openvpn ccd: Minor fixes: iroute, delete route line.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2011 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 ###
22 # Based on IPFireCore 55
23 ###
24 use CGI;
25 use CGI qw/:standard/;
26 use Net::DNS;
27 use Net::Ping;
28 use Net::Telnet;
29 use File::Copy;
30 use File::Temp qw/ tempfile tempdir /;
31 use strict;
32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
33 require '/var/ipfire/general-functions.pl';
34 require "${General::swroot}/lang.pl";
35 require "${General::swroot}/header.pl";
36 require "${General::swroot}/countries.pl";
37
38 # enable only the following on debugging purpose
39 #use warnings;
40 #use CGI::Carp 'fatalsToBrowser';
41 #workaround to suppress a warning when a variable is used only once
42 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
43 undef (@dummy);
44
45 my %color = ();
46 my %mainsettings = ();
47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
49
50 ###
51 ### Initialize variables
52 ###
53 my %ccdconfhash=();
54 my %ccdroutehash=();
55 my %ccdroute2hash=();
56 my %netsettings=();
57 my %cgiparams=();
58 my %vpnsettings=();
59 my %checked=();
60 my %confighash=();
61 my %cahash=();
62 my %selected=();
63 my $warnmessage = '';
64 my $errormessage = '';
65 my %settings=();
66 my $routes_push_file = '';
67 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
68 $cgiparams{'ENABLED'} = 'off';
69 $cgiparams{'ENABLED_BLUE'} = 'off';
70 $cgiparams{'ENABLED_ORANGE'} = 'off';
71 $cgiparams{'EDIT_ADVANCED'} = 'off';
72 $cgiparams{'NAT'} = 'off';
73 $cgiparams{'COMPRESSION'} = 'off';
74 $cgiparams{'ONLY_PROPOSED'} = 'off';
75 $cgiparams{'ACTION'} = '';
76 $cgiparams{'CA_NAME'} = '';
77 $cgiparams{'DHCP_DOMAIN'} = '';
78 $cgiparams{'DHCP_DNS'} = '';
79 $cgiparams{'DHCP_WINS'} = '';
80 $cgiparams{'ROUTES_PUSH'} = '';
81 $cgiparams{'DCOMPLZO'} = 'off';
82 $cgiparams{'MSSFIX'} = '';
83 $cgiparams{'number'} = '';
84 $cgiparams{'PMTU_DISCOVERY'} = '';
85 $routes_push_file = "${General::swroot}/ovpn/routes_push";
86 unless (-e $routes_push_file) { system("touch $routes_push_file"); }
87 unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
88 unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
89 unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
90
91 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
92
93 # prepare openvpn config file
94 ###
95 ### Useful functions
96 ###
97 sub haveOrangeNet
98 {
99 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
100 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
101 return 0;
102 }
103
104 sub haveBlueNet
105 {
106 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
107 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
108 return 0;
109 }
110
111 sub sizeformat{
112 my $bytesize = shift;
113 my $i = 0;
114
115 while(abs($bytesize) >= 1024){
116 $bytesize=$bytesize/1024;
117 $i++;
118 last if($i==6);
119 }
120
121 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
122 my $newsize=(int($bytesize*100 +0.5))/100;
123 return("$newsize $units[$i]");
124 }
125
126 sub valid_dns_host {
127 my $hostname = $_[0];
128 unless ($hostname) { return "No hostname"};
129 my $res = new Net::DNS::Resolver;
130 my $query = $res->search("$hostname");
131 if ($query) {
132 foreach my $rr ($query->answer) {
133 ## Potential bug - we are only looking at A records:
134 return 0 if $rr->type eq "A";
135 }
136 } else {
137 return $res->errorstring;
138 }
139 }
140
141 sub cleanssldatabase
142 {
143 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
144 print FILE "01";
145 close FILE;
146 }
147 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
148 print FILE "";
149 close FILE;
150 }
151 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
152 unlink ("${General::swroot}/ovpn/certs/serial.old");
153 unlink ("${General::swroot}/ovpn/certs/01.pem");
154 }
155
156 sub newcleanssldatabase
157 {
158 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
159 open(FILE, ">${General::swroot}(ovpn/certs/serial");
160 print FILE "01";
161 close FILE;
162 }
163 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
164 system ("touch ${General::swroot}/ovpn/certs/index.txt");
165 }
166 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
167 unlink ("${General::swroot}/ovpn/certs/serial.old");
168 }
169
170 sub deletebackupcert
171 {
172 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
173 my $hexvalue = <FILE>;
174 chomp $hexvalue;
175 close FILE;
176 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
177 }
178 }
179
180 sub checkportfw {
181 my $KEY2 = $_[0]; # key2
182 my $SRC_PORT = $_[1]; # src_port
183 my $PROTOCOL = $_[2]; # protocol
184 my $SRC_IP = $_[3]; # sourceip
185
186 my $pfwfilename = "${General::swroot}/portfw/config";
187 open(FILE, $pfwfilename) or die 'Unable to open config file.';
188 my @pfwcurrent = <FILE>;
189 close(FILE);
190 my $pfwkey1 = 0; # used for finding last sequence number used
191 foreach my $pfwline (@pfwcurrent)
192 {
193 my @pfwtemp = split(/\,/,$pfwline);
194
195 chomp ($pfwtemp[8]);
196 if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
197 if ( $SRC_PORT eq $pfwtemp[3] &&
198 $PROTOCOL eq $pfwtemp[2] &&
199 $SRC_IP eq $pfwtemp[7])
200 {
201 $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
202 }
203 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
204 if ( $pfwtemp[1] eq "0") {
205 $pfwkey1=$pfwtemp[0];
206 }
207 # Darren Critchley - Duplicate or overlapping Port range check
208 if ($pfwtemp[1] eq "0" &&
209 $PROTOCOL eq $pfwtemp[2] &&
210 $SRC_IP eq $pfwtemp[7] &&
211 $errormessage eq '')
212 {
213 &portchecks($SRC_PORT, $pfwtemp[5]);
214 # &portchecks($pfwtemp[3], $pfwtemp[5]);
215 # &portchecks($pfwtemp[3], $SRC_IP);
216 }
217 }
218 }
219 # $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
220
221 return;
222 }
223
224 sub checkportoverlap
225 {
226 my $portrange1 = $_[0]; # New port range
227 my $portrange2 = $_[1]; # existing port range
228 my @tempr1 = split(/\:/,$portrange1);
229 my @tempr2 = split(/\:/,$portrange2);
230
231 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
232 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
233
234 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
235 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
236
237 return 1; # Everything checks out!
238 }
239
240 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
241 sub checkportinc
242 {
243 my $port1 = $_[0]; # Port
244 my $portrange2 = $_[1]; # Port range
245 my @tempr1 = split(/\:/,$portrange2);
246
247 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
248 return 1;
249 } else {
250 return 0;
251 }
252 }
253 # Darren Critchley - Duplicate or overlapping Port range check
254 sub portchecks
255 {
256 my $p1 = $_[0]; # New port range
257 my $p2 = $_[1]; # existing port range
258 # $_ = $_[0];
259 our ($prtrange1, $prtrange2);
260 $prtrange1 = 0;
261 # if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
262 # unless (&checkportoverlap($p1,$p2)) {
263 # $errormessage = "$Lang::tr{'source port overlaps'} $p1";
264 # }
265 # }
266 if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
267 unless (&checkportinc($p2,$p1)) {
268 $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
269 }
270 }
271 $prtrange1 = 1;
272 if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
273 unless (&checkportinc($p1,$p2)) {
274 $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
275 }
276 }
277 return;
278 }
279
280 # Darren Critchley - certain ports are reserved for IPFire
281 # TCP 67,68,81,222,445
282 # UDP 67,68
283 # Params passed in -> port, rangeyn, protocol
284 sub disallowreserved
285 {
286 # port 67 and 68 same for tcp and udp, don't bother putting in an array
287 my $msg = "";
288 my @tcp_reserved = (81,222,445);
289 my $prt = $_[0]; # the port or range
290 my $ryn = $_[1]; # tells us whether or not it is a port range
291 my $prot = $_[2]; # protocol
292 my $srcdst = $_[3]; # source or destination
293 if ($ryn) { # disect port range
294 if ($srcdst eq "src") {
295 $msg = "$Lang::tr{'rsvd src port overlap'}";
296 } else {
297 $msg = "$Lang::tr{'rsvd dst port overlap'}";
298 }
299 my @tmprng = split(/\:/,$prt);
300 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
301 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
302 if ($prot eq "tcp") {
303 foreach my $prange (@tcp_reserved) {
304 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
305 }
306 }
307 } else {
308 if ($srcdst eq "src") {
309 $msg = "$Lang::tr{'reserved src port'}";
310 } else {
311 $msg = "$Lang::tr{'reserved dst port'}";
312 }
313 if ($prt == 67) { $errormessage="$msg 67"; return; }
314 if ($prt == 68) { $errormessage="$msg 68"; return; }
315 if ($prot eq "tcp") {
316 foreach my $prange (@tcp_reserved) {
317 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
318 }
319 }
320 }
321 return;
322 }
323
324 sub writeserverconf {
325 my %sovpnsettings = ();
326 my @temp = ();
327 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
328 &read_routepushfile;
329
330 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
331 flock CONF, 2;
332 print CONF "#OpenVPN Server conf\n";
333 print CONF "\n";
334 print CONF "daemon openvpnserver\n";
335 print CONF "writepid /var/run/openvpn.pid\n";
336 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
337 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
338 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
339 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
340 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
341 print CONF "script-security 3 system\n";
342 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
343 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
344 print CONF "tls-server\n";
345 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
346 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
347 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
348 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
349 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
350 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
351 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
352
353 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
354 # If we doesn't use one of them, we can use the configured mtu value.
355 if ($sovpnsettings{'MSSFIX'} eq 'on')
356 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
357 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
358 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
359 elsif (($sovpnsettings{'PMTU_DISCOVERY'} ne 'off') || ($sovpnsettings{'PMTU_DISCOVERY'} ne ''))
360 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
361 else
362 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
363
364 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
365 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
366 foreach (@temp)
367 {
368 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
369 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
370 }
371 }
372 # a.marx ccd
373 my %ccdconfhash=();
374 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
375 foreach my $key (keys %ccdconfhash) {
376 my $a=$ccdconfhash{$key}[1];
377 my ($b,$c) = split (/\//, $a);
378 print CONF "route $b ".&General::cidrtosub($c)."\n";
379 }
380 my %ccdroutehash=();
381 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
382 foreach my $key (keys %ccdroutehash) {
383 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
384 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
385 print CONF "route $a $b\n";
386 }
387 }
388 # ccd end
389
390 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
391 print CONF "client-to-client\n";
392 }
393 if ($sovpnsettings{MSSFIX} eq 'on') {
394 print CONF "mssfix\n";
395 }
396 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
397 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
398 }
399
400 if (($sovpnsettings{PMTU_DISCOVERY} ne 'off') || ($sovpnsettings{'PMTU_DISCOVERY'} ne '')) {
401 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
402 }
403
404 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
405 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
406 }
407 print CONF "status-version 1\n";
408 print CONF "status /var/log/ovpnserver.log 30\n";
409 print CONF "cipher $sovpnsettings{DCIPHER}\n";
410 if ($sovpnsettings{DCOMPLZO} eq 'on') {
411 print CONF "comp-lzo\n";
412 }
413 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
414 print CONF "push \"redirect-gateway def1\"\n";
415 }
416 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
417 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
418 }
419
420 if ($sovpnsettings{DHCP_DNS} ne '') {
421 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
422 }
423
424 if ($sovpnsettings{DHCP_WINS} ne '') {
425 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
426 }
427
428 if ($sovpnsettings{DHCP_WINS} eq '') {
429 print CONF "max-clients 100\n";
430 }
431 if ($sovpnsettings{DHCP_WINS} ne '') {
432 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
433 }
434 print CONF "tls-verify /var/ipfire/ovpn/verify\n";
435 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
436 print CONF "user nobody\n";
437 print CONF "group nobody\n";
438 print CONF "persist-key\n";
439 print CONF "persist-tun\n";
440 if ($sovpnsettings{LOG_VERB} ne '') {
441 print CONF "verb $sovpnsettings{LOG_VERB}\n";
442 } else {
443 print CONF "verb 3\n";
444 }
445 print CONF "\n";
446
447 close(CONF);
448 }
449
450 sub emptyserverlog{
451 if (open(FILE, ">/var/log/ovpnserver.log")) {
452 flock FILE, 2;
453 print FILE "";
454 close FILE;
455 }
456
457 }
458
459 sub delccdnet
460 {
461 my %ccdconfhash = ();
462 my %ccdhash = ();
463 my $ccdnetname=$_[0];
464 if (-f "${General::swroot}/ovpn/ovpnconfig"){
465 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
466 foreach my $key (keys %ccdhash) {
467 if ($ccdhash{$key}[32] eq $ccdnetname) {
468 $errormessage=$Lang::tr{'ccd err hostinnet'};
469 return;
470 }
471 }
472 }
473 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
474 foreach my $key (keys %ccdconfhash) {
475 if ($ccdconfhash{$key}[0] eq $ccdnetname){
476 delete $ccdconfhash{$key};
477 }
478 }
479 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
480
481 &writeserverconf;
482 return 0;
483 }
484
485 sub addccdnet
486 {
487 my %ccdconfhash=();
488 my @ccdconf=();
489 my $ccdname=$_[0];
490 my $ccdnet=$_[1];
491 my $ovpnsubnet=$_[2];
492 my $subcidr;
493 my @ip2=();
494 my $checkup;
495 my $ccdip;
496 my $baseaddress;
497 if(!&General::validhostname($ccdname)){
498 $errormessage=$Lang::tr{'ccd err invalidname'};
499 return;
500 }
501 #check ip
502 if (&General::validipandmask($ccdnet)){
503 $ccdnet=&General::iporsubtocidr($ccdnet);
504 }else{
505 $errormessage=$Lang::tr{'ccd err invalidnet'};
506 return;
507 }
508 ($ccdip,$subcidr) = split (/\//,$ccdnet);
509 if ($ccdname eq '') {
510 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
511 }
512 #check if we try to use same network as ovpn server
513 if (&General::iporsubtocidr($ccdnet) eq &General::iporsubtocidr($ovpnsubnet)) {
514 $errormessage=$errormessage.$Lang::tr{'ccd err isovpnnet'}."<br>";
515 }
516
517 #check if we use a name/subnet that already exists
518 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
519 foreach my $key (keys %ccdconfhash) {
520 @ccdconf=split(/\//,$ccdconfhash{$key}[1]);
521 if ($ccdname eq $ccdconfhash{$key}[0]) {$errormessage=$errormessage.$Lang::tr{'ccd err nameexist'}."<br>";}
522 my ($newip,$newsub) = split(/\//,$ccdnet);
523 if (&General::IpInSubnet($newip,$ccdconf[0],&General::iporsubtodec($ccdconf[1]))) {$errormessage=$errormessage.$Lang::tr{'ccd err issubnet'}."<br>";}
524
525 }
526 #check if we use one of ipfire's networks (green,orange,blue)
527 my %ownnet=();
528 &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
529 if (($ownnet{'GREEN_NETADDRESS'} ne '' && $ownnet{'GREEN_NETADDRESS'} ne '0.0.0.0') && &General::IpInSubnet($ownnet{'GREEN_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err green'};}
530 if (($ownnet{'ORANGE_NETADDRESS'} ne '' && $ownnet{'ORANGE_NETADDRESS'} ne '0.0.0.0') && &General::IpInSubnet($ownnet{'ORANGE_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err orange'};}
531 if (($ownnet{'BLUE_NETADDRESS'} ne '' && $ownnet{'BLUE_NETADDRESS'} ne '0.0.0.0') && &General::IpInSubnet($ownnet{'BLUE_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err blue'};}
532 if (($ownnet{'RED_NETADDRESS'} ne '' && $ownnet{'RED_NETADDRESS'} ne '0.0.0.0') && &General::IpInSubnet($ownnet{'RED_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err red'};}
533
534
535 if (!$errormessage) {
536 my %ccdconfhash=();
537 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
538 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
539 my $key = &General::findhasharraykey (\%ccdconfhash);
540 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
541 $ccdconfhash{$key}[0] = $ccdname;
542 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
543 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
544 &writeserverconf;
545 $cgiparams{'ccdname'}='';
546 $cgiparams{'ccdsubnet'}='';
547 return 1;
548 }
549 }
550
551 sub modccdnet
552 {
553
554 my $newname=$_[0];
555 my $oldname=$_[1];
556 my %ccdconfhash=();
557 my %ccdhash=();
558 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
559 foreach my $key (keys %ccdconfhash) {
560 if ($ccdconfhash{$key}[0] eq $oldname) {
561 foreach my $key1 (keys %ccdconfhash) {
562 if ($ccdconfhash{$key1}[0] eq $newname){
563 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
564 return;
565 }else{
566 $ccdconfhash{$key}[0]= $newname;
567 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
568 last;
569 }
570 }
571 }
572 }
573
574 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
575 foreach my $key (keys %ccdhash) {
576 if ($ccdhash{$key}[32] eq $oldname) {
577 $ccdhash{$key}[32]=$newname;
578 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
579 last;
580 }
581 }
582
583 return 0;
584 }
585 sub ccdmaxclients
586 {
587 my $ccdnetwork=$_[0];
588 my @octets=();
589 my @subnet=();
590 @octets=split("\/",$ccdnetwork);
591 @subnet= split /\./, &General::cidrtosub($octets[1]);
592 my ($a,$b,$c,$d,$e);
593 $a=256-$subnet[0];
594 $b=256-$subnet[1];
595 $c=256-$subnet[2];
596 $d=256-$subnet[3];
597 $e=($a*$b*$c*$d)/4;
598 return $e-1;
599 }
600
601 sub getccdadresses
602 {
603 my $ipin=$_[0];
604 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
605 my $cidr=$_[1];
606 chomp($cidr);
607 my $count=$_[2];
608 my $hasip=$_[3];
609 chomp($hasip);
610 my @iprange=();
611 my %ccdhash=();
612 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
613 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
614 for (my $i=0;$i<=$count-1;$i++) {
615 my $tmpip=$iprange[$i-1];
616 my $stepper=$i*4;
617 $iprange[$i]= &General::getnextip($tmpip,4);
618 }
619 my $r=0;
620 foreach my $key (keys %ccdhash) {
621 $r=0;
622 foreach my $tmp (@iprange){
623 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
624 if ($net eq $tmp) {
625 if ( $hasip ne $ccdhash{$key}[33] ){
626 splice (@iprange,$r,1);
627 }
628 }
629 $r++;
630 }
631 }
632 return @iprange;
633 }
634
635 sub fillselectbox
636 {
637 my $boxname=$_[1];
638 my ($ccdip,$subcidr) = split("/",$_[0]);
639 my $tz=$_[2];
640 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
641 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
642 foreach (@allccdips) {
643 my $ip=$_."/30";
644 chomp($ip);
645 print "<option value='$ip' ";
646 if ( $ip eq $cgiparams{$boxname} ){
647 print"selected";
648 }
649 print ">$ip</option>";
650 }
651 print "</select>";
652 }
653
654 sub hostsinnet
655 {
656 my $name=$_[0];
657 my %ccdhash=();
658 my $i=0;
659 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
660 foreach my $key (keys %ccdhash) {
661 if ($ccdhash{$key}[32] eq $name){ $i++;}
662 }
663 return $i;
664 }
665
666 sub check_routes_push
667 {
668 my $val=$_[0];
669 my ($ip,$cidr) = split (/\//, $val);
670 ##check for existing routes in routes_push
671 if (-e "${General::swroot}/ovpn/routes_push") {
672 open(FILE,"${General::swroot}/ovpn/routes_push");
673 while (<FILE>) {
674 $_=~s/\s*$//g;
675
676 my ($ip2,$cidr2) = split (/\//,"$_");
677 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
678
679 if($val eq $val2){
680 return 0;
681 }
682 #subnetcheck
683 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
684 return 0;
685 }
686 };
687 close(FILE);
688 }
689 return 1;
690 }
691
692 sub check_ccdroute
693 {
694 my %ccdroutehash=();
695 my $val=$_[0];
696 my ($ip,$cidr) = split (/\//, $val);
697 #check for existing routes in ccdroute
698 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
699 foreach my $key (keys %ccdroutehash) {
700 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
701 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
702 return 0;
703 }
704 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
705 #subnetcheck
706 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
707 return 0;
708 }
709 }
710 }
711 return 1;
712 }
713 sub check_ccdconf
714 {
715 my %ccdconfhash=();
716 my $val=$_[0];
717 my ($ip,$cidr) = split (/\//, $val);
718 #check for existing routes in ccdroute
719 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
720 foreach my $key (keys %ccdconfhash) {
721 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
722 return 0;
723 }
724 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
725 #subnetcheck
726 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
727 return 0;
728 }
729
730 }
731 return 1;
732 }
733
734 ###
735 # m.a.d net2net
736 ###
737
738 sub validdotmask
739 {
740 my $ipdotmask = $_[0];
741 if (&General::validip($ipdotmask)) { return 0; }
742 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
743 my $mask = $2;
744 if (($mask =~ /\./ )) { return 0; }
745 return 1;
746 }
747
748 # -------------------------------------------------------------------
749
750 sub write_routepushfile
751 {
752 open(FILE, ">$routes_push_file");
753 flock(FILE, 2);
754 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
755 print FILE $vpnsettings{'ROUTES_PUSH'};
756 }
757 close(FILE);
758 }
759
760 sub read_routepushfile
761 {
762 if (-e "$routes_push_file") {
763 open(FILE,"$routes_push_file");
764 delete $vpnsettings{'ROUTES_PUSH'};
765 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
766 close(FILE);
767 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
768
769 }
770 }
771
772
773 #hier die refresh page
774 if ( -e "${General::swroot}/ovpn/gencanow") {
775 my $refresh = '';
776 $refresh = "<meta http-equiv='refresh' content='15;' />";
777 &Header::showhttpheaders();
778 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
779 &Header::openbigbox('100%', 'center');
780 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
781 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
782 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
783 &Header::closebox();
784 &Header::closebigbox();
785 &Header::closepage();
786 exit (0);
787 }
788 ##hier die refresh page
789
790
791 ###
792 ### OpenVPN Server Control
793 ###
794 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
795 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
796 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
797 #start openvpn server
798 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
799 &emptyserverlog();
800 system('/usr/local/bin/openvpnctrl', '-s');
801 }
802 #stop openvpn server
803 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
804 system('/usr/local/bin/openvpnctrl', '-k');
805 &emptyserverlog();
806 }
807 # #restart openvpn server
808 # if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
809 #workarund, till SIGHUP also works when running as nobody
810 # system('/usr/local/bin/openvpnctrl', '-r');
811 # &emptyserverlog();
812 # }
813 }
814
815 ###
816 ### Save Advanced options
817 ###
818
819 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
820 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
821 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
822 #DAN this value has to leave.
823 #new settings for daemon
824 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
825 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
826 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
827 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
828 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
829 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
830 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
831 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
832 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
833 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
834 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
835 my @temp=();
836
837 if ($cgiparams{'FRAGMENT'} eq '') {
838 delete $vpnsettings{'FRAGMENT'};
839 } else {
840 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
841 $errormessage = "Incorrect value, please insert only numbers.";
842 goto ADV_ERROR;
843 } else {
844 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
845 }
846 }
847 if ($cgiparams{'MSSFIX'} ne 'on') {
848 delete $vpnsettings{'MSSFIX'};
849 } else {
850 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
851 }
852
853 if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') {
854 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
855 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
856 goto ADV_ERROR;
857 }
858 }
859
860 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
861 unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
862 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
863 goto ADV_ERROR;
864 }
865 }
866 if ($cgiparams{'DHCP_DNS'} ne ''){
867 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
868 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
869 goto ADV_ERROR;
870 }
871 }
872 if ($cgiparams{'DHCP_WINS'} ne ''){
873 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
874 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
875 goto ADV_ERROR;
876 }
877 }
878 if ($cgiparams{'ROUTES_PUSH'} ne ''){
879 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
880 undef $vpnsettings{'ROUTES_PUSH'};
881
882 foreach my $tmpip (@temp)
883 {
884 s/^\s+//g; s/\s+$//g;
885
886 if ($tmpip)
887 {
888 $tmpip=~s/\s*$//g;
889 unless (&General::validipandmask($tmpip)) {
890 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
891 goto ADV_ERROR;
892 }
893 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
894
895 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
896 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
897 goto ADV_ERROR;
898 }
899 # a.marx ccd
900 my %ccdroutehash=();
901 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
902 foreach my $key (keys %ccdroutehash) {
903 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
904 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
905 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
906 goto ADV_ERROR;
907 }
908 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
909 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
910 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
911 goto ADV_ERROR;
912 }
913 }
914 }
915
916 # ccd end
917
918 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
919 }
920 }
921 &write_routepushfile;
922 undef $vpnsettings{'ROUTES_PUSH'};
923 }
924 else {
925 undef $vpnsettings{'ROUTES_PUSH'};
926 &write_routepushfile;
927 }
928 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
929 $errormessage = $Lang::tr{'invalid input for max clients'};
930 goto ADV_ERROR;
931 }
932 if ($cgiparams{'KEEPALIVE_1'} ne '') {
933 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
934 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
935 goto ADV_ERROR;
936 }
937 }
938 if ($cgiparams{'KEEPALIVE_2'} ne ''){
939 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
940 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
941 goto ADV_ERROR;
942 }
943 }
944 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
945 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
946 goto ADV_ERROR;
947 }
948
949 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
950 &writeserverconf();#hier ok
951 }
952
953 ###
954 # m.a.d net2net
955 ###
956
957 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
958 {
959
960 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
961 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
962 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
963 my $tunmtu = '';
964
965 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
966 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
967
968 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
969
970 flock SERVERCONF, 2;
971 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
972 print SERVERCONF "\n";
973 print SERVERCONF "# User Security\n";
974 print SERVERCONF "user nobody\n";
975 print SERVERCONF "group nobody\n";
976 print SERVERCONF "persist-tun\n";
977 print SERVERCONF "persist-key\n";
978 print SERVERCONF "script-security 2\n";
979 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
980 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
981 print SERVERCONF "float\n";
982 print SERVERCONF "# IP adresses of the VPN Subnet\n";
983 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
984 print SERVERCONF "# Client Gateway Network\n";
985 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
986 print SERVERCONF "# tun Device\n";
987 print SERVERCONF "dev tun\n";
988 print SERVERCONF "# Port and Protokol\n";
989 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
990
991 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
992 print SERVERCONF "proto tcp-server\n";
993 print SERVERCONF "# Packet size\n";
994 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
995 print SERVERCONF "tun-mtu $tunmtu\n";
996 }
997
998 if ($cgiparams{'PROTOCOL'} eq 'udp') {
999 print SERVERCONF "proto udp\n";
1000 print SERVERCONF "# Paketsize\n";
1001 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1002 print SERVERCONF "tun-mtu $tunmtu\n";
1003 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1004 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
1005 }
1006 if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne '')) {
1007 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1008 if($cgiparams{'MTU'} eq '1500') {
1009 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1010 }
1011 }
1012 }
1013 print SERVERCONF "# Auth. Server\n";
1014 print SERVERCONF "tls-server\n";
1015 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
1016 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
1017 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
1018 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
1019 print SERVERCONF "# Cipher\n";
1020 print SERVERCONF "cipher AES-256-CBC\n";
1021 if ($cgiparams{'COMPLZO'} eq 'on') {
1022 print SERVERCONF "# Enable Compression\n";
1023 print SERVERCONF "comp-lzo\r\n";
1024 }
1025 print SERVERCONF "# Debug Level\n";
1026 print SERVERCONF "verb 3\n";
1027 print SERVERCONF "# Tunnel check\n";
1028 print SERVERCONF "keepalive 10 60\n";
1029 print SERVERCONF "# Start as daemon\n";
1030 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1031 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1032 print SERVERCONF "# Activate Management Interface and Port\n";
1033 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1034 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1035 close(SERVERCONF);
1036
1037 }
1038
1039 ###
1040 # m.a.d net2net
1041 ###
1042
1043 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1044 {
1045 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
1046 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1047 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
1048 my $tunmtu = '';
1049
1050 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1051 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1052
1053 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1054
1055 flock CLIENTCONF, 2;
1056 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1057 print CLIENTCONF "#\n";
1058 print CLIENTCONF "# User Security\n";
1059 print CLIENTCONF "user nobody\n";
1060 print CLIENTCONF "group nobody\n";
1061 print CLIENTCONF "persist-tun\n";
1062 print CLIENTCONF "persist-key\n";
1063 print CLIENTCONF "script-security 2\n";
1064 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1065 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1066 print CLIENTCONF "float\n";
1067 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1068 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1069 print CLIENTCONF "# Server Gateway Network\n";
1070 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1071 print CLIENTCONF "# tun Device\n";
1072 print CLIENTCONF "dev tun\n";
1073 print CLIENTCONF "# Port and Protokol\n";
1074 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1075
1076 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1077 print CLIENTCONF "proto tcp-client\n";
1078 print CLIENTCONF "# Packet size\n";
1079 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1080 print CLIENTCONF "tun-mtu $tunmtu\n";
1081 }
1082
1083 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1084 print CLIENTCONF "proto udp\n";
1085 print CLIENTCONF "# Paketsize\n";
1086 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1087 print CLIENTCONF "tun-mtu $tunmtu\n";
1088 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1089 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1090 }
1091 if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne '')) {
1092 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1093 if ($cgiparams{'MTU'} eq '1500') {
1094 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1095 }
1096 }
1097 }
1098 print CLIENTCONF "ns-cert-type server\n";
1099 print CLIENTCONF "# Auth. Client\n";
1100 print CLIENTCONF "tls-client\n";
1101 print CLIENTCONF "# Cipher\n";
1102 print CLIENTCONF "cipher AES-256-CBC\n";
1103 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1104 if ($cgiparams{'COMPLZO'} eq 'on') {
1105 print CLIENTCONF "# Enable Compression\n";
1106 print CLIENTCONF "comp-lzo\r\n";
1107 }
1108 print CLIENTCONF "# Debug Level\n";
1109 print CLIENTCONF "verb 3\n";
1110 print CLIENTCONF "# Tunnel check\n";
1111 print CLIENTCONF "keepalive 10 60\n";
1112 print CLIENTCONF "# Start as daemon\n";
1113 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1114 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1115 print CLIENTCONF "# Activate Management Interface and Port\n";
1116 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1117 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1118 close(CLIENTCONF);
1119
1120 }
1121
1122 ###
1123 ### Save main settings
1124 ###
1125
1126
1127 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1128 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1129 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1130 #DAN this value has to leave.
1131 if ($cgiparams{'ENABLED'} eq 'on'){
1132 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1133 $errormessage = $Lang::tr{'invalid input for hostname'};
1134 goto SETTINGS_ERROR;
1135 }
1136 }
1137 if ($cgiparams{'ENABLED'} eq 'on'){
1138 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
1139 }
1140 if ($errormessage) { goto SETTINGS_ERROR; }
1141
1142
1143 if ($cgiparams{'ENABLED'} eq 'on'){
1144 &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
1145 }
1146
1147 if ($errormessage) { goto SETTINGS_ERROR; }
1148
1149 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1150 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1151 goto SETTINGS_ERROR;
1152 }
1153 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1154
1155 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1156 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1157 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1158 goto SETTINGS_ERROR;
1159 }
1160
1161 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1162 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1163 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1164 goto SETTINGS_ERROR;
1165 }
1166
1167 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1168 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1169 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1170 goto SETTINGS_ERROR;
1171 }
1172
1173 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1174 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1175 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1176 goto SETTINGS_ERROR;
1177 }
1178 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1179 while (<ALIASES>)
1180 {
1181 chomp($_);
1182 my @tempalias = split(/\,/,$_);
1183 if ($tempalias[1] eq 'on') {
1184 if (&General::IpInSubnet ($tempalias[0] ,
1185 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1186 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1187 }
1188 }
1189 }
1190 close(ALIASES);
1191 if ($errormessage ne ''){
1192 goto SETTINGS_ERROR;
1193 }
1194 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1195 $errormessage = $Lang::tr{'invalid input'};
1196 goto SETTINGS_ERROR;
1197 }
1198 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1199 $errormessage = $Lang::tr{'invalid mtu input'};
1200 goto SETTINGS_ERROR;
1201 }
1202
1203 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1204 $errormessage = $Lang::tr{'invalid port'};
1205 goto SETTINGS_ERROR;
1206 }
1207 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1208 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1209 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1210 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1211 #new settings for daemon
1212 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1213 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1214 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1215 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1216 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1217 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1218 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1219 #wrtie enable
1220
1221 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1222 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1223 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1224 #new settings for daemon
1225 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1226 &writeserverconf();#hier ok
1227 SETTINGS_ERROR:
1228 ###
1229 ### Reset all step 2
1230 ###
1231 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1232 my $file = '';
1233 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1234
1235 foreach my $key (keys %confighash) {
1236 if ($confighash{$key}[4] eq 'cert') {
1237 delete $confighash{$cgiparams{'$key'}};
1238 }
1239 }
1240 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1241 unlink $file
1242 }
1243 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1244 unlink $file
1245 }
1246 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1247 unlink $file
1248 }
1249 &cleanssldatabase();
1250 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1251 print FILE "";
1252 close FILE;
1253 }
1254 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1255 #&writeserverconf();
1256 ###
1257 ### Reset all step 1
1258 ###
1259 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1260 &Header::showhttpheaders();
1261 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1262 &Header::openbigbox('100%', 'LEFT', '', '');
1263 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1264 print <<END
1265 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1266 <tr><td align='center'>
1267 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1268 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1269 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1270 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1271 </form></table>
1272 END
1273 ;
1274 &Header::closebox();
1275 &Header::closebigbox();
1276 &Header::closepage();
1277 exit (0);
1278
1279 ###
1280 ### Upload CA Certificate
1281 ###
1282 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1283 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1284
1285 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1286 $errormessage = $Lang::tr{'name must only contain characters'};
1287 goto UPLOADCA_ERROR;
1288 }
1289
1290 if (length($cgiparams{'CA_NAME'}) >60) {
1291 $errormessage = $Lang::tr{'name too long'};
1292 goto VPNCONF_ERROR;
1293 }
1294
1295 if ($cgiparams{'CA_NAME'} eq 'ca') {
1296 $errormessage = $Lang::tr{'name is invalid'};
1297 goto UPLOAD_CA_ERROR;
1298 }
1299
1300 # Check if there is no other entry with this name
1301 foreach my $key (keys %cahash) {
1302 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1303 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1304 goto UPLOADCA_ERROR;
1305 }
1306 }
1307
1308 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1309 $errormessage = $Lang::tr{'there was no file upload'};
1310 goto UPLOADCA_ERROR;
1311 }
1312 # Move uploaded ca to a temporary file
1313 (my $fh, my $filename) = tempfile( );
1314 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1315 $errormessage = $!;
1316 goto UPLOADCA_ERROR;
1317 }
1318 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1319 if ($temp !~ /CA:TRUE/i) {
1320 $errormessage = $Lang::tr{'not a valid ca certificate'};
1321 unlink ($filename);
1322 goto UPLOADCA_ERROR;
1323 } else {
1324 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1325 if ($? ne 0) {
1326 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1327 unlink ($filename);
1328 goto UPLOADCA_ERROR;
1329 }
1330 }
1331
1332 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1333 $casubject =~ /Subject: (.*)[\n]/;
1334 $casubject = $1;
1335 $casubject =~ s+/Email+, E+;
1336 $casubject =~ s/ ST=/ S=/;
1337 $casubject = &Header::cleanhtml($casubject);
1338
1339 my $key = &General::findhasharraykey (\%cahash);
1340 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1341 $cahash{$key}[1] = $casubject;
1342 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1343 # system('/usr/local/bin/ipsecctrl', 'R');
1344
1345 UPLOADCA_ERROR:
1346
1347 ###
1348 ### Display ca certificate
1349 ###
1350 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1351 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1352
1353 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1354 &Header::showhttpheaders();
1355 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1356 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1357 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1358 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1359 $output = &Header::cleanhtml($output,"y");
1360 print "<pre>$output</pre>\n";
1361 &Header::closebox();
1362 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1363 &Header::closebigbox();
1364 &Header::closepage();
1365 exit(0);
1366 } else {
1367 $errormessage = $Lang::tr{'invalid key'};
1368 }
1369
1370 ###
1371 ### Download ca certificate
1372 ###
1373 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1374 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1375
1376 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1377 print "Content-Type: application/octet-stream\r\n";
1378 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1379 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1380 exit(0);
1381 } else {
1382 $errormessage = $Lang::tr{'invalid key'};
1383 }
1384
1385 ###
1386 ### Remove ca certificate (step 2)
1387 ###
1388 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1389 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1390 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1391
1392 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1393 foreach my $key (keys %confighash) {
1394 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1395 if ($test =~ /: OK/) {
1396 # Delete connection
1397 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1398 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1399 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1400 # }
1401 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1402 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1403 delete $confighash{$key};
1404 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1405 # &writeipsecfiles();
1406 }
1407 }
1408 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1409 delete $cahash{$cgiparams{'KEY'}};
1410 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1411 # system('/usr/local/bin/ipsecctrl', 'R');
1412 } else {
1413 $errormessage = $Lang::tr{'invalid key'};
1414 }
1415 ###
1416 ### Remove ca certificate (step 1)
1417 ###
1418 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1419 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1420 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1421
1422 my $assignedcerts = 0;
1423 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1424 foreach my $key (keys %confighash) {
1425 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1426 if ($test =~ /: OK/) {
1427 $assignedcerts++;
1428 }
1429 }
1430 if ($assignedcerts) {
1431 &Header::showhttpheaders();
1432 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1433 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1434 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1435 print <<END
1436 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1437 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1438 <tr><td align='center'>
1439 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1440 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1441 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1442 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1443 </form></table>
1444 END
1445 ;
1446 &Header::closebox();
1447 &Header::closebigbox();
1448 &Header::closepage();
1449 exit (0);
1450 } else {
1451 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1452 delete $cahash{$cgiparams{'KEY'}};
1453 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1454 # system('/usr/local/bin/ipsecctrl', 'R');
1455 }
1456 } else {
1457 $errormessage = $Lang::tr{'invalid key'};
1458 }
1459
1460 ###
1461 ### Display root certificate
1462 ###
1463 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1464 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1465 my $output;
1466 &Header::showhttpheaders();
1467 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1468 &Header::openbigbox('100%', 'LEFT', '', '');
1469 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1470 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1471 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1472 } else {
1473 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1474 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1475 }
1476 $output = &Header::cleanhtml($output,"y");
1477 print "<pre>$output</pre>\n";
1478 &Header::closebox();
1479 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1480 &Header::closebigbox();
1481 &Header::closepage();
1482 exit(0);
1483
1484 ###
1485 ### Download root certificate
1486 ###
1487 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1488 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1489 print "Content-Type: application/octet-stream\r\n";
1490 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1491 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1492 exit(0);
1493 }
1494
1495 ###
1496 ### Download host certificate
1497 ###
1498 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1499 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1500 print "Content-Type: application/octet-stream\r\n";
1501 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1502 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1503 exit(0);
1504 }
1505 ###
1506 ### Form for generating a root certificate
1507 ###
1508 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1509 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1510
1511 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1512 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1513 $errormessage = $Lang::tr{'valid root certificate already exists'};
1514 $cgiparams{'ACTION'} = '';
1515 goto ROOTCERT_ERROR;
1516 }
1517
1518 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1519 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1520 my $ipaddr = <IPADDR>;
1521 close IPADDR;
1522 chomp ($ipaddr);
1523 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1524 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1525 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1526 }
1527 }
1528 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1529
1530 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1531 $errormessage = $Lang::tr{'there was no file upload'};
1532 goto ROOTCERT_ERROR;
1533 }
1534
1535 # Move uploaded certificate request to a temporary file
1536 (my $fh, my $filename) = tempfile( );
1537 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1538 $errormessage = $!;
1539 goto ROOTCERT_ERROR;
1540 }
1541
1542 # Create a temporary dirctory
1543 my $tempdir = tempdir( CLEANUP => 1 );
1544
1545 # Extract the CA certificate from the file
1546 my $pid = open(OPENSSL, "|-");
1547 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1548 if ($pid) { # parent
1549 if ($cgiparams{'P12_PASS'} ne '') {
1550 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1551 }
1552 close (OPENSSL);
1553 if ($?) {
1554 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1555 unlink ($filename);
1556 goto ROOTCERT_ERROR;
1557 }
1558 } else { # child
1559 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1560 '-in', $filename,
1561 '-out', "$tempdir/cacert.pem")) {
1562 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1563 unlink ($filename);
1564 goto ROOTCERT_ERROR;
1565 }
1566 }
1567
1568 # Extract the Host certificate from the file
1569 $pid = open(OPENSSL, "|-");
1570 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1571 if ($pid) { # parent
1572 if ($cgiparams{'P12_PASS'} ne '') {
1573 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1574 }
1575 close (OPENSSL);
1576 if ($?) {
1577 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1578 unlink ($filename);
1579 goto ROOTCERT_ERROR;
1580 }
1581 } else { # child
1582 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1583 '-in', $filename,
1584 '-out', "$tempdir/hostcert.pem")) {
1585 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1586 unlink ($filename);
1587 goto ROOTCERT_ERROR;
1588 }
1589 }
1590
1591 # Extract the Host key from the file
1592 $pid = open(OPENSSL, "|-");
1593 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1594 if ($pid) { # parent
1595 if ($cgiparams{'P12_PASS'} ne '') {
1596 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1597 }
1598 close (OPENSSL);
1599 if ($?) {
1600 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1601 unlink ($filename);
1602 goto ROOTCERT_ERROR;
1603 }
1604 } else { # child
1605 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1606 '-nodes',
1607 '-in', $filename,
1608 '-out', "$tempdir/serverkey.pem")) {
1609 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1610 unlink ($filename);
1611 goto ROOTCERT_ERROR;
1612 }
1613 }
1614
1615 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1616 if ($? ne 0) {
1617 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1618 unlink ($filename);
1619 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1620 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1621 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1622 goto ROOTCERT_ERROR;
1623 }
1624
1625 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1626 if ($? ne 0) {
1627 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1628 unlink ($filename);
1629 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1630 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1631 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1632 goto ROOTCERT_ERROR;
1633 }
1634
1635 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1636 if ($? ne 0) {
1637 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1638 unlink ($filename);
1639 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1640 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1641 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1642 goto ROOTCERT_ERROR;
1643 }
1644
1645 goto ROOTCERT_SUCCESS;
1646
1647 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1648
1649 # Validate input since the form was submitted
1650 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1651 $errormessage = $Lang::tr{'organization cant be empty'};
1652 goto ROOTCERT_ERROR;
1653 }
1654 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1655 $errormessage = $Lang::tr{'organization too long'};
1656 goto ROOTCERT_ERROR;
1657 }
1658 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1659 $errormessage = $Lang::tr{'invalid input for organization'};
1660 goto ROOTCERT_ERROR;
1661 }
1662 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1663 $errormessage = $Lang::tr{'hostname cant be empty'};
1664 goto ROOTCERT_ERROR;
1665 }
1666 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1667 $errormessage = $Lang::tr{'invalid input for hostname'};
1668 goto ROOTCERT_ERROR;
1669 }
1670 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1671 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1672 goto ROOTCERT_ERROR;
1673 }
1674 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1675 $errormessage = $Lang::tr{'e-mail address too long'};
1676 goto ROOTCERT_ERROR;
1677 }
1678 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1679 $errormessage = $Lang::tr{'invalid input for department'};
1680 goto ROOTCERT_ERROR;
1681 }
1682 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1683 $errormessage = $Lang::tr{'invalid input for city'};
1684 goto ROOTCERT_ERROR;
1685 }
1686 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1687 $errormessage = $Lang::tr{'invalid input for state or province'};
1688 goto ROOTCERT_ERROR;
1689 }
1690 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1691 $errormessage = $Lang::tr{'invalid input for country'};
1692 goto ROOTCERT_ERROR;
1693 }
1694
1695 # Copy the cgisettings to vpnsettings and save the configfile
1696 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1697 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1698 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1699 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1700 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1701 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1702 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1703 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1704
1705 # Replace empty strings with a .
1706 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1707 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1708 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1709
1710 # refresh
1711 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1712
1713 # Create the CA certificate
1714 my $pid = open(OPENSSL, "|-");
1715 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1716 if ($pid) { # parent
1717 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1718 print OPENSSL "$state\n";
1719 print OPENSSL "$city\n";
1720 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1721 print OPENSSL "$ou\n";
1722 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1723 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1724 close (OPENSSL);
1725 if ($?) {
1726 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1727 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1728 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1729 goto ROOTCERT_ERROR;
1730 }
1731 } else { # child
1732 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1733 '-days', '999999', '-newkey', 'rsa:2048',
1734 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1735 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1736 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1737 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1738 goto ROOTCERT_ERROR;
1739 }
1740 }
1741
1742 # Create the Host certificate request
1743 $pid = open(OPENSSL, "|-");
1744 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1745 if ($pid) { # parent
1746 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1747 print OPENSSL "$state\n";
1748 print OPENSSL "$city\n";
1749 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1750 print OPENSSL "$ou\n";
1751 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1752 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1753 print OPENSSL ".\n";
1754 print OPENSSL ".\n";
1755 close (OPENSSL);
1756 if ($?) {
1757 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1758 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1759 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1760 goto ROOTCERT_ERROR;
1761 }
1762 } else { # child
1763 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1764 '-newkey', 'rsa:1024',
1765 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1766 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1767 '-extensions', 'server',
1768 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1769 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1770 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1771 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1772 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1773 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1774 goto ROOTCERT_ERROR;
1775 }
1776 }
1777
1778 # Sign the host certificate request
1779 system('/usr/bin/openssl', 'ca', '-days', '999999',
1780 '-batch', '-notext',
1781 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1782 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1783 '-extensions', 'server',
1784 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1785 if ($?) {
1786 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1787 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1788 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1789 unlink ("${General::swroot}/ovpn/serverkey.pem");
1790 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1791 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1792 &newcleanssldatabase();
1793 goto ROOTCERT_ERROR;
1794 } else {
1795 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1796 &deletebackupcert();
1797 }
1798
1799 # Create an empty CRL
1800 system('/usr/bin/openssl', 'ca', '-gencrl',
1801 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1802 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1803 if ($?) {
1804 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1805 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1806 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1807 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1808 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1809 &cleanssldatabase();
1810 goto ROOTCERT_ERROR;
1811 # } else {
1812 # &cleanssldatabase();
1813 }
1814 # Create Diffie Hellmann Parameter
1815 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1816 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1817 '1024' );
1818 if ($?) {
1819 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1820 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1821 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1822 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1823 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1824 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1825 &cleanssldatabase();
1826 goto ROOTCERT_ERROR;
1827 # } else {
1828 # &cleanssldatabase();
1829 }
1830 goto ROOTCERT_SUCCESS;
1831 }
1832 ROOTCERT_ERROR:
1833 if ($cgiparams{'ACTION'} ne '') {
1834 &Header::showhttpheaders();
1835 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1836 &Header::openbigbox('100%', 'LEFT', '', '');
1837 if ($errormessage) {
1838 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1839 print "<class name='base'>$errormessage";
1840 print "&nbsp;</class>";
1841 &Header::closebox();
1842 }
1843 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1844 print <<END
1845 <form method='post' enctype='multipart/form-data'>
1846 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1847 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1848 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1849 <td width='35%' colspan='2'>&nbsp;</td></tr>
1850 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1851 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1852 <td colspan='2'>&nbsp;</td></tr>
1853 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1854 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1855 <td colspan='2'>&nbsp;</td></tr>
1856 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1857 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1858 <td colspan='2'>&nbsp;</td></tr>
1859 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1860 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1861 <td colspan='2'>&nbsp;</td></tr>
1862 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1863 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1864 <td colspan='2'>&nbsp;</td></tr>
1865 <tr><td class='base'>$Lang::tr{'country'}:</td>
1866 <td class='base'><select name='ROOTCERT_COUNTRY'>
1867
1868 END
1869 ;
1870 foreach my $country (sort keys %{Countries::countries}) {
1871 print "<option value='$Countries::countries{$country}'";
1872 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1873 print " selected='selected'";
1874 }
1875 print ">$country</option>";
1876 }
1877 print <<END
1878 </select></td>
1879 <td colspan='2'>&nbsp;</td></tr>
1880 <tr><td>&nbsp;</td>
1881 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1882 <td>&nbsp;</td><td>&nbsp;</td></tr>
1883 <tr><td class='base' colspan='4' align='left'>
1884 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1885 <tr><td class='base' colspan='4' align='left'>
1886 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1887 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1888 </td></tr>
1889 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1890 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1891 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1892 <td colspan='2'>&nbsp;</td></tr>
1893 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1894 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1895 <td colspan='2'>&nbsp;</td></tr>
1896 <tr><td>&nbsp;</td>
1897 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1898 <td colspan='2'>&nbsp;</td></tr>
1899 <tr><td class='base' colspan='4' align='left'>
1900 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1901 </form></table>
1902 END
1903 ;
1904 &Header::closebox();
1905
1906 &Header::closebigbox();
1907 &Header::closepage();
1908 exit(0)
1909 }
1910
1911 ROOTCERT_SUCCESS:
1912 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1913 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1914 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1915 # system('/usr/local/bin/ipsecctrl', 'S');
1916 # }
1917
1918 ###
1919 ### Enable/Disable connection
1920 ###
1921
1922 ###
1923 # m.a.d net2net
1924 ###
1925
1926 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1927
1928 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1929 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1930 # my $n2nactive = '';
1931 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1932
1933 if ($confighash{$cgiparams{'KEY'}}) {
1934 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1935 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1936 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1937
1938 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1939 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1940 }
1941 } else {
1942
1943 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1944 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1945
1946 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1947 if ($n2nactive ne ''){
1948 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1949 }
1950
1951 } else {
1952 $errormessage = $Lang::tr{'invalid key'};
1953 }
1954 }
1955 }
1956
1957 ###
1958 ### Download OpenVPN client package
1959 ###
1960
1961
1962 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1963 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1964 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1965 my $file = '';
1966 my $clientovpn = '';
1967 my @fileholder;
1968 my $tempdir = tempdir( CLEANUP => 1 );
1969 my $zippath = "$tempdir/";
1970
1971 ###
1972 # m.a.d net2net
1973 ###
1974
1975 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1976
1977 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1978 my $zippathname = "$zippath$zipname";
1979 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1980 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1981 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1982 my $tunmtu = '';
1983 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1984 my $n2nfragment = '';
1985
1986 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1987 flock CLIENTCONF, 2;
1988
1989 my $zip = Archive::Zip->new();
1990 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1991 print CLIENTCONF "# \n";
1992 print CLIENTCONF "# User Security\n";
1993 print CLIENTCONF "user nobody\n";
1994 print CLIENTCONF "group nobody\n";
1995 print CLIENTCONF "persist-tun\n";
1996 print CLIENTCONF "persist-key\n";
1997 print CLIENTCONF "script-security 2\n";
1998 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1999 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2000 print CLIENTCONF "float\n";
2001 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2002 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2003 print CLIENTCONF "# Server Gateway Network\n";
2004 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2005 print CLIENTCONF "# tun Device\n";
2006 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
2007 print CLIENTCONF "# Port and Protokoll\n";
2008 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2009
2010 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2011 print CLIENTCONF "proto tcp-client\n";
2012 print CLIENTCONF "# Packet size\n";
2013 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2014 print CLIENTCONF "tun-mtu $tunmtu\n";
2015 }
2016
2017 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2018 print CLIENTCONF "proto udp\n";
2019 print CLIENTCONF "# Paketsize\n";
2020 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2021 print CLIENTCONF "tun-mtu $tunmtu\n";
2022 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2023 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
2024 }
2025 if ($confighash{$cgiparams{'KEY'}}[38] ne 'off') {
2026 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2027 if ($tunmtu eq '1500' ) {
2028 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2029 }
2030 }
2031 }
2032 print CLIENTCONF "ns-cert-type server\n";
2033 print CLIENTCONF "# Auth. Client\n";
2034 print CLIENTCONF "tls-client\n";
2035 print CLIENTCONF "# Cipher\n";
2036 print CLIENTCONF "cipher AES-256-CBC\n";
2037 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2038 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2039 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2040 }
2041 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2042 print CLIENTCONF "# Enable Compression\n";
2043 print CLIENTCONF "comp-lzo\r\n";
2044 }
2045 print CLIENTCONF "# Debug Level\n";
2046 print CLIENTCONF "verb 3\n";
2047 print CLIENTCONF "# Tunnel check\n";
2048 print CLIENTCONF "keepalive 10 60\n";
2049 print CLIENTCONF "# Start as daemon\n";
2050 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2051 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2052 print CLIENTCONF "# Activate Management Interface and Port\n";
2053 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2054 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2055 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2056
2057
2058 close(CLIENTCONF);
2059
2060 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2061 my $status = $zip->writeToFileNamed($zippathname);
2062
2063 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2064 @fileholder = <DLFILE>;
2065 print "Content-Type:application/x-download\n";
2066 print "Content-Disposition:attachment;filename=$zipname\n\n";
2067 print @fileholder;
2068 exit (0);
2069 }
2070 else
2071 {
2072 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2073 my $zippathname = "$zippath$zipname";
2074 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2075
2076 ###
2077 # m.a.d net2net
2078 ###
2079
2080 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2081 flock CLIENTCONF, 2;
2082
2083 my $zip = Archive::Zip->new();
2084
2085 print CLIENTCONF "#OpenVPN Client conf\r\n";
2086 print CLIENTCONF "tls-client\r\n";
2087 print CLIENTCONF "client\r\n";
2088 print CLIENTCONF "nobind\n";
2089 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2090 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2091
2092 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2093 # or use configured value.
2094 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2095 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2096 elsif ($vpnsettings{MSSFIX} eq 'on')
2097 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2098 elsif (($vpnsettings{PMTU_DISCOVERY} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne ''))
2099 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2100 else
2101 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2102
2103 if ( $vpnsettings{'ENABLED'} eq 'on'){
2104 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2105 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2106 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2107 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2108 }
2109 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2110 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2111 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2112 }
2113 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2114 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2115 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2116 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2117 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2118 }
2119 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2120 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2121 }
2122
2123 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2124 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2125 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2126 } else {
2127 print CLIENTCONF "ca cacert.pem\r\n";
2128 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2129 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2130 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2131 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2132 }
2133 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2134 if ($vpnsettings{DCOMPLZO} eq 'on') {
2135 print CLIENTCONF "comp-lzo\r\n";
2136 }
2137 print CLIENTCONF "verb 3\r\n";
2138 print CLIENTCONF "ns-cert-type server\r\n";
2139 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2140 if ($vpnsettings{MSSFIX} eq 'on') {
2141 print CLIENTCONF "mssfix\r\n";
2142 }
2143 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2144 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2145 }
2146 if (($vpnsettings{PMTU_DISCOVERY} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne '')) {
2147 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2148 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\n";
2149 }
2150 }
2151 close(CLIENTCONF);
2152
2153 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2154 my $status = $zip->writeToFileNamed($zippathname);
2155
2156 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2157 @fileholder = <DLFILE>;
2158 print "Content-Type:application/x-download\n";
2159 print "Content-Disposition:attachment;filename=$zipname\n\n";
2160 print @fileholder;
2161 exit (0);
2162 }
2163
2164
2165
2166 ###
2167 ### Remove connection
2168 ###
2169
2170
2171 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2172 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2173 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2174
2175 if ($confighash{$cgiparams{'KEY'}}) {
2176 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2177 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2178 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2179 # }
2180 #
2181 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2182
2183 ###
2184 # m.a.d net2net
2185 ###
2186
2187 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2188
2189 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2190 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2191 unlink ($certfile) or die "Removing $certfile fail: $!";
2192 unlink ($conffile) or die "Removing $conffile fail: $!";
2193 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2194
2195 }
2196
2197 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2198 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2199
2200 # A.Marx CCD delete ccd files and routes
2201
2202
2203 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2204 {
2205 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2206 }
2207
2208 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2209 foreach my $key (keys %ccdroutehash) {
2210 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2211 delete $ccdroutehash{$key};
2212 }
2213 }
2214 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2215
2216 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2217 foreach my $key (keys %ccdroute2hash) {
2218 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2219 delete $ccdroute2hash{$key};
2220 }
2221 }
2222 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2223 &writeserverconf;
2224
2225
2226 # CCD end
2227
2228
2229 delete $confighash{$cgiparams{'KEY'}};
2230 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2231 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2232
2233 #&writeserverconf();
2234 } else {
2235 $errormessage = $Lang::tr{'invalid key'};
2236 }
2237
2238
2239 ###
2240 ### Download PKCS12 file
2241 ###
2242 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2243 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2244
2245 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2246 print "Content-Type: application/octet-stream\r\n\r\n";
2247 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2248 exit (0);
2249
2250 ###
2251 ### Display certificate
2252 ###
2253 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2254 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2255
2256 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2257 &Header::showhttpheaders();
2258 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2259 &Header::openbigbox('100%', 'LEFT', '', '');
2260 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2261 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2262 $output = &Header::cleanhtml($output,"y");
2263 print "<pre>$output</pre>\n";
2264 &Header::closebox();
2265 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2266 &Header::closebigbox();
2267 &Header::closepage();
2268 exit(0);
2269 }
2270 ###
2271 ### Display Certificate Revoke List
2272 ###
2273 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2274 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2275
2276 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
2277 &Header::showhttpheaders();
2278 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2279 &Header::openbigbox('100%', 'LEFT', '', '');
2280 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2281 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2282 $output = &Header::cleanhtml($output,"y");
2283 print "<pre>$output</pre>\n";
2284 &Header::closebox();
2285 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2286 &Header::closebigbox();
2287 &Header::closepage();
2288 exit(0);
2289 }
2290
2291 ###
2292 ### Advanced Server Settings
2293 ###
2294
2295 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2296 %cgiparams = ();
2297 %cahash = ();
2298 %confighash = ();
2299 my $disabled;
2300 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2301 read_routepushfile;
2302
2303
2304 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2305 # $cgiparams{'CLIENT2CLIENT'} = 'on';
2306 # }
2307 ADV_ERROR:
2308 if ($cgiparams{'MAX_CLIENTS'} eq '') {
2309 $cgiparams{'MAX_CLIENTS'} = '100';
2310 }
2311 if ($cgiparams{'KEEPALIVE_1'} eq '') {
2312 $cgiparams{'KEEPALIVE_1'} = '10';
2313 }
2314 if ($cgiparams{'KEEPALIVE_2'} eq '') {
2315 $cgiparams{'KEEPALIVE_2'} = '60';
2316 }
2317 if ($cgiparams{'LOG_VERB'} eq '') {
2318 $cgiparams{'LOG_VERB'} = '3';
2319 }
2320 $checked{'CLIENT2CLIENT'}{'off'} = '';
2321 $checked{'CLIENT2CLIENT'}{'on'} = '';
2322 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2323 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2324 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2325 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2326 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2327 $checked{'MSSFIX'}{'off'} = '';
2328 $checked{'MSSFIX'}{'on'} = '';
2329 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2330 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
2331 $selected{'LOG_VERB'}{'1'} = '';
2332 $selected{'LOG_VERB'}{'2'} = '';
2333 $selected{'LOG_VERB'}{'3'} = '';
2334 $selected{'LOG_VERB'}{'4'} = '';
2335 $selected{'LOG_VERB'}{'5'} = '';
2336 $selected{'LOG_VERB'}{'6'} = '';
2337 $selected{'LOG_VERB'}{'7'} = '';
2338 $selected{'LOG_VERB'}{'8'} = '';
2339 $selected{'LOG_VERB'}{'9'} = '';
2340 $selected{'LOG_VERB'}{'10'} = '';
2341 $selected{'LOG_VERB'}{'11'} = '';
2342 $selected{'LOG_VERB'}{'0'} = '';
2343 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2344
2345 &Header::showhttpheaders();
2346 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2347 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2348 if ($errormessage) {
2349 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2350 print "<class name='base'>$errormessage\n";
2351 print "&nbsp;</class>\n";
2352 &Header::closebox();
2353 }
2354 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2355 print <<END
2356 <form method='post' enctype='multipart/form-data' disabled>
2357 <table width='100%' border=0>
2358 <tr>
2359 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2360 </tr>
2361 <tr>
2362 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2363 </tr>
2364 <tr>
2365 <td class='base'>Domain</td>
2366 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
2367 </tr>
2368 <tr>
2369 <td class='base'>DNS</td>
2370 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2371 </tr>
2372 <tr>
2373 <td class='base'>WINS</td>
2374 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2375 </tr>
2376 <tr>
2377 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2378 </tr>
2379 <tr>
2380 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2381 <td colspan='2'>
2382 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2383 END
2384 ;
2385
2386 if ($cgiparams{'ROUTES_PUSH'} ne '')
2387 {
2388 print $cgiparams{'ROUTES_PUSH'};
2389 }
2390
2391 print <<END;
2392 </textarea></td>
2393 </tr>
2394 </tr>
2395 </table>
2396 <hr size='1'>
2397 <table width='100%'>
2398 <tr>
2399 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2400 </tr>
2401 <tr>
2402 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
2403 </tr>
2404 <tr>
2405 <td class='base'>Client-To-Client</td>
2406 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2407 </tr>
2408 <tr>
2409 <td class='base'>Redirect-Gateway def1</td>
2410 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2411 </tr>
2412 <tr>
2413 <td class='base'>Max-Clients</td>
2414 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2415 </tr>
2416 <tr>
2417 <td class='base'>Keppalive <br />
2418 (ping/ping-restart)</td>
2419 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2420 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2421 </tr>
2422 <tr>
2423 <td class='base'>fragment <br></td>
2424 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2425 <td>Default: <span class="base">1300</span></td>
2426 </tr>
2427 <tr>
2428 <td class='base'>mssfix</td>
2429 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2430 <td>Default: on</td>
2431 </tr>
2432
2433 <tr>
2434 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2435 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2436 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2437 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2438 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2439 </tr>
2440 </table>
2441
2442 <!--
2443 <hr size='1'>
2444 <table width='100%'>
2445 <tr>
2446 <td class'base'><b>Crypto-Engines</b></td>
2447 </tr>
2448 <tr>
2449 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2450 </tr>
2451 <tr><td class='base'>Engines:</td>
2452 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2453 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2454 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2455 </select>
2456 </td>
2457 </table>
2458 -->
2459 <hr size='1'>
2460 <table width='100%'>
2461 <tr>
2462 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2463 </tr>
2464 <tr>
2465 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2466 </tr>
2467
2468 <tr><td class='base'>VERB</td>
2469 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2470 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2471 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2472 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2473 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2474 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2475 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2476 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2477 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2478 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2479 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2480 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2481 </table><hr>
2482 END
2483
2484 if ( -e "/var/run/openvpn.pid"){
2485 print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2486 $Lang::tr{'server restart'}<br><br>
2487 <hr>";
2488 print<<END
2489 <table width='100%'>
2490 <tr>
2491 <td>&nbsp;</td>
2492 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2493 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2494 <td>&nbsp;</td>
2495 </tr>
2496 </table>
2497 </form>
2498 END
2499 ;
2500
2501
2502 }else{
2503
2504 print<<END
2505 <table width='100%'>
2506 <tr>
2507 <td>&nbsp;</td>
2508 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2509 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2510 <td>&nbsp;</td>
2511 </tr>
2512 </table>
2513 </form>
2514 END
2515 ;
2516 }
2517 &Header::closebox();
2518 # print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2519 &Header::closebigbox();
2520 &Header::closepage();
2521 exit(0);
2522
2523
2524 # A.Marx CCD Add,delete or edit CCD net
2525
2526 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2527 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2528 $cgiparams{'ACTION'} eq "kill" ||
2529 $cgiparams{'ACTION'} eq "edit" ||
2530 $cgiparams{'ACTION'} eq 'editsave'){