delete $cahash{$cgiparams{'KEY'}};
978 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
c6c9630e 979# system('/usr/local/bin/ipsecctrl', 'R');
6e13d0a5
MT		 980 } else {
981 $errormessage = $Lang::tr{'invalid key'};
982 }
983###
984### Remove ca certificate (step 1)
985###
986} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
987 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
988 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
989
990 my $assignedcerts = 0;
991 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
992 foreach my $key (keys %confighash) {
993 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
994 if ($test =~ /: OK/) {
995 $assignedcerts++;
996 }
997 }
998 if ($assignedcerts) {
999 &Header::showhttpheaders();
1000 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1001 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1002 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1003 print <<END
1004 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1005 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1006 <tr><td align='center'>
1007 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1008 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1009 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1010 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1011 </form></table>
1012END
1013 ;
1014 &Header::closebox();
1015 &Header::closebigbox();
1016 &Header::closepage();
1017 exit (0);
1018 } else {
1019 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1020 delete $cahash{$cgiparams{'KEY'}};
1021 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1022# system('/usr/local/bin/ipsecctrl', 'R');
1023 }
1024 } else {
1025 $errormessage = $Lang::tr{'invalid key'};
1026 }
1027
1028###
1029### Display root certificate
1030###
c6c9630e
MT		 1031}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1032 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1033 my $output;
1034 &Header::showhttpheaders();
1035 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1036 &Header::openbigbox('100%', 'LEFT', '', '');
1037 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1038 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1039 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1040 } else {
1041 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1042 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1043 }
1044 $output = &Header::cleanhtml($output,"y");
1045 print "<pre>$output</pre>\n";
1046 &Header::closebox();
1047 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1048 &Header::closebigbox();
1049 &Header::closepage();
1050 exit(0);
1051
6e13d0a5
MT		 1052###
1053### Download root certificate
1054###
1055}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1056 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1057 print "Content-Type: application/octet-stream\r\n";
1058 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1059 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1060 exit(0);
1061 }
1062
1063###
1064### Download host certificate
1065###
1066}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1067 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1068 print "Content-Type: application/octet-stream\r\n";
1069 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1070 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1071 exit(0);
1072 }
1073###
1074### Form for generating a root certificate
1075###
1076}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1077 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1078
1079 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1080 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1081 $errormessage = $Lang::tr{'valid root certificate already exists'};
1082 $cgiparams{'ACTION'} = '';
1083 goto ROOTCERT_ERROR;
1084 }
1085
1086 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1087 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1088 my $ipaddr = <IPADDR>;
1089 close IPADDR;
1090 chomp ($ipaddr);
1091 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1092 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1093 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1094 }
1095 }
1096 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1097
1098 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1099 $errormessage = $Lang::tr{'there was no file upload'};
1100 goto ROOTCERT_ERROR;
1101 }
1102
1103 # Move uploaded certificate request to a temporary file
1104 (my $fh, my $filename) = tempfile( );
1105 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1106 $errormessage = $!;
1107 goto ROOTCERT_ERROR;
1108 }
1109
1110 # Create a temporary dirctory
1111 my $tempdir = tempdir( CLEANUP => 1 );
1112
1113 # Extract the CA certificate from the file
1114 my $pid = open(OPENSSL, "|-");
1115 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1116 if ($pid) { # parent
1117 if ($cgiparams{'P12_PASS'} ne '') {
1118 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1119 }
1120 close (OPENSSL);
1121 if ($?) {
1122 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1123 unlink ($filename);
1124 goto ROOTCERT_ERROR;
1125 }
1126 } else { # child
1127 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1128 '-in', $filename,
1129 '-out', "$tempdir/cacert.pem")) {
1130 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1131 unlink ($filename);
1132 goto ROOTCERT_ERROR;
1133 }
1134 }
1135
1136 # Extract the Host certificate from the file
1137 $pid = open(OPENSSL, "|-");
1138 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1139 if ($pid) { # parent
1140 if ($cgiparams{'P12_PASS'} ne '') {
1141 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1142 }
1143 close (OPENSSL);
1144 if ($?) {
1145 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1146 unlink ($filename);
1147 goto ROOTCERT_ERROR;
1148 }
1149 } else { # child
1150 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1151 '-in', $filename,
1152 '-out', "$tempdir/hostcert.pem")) {
1153 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1154 unlink ($filename);
1155 goto ROOTCERT_ERROR;
1156 }
1157 }
1158
1159 # Extract the Host key from the file
1160 $pid = open(OPENSSL, "|-");
1161 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1162 if ($pid) { # parent
1163 if ($cgiparams{'P12_PASS'} ne '') {
1164 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1165 }
1166 close (OPENSSL);
1167 if ($?) {
1168 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1169 unlink ($filename);
1170 goto ROOTCERT_ERROR;
1171 }
1172 } else { # child
1173 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1174 '-nodes',
1175 '-in', $filename,
1176 '-out', "$tempdir/serverkey.pem")) {
1177 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1178 unlink ($filename);
1179 goto ROOTCERT_ERROR;
1180 }
1181 }
1182
1183 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1184 if ($? ne 0) {
1185 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1186 unlink ($filename);
1187 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1188 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1189 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1190 goto ROOTCERT_ERROR;
1191 }
1192
1193 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1194 if ($? ne 0) {
1195 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1196 unlink ($filename);
1197 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1198 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1199 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1200 goto ROOTCERT_ERROR;
1201 }
1202
1203 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1204 if ($? ne 0) {
1205 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1206 unlink ($filename);
1207 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1208 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1209 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1210 goto ROOTCERT_ERROR;
1211 }
1212
1213 goto ROOTCERT_SUCCESS;
1214
1215 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1216
1217 # Validate input since the form was submitted
1218 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1219 $errormessage = $Lang::tr{'organization cant be empty'};
1220 goto ROOTCERT_ERROR;
1221 }
1222 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1223 $errormessage = $Lang::tr{'organization too long'};
1224 goto ROOTCERT_ERROR;
1225 }
1226 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1227 $errormessage = $Lang::tr{'invalid input for organization'};
1228 goto ROOTCERT_ERROR;
1229 }
1230 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1231 $errormessage = $Lang::tr{'hostname cant be empty'};
1232 goto ROOTCERT_ERROR;
1233 }
1234 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1235 $errormessage = $Lang::tr{'invalid input for hostname'};
1236 goto ROOTCERT_ERROR;
1237 }
1238 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1239 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1240 goto ROOTCERT_ERROR;
1241 }
1242 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1243 $errormessage = $Lang::tr{'e-mail address too long'};
1244 goto ROOTCERT_ERROR;
1245 }
1246 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1247 $errormessage = $Lang::tr{'invalid input for department'};
1248 goto ROOTCERT_ERROR;
1249 }
1250 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1251 $errormessage = $Lang::tr{'invalid input for city'};
1252 goto ROOTCERT_ERROR;
1253 }
1254 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1255 $errormessage = $Lang::tr{'invalid input for state or province'};
1256 goto ROOTCERT_ERROR;
1257 }
1258 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1259 $errormessage = $Lang::tr{'invalid input for country'};
1260 goto ROOTCERT_ERROR;
1261 }
1262
1263 # Copy the cgisettings to vpnsettings and save the configfile
1264 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1265 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1266 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1267 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1268 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1269 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1270 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1271 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1272
1273 # Replace empty strings with a .
1274 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1275 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1276 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1277
1278 # refresh
c6c9630e 1279 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
6e13d0a5
MT		 1280
1281 # Create the CA certificate
1282 my $pid = open(OPENSSL, "|-");
1283 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1284 if ($pid) { # parent
1285 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1286 print OPENSSL "$state\n";
1287 print OPENSSL "$city\n";
1288 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1289 print OPENSSL "$ou\n";
1290 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1291 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1292 close (OPENSSL);
1293 if ($?) {
1294 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1295 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1296 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1297 goto ROOTCERT_ERROR;
1298 }
1299 } else { # child
1300 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1301 '-days', '999999', '-newkey', 'rsa:2048',
1302 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1303 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1304 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1305 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1306 goto ROOTCERT_ERROR;
1307 }
1308 }
1309
1310 # Create the Host certificate request
1311 $pid = open(OPENSSL, "|-");
1312 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1313 if ($pid) { # parent
1314 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1315 print OPENSSL "$state\n";
1316 print OPENSSL "$city\n";
1317 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1318 print OPENSSL "$ou\n";
1319 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1320 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1321 print OPENSSL ".\n";
1322 print OPENSSL ".\n";
1323 close (OPENSSL);
1324 if ($?) {
1325 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1326 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1327 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1328 goto ROOTCERT_ERROR;
1329 }
1330 } else { # child
1331 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1332 '-newkey', 'rsa:1024',
1333 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1334 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1335 '-extensions', 'server',
1336 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1337 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1338 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1339 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1340 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1341 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1342 goto ROOTCERT_ERROR;
1343 }
1344 }
1345
1346 # Sign the host certificate request
1347 system('/usr/bin/openssl', 'ca', '-days', '999999',
1348 '-batch', '-notext',
1349 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1350 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1351 '-extensions', 'server',
1352 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1353 if ($?) {
1354 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1355 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1356 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1357 unlink ("${General::swroot}/ovpn/serverkey.pem");
1358 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1359 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
c6c9630e 1360 &newcleanssldatabase();
6e13d0a5
MT		 1361 goto ROOTCERT_ERROR;
1362 } else {
1363 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
c6c9630e 1364 &deletebackupcert();
6e13d0a5
MT		 1365 }
1366
1367 # Create an empty CRL
1368 system('/usr/bin/openssl', 'ca', '-gencrl',
1369 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1370 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1371 if ($?) {
1372 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1373 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1374 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1375 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1376 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
c6c9630e 1377 &cleanssldatabase();
6e13d0a5 1378 goto ROOTCERT_ERROR;
c6c9630e
MT		 1379# } else {
1380# &cleanssldatabase();
6e13d0a5
MT		 1381 }
1382 # Create Diffie Hellmann Parameter
1383 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1384 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1385 '1024' );
1386 if ($?) {
1387 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1388 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1389 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1390 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1391 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1392 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
c6c9630e 1393 &cleanssldatabase();
6e13d0a5 1394 goto ROOTCERT_ERROR;
c6c9630e
MT		 1395# } else {
1396# &cleanssldatabase();
6e13d0a5
MT		 1397 }
1398 goto ROOTCERT_SUCCESS;
1399 }
1400 ROOTCERT_ERROR:
1401 if ($cgiparams{'ACTION'} ne '') {
1402 &Header::showhttpheaders();
1403 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1404 &Header::openbigbox('100%', 'LEFT', '', '');
1405 if ($errormessage) {
1406 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1407 print "<class name='base'>$errormessage";
1408 print "&nbsp;</class>";
1409 &Header::closebox();
1410 }
1411 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1412 print <<END
1413 <form method='post' enctype='multipart/form-data'>
1414 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1415 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1416 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1417 <td width='35%' colspan='2'>&nbsp;</td></tr>
1418 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1419 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1420 <td colspan='2'>&nbsp;</td></tr>
1421 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1422 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1423 <td colspan='2'>&nbsp;</td></tr>
1424 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1425 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1426 <td colspan='2'>&nbsp;</td></tr>
1427 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1428 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1429 <td colspan='2'>&nbsp;</td></tr>
1430 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1431 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1432 <td colspan='2'>&nbsp;</td></tr>
1433 <tr><td class='base'>$Lang::tr{'country'}:</td>
1434 <td class='base'><select name='ROOTCERT_COUNTRY'>
1435
1436END
1437 ;
1438 foreach my $country (sort keys %{Countries::countries}) {
1439 print "<option value='$Countries::countries{$country}'";
1440 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1441 print " selected='selected'";
1442 }
1443 print ">$country</option>";
1444 }
1445 print <<END
1446 </select></td>
1447 <td colspan='2'>&nbsp;</td></tr>
1448 <tr><td>&nbsp;</td>
1449 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1450 <td>&nbsp;</td><td>&nbsp;</td></tr>
1451 <tr><td class='base' colspan='4' align='left'>
1452 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1453 <tr><td class='base' colspan='4' align='left'>
1454 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1455 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1456 </td></tr>
1457 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1458 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1459 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1460 <td colspan='2'>&nbsp;</td></tr>
1461 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1462 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1463 <td colspan='2'>&nbsp;</td></tr>
1464 <tr><td>&nbsp;</td>
1465 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1466 <td colspan='2'>&nbsp;</td></tr>
1467 <tr><td class='base' colspan='4' align='left'>
1468 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1469 </form></table>
1470END
1471 ;
1472 &Header::closebox();
1473
1474 &Header::closebigbox();
1475 &Header::closepage();
1476 exit(0)
1477 }
1478
1479 ROOTCERT_SUCCESS:
1480 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
c6c9630e
MT		 1481# if ($vpnsettings{'ENABLED'} eq 'on' ||
1482# $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1483# system('/usr/local/bin/ipsecctrl', 'S');
1484# }
6e13d0a5
MT		 1485
1486###
1487### Enable/Disable connection
1488###
ce9abb66
AH		 1489
1490###
1491# m.a.d net2net Anpassung
1492###
1493
6e13d0a5 1494}elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
c6c9630e
MT		 1495
1496 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
6e13d0a5 1497 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH		 1498# my $n2nactive = '';
1499 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1500
6e13d0a5 1501 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66
AH		 1502
1503
1504 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT		 1505 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1506 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
ce9abb66
AH		 1507
1508 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1509 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1510 }
1511
1512 } else {
1513
c6c9630e 1514 $confighash{$cgiparams{'KEY'}}[0] = 'off';
ce9abb66
AH		 1515 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1516
1517 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1518 if ($n2nactive ne ''){
1519 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1520 }
1521
1522 } else {
1523 $errormessage = $Lang::tr{'invalid key'};
1524 }
1525 }
1526 }
6e13d0a5
MT		 1527
1528###
1529### Download OpenVPN client package
1530###
ce9abb66
AH		 1531
1532
6e13d0a5
MT		 1533} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1534 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1535 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1536 my $file = '';
1537 my $clientovpn = '';
1538 my @fileholder;
1539 my $tempdir = tempdir( CLEANUP => 1 );
1540 my $zippath = "$tempdir/";
ce9abb66
AH		 1541
1542###
1543# m.a.d net2net DL Client Package
1544###
1545
1546if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1547
1548 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1549 my $zippathname = "$zippath$zipname";
1550 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1551 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1552 my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]";
1553 my $tunmtu = '';
1554
1555 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1556 flock CLIENTCONF, 2;
1557
1558 my $zip = Archive::Zip->new();
1559 print CLIENTCONF "# n2n Open VPN Client Config by ummeegge und m.a.d\n";
1560 print CLIENTCONF "# \n";
1561 print CLIENTCONF "# User Sicherheit\n";
1562 print CLIENTCONF "user nobody\n";
1563 print CLIENTCONF "group nobody\n";
1564 print CLIENTCONF "persist-tun\n";
1565 print CLIENTCONF "persist-key\n";
1566 print CLIENTCONF "#\n";
1567 print CLIENTCONF "# IP/DNS fuer das Server Gateway - g2g Mode\n";
531f0835 1568 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
ce9abb66
AH		 1569 print CLIENTCONF "#\n";
1570 print CLIENTCONF "# IP Adressen des VPN Tunnels\n";
1571 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1572 print CLIENTCONF "#\n";
1573 print CLIENTCONF "# Netzwerk auf dem Server Gateway\n";
1574 print CLIENTCONF "route $confighash{$cgiparams{'KEY'}}[8]\n";
1575 print CLIENTCONF "# Device fuer den Tunnel\n";
1576 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1577 print CLIENTCONF "#\n";
1578 print CLIENTCONF "#Port und Protokoll\n";
1579 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1580 print CLIENTCONF "proto $confighash{$cgiparams{'KEY'}}[28]\n";
1581 print CLIENTCONF "#\n";
1582 print CLIENTCONF "# Paketgroessen\n";
d96c89eb 1583 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
ce9abb66 1584 print CLIENTCONF "tun-mtu $tunmtu\n";
d96c89eb
AH		 1585 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1586 if ($cgiparams{'FRAGMENT'} eq '') {
1587 print CLIENTCONF "fragment 1300\r\n";
1588 } else {
1589 print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n"
1590 }
1591 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {
ce9abb66 1592 print CLIENTCONF "mssfix\n";
d96c89eb
AH		 1593 }
1594 }
ce9abb66
AH		 1595 print CLIENTCONF "#\n";
1596 print CLIENTCONF "# Auth. Client\n";
1597 print CLIENTCONF "tls-client\n";
1598 print CLIENTCONF "#\n";
1599 print CLIENTCONF "# Verschluesselung\n";
1600 print CLIENTCONF "cipher AES-256-CBC\n";
1601 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1602 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1603 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1604 }
1605 print CLIENTCONF "#\n";
1606 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1607 print CLIENTCONF "# Kompression einschalten\n";
1608 print CLIENTCONF "comp-lzo\r\n";
1609 print CLIENTCONF "#\n";
1610 }
1611 print CLIENTCONF "# Debug Level\n";
1612 print CLIENTCONF "verb 3\n";
1613 print CLIENTCONF "#\n";
1614 print CLIENTCONF "# Tunnel Ueberwachung\n";
1615 print CLIENTCONF "keepalive 10 60\n";
1616 print CLIENTCONF "#\n";
1617 print CLIENTCONF "# Als Daemon starten\n";
1618 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1619 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
1620 print CLIENTCONF "#\n";
1621 print CLIENTCONF "# Management Interface aktivieren\n";
1622 print CLIENTCONF "# management localhost 4711\n";
1623 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
531f0835 1624
ce9abb66
AH		 1625
1626 close(CLIENTCONF);
1627
1628 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1629 my $status = $zip->writeToFileNamed($zippathname);
1630
1631 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1632 @fileholder = <DLFILE>;
1633 print "Content-Type:application/x-download\n";
1634 print "Content-Disposition:attachment;filename=$zipname\n\n";
1635 print @fileholder;
1636 exit (0);
1637}
1638else
1639{
1640 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1641 my $zippathname = "$zippath$zipname";
1642 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1643
1644###
1645# m.a.d net2net DL Client Package end
1646###
1647
c6c9630e 1648 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
6e13d0a5
MT		 1649 flock CLIENTCONF, 2;
1650
1651 my $zip = Archive::Zip->new();
1652
c6c9630e 1653 print CLIENTCONF "#OpenVPN Server conf\r\n";
6e13d0a5
MT		 1654 print CLIENTCONF "tls-client\r\n";
1655 print CLIENTCONF "client\r\n";
1656 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
c6c9630e 1657 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
6e13d0a5
MT		 1658 print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1659 if ( $vpnsettings{'ENABLED'} eq 'on'){
1660 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
c6c9630e
MT		 1661 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1662 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1663 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1664 }
1665 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1666 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1667 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1668 }
1669 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1670 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1671 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1672 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1673 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1674 }
1675 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1676 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
6e13d0a5
MT		 1677 }
1678
1679 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
c6c9630e
MT		 1680 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1681 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
6e13d0a5 1682 } else {
c6c9630e
MT		 1683 print CLIENTCONF "ca cacert.pem\r\n";
1684 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1685 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1686 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
1687 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
6e13d0a5
MT		 1688 }
1689 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1690 if ($vpnsettings{DCOMPLZO} eq 'on') {
1691 print CLIENTCONF "comp-lzo\r\n";
1692 }
1693 print CLIENTCONF "verb 3\r\n";
1694 print CLIENTCONF "ns-cert-type server\r\n";
a79fa1d6
JPT		 1695 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1696 if ($vpnsettings{MSSFIX} eq 'on') {
1697 print CLIENTCONF "mssfix\r\n";
1698 }
74225cce 1699 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
a79fa1d6
JPT		 1700 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1701 }
6e13d0a5 1702 close(CLIENTCONF);
ce9abb66 1703
6e13d0a5
MT		 1704 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1705 my $status = $zip->writeToFileNamed($zippathname);
1706
1707 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1708 @fileholder = <DLFILE>;
1709 print "Content-Type:application/x-download\n";
1710 print "Content-Disposition:attachment;filename=$zipname\n\n";
1711 print @fileholder;
1712 exit (0);
ce9abb66
AH		 1713 }
1714
1715
1716
6e13d0a5
MT		 1717###
1718### Remove connection
1719###
ce9abb66
AH		 1720
1721
6e13d0a5
MT		 1722} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1723 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1724 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e
MT		 1725
1726 if ($confighash{$cgiparams{'KEY'}}) {
1727# if ($vpnsettings{'ENABLED'} eq 'on' ||
1728# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1729# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1730# }
1731#
1732 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
ce9abb66
AH		 1733
1734###
1735# m.a.d net2net Anpassung
1736###
1737 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1738
1739 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1740 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1741 unlink ($certfile) or die "Removing $certfile fail: $!";
1742 unlink ($conffile) or die "Removing $conffile fail: $!";
1743 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1744
1745}
1746###
1747# m.a.d net2net Anpassung end
1748###
1749
1750 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
c6c9630e
MT		 1751 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1752 delete $confighash{$cgiparams{'KEY'}};
1753 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1754 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1755 #&writeserverconf();
6e13d0a5 1756 } else {
c6c9630e 1757 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5 1758 }
ce9abb66
AH		 1759
1760
6e13d0a5
MT		 1761###
1762### Download PKCS12 file
1763###
1764} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1765 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1766
1767 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1768 print "Content-Type: application/octet-stream\r\n\r\n";
1769 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1770 exit (0);
1771
1772###
1773### Display certificate
1774###
1775} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1776 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1777
1778 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT		 1779 &Header::showhttpheaders();
1780 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1781 &Header::openbigbox('100%', 'LEFT', '', '');
1782 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1783 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1784 $output = &Header::cleanhtml($output,"y");
1785 print "<pre>$output</pre>\n";
1786 &Header::closebox();
1787 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1788 &Header::closebigbox();
1789 &Header::closepage();
1790 exit(0);
6e13d0a5
MT		 1791 }
1792###
1793### Display Certificate Revoke List
1794###
1795} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
c6c9630e
MT		 1796# &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1797
6e13d0a5 1798 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
c6c9630e
MT		 1799 &Header::showhttpheaders();
1800 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1801 &Header::openbigbox('100%', 'LEFT', '', '');
1802 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1803 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1804 $output = &Header::cleanhtml($output,"y");
1805 print "<pre>$output</pre>\n";
1806 &Header::closebox();
1807 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1808 &Header::closebigbox();
1809 &Header::closepage();
1810 exit(0);
6e13d0a5
MT		 1811 }
1812
1813###
1814### Advanced Server Settings
1815###
1816
1817} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1818 %cgiparams = ();
1819 %cahash = ();
1820 %confighash = ();
1821 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
1822
c6c9630e
MT		 1823# if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1824# $cgiparams{'CLIENT2CLIENT'} = 'on';
1825# }
6e13d0a5
MT		 1826ADV_ERROR:
1827 if ($cgiparams{'MAX_CLIENTS'} eq '') {
c6c9630e 1828 $cgiparams{'MAX_CLIENTS'} = '100';
6e13d0a5
MT		 1829 }
1830
1831 if ($cgiparams{'KEEPALIVE_1'} eq '') {
c6c9630e 1832 $cgiparams{'KEEPALIVE_1'} = '10';
6e13d0a5
MT		 1833 }
1834 if ($cgiparams{'KEEPALIVE_2'} eq '') {
c6c9630e 1835 $cgiparams{'KEEPALIVE_2'} = '60';
6e13d0a5
MT		 1836 }
1837 if ($cgiparams{'LOG_VERB'} eq '') {
c6c9630e 1838 $cgiparams{'LOG_VERB'} = '3';
6e13d0a5 1839 }
6e13d0a5
MT		 1840 $checked{'CLIENT2CLIENT'}{'off'} = '';
1841 $checked{'CLIENT2CLIENT'}{'on'} = '';
1842 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1843 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1844 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1845 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
a79fa1d6
JPT		 1846 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1847 $checked{'MSSFIX'}{'off'} = '';
1848 $checked{'MSSFIX'}{'on'} = '';
1849 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
6e13d0a5
MT		 1850 $selected{'LOG_VERB'}{'1'} = '';
1851 $selected{'LOG_VERB'}{'2'} = '';
1852 $selected{'LOG_VERB'}{'3'} = '';
1853 $selected{'LOG_VERB'}{'4'} = '';
1854 $selected{'LOG_VERB'}{'5'} = '';
1855 $selected{'LOG_VERB'}{'6'} = '';
1856 $selected{'LOG_VERB'}{'7'} = '';
1857 $selected{'LOG_VERB'}{'8'} = '';
1858 $selected{'LOG_VERB'}{'9'} = '';
1859 $selected{'LOG_VERB'}{'10'} = '';
1860 $selected{'LOG_VERB'}{'11'} = '';
1861 $selected{'LOG_VERB'}{'0'} = '';
1862 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
a79fa1d6
JPT		 1863
1864
6e13d0a5
MT		 1865
1866 &Header::showhttpheaders();
1867 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1868 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1869 if ($errormessage) {
c6c9630e
MT		 1870 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1871 print "<class name='base'>$errormessage\n";
1872 print "&nbsp;</class>\n";
1873 &Header::closebox();
6e13d0a5
MT		 1874 }
1875 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1876 print <<END
1877 <form method='post' enctype='multipart/form-data'>
1878 <table width='100%'>
1879 <tr>
1880 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1881 </tr>
1882 <tr>
1883 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1884 </tr>
1885 <tr>
1886 <td class='base'>Domain</td>
1887 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1888 </tr>
1889 <tr>
1890 <td class='base'>DNS</td>
1891 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1892 </tr>
1893 <tr>
1894 <td class='base'>WINS</td>
1895 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
1896 </tr>
1897</table>
1898<hr size='1'>
6e13d0a5
MT		 1899 <table width='100%'>
1900 <tr>
1901 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1902 </tr>
1903 <tr>
a79fa1d6 1904 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
6e13d0a5
MT		 1905 </tr>
1906 <tr>
1907 <td class='base'>Client-To-Client</td>
1908 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
1909 </tr>
1910 <tr>
1911 <td class='base'>Redirect-Gateway def1</td>
1912 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
1913 </tr>
1914 <tr>
1915 <td class='base'>Max-Clients</td>
a79fa1d6 1916 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
6e13d0a5 1917 </tr>
a79fa1d6
JPT		 1918 <tr>
1919 <td class='base'>Keppalive <br />
1920 (ping/ping-restart)</td>
1921 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
1922 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
1923 </tr>
1924 <tr>
1925 <td class='base'>fragment <br></td>
1926 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
1927 <td>Default: <span class="base">1300</span></td>
1928 </tr>
1929 <tr>
1930 <td class='base'>mssfix</td>
1931 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
1932 <td>Default: on</td>
1933 </tr>
1934</table>
1935
1936<!--
1937<hr size='1'>
1938 <table width='100%'>
1939 <tr>
1940 <td class'base'><b>Crypto-Engines</b></td>
1941 </tr>
1942 <tr>
1943 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5 1944 </tr>
a79fa1d6
JPT		 1945 <tr><td class='base'>Engines:</td>
1946 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
1947 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
1948 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
1949 </select>
1950 </td>
6e13d0a5 1951</table>
a79fa1d6 1952-->
6e13d0a5
MT		 1953<hr size='1'>
1954 <table width='100%'>
1955 <tr>
1956 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
1957 </tr>
1958 <tr>
a79fa1d6 1959 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
6e13d0a5
MT		 1960 </tr>
1961
1962 <tr><td class='base'>VERB</td>
1963 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
1964 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
1965 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
1966 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
1967 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
1968 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
1969 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
1970 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
1971 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
1972 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
1973 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
c6c9630e 1974 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
6e13d0a5
MT		 1975</table>
1976<hr size='1'>
1977<table width='100%'>
1978<tr>
1979 <td>&nbsp;</td>
1980 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
1981 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
1982 <td>&nbsp;</td>
1983</tr>
1984</table>
1985</form>
1986END
1987;
1988
1989 &Header::closebox();
c6c9630e 1990# print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
6e13d0a5
MT		 1991 &Header::closebigbox();
1992 &Header::closepage();
1993 exit(0);
1994
1995###
1996### Openvpn Connections Statistics
1997###
1998} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
1999 &Header::showhttpheaders();
2000 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2001 &Header::openbigbox('100%', 'LEFT', '', '');
2002 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2003
2004#
2005# <td><b>$Lang::tr{'protocol'}</b></td>
2006# protocol temp removed
2007 print <<END
2008 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2009 <tr>
2010 <td><b>$Lang::tr{'common name'}</b></td>
2011 <td><b>$Lang::tr{'real address'}</b></td>
2012 <td><b>$Lang::tr{'virtual address'}</b></td>
2013 <td><b>$Lang::tr{'loged in at'}</b></td>
2014 <td><b>$Lang::tr{'bytes sent'}</b></td>
2015 <td><b>$Lang::tr{'bytes received'}</b></td>
2016 <td><b>$Lang::tr{'last activity'}</b></td>
2017 </tr>
2018END
2019;
4e17adad 2020 my $filename = "/var/log/ovpnserver.log";
6e13d0a5
MT		 2021 open(FILE, $filename) or die 'Unable to open config file.';
2022 my @current = <FILE>;
2023 close(FILE);
2024 my @users =();
2025 my $status;
2026 my $uid = 0;
2027 my $cn;
2028 my @match = ();
2029 my $proto = "udp";
2030 my $address;
2031 my %userlookup = ();
2032 foreach my $line (@current)
2033 {
2034 chomp($line);
2035 if ( $line =~ /^Updated,(.+)/){
2036 @match = split( /^Updated,(.+)/, $line);
2037 $status = $match[1];
2038 }
c6c9630e 2039#gian
6e13d0a5
MT		 2040 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2041 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2042 if ($match[1] ne "Common Name") {
2043 $cn = $match[1];
2044 $userlookup{$match[2]} = $uid;
2045 $users[$uid]{'CommonName'} = $match[1];
2046 $users[$uid]{'RealAddress'} = $match[2];
c6c9630e
MT		 2047 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2048 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
6e13d0a5
MT		 2049 $users[$uid]{'Since'} = $match[5];
2050 $users[$uid]{'Proto'} = $proto;
2051 $uid++;
2052 }
2053 }
2054 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2055 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2056 if ($match[1] ne "Virtual Address") {
2057 $address = $match[3];
2058 #find the uid in the lookup table
2059 $uid = $userlookup{$address};
2060 $users[$uid]{'VirtualAddress'} = $match[1];
2061 $users[$uid]{'LastRef'} = $match[4];
2062 }
2063 }
2064 }
2065 my $user2 = @users;
2066 if ($user2 >= 1){
2067 for (my $idx = 1; $idx <= $user2; $idx++){
2068 if ($idx % 2) {
4e17adad 2069 print "<tr bgcolor='$color{'color20'}'>\n";
6e13d0a5 2070 } else {
4e17adad 2071 print "<tr bgcolor='$color{'color22'}'>\n";
6e13d0a5
MT		 2072 }
2073 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2074 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2075 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2076 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2077 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2078 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2079 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2080# print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2081 }
2082 }
2083
2084 print "</table>";
2085 print <<END
2086 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2087 <tr><td></td></tr>
2088 <tr><td></td></tr>
2089 <tr><td></td></tr>
2090 <tr><td></td></tr>
2091 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2092 </table>
2093END
2094;
2095 &Header::closebox();
2096 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2097 &Header::closebigbox();
2098 &Header::closepage();
2099 exit(0);
2100
2101###
2102### Download Certificate
2103###
2104} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2105 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
c6c9630e 2106
6e13d0a5 2107 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
c6c9630e
MT		 2108 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2109 print "Content-Type: application/octet-stream\r\n\r\n";
2110 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2111 exit (0);
2112 }
2113
2114###
2115### Enable/Disable connection
2116###
ce9abb66 2117
c6c9630e
MT		 2118} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2119
2120 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2121 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2122
2123 if ($confighash{$cgiparams{'KEY'}}) {
ce9abb66 2124 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
c6c9630e
MT		 2125 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2126 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2127 #&writeserverconf();
2128# if ($vpnsettings{'ENABLED'} eq 'on' ||
2129# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2130# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2131# }
2132 } else {
2133 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2134# if ($vpnsettings{'ENABLED'} eq 'on' ||
2135# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2136# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2137# }
2138 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2139 #&writeserverconf();
2140 }
2141 } else {
2142 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT		 2143 }
2144
2145###
2146### Restart connection
2147###
2148} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2149 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2150 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2151
2152 if ($confighash{$cgiparams{'KEY'}}) {
c6c9630e
MT		 2153# if ($vpnsettings{'ENABLED'} eq 'on' ||
2154# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2155# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2156# }
6e13d0a5 2157 } else {
c6c9630e 2158 $errormessage = $Lang::tr{'invalid key'};
6e13d0a5
MT		 2159 }
2160
2161###
c6c9630e 2162### Remove connection
6e13d0a5 2163###
c6c9630e
MT		 2164} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2165 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2166 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2167
2168 if ($confighash{$cgiparams{'KEY'}}) {
2169# if ($vpnsettings{'ENABLED'} eq 'on' ||
2170# $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2171# system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2172# }
2173 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2174 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2175 delete $confighash{$cgiparams{'KEY'}};
2176 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2177 #&writeserverconf();
2178 } else {
2179 $errormessage = $Lang::tr{'invalid key'};
2180 }
ce9abb66
AH		 2181#test33
2182
2183###
2184### Choose between adding a host-net or net-net connection
2185###
2186
2187###
2188# m.a.d Anpassung wegen upload n2n Package
2189###
2190
2191} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2192 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2193 &Header::showhttpheaders();
2194 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2195 &Header::openbigbox('100%', 'LEFT', '', '');
2196 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2197 print <<END
2198 <b>$Lang::tr{'connection type'}:</b><br />
2199 <table><form method='post' ENCTYPE="multipart/form-data">
2200 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2201 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2202 <tr><td><input type='radio' name='TYPE' value='net' /></td>
2203 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2204 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2205 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2206 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2207 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2208 </form></table>
2209END
2210 ;
2211
2212 &Header::closebox();
2213 &Header::closebigbox();
2214 &Header::closepage();
2215 exit (0);
2216
2217###
2218# m.a.d uploading a IPFire n2n Client package
2219###
2220
2221} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2222
2223 my @firen2nconf;
2224 my @confdetails;
2225 my $uplconffilename ='';
2226 my $uplp12name = '';
ce9abb66
AH		 2227 my @rem_subnet;
2228 my @rem_subnet2;
2229 my @tmposupnet3;
2230 my $key;
2231
2232 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2233
2234# Check if a file is uploaded
2235
2236 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2237 $errormessage = $Lang::tr{'there was no file upload'};
2238 goto N2N_ERROR;
2239 }
2240
2241# Move uploaded IPfire n2n package to temporary file
2242
2243 (my $fh, my $filename) = tempfile( );
2244 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2245 $errormessage = $!;
2246 goto N2N_ERROR;
2247 }
2248
2249 my $zip = Archive::Zip->new();
2250 my $zipName = $filename;
2251 my $status = $zip->read( $zipName );
2252 if ($status != AZ_OK) {
2253 $errormessage = "Read of $zipName failed\n";
2254 goto N2N_ERROR;
2255 }
2256
2257 my $tempdir = tempdir( CLEANUP => 1 );
2258 my @files = $zip->memberNames();
2259 for(@files) {
2260 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2261 }
2262 my $countfiles = @files;
2263
2264# Check if we have not more then 2 files
2265
2266 if ( $countfiles == 2){
2267 foreach (@files){
2268 if ( $_ =~ /.conf$/){
2269 $uplconffilename = $_;
2270 }
2271 if ( $_ =~ /.p12$/){
2272 $uplp12name = $_;
2273 }
2274 }
2275 if (($uplconffilename eq '') || ($uplp12name eq '')){
2276 $errormessage = "Either no *.conf or no *.p12 file found\n";
2277 goto N2N_ERROR;
2278 }
2279
2280 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2281 @firen2nconf = <FILE>;
2282 close (FILE);
2283 chomp(@firen2nconf);
2284
2285 } else {
2286
2287 $errormessage = "Filecount does not match only 2 files are allowed\n";
2288 goto N2N_ERROR;
2289 }
2290
2291###
2292# m.a.d prepare imported ipfire net2net data
2293###
2294
2295 my @n2nname = split(/\./,$uplconffilename);
2296 $n2nname[0] =~ s/\n|\r//g;
2297
2298 if ( !-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]") {
2299 mkdir("${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770); }
2300
2301 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename");
2302
2303 if ($? ne 0) {
2304 $errormessage = "*.conf move failed: $!";
2305 unlink ($filename);
2306 goto N2N_ERROR;
2307 }
2308
2309 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name");
2310 if ($? ne 0) {
2311 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2312 unlink ($filename);
2313 goto N2N_ERROR;
2314 }
2315
2316my $complzoactive;
d96c89eb
AH		 2317my $mssfixactive;
2318my $n2nfragment;
ce9abb66
AH		 2319my @n2nproto = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2320my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2321my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2322my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2323if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
d96c89eb
AH		 2324my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
2325if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2326my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
ce9abb66
AH		 2327my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2328my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2329my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
2330my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2331my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2332
ce9abb66
AH		 2333###
2334# m.a.d delete CR and LF from arrays for this chomp doesnt work
2335###
2336
ce9abb66 2337$n2nremote[1] =~ s/\n|\r//g;
ce9abb66
AH		 2338$n2novpnsub[0] =~ s/\n|\r//g;
2339$n2novpnsub[1] =~ s/\n|\r//g;
2340$n2novpnsub[2] =~ s/\n|\r//g;
2341$n2nproto[1] =~ s/\n|\r//g;
2342$n2nport[1] =~ s/\n|\r//g;
2343$n2ntunmtu[1] =~ s/\n|\r//g;
2344$n2nremsub[1] =~ s/\n|\r//g;
2345$n2nlocalsub[2] =~ s/\n|\r//g;
d96c89eb 2346$n2nfragment[1] =~ s/\n|\r//g;
ce9abb66 2347chomp ($complzoactive);
d96c89eb 2348chomp ($mssfixactive);
ce9abb66
AH		 2349
2350###
2351# m.a.d Write n2n config
2352###
2353
2354###
2355# Check if there is no other entry with this name
2356###
2357
2358 foreach my $dkey (keys %confighash) {
2359 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2360 $errormessage = $Lang::tr{'a connection with this name already exists'};
2361 goto N2N_ERROR;
2362 }
2363 }
2364
d96c89eb
AH		 2365###
2366# Check if RemSubnet is green orange blue
2367###
2368
2369
2370###
2371# Check if OpenVPN Subnet is valid
2372###
2373
2374foreach my $dkey (keys %confighash) {
2375 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2376 $errormessage = 'The OpenVPN Subnet is already in use';
2377 goto N2N_ERROR;
2378 }
2379 }
2380
2381###
2382# Check im Dest Port is vaild
2383###
2384
2385foreach my $dkey (keys %confighash) {
2386 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2387 $errormessage = 'The OpenVPN Port is already in use';
2388 goto N2N_ERROR;
2389 }
2390 }
2391
2392
2393
ce9abb66
AH		 2394 $key = &General::findhasharraykey (\%confighash);
2395
2396 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2397 $confighash{$key}[0] = 'off';
2398 $confighash{$key}[1] = $n2nname[0];
2399 $confighash{$key}[2] = $n2nname[0];
2400 $confighash{$key}[3] = 'net';
2401 $confighash{$key}[4] = 'cert';
2402 $confighash{$key}[6] = 'client';
2403 $confighash{$key}[8] = $n2nlocalsub[2];
2404 $confighash{$key}[10] = $n2nremote[1];
2405 $confighash{$key}[11] = $n2nremsub[1];
d96c89eb
AH		 2406 $confighash{$key}[23] = $mssfixactive;
2407 $confighash{$key}[24] = $n2nfragment[1];
2408 $confighash{$key}[25] = 'IPFire n2n Client';
ce9abb66
AH		 2409 $confighash{$key}[26] = 'red';
2410 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
2411 $confighash{$key}[28] = $n2nproto[1];
2412 $confighash{$key}[29] = $n2nport[1];
2413 $confighash{$key}[30] = $complzoactive;
2414 $confighash{$key}[31] = $n2ntunmtu[1];
2415
2416
2417 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
d96c89eb 2418
ce9abb66
AH		 2419 N2N_ERROR:
2420
2421 &Header::showhttpheaders();
2422 &Header::openpage('Validate imported configuration', 1, '');
2423 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2424 if ($errormessage) {
2425 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2426 print "<class name='base'>$errormessage";
2427 print "&nbsp;</class>";
2428 &Header::closebox();
2429
2430 } else
2431 {
2432 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2433 }
2434 if ($errormessage eq ''){
2435 print <<END
2436 <!-- ipfire net2net config gui -->
2437 <table width='100%'>
2438 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2439 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2440 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2441 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2442 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2443 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2444 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2445 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2446 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2447 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2448 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
2449 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
2450 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2451 </table>
2452END
2453;
2454 &Header::closebox();
2455 }
2456
2457 if ($errormessage) {
2458 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2459 } else {
2460 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2461 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2462 print "<input type='hidden' name='KEY' value='$key' />";
2463 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2464 }
2465 &Header::closebigbox();
2466 &Header::closepage();
2467 exit(0);
2468
2469
2470##
2471### Accept IPFire n2n Package Settings
2472###
2473
2474 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2475
2476###
2477### Discard and Rollback IPFire n2n Package Settings
2478###
2479
2480 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2481
2482 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2483
2484if ($confighash{$cgiparams{'KEY'}}) {
2485
2486 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2487 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2488 unlink ($certfile) or die "Removing $certfile fail: $!";
2489 unlink ($conffile) or die "Removing $conffile fail: $!";
2490 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2491 delete $confighash{$cgiparams{'KEY'}};
2492 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2493
2494 } else {
2495 $errormessage = $Lang::tr{'invalid key'};
2496 }
2497
2498
2499###
2500# m.a.d end uploading a IPFire n2n Client package
2501###
2502
2503
2504###
2505### Adding a new connection
2506###
6e13d0a5
MT		 2507} elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2508 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2509 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2510
2511 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2512 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2513 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2514
2515 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
c6c9630e
MT		 2516 if (! $confighash{$cgiparams{'KEY'}}[0]) {
2517 $errormessage = $Lang::tr{'invalid key'};
2518 goto VPNCONF_END;
2519 }
2520 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
2521 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
ce9abb66 2522 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
c6c9630e
MT		 2523 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
2524 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
2525 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
2526 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
531f0835
AH		 2527 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
2528 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
d96c89eb
AH		 2529# n2n m.a.d new fields
2530 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2531 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
c6c9630e
MT		 2532 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
2533 $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
2534#new fields
2535 $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
2536 $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28];
2537 $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29];
2538 $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30];
2539 $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31];
d96c89eb 2540
c6c9630e
MT		 2541#new fields
2542#ab hiere error uebernehmen
d96c89eb 2543
c6c9630e
MT		 2544 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2545 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
2546 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
2547 $errormessage = $Lang::tr{'connection type is invalid'};
2548 goto VPNCONF_ERROR;
2549 }
2550
2551
2552 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
2553 $errormessage = $Lang::tr{'name must only contain characters'};
2554 goto VPNCONF_ERROR;
2555 }
2556
2557 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
2558 $errormessage = $Lang::tr{'name is invalid'};
2559 goto VPNCONF_ERROR;
2560 }
2561
2562 if (length($cgiparams{'NAME'}) >60) {
2563 $errormessage = $Lang::tr{'name too long'};
2564 goto VPNCONF_ERROR;
2565 }
2566
d96c89eb
AH		 2567###
2568# n2n Plausi m.a.d
2569###
2570
2571 if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) {
2572 $errormessage = 'The Destination Port is used by the OpenVPN Server please change';
2573 goto VPNCONF_ERROR;
2574 }
2575
2576 if ($cgiparams{'OVPN_SUBNET'} eq $vpnsettings{'DOVPN_SUBNET'}) {
2577 $errormessage = 'The OpenVPN Subnet is used by the OpenVPN Server please change';
2578 goto VPNCONF_ERROR;
2579 }
2580
2581 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
2582 $errormessage = 'mssfix only allowed with udp';
2583 goto VPNCONF_ERROR;
2584 }
2585
2586 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
2587 $errormessage = 'fragment only allowed with udp';
2588 goto VPNCONF_ERROR;
2589 }
2590
2591
2592###
2593# n2n Plausi m.a.d
2594###
2595
ce9abb66
AH		 2596# if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
2597# $errormessage = $Lang::tr{'ipfire side is invalid'};
2598# goto VPNCONF_ERROR;
2599# }
2600
c6c9630e
MT		 2601 # Check if there is no other entry with this name
2602 if (! $cgiparams{'KEY'}) {
2603 foreach my $key (keys %confighash) {
2604 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
2605 $errormessage = $Lang::tr{'a connection with this name already exists'};
2606 goto VPNCONF_ERROR;
6e13d0a5 2607 }
c6c9630e
MT		 2608 }
2609 }
2610
ce9abb66
AH		 2611 if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
2612 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2613 goto VPNCONF_ERROR;
2614 }
2615
c6c9630e
MT		 2616 if ($cgiparams{'REMOTE'}) {
2617 if (! &General::validip($cgiparams{'REMOTE'})) {
2618 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
2619 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2620 goto VPNCONF_ERROR;
6e13d0a5 2621 } else {
c6c9630e
MT		 2622 if (&valid_dns_host($cgiparams{'REMOTE'})) {
2623 $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
2624 }
6e13d0a5 2625 }
c6c9630e
MT		 2626 }
2627 }
2628 if ($cgiparams{'TYPE'} ne 'host') {
2629 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
2630 $errormessage = $Lang::tr{'local subnet is invalid'};
2631 goto VPNCONF_ERROR;}
2632 }
2633 # Check if there is no other entry without IP-address and PSK
2634 if ($cgiparams{'REMOTE'} eq '') {
2635 foreach my $key (keys %confighash) {
2636 if(($cgiparams{'KEY'} ne $key) &&
2637 ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
2638 $confighash{$key}[10] eq '') {
2639 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
2640 goto VPNCONF_ERROR;
6e13d0a5 2641 }
c6c9630e
MT		 2642 }
2643 }
ce9abb66
AH		 2644 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
2645 $errormessage = $Lang::tr{'remote subnet is invalid'};
2646 goto VPNCONF_ERROR;
2647 }
c6c9630e
MT		 2648
2649 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
2650 $errormessage = $Lang::tr{'invalid input'};
2651 goto VPNCONF_ERROR;
2652 }
2653 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
2654 $errormessage = $Lang::tr{'invalid input'};
2655 goto VPNCONF_ERROR;
2656 }
2657
2658#fixplausi
2659 if ($cgiparams{'AUTH'} eq 'psk') {
2660# if (! length($cgiparams{'PSK'}) ) {
2661# $errormessage = $Lang::tr{'pre-shared key is too short'};
2662# goto VPNCONF_ERROR;
2663# }
2664# if ($cgiparams{'PSK'} =~ /['",&]/) {
2665# $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
2666# goto VPNCONF_ERROR;
2667# }
2668 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
2669 if ($cgiparams{'KEY'}) {
2670 $errormessage = $Lang::tr{'cant change certificates'};
2671 goto VPNCONF_ERROR;
2672 }
2673 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2674 $errormessage = $Lang::tr{'there was no file upload'};
2675 goto VPNCONF_ERROR;
2676 }
2677
2678 # Move uploaded certificate request to a temporary file
2679 (my $fh, my $filename) = tempfile( );
2680 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2681 $errormessage = $!;
2682 goto VPNCONF_ERROR;
2683 }
6e13d0a5 2684
c6c9630e
MT		 2685 # Sign the certificate request and move it
2686 # Sign the host certificate request
2687 system('/usr/bin/openssl', 'ca', '-days', '999999',
2688 '-batch', '-notext',
2689 '-in', $filename,
2690 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2691 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
2692 if ($?) {
2693 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2694 unlink ($filename);
2695 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2696 &newcleanssldatabase();
2697 goto VPNCONF_ERROR;
2698 } else {
2699 unlink ($filename);
2700 &deletebackupcert();
2701 }
2702
2703 my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2704 $temp =~ /Subject:.*CN=(.*)[\n]/;
2705 $temp = $1;
2706 $temp =~ s+/Email+, E+;
2707 $temp =~ s/ ST=/ S=/;
2708 $cgiparams{'CERT_NAME'} = $temp;
2709 $cgiparams{'CERT_NAME'} =~ s/,//g;
2710 $cgiparams{'CERT_NAME'} =~ s/\'//g;
2711 if ($cgiparams{'CERT_NAME'} eq '') {
2712 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2713 goto VPNCONF_ERROR;
2714 }
2715 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
2716 if ($cgiparams{'KEY'}) {
2717 $errormessage = $Lang::tr{'cant change certificates'};
2718 goto VPNCONF_ERROR;
2719 }
2720 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2721 $errormessage = $Lang::tr{'there was no file upload'};
2722 goto VPNCONF_ERROR;
2723 }
2724 # Move uploaded certificate to a temporary file
2725 (my $fh, my $filename) = tempfile( );
2726 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2727 $errormessage = $!;
2728 goto VPNCONF_ERROR;
2729 }
2730
2731 # Verify the certificate has a valid CA and move it
2732 my $validca = 0;
2733 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
2734 if ($test =~ /: OK/) {
2735 $validca = 1;
2736 } else {
2737 foreach my $key (keys %cahash) {
2738 $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
2739 if ($test =~ /: OK/) {
2740 $validca = 1;
2741 }
6e13d0a5 2742 }
c6c9630e
MT		 2743 }
2744 if (! $validca) {
2745 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
2746 unlink ($filename);
2747 goto VPNCONF_ERROR;
2748 } else {
2749 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2750 if ($? ne 0) {
2751 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2752 unlink ($filename);
2753 goto VPNCONF_ERROR;
6e13d0a5 2754 }
c6c9630e
MT		 2755 }
2756
2757 my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2758 $temp =~ /Subject:.*CN=(.*)[\n]/;
2759 $temp = $1;
2760 $temp =~ s+/Email+, E+;
2761 $temp =~ s/ ST=/ S=/;
2762 $cgiparams{'CERT_NAME'} = $temp;
2763 $cgiparams{'CERT_NAME'} =~ s/,//g;
2764 $cgiparams{'CERT_NAME'} =~ s/\'//g;
2765 if ($cgiparams{'CERT_NAME'} eq '') {
2766 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2767 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2768 goto VPNCONF_ERROR;
2769 }
2770 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
2771 if ($cgiparams{'KEY'}) {
2772 $errormessage = $Lang::tr{'cant change certificates'};
2773 goto VPNCONF_ERROR;
2774 }
2775 # Validate input since the form was submitted
2776 if (length($cgiparams{'CERT_NAME'}) >60) {
2777 $errormessage = $Lang::tr{'name too long'};
2778 goto VPNCONF_ERROR;
2779 }
2780 if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
2781 $errormessage = $Lang::tr{'invalid input for name'};
2782 goto VPNCONF_ERROR;
2783 }
2784 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
2785 $errormessage = $Lang::tr{'invalid input for e-mail address'};
2786 goto VPNCONF_ERROR;
2787 }
2788 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
2789 $errormessage = $Lang::tr{'e-mail address too long'};
2790 goto VPNCONF_ERROR;
2791 }
2792 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
2793 $errormessage = $Lang::tr{'invalid input for department'};
2794 goto VPNCONF_ERROR;
2795 }
2796 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
2797 $errormessage = $Lang::tr{'organization too long'};
2798 goto VPNCONF_ERROR;
2799 }
2800 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
2801 $errormessage = $Lang::tr{'invalid input for organization'};
2802 goto VPNCONF_ERROR;
2803 }
2804 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
2805 $errormessage = $Lang::tr{'invalid input for city'};
2806 goto VPNCONF_ERROR;
2807 }
2808 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
2809 $errormessage = $Lang::tr{'invalid input for state or province'};
2810 goto VPNCONF_ERROR;
2811 }
2812 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
2813 $errormessage = $Lang::tr{'invalid input for country'};
2814 goto VPNCONF_ERROR;
2815 }
2816 if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
2817 if (length($cgiparams{'CERT_PASS1'}) < 5) {
2818 $errormessage = $Lang::tr{'password too short'};
2819 goto VPNCONF_ERROR;
6e13d0a5 2820 }
c6c9630e
MT		 2821 }
2822 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
2823 $errormessage = $Lang::tr{'passwords do not match'};
2824 goto VPNCONF_ERROR;
2825 }
2826
2827 # Replace empty strings with a .
2828 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
2829 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
2830 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
2831
2832 # Create the Host certificate request client
2833 my $pid = open(OPENSSL, "|-");
2834 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
2835 if ($pid) { # parent
2836 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
2837 print OPENSSL "$state\n";
2838 print OPENSSL "$city\n";
2839 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
2840 print OPENSSL "$ou\n";
2841 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
2842 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
2843 print OPENSSL ".\n";
2844 print OPENSSL ".\n";
2845 close (OPENSSL);
2846 if ($?) {
2847 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2848 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
2849 unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
2850 goto VPNCONF_ERROR;
6e13d0a5 2851 }
c6c9630e
MT		 2852 } else { # child
2853 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
2854 '-newkey', 'rsa:1024',
2855 '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
2856 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
2857 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
2858 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
2859 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
2860 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
2861 goto VPNCONF_ERROR;
6e13d0a5 2862 }
c6c9630e
MT		 2863 }
2864
2865 # Sign the host certificate request
2866 system('/usr/bin/openssl', 'ca', '-days', '999999',
2867 '-batch', '-notext',
2868 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
2869 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2870 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
2871 if ($?) {
2872 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2873 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
2874 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
2875 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2876 &newcleanssldatabase();
2877 goto VPNCONF_ERROR;
2878 } else {
2879 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
2880 &deletebackupcert();
2881 }
2882
2883 # Create the pkcs12 file
2884 system('/usr/bin/openssl', 'pkcs12', '-export',
2885 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
2886 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2887 '-name', $cgiparams{'NAME'},
2888 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
2889 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
2890 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
2891 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
2892 if ($?) {
2893 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2894 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
2895 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2896 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
2897 goto VPNCONF_ERROR;
2898 } else {
2899 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
2900 }
2901 } elsif ($cgiparams{'AUTH'} eq 'cert') {
2902 ;# Nothing, just editing
2903 } else {
2904 $errormessage = $Lang::tr{'invalid input for authentication method'};
2905 goto VPNCONF_ERROR;
2906 }
2907
2908 # Check if there is no other entry with this common name
2909 if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
2910 foreach my $key (keys %confighash) {
2911 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
2912 $errormessage = $Lang::tr{'a connection with this common name already exists'};
2913 goto VPNCONF_ERROR;
6e13d0a5 2914 }
c6c9630e
MT		 2915 }
2916 }
2917
2918 # Save the config
2919 my $key = $cgiparams{'KEY'};
2920 if (! $key) {
2921 $key = &General::findhasharraykey (\%confighash);
2922 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2923 }
2924 $confighash{$key}[0] = $cgiparams{'ENABLED'};
2925 $confighash{$key}[1] = $cgiparams{'NAME'};
2926 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
2927 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
2928 }
ce9abb66 2929 $confighash{$key}[3] = $cgiparams{'TYPE'};
c6c9630e
MT		 2930 if ($cgiparams{'AUTH'} eq 'psk') {
2931 $confighash{$key}[4] = 'psk';
2932 $confighash{$key}[5] = $cgiparams{'PSK'};
2933 } else {
2934 $confighash{$key}[4] = 'cert';
2935 }
ce9abb66
AH		 2936 if ($cgiparams{'TYPE'} eq 'net') {
2937 $confighash{$key}[6] = $cgiparams{'SIDE'};
2938 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
2939 }
c6c9630e
MT		 2940 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
2941 $confighash{$key}[10] = $cgiparams{'REMOTE'};
d96c89eb
AH		 2942 $confighash{$key}[23] = $cgiparams{'MSSFIX'};
2943 if ($cgiparams{'FRAGMENT'} eq '') {
2944 $confighash{$key}[24] = '1300';
2945 } else {
2946 $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
2947 }
c6c9630e
MT		 2948 $confighash{$key}[25] = $cgiparams{'REMARK'};
2949 $confighash{$key}[26] = $cgiparams{'INTERFACE'};
2950# new fields
2951 $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
2952 $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
2953 $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
2954 $confighash{$key}[30] = $cgiparams{'COMPLZO'};
2955 $confighash{$key}[31] = $cgiparams{'MTU'};
2956# new fileds
2957 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2958 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
2959 $cgiparams{'KEY'} = $key;
2960 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
2961 }
2962 goto VPNCONF_END;
6e13d0a5 2963 } else {
c6c9630e
MT		 2964 $cgiparams{'ENABLED'} = 'on';
2965 $cgiparams{'SIDE'} = 'left';
2966 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
2967 $cgiparams{'AUTH'} = 'psk';
2968 } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
2969 $cgiparams{'AUTH'} = 'certfile';
2970 } else {
6e13d0a5 2971 $cgiparams{'AUTH'} = 'certgen';
c6c9630e
MT		 2972 }
2973 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
2974 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
2975 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
2976 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
2977 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
6e13d0a5 2978 }
c6c9630e 2979
6e13d0a5 2980 VPNCONF_ERROR:
6e13d0a5
MT		 2981 $checked{'ENABLED'}{'off'} = '';
2982 $checked{'ENABLED'}{'on'} = '';
2983 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
2984 $checked{'ENABLED_BLUE'}{'off'} = '';
2985 $checked{'ENABLED_BLUE'}{'on'} = '';
2986 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
2987 $checked{'ENABLED_ORANGE'}{'off'} = '';
2988 $checked{'ENABLED_ORANGE'}{'on'} = '';
2989 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
c6c9630e
MT		 2990
2991
6e13d0a5
MT		 2992 $checked{'EDIT_ADVANCED'}{'off'} = '';
2993 $checked{'EDIT_ADVANCED'}{'on'} = '';
2994 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
c6c9630e 2995
6e13d0a5
MT		 2996 $selected{'SIDE'}{'server'} = '';
2997 $selected{'SIDE'}{'client'} = '';
2998 $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
d96c89eb
AH		 2999
3000 $selected{'PROTOCOL'}{'udp'} = '';
3001 $selected{'PROTOCOL'}{'tcp'} = '';
3002 $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
3003
c6c9630e 3004
6e13d0a5
MT		 3005 $checked{'AUTH'}{'psk'} = '';
3006 $checked{'AUTH'}{'certreq'} = '';
3007 $checked{'AUTH'}{'certgen'} = '';
3008 $checked{'AUTH'}{'certfile'} = '';
3009 $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
c6c9630e 3010
6e13d0a5 3011 $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
c6c9630e 3012
6e13d0a5
MT		 3013 $checked{'COMPLZO'}{'off'} = '';
3014 $checked{'COMPLZO'}{'on'} = '';
3015 $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
c6c9630e 3016
d96c89eb
AH		 3017 $checked{'MSSFIX'}{'off'} = '';
3018 $checked{'MSSFIX'}{'on'} = '';
3019 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3020
6e13d0a5
MT		 3021
3022 if (1) {
3023 &Header::showhttpheaders();
3024 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
3025 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3026 if ($errormessage) {
3027 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3028 print "<class name='base'>$errormessage";
3029 print "&nbsp;</class>";
3030 &Header::closebox();
3031 }
c6c9630e 3032
6e13d0a5
MT		 3033 if ($warnmessage) {
3034 &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
3035 print "<class name='base'>$warnmessage";
3036 print "&nbsp;</class>";
3037 &Header::closebox();
3038 }
c6c9630e 3039
6e13d0a5 3040 print "<form method='post' enctype='multipart/form-data'>";
ce9abb66 3041 print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
c6c9630e 3042
6e13d0a5
MT		 3043 if ($cgiparams{'KEY'}) {
3044 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
3045 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
6e13d0a5 3046 }
c6c9630e 3047
6e13d0a5
MT		 3048 &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
3049 print "<table width='100%'>\n";
3050 print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>";
ce9abb66 3051 if ($cgiparams{'TYPE'} eq 'host') {
6e13d0a5
MT		 3052 if ($cgiparams{'KEY'}) {
3053 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>\n";
3054 } else {
3055 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
3056 }
c6c9630e
MT		 3057# print "<tr><td>$Lang::tr{'interface'}</td>";
3058# print "<td><select name='INTERFACE'>";
3059# print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
3060# if ($netsettings{'BLUE_DEV'} ne '') {
3061# print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
3062# }
3063# print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
3064# print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
3065# print "</select></td></tr>";
3066# print <<END
ce9abb66
AH		 3067 } else {
3068 print "<input type='hidden' name='INTERFACE' value='red' />";
3069 if ($cgiparams{'KEY'}) {
3070 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
3071 } else {
3072 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
3073 }
3074 print <<END
3075 <td width='25%'>&nbsp;</td>
3076 <td width='25%'>&nbsp;</td></tr>
3077 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
3078 <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>OpenVPN Server</option>
3079 <option value='client' $selected{'SIDE'}{'client'}>OpenVPN Client</option></select></td>
3080 <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
3081 <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
3082 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
3083 <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
3084 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
3085 <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
3086 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
3087 <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
3088 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
d96c89eb
AH		 3089
3090 <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
3091 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
3092
3093 <td class='boldbase'>$Lang::tr{'destination port'}:</td>
ce9abb66 3094 <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
d96c89eb 3095 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
ce9abb66 3096 <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
d96c89eb
AH		 3097
3098 <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
3099 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
3100
3101 <tr><td class='boldbase' nowrap='nowrap'>Fragment &nbsp;<img src='/blob.gif' /></td>
3102 <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
3103 <td>Default: <span class="base">1300</span></td>
3104
ce9abb66
AH		 3105 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
3106 <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></TD>
ce9abb66
AH		 3107
3108END
3109 ;
3110 }
d96c89eb 3111
6e13d0a5
MT		 3112 print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
3113 print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr>";
c6c9630e 3114
ce9abb66
AH		 3115 if ($cgiparams{'TYPE'} eq 'host') {
3116
3117 print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>\n";
3118 }
3119
c6c9630e
MT		 3120# if ($cgiparams{'KEY'}) {
3121# print "<td colspan='3'>&nbsp;</td></tr></table>";
3122# } else {
3123# print "<td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</tr></table>";
3124# }
3125# }else{
6e13d0a5 3126 print "<td colspan='3'>&nbsp;</td></tr></table>";
c6c9630e
MT		 3127# }
3128
6e13d0a5
MT		 3129
3130
3131 &Header::closebox();
c6c9630e 3132
6e13d0a5 3133 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
c6c9630e
MT		 3134 # &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3135 # print <<END
3136 # <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3137 # <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
3138 # <td class='base' width='50%'><input type='text' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
3139 # </table>
3140END
3141 # ;
3142 # &Header::closebox();
6e13d0a5
MT		 3143 } elsif (! $cgiparams{'KEY'}) {
3144 my $disabled='';
3145 my $cakeydisabled='';
3146 my $cacrtdisabled='';
3147 if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
3148 if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
3149 &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
ce9abb66
AH		 3150
3151
3152 if ($cgiparams{'TYPE'} eq 'host') {
3153
3154print <<END
6e13d0a5
MT		 3155 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3156 <tr><td colspan='3' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
ce9abb66
AH		 3157 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
3158 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
6e13d0a5 3159 <tr><td colspan='3' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' BORDER='0' /></td></tr>
ce9abb66
AH		 3160 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3161 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3162 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3163 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3164 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3165 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3166 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3167 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
6e13d0a5 3168END
ce9abb66
AH		 3169;
3170
3171###
3172# m.a.d Disbale upload cert for n2n connections
3173###
3174
3175} else {
3176
3177print <<END
3178 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3179
3180 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3181 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3182 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3183 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3184 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3185 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3186 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3187 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3188
3189END
3190;
3191
3192}
3193
3194###
3195# m.a.d Disbale upload cert for n2n connections end
3196###
c6c9630e 3197
6e13d0a5
MT		 3198 foreach my $country (sort keys %{Countries::countries}) {
3199 print "<option value='$Countries::countries{$country}'";
3200 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
3201 print " selected='selected'";
3202 }
3203 print ">$country</option>";
3204 }
ce9abb66
AH		 3205###
3206# m.a.d Disbale pkcs-password for n2n connections
3207###
3208
3209if ($cgiparams{'TYPE'} eq 'host') {
6e13d0a5
MT		 3210 print <<END
3211 </select></td></tr>
ce9abb66
AH		 3212
3213 <td class='base'>$Lang::tr{'valid till'} (days):</td>
3214 <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
3215 <tr><td>&nbsp;</td>
6e13d0a5
MT		 3216 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
3217 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
3218 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
3219 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
ce9abb66
AH		 3220 </table>
3221END
3222}else{
3223 print <<END
3224 </select></td></tr>
3225 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3226 <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3227 </table>
3228
c6c9630e 3229END
ce9abb66
AH		 3230}
3231
3232###
3233# m.a.d Disbale pkcs-password for n2n connections end
3234###
c6c9630e
MT		 3235 ;
3236 &Header::closebox();
3237 }
6e13d0a5 3238
c6c9630e
MT		 3239 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
3240 if ($cgiparams{'KEY'}) {
3241# print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
3242 }
3243 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3244 &Header::closebigbox();
3245 &Header::closepage();
3246 exit (0);
6e13d0a5 3247 }
c6c9630e 3248 VPNCONF_END:
6e13d0a5 3249}
c6c9630e
MT		 3250
3251# SETTINGS_ERROR:
6e13d0a5
MT		 3252###
3253### Default status page
3254###
c6c9630e
MT		 3255 %cgiparams = ();
3256 %cahash = ();
3257 %confighash = ();
3258 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
3259 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3260 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3261
4e17adad 3262 my @status = `/bin/cat /var/log/ovpnserver.log`;
c6c9630e
MT		 3263
3264 if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
6e13d0a5
MT		 3265 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
3266 my $ipaddr = <IPADDR>;
3267 close IPADDR;
3268 chomp ($ipaddr);
3269 $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
3270 if ($cgiparams{'VPN_IP'} eq '') {
c6c9630e 3271 $cgiparams{'VPN_IP'} = $ipaddr;
6e13d0a5
MT		 3272 }
3273 }
c6c9630e
MT		 3274 }
3275
6e13d0a5 3276#default setzen
c6c9630e 3277 if ($cgiparams{'DCIPHER'} eq '') {
6e13d0a5 3278 $cgiparams{'DCIPHER'} = 'BF-CBC';
c6c9630e 3279 }
6e13d0a5
MT		 3280# if ($cgiparams{'DCOMPLZO'} eq '') {
3281# $cgiparams{'DCOMPLZO'} = 'on';
3282# }
c6c9630e 3283 if ($cgiparams{'DDEST_PORT'} eq '') {
6e13d0a5 3284 $cgiparams{'DDEST_PORT'} = '1194';
c6c9630e
MT		 3285 }
3286 if ($cgiparams{'DMTU'} eq '') {
6e13d0a5 3287 $cgiparams{'DMTU'} = '1400';
c6c9630e
MT		 3288 }
3289 if ($cgiparams{'DOVPN_SUBNET'} eq '') {
6e13d0a5 3290 $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
c6c9630e
MT		 3291 }
3292
3293 $checked{'ENABLED'}{'off'} = '';
3294 $checked{'ENABLED'}{'on'} = '';
3295 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3296 $checked{'ENABLED_BLUE'}{'off'} = '';
3297 $checked{'ENABLED_BLUE'}{'on'} = '';
3298 $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3299 $checked{'ENABLED_ORANGE'}{'off'} = '';
3300 $checked{'ENABLED_ORANGE'}{'on'} = '';
3301 $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
c6c9630e
MT		 3302 $selected{'DDEVICE'}{'tun'} = '';
3303 $selected{'DDEVICE'}{'tap'} = '';
3304 $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
3305
3306 $selected{'DPROTOCOL'}{'udp'} = '';
3307 $selected{'DPROTOCOL'}{'tcp'} = '';
3308 $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
3309
3310 $selected{'DCIPHER'}{'DES-CBC'} = '';
3311 $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
3312 $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
3313 $selected{'DCIPHER'}{'DESX-CBC'} = '';
3314 $selected{'DCIPHER'}{'RC2-CBC'} = '';
3315 $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
3316 $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
3317 $selected{'DCIPHER'}{'BF-CBC'} = '';
3318 $selected{'DCIPHER'}{'CAST5-CBC'} = '';
3319 $selected{'DCIPHER'}{'AES-128-CBC'} = '';
3320 $selected{'DCIPHER'}{'AES-192-CBC'} = '';
3321 $selected{'DCIPHER'}{'AES-256-CBC'} = '';
3322 $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
3323 $checked{'DCOMPLZO'}{'off'} = '';
3324 $checked{'DCOMPLZO'}{'on'} = '';
3325 $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
d96c89eb
AH		 3326# m.a.d
3327 $checked{'MSSFIX'}{'off'} = '';
3328 $checked{'MSSFIX'}{'on'} = '';
3329 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
6e13d0a5 3330#new settings
c6c9630e
MT		 3331 &Header::showhttpheaders();
3332 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
3333 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
6e13d0a5 3334
c6c9630e 3335 if ($errormessage) {
6e13d0a5
MT		 3336 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3337 print "<class name='base'>$errormessage\n";
3338 print "&nbsp;</class>\n";
3339 &Header::closebox();
c6c9630e 3340 }
6e13d0a5 3341
c6c9630e
MT		 3342 my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
3343 my $srunning = "no";
3344 my $activeonrun = "";
3345 if ( -e "/var/run/openvpn.pid"){
6e13d0a5
MT		 3346 $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
3347 $srunning ="yes";
3348 $activeonrun = "";
c6c9630e 3349 } else {
6e13d0a5 3350 $activeonrun = "disabled='disabled'";
c6c9630e 3351 }
afabe9f7 3352 &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
c6c9630e
MT		 3353 print <<END
3354 <table width='100%'>
3355 <form method='post'>
3356 <td width='25%'>&nbsp;</td>
3357 <td width='25%'>&nbsp;</td>
3358 <td width='25%'>&nbsp;</td></tr>
3359 <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
3360 <td align='left'>$sactive</td>
3361 <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
3362 <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
3363END
3364;
3365 if (&haveBlueNet()) {
3366 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
3367 print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
3368 }
3369 if (&haveOrangeNet()) {
3370 print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
3371 print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
3372 }
3373 print <<END
4e17adad
CS		 3374 <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
3375 <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
c6c9630e
MT		 3376 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
3377 <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
ee79343e
JPT		 3378 <!-- this is still not working
3379 <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
c6c9630e
MT		 3380 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3381 <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
3382 <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
3383 <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3384 <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
3385 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
3386 <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
3387 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
3388 <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
3389 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
3390 <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
3391 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
3392 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
3393 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
3394 <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
3395 <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
3396 <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
3397 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
3398 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
3399 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
3400 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
3401 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td>
3402END
3403;
3404
3405 if ( $srunning eq "yes" ) {
3406 print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' /></td>";
3407 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' disabled='disabled'/></td>";
3408 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td>";
3409 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3410 } else{
3411 print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>";
3412 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' /></td>";
3413 if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
3414 -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
3415 -e "${General::swroot}/ovpn/certs/servercert.pem" &&
3416 -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
3417 (( $cgiparams{'ENABLED'} eq 'on') ||
3418 ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3419 ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
3420 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td>";
3421 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3422 } else {
3423 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td>";
3424 print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' disabled='disabled' /></td></tr>";
3425 }
3426 }
3427 print "</form></table>";
3428 &Header::closebox();
3429 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
3430 print <<EOF#'
3431 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3432 <tr>
3433 <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
6e13d0a5
MT		 3434 <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
3435 <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
c6c9630e 3436 </tr>
6e13d0a5
MT		 3437EOF
3438 ;
c6c9630e 3439 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
6e13d0a5
MT		 3440 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
3441 $casubject =~ /Subject: (.*)[\n]/;
3442 $casubject = $1;
3443 $casubject =~ s+/Email+, E+;
3444 $casubject =~ s/ ST=/ S=/;
c6c9630e 3445
6e13d0a5 3446 print <<END
4e17adad 3447 <tr bgcolor='$color{'color22'}'>
c6c9630e
MT		 3448 <td class='base'>$Lang::tr{'root certificate'}</td>
3449 <td class='base'>$casubject</td>
3450 <form method='post' name='frmrootcrta'><td width='3%' align='center'>
3451 <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
3452 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
3453 </td></form>
3454 <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
438dd0cc 3455 <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
6e13d0a5 3456 <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
c6c9630e
MT		 3457 </td></form>
3458 <td width='4%'>&nbsp;</td></tr>
6e13d0a5
MT		 3459END
3460 ;
c6c9630e 3461 } else {
6e13d0a5
MT		 3462 # display rootcert generation buttons
3463 print <<END
4e17adad 3464 <tr bgcolor='$color{'color22'}'>
6e13d0a5
MT		 3465 <td class='base'>$Lang::tr{'root certificate'}:</td>
3466 <td class='base'>$Lang::tr{'not present'}</td>
3467 <td colspan='3'>&nbsp;</td></tr>
3468END
3469 ;
c6c9630e 3470 }
6e13d0a5 3471
c6c9630e 3472 if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
6e13d0a5
MT		 3473 my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
3474 $hostsubject =~ /Subject: (.*)[\n]/;
3475 $hostsubject = $1;
3476 $hostsubject =~ s+/Email+, E+;
3477 $hostsubject =~ s/ ST=/ S=/;
c6c9630e 3478
6e13d0a5 3479 print <<END
4e17adad 3480 <tr bgcolor='$color{'color20'}'>
6e13d0a5
MT		 3481 <td class='base'>$Lang::tr{'host certificate'}</td>
3482 <td class='base'>$hostsubject</td>
3483 <form method='post' name='frmhostcrta'><td width='3%' align='center'>
c6c9630e
MT		 3484 <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
3485 <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
6e13d0a5
MT		 3486 </td></form>
3487 <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
438dd0cc 3488 <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
c6c9630e 3489 <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
6e13d0a5
MT		 3490 </td></form>
3491 <td width='4%'>&nbsp;</td></tr>
3492END
3493 ;
c6c9630e 3494 } else {
6e13d0a5
MT		 3495 # Nothing
3496 print <<END
4e17adad 3497 <tr bgcolor='$color{'color20'}'>
6e13d0a5
MT		 3498 <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
3499 <td class='base'>$Lang::tr{'not present'}</td>
3500 </td><td colspan='3'>&nbsp;</td></tr>
3501END
3502 ;
c6c9630e 3503 }
6e13d0a5 3504
c6c9630e
MT		 3505 if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3506 print "<tr><td colspan='5' align='center'><form method='post'>";
6e13d0a5 3507 print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
c6c9630e
MT		 3508 print "</form></td></tr>\n";
3509 }
6e13d0a5 3510
c6c9630e 3511 if (keys %cahash > 0) {
6e13d0a5 3512 foreach my $key (keys %cahash) {
c6c9630e 3513 if (($key + 1) % 2) {
4e17adad 3514 print "<tr bgcolor='$color{'color20'}'>\n";
c6c9630e 3515 } else {
4e17adad 3516 print "<tr bgcolor='$color{'color22'}'>\n";
c6c9630e
MT		 3517 }
3518 print "<td class='base'>$cahash{$key}[0]</td>\n";
3519 print "<td class='base'>$cahash{$key}[1]</td>\n";
3520 print <<END
3521 <form method='post' name='cafrm${key}a'><td align='center'>
6e13d0a5
MT		 3522 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
3523 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
3524 <input type='hidden' name='KEY' value='$key' />
c6c9630e
MT		 3525 </td></form>
3526 <form method='post' name='cafrm${key}b'><td align='center'>
438dd0cc 3527 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
6e13d0a5
MT		 3528 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
3529 <input type='hidden' name='KEY' value='$key' />
c6c9630e
MT		 3530 </td></form>
3531 <form method='post' name='cafrm${key}c'><td align='center'>
6e13d0a5
MT		 3532 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
3533 <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
3534 <input type='hidden' name='KEY' value='$key' />
c6c9630e 3535 </td></form></tr>
6e13d0a5
MT		 3536END
3537 ;
3538 }
c6c9630e
MT		 3539 }
3540
3541 print "</table>";
3542
3543 # If the file contains entries, print Key to action icons
3544 if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
3545 print <<END
3546 <table>
3547 <tr>
6e13d0a5
MT		 3548 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
3549 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
3550 <td class='base'>$Lang::tr{'show certificate'}</td>
438dd0cc 3551 <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
6e13d0a5 3552 <td class='base'>$Lang::tr{'download certificate'}</td>
c6c9630e
MT		 3553 </tr>
3554 </table>
6e13d0a5
MT		 3555END
3556 ;
c6c9630e
MT		 3557 }
3558 print <<END
3559 <form method='post' enctype='multipart/form-data'>
3560 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3561 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td>
3562 <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' />
3563 <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td>
4e17adad 3564 <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /><br /><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
c6c9630e 3565 </tr></table></form>
6e13d0a5
MT		 3566END
3567 ;
c6c9630e
MT		 3568
3569 &Header::closebox();
3570 if ( $srunning eq "yes" ) {
6e13d0a5 3571 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
c6c9630e
MT		 3572 }else{
3573 print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
3574 }
3575 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
ce9abb66
AH		 3576
3577###
3578# m.a.d Client Status Table
3579###
3580
c6c9630e
MT		 3581 &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
3582 print <<END
ce9abb66
AH		 3583
3584
c6c9630e
MT		 3585 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3586<tr>
3587 <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3588 <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
3589 <td width='18%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></td>
3590 <td width='17%' class='boldbase' align='center'><b>$Lang::tr{'valid till'}</b></td>
3591 <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
3592 <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
3593 <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
3594</tr>
6e13d0a5 3595END
c6c9630e
MT		 3596 ;
3597 my $id = 0;
3598 my $gif;
3599 foreach my $key (keys %confighash) {
3600 if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
3601
3602 if ($id % 2) {
4e17adad 3603 print "<tr bgcolor='$color{'color20'}'>\n";
bb89e92a 3604 } else {
4e17adad 3605 print "<tr bgcolor='$color{'color22'}'>\n";
c6c9630e
MT		 3606 }
3607 print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
3608 print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
3609 if ($confighash{$key}[4] eq 'cert') {
3610 print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
3611 } else {
3612 print "<td align='left'>&nbsp;</td>";
3613 }
3614 my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
3615 $cavalid =~ /Not After : (.*)[\n]/;
3616 $cavalid = $1;
3617 print "<td align='center'>$cavalid</td>";
3618 print "<td align='center'>$confighash{$key}[25]</td>";
ce9abb66 3619
c6c9630e 3620 my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
ce9abb66 3621
c6c9630e
MT		 3622 if ($confighash{$key}[0] eq 'off') {
3623 $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3624 } else {
ce9abb66
AH		 3625
3626###
3627# m.a.d net2net Status
3628###
3629
3630 if ($confighash{$cgiparams{'KEY'}}[3] eq 'host'){
3631
c6c9630e 3632 my $cn;
ce9abb66 3633 my @match = ();
c6c9630e 3634 foreach my $line (@status) {
ce9abb66 3635
c6c9630e
MT		 3636 chomp($line);
3637 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3638 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3639 if ($match[1] ne "Common Name") {
3640 $cn = $match[1];
3641 }
3642 $cn =~ s/[_]/ /g;
3643 if ($cn eq "$confighash{$key}[2]") {
ce9abb66 3644 $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
c6c9630e 3645 }
ce9abb66
AH		 3646 }
3647 }
3648 } else {
3649 my @tempovpnsubnet = split("\/",$confighash{$key}[27]);
3650 my @ovpnip = split /\./,$tempovpnsubnet[0];
3651 my $pingip = "";
3652
3653 if ($confighash{$key}[6] eq 'server') {
3654 $pingip = "$ovpnip[0].$ovpnip[1].$ovpnip[2].2";
3655 } else {
3656 $pingip = "$ovpnip[0].$ovpnip[1].$ovpnip[2].1";
3657 }
3658
3659 my $p = Net::Ping->new("udp",1);
3660
3661 if ($p->ping($pingip)) {
3662 $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
3663 }
3664 $p->close();
3665
3666 }
c6c9630e 3667 }
ce9abb66
AH		 3668
3669###
3670# m.a.d net2net Status end
3671###
3672
3673
c6c9630e
MT		 3674 my $disable_clientdl = "disabled='disabled'";
3675 if (( $cgiparams{'ENABLED'} eq 'on') ||
3676 ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3677 ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
3678 $disable_clientdl = "";
3679 }
3680 print <<END
3681 <td align='center'>$active</td>
3682
3683 <form method='post' name='frm${key}a'><td align='center'>
3684 <input type='image' name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
3685 <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
3686 <input type='hidden' name='KEY' value='$key' $disable_clientdl />
3687 </td></form>
3688END
3689 ;
3690 if ($confighash{$key}[4] eq 'cert') {
3691 print <<END
3692 <form method='post' name='frm${key}b'><td align='center'>
3693 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
3694 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
3695 <input type='hidden' name='KEY' value='$key' />
3696 </td></form>
3697END
3698 ; } else {
3699 print "<td>&nbsp;</td>";
3700 }
3701 if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
3702 print <<END
3703 <form method='post' name='frm${key}c'><td align='center'>
438dd0cc 3704 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
c6c9630e
MT		 3705 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
3706 <input type='hidden' name='KEY' value='$key' />
3707 </td></form>
3708END
3709 ; } elsif ($confighash{$key}[4] eq 'cert') {
3710 print <<END
3711 <form method='post' name='frm${key}c'><td align='center'>
438dd0cc 3712 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
c6c9630e
MT		 3713 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
3714 <input type='hidden' name='KEY' value='$key' />
3715 </td></form>
3716END
3717 ; } else {
3718 print "<td>&nbsp;</td>";
3719 }
3720 print <<END
3721 <form method='post' name='frm${key}d'><td align='center'>
3722 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
3723 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
3724 <input type='hidden' name='KEY' value='$key' />
3725 </td></form>
3726
3727 <form method='post' name='frm${key}e'><td align='center'>
3728 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
3729 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
3730 <input type='hidden' name='KEY' value='$key' />
3731 </td></form>
3732 <form method='post' name='frm${key}f'><td align='center'>
3733 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
3734 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
3735 <input type='hidden' name='KEY' value='$key' />
3736 </td></form>
3737 </tr>
3738END
3739 ;
3740 $id++;
3741 }
3742 ;
3743
3744 # If the config file contains entries, print Key to action icons
3745 if ( $id ) {
3746 print <<END
3747 <table>
3748 <tr>
3749 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
3750 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
3751 <td class='base'>$Lang::tr{'click to disable'}</td>
3752 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
3753 <td class='base'>$Lang::tr{'show certificate'}</td>
3754 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
3755 <td class='base'>$Lang::tr{'edit'}</td>
3756 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
3757 <td class='base'>$Lang::tr{'remove'}</td>
3758 </tr>
3759 <tr>
3760 <td>&nbsp; </td>
3761 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
3762 <td class='base'>$Lang::tr{'click to enable'}</td>
aa7eb426 3763 <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
c6c9630e 3764 <td class='base'>$Lang::tr{'download certificate'}</td>
aa7eb426 3765 <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
c6c9630e
MT		 3766 <td class='base'>$Lang::tr{'dl client arch'}</td>
3767 </tr>
3768 </table>
3769END
3770 ;
3771 }
3772
3773 print <<END
3774 <table width='100%'>
3775 <form method='post'>
3776 <tr><td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
3777 <td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
3778 </form>
3779 </table>
3780END
3781 ;
3782 &Header::closebox();
bb89e92a 3783}
115340d2 3784&Header::closepage();
ce9abb66
AH		 3785
3786
3787
Timo's tree of IPFire 2.x