statuspage: some fixes of last commit
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2013 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 ###
22 # Based on IPFireCore 55
23 ###
24 use CGI;
25 use CGI qw/:standard/;
26 use Net::DNS;
27 use Net::Ping;
28 use Net::Telnet;
29 use File::Copy;
30 use File::Temp qw/ tempfile tempdir /;
31 use strict;
32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
33 use Sort::Naturally;
34 require '/var/ipfire/general-functions.pl';
35 require "${General::swroot}/lang.pl";
36 require "${General::swroot}/header.pl";
37 require "${General::swroot}/countries.pl";
38
39 # enable only the following on debugging purpose
40 #use warnings;
41 #use CGI::Carp 'fatalsToBrowser';
42 #workaround to suppress a warning when a variable is used only once
43 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
44 undef (@dummy);
45
46 my %color = ();
47 my %mainsettings = ();
48 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
49 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
50
51 ###
52 ### Initialize variables
53 ###
54 my %ccdconfhash=();
55 my %ccdroutehash=();
56 my %ccdroute2hash=();
57 my %netsettings=();
58 my %cgiparams=();
59 my %vpnsettings=();
60 my %checked=();
61 my %confighash=();
62 my %cahash=();
63 my %selected=();
64 my $warnmessage = '';
65 my $errormessage = '';
66 my %settings=();
67 my $routes_push_file = '';
68 my $confighost="${General::swroot}/fwhosts/customhosts";
69 my $configgrp="${General::swroot}/fwhosts/customgroups";
70 my $customnet="${General::swroot}/fwhosts/customnetworks";
71 my $name;
72 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
73 $cgiparams{'ENABLED'} = 'off';
74 $cgiparams{'ENABLED_BLUE'} = 'off';
75 $cgiparams{'ENABLED_ORANGE'} = 'off';
76 $cgiparams{'EDIT_ADVANCED'} = 'off';
77 $cgiparams{'NAT'} = 'off';
78 $cgiparams{'COMPRESSION'} = 'off';
79 $cgiparams{'ONLY_PROPOSED'} = 'off';
80 $cgiparams{'ACTION'} = '';
81 $cgiparams{'CA_NAME'} = '';
82 $cgiparams{'DHCP_DOMAIN'} = '';
83 $cgiparams{'DHCP_DNS'} = '';
84 $cgiparams{'DHCP_WINS'} = '';
85 $cgiparams{'ROUTES_PUSH'} = '';
86 $cgiparams{'DCOMPLZO'} = 'off';
87 $cgiparams{'MSSFIX'} = '';
88 $cgiparams{'number'} = '';
89 $cgiparams{'PMTU_DISCOVERY'} = '';
90 $routes_push_file = "${General::swroot}/ovpn/routes_push";
91 unless (-e $routes_push_file) { system("touch $routes_push_file"); }
92 unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
93 unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
94 unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
95
96 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
97
98 # prepare openvpn config file
99 ###
100 ### Useful functions
101 ###
102 sub haveOrangeNet
103 {
104 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
105 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
106 return 0;
107 }
108
109 sub haveBlueNet
110 {
111 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
112 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
113 return 0;
114 }
115
116 sub sizeformat{
117 my $bytesize = shift;
118 my $i = 0;
119
120 while(abs($bytesize) >= 1024){
121 $bytesize=$bytesize/1024;
122 $i++;
123 last if($i==6);
124 }
125
126 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
127 my $newsize=(int($bytesize*100 +0.5))/100;
128 return("$newsize $units[$i]");
129 }
130
131 sub cleanssldatabase
132 {
133 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
134 print FILE "01";
135 close FILE;
136 }
137 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
138 print FILE "";
139 close FILE;
140 }
141 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
142 unlink ("${General::swroot}/ovpn/certs/serial.old");
143 unlink ("${General::swroot}/ovpn/certs/01.pem");
144 }
145
146 sub newcleanssldatabase
147 {
148 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
149 open(FILE, ">${General::swroot}(ovpn/certs/serial");
150 print FILE "01";
151 close FILE;
152 }
153 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
154 system ("touch ${General::swroot}/ovpn/certs/index.txt");
155 }
156 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
157 unlink ("${General::swroot}/ovpn/certs/serial.old");
158 }
159
160 sub deletebackupcert
161 {
162 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
163 my $hexvalue = <FILE>;
164 chomp $hexvalue;
165 close FILE;
166 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
167 }
168 }
169 sub checkportfw {
170 my $DPORT = shift;
171 my $DPROT = shift;
172 my %natconfig =();
173 my $confignat = "${General::swroot}/firewall/config";
174 $DPROT= uc ($DPROT);
175 &General::readhasharray($confignat, \%natconfig);
176 foreach my $key (sort keys %natconfig){
177 my @portarray = split (/\|/,$natconfig{$key}[30]);
178 foreach my $value (@portarray){
179 if ($value =~ /:/i){
180 my ($a,$b) = split (":",$value);
181 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
182 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
183 }
184 }else{
185 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
186 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
187 }
188 }
189 }
190 }
191 return;
192 }
193
194 sub checkportoverlap
195 {
196 my $portrange1 = $_[0]; # New port range
197 my $portrange2 = $_[1]; # existing port range
198 my @tempr1 = split(/\:/,$portrange1);
199 my @tempr2 = split(/\:/,$portrange2);
200
201 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
202 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
203
204 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
205 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
206
207 return 1; # Everything checks out!
208 }
209
210 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
211 sub checkportinc
212 {
213 my $port1 = $_[0]; # Port
214 my $portrange2 = $_[1]; # Port range
215 my @tempr1 = split(/\:/,$portrange2);
216
217 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
218 return 1;
219 } else {
220 return 0;
221 }
222 }
223
224 # Darren Critchley - certain ports are reserved for IPFire
225 # TCP 67,68,81,222,445
226 # UDP 67,68
227 # Params passed in -> port, rangeyn, protocol
228 sub disallowreserved
229 {
230 # port 67 and 68 same for tcp and udp, don't bother putting in an array
231 my $msg = "";
232 my @tcp_reserved = (81,222,445);
233 my $prt = $_[0]; # the port or range
234 my $ryn = $_[1]; # tells us whether or not it is a port range
235 my $prot = $_[2]; # protocol
236 my $srcdst = $_[3]; # source or destination
237 if ($ryn) { # disect port range
238 if ($srcdst eq "src") {
239 $msg = "$Lang::tr{'rsvd src port overlap'}";
240 } else {
241 $msg = "$Lang::tr{'rsvd dst port overlap'}";
242 }
243 my @tmprng = split(/\:/,$prt);
244 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
245 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
246 if ($prot eq "tcp") {
247 foreach my $prange (@tcp_reserved) {
248 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
249 }
250 }
251 } else {
252 if ($srcdst eq "src") {
253 $msg = "$Lang::tr{'reserved src port'}";
254 } else {
255 $msg = "$Lang::tr{'reserved dst port'}";
256 }
257 if ($prt == 67) { $errormessage="$msg 67"; return; }
258 if ($prt == 68) { $errormessage="$msg 68"; return; }
259 if ($prot eq "tcp") {
260 foreach my $prange (@tcp_reserved) {
261 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
262 }
263 }
264 }
265 return;
266 }
267
268 sub writeserverconf {
269 my %sovpnsettings = ();
270 my @temp = ();
271 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
272 &read_routepushfile;
273
274 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
275 flock CONF, 2;
276 print CONF "#OpenVPN Server conf\n";
277 print CONF "\n";
278 print CONF "daemon openvpnserver\n";
279 print CONF "writepid /var/run/openvpn.pid\n";
280 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
281 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
282 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
283 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
284 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
285 print CONF "script-security 3 system\n";
286 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
287 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
288 print CONF "tls-server\n";
289 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
290 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
291 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
292 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
293 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
294 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
295 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
296
297 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
298 # If we doesn't use one of them, we can use the configured mtu value.
299 if ($sovpnsettings{'MSSFIX'} eq 'on')
300 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
301 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
302 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
303 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
304 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
305 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
306 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
307 else
308 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
309
310 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
311 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
312 foreach (@temp)
313 {
314 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
315 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
316 }
317 }
318 # a.marx ccd
319 my %ccdconfhash=();
320 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
321 foreach my $key (keys %ccdconfhash) {
322 my $a=$ccdconfhash{$key}[1];
323 my ($b,$c) = split (/\//, $a);
324 print CONF "route $b ".&General::cidrtosub($c)."\n";
325 }
326 my %ccdroutehash=();
327 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
328 foreach my $key (keys %ccdroutehash) {
329 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
330 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
331 print CONF "route $a $b\n";
332 }
333 }
334 # ccd end
335
336 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
337 print CONF "client-to-client\n";
338 }
339 if ($sovpnsettings{MSSFIX} eq 'on') {
340 print CONF "mssfix\n";
341 }
342 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
343 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
344 }
345
346 # Check if a valid operating mode has been choosen and use it.
347 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
348 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
349 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
350 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
351 }
352
353 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
354 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
355 }
356 print CONF "status-version 1\n";
357 print CONF "status /var/log/ovpnserver.log 30\n";
358 print CONF "cipher $sovpnsettings{DCIPHER}\n";
359 if ($sovpnsettings{DCOMPLZO} eq 'on') {
360 print CONF "comp-lzo\n";
361 }
362 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
363 print CONF "push \"redirect-gateway def1\"\n";
364 }
365 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
366 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
367 }
368
369 if ($sovpnsettings{DHCP_DNS} ne '') {
370 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
371 }
372
373 if ($sovpnsettings{DHCP_WINS} ne '') {
374 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
375 }
376
377 if ($sovpnsettings{DHCP_WINS} eq '') {
378 print CONF "max-clients 100\n";
379 }
380 if ($sovpnsettings{DHCP_WINS} ne '') {
381 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
382 }
383 print CONF "tls-verify /usr/lib/openvpn/verify\n";
384 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
385 print CONF "user nobody\n";
386 print CONF "group nobody\n";
387 print CONF "persist-key\n";
388 print CONF "persist-tun\n";
389 if ($sovpnsettings{LOG_VERB} ne '') {
390 print CONF "verb $sovpnsettings{LOG_VERB}\n";
391 } else {
392 print CONF "verb 3\n";
393 }
394 print CONF "\n";
395
396 close(CONF);
397 }
398
399 sub emptyserverlog{
400 if (open(FILE, ">/var/log/ovpnserver.log")) {
401 flock FILE, 2;
402 print FILE "";
403 close FILE;
404 }
405
406 }
407
408 sub delccdnet
409 {
410 my %ccdconfhash = ();
411 my %ccdhash = ();
412 my $ccdnetname=$_[0];
413 if (-f "${General::swroot}/ovpn/ovpnconfig"){
414 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
415 foreach my $key (keys %ccdhash) {
416 if ($ccdhash{$key}[32] eq $ccdnetname) {
417 $errormessage=$Lang::tr{'ccd err hostinnet'};
418 return;
419 }
420 }
421 }
422 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
423 foreach my $key (keys %ccdconfhash) {
424 if ($ccdconfhash{$key}[0] eq $ccdnetname){
425 delete $ccdconfhash{$key};
426 }
427 }
428 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
429
430 &writeserverconf;
431 return 0;
432 }
433
434 sub addccdnet
435 {
436 my %ccdconfhash=();
437 my @ccdconf=();
438 my $ccdname=$_[0];
439 my $ccdnet=$_[1];
440 my $subcidr;
441 my @ip2=();
442 my $checkup;
443 my $ccdip;
444 my $baseaddress;
445
446
447 #check name
448 if ($ccdname eq '')
449 {
450 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
451 return
452 }
453
454 if(!&General::validhostname($ccdname))
455 {
456 $errormessage=$Lang::tr{'ccd err invalidname'};
457 return;
458 }
459
460 ($ccdip,$subcidr) = split (/\//,$ccdnet);
461 $subcidr=&General::iporsubtocidr($subcidr);
462 #check subnet
463 if ($subcidr > 30)
464 {
465 $errormessage=$Lang::tr{'ccd err invalidnet'};
466 return;
467 }
468 #check ip
469 if (!&General::validipandmask($ccdnet)){
470 $errormessage=$Lang::tr{'ccd err invalidnet'};
471 return;
472 }
473
474 $errormessage=&General::checksubnets($ccdname,$ccdnet);
475
476
477 if (!$errormessage) {
478 my %ccdconfhash=();
479 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
480 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
481 my $key = &General::findhasharraykey (\%ccdconfhash);
482 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
483 $ccdconfhash{$key}[0] = $ccdname;
484 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
485 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
486 &writeserverconf;
487 $cgiparams{'ccdname'}='';
488 $cgiparams{'ccdsubnet'}='';
489 return 1;
490 }
491 }
492
493 sub modccdnet
494 {
495
496 my $newname=$_[0];
497 my $oldname=$_[1];
498 my %ccdconfhash=();
499 my %ccdhash=();
500 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
501 foreach my $key (keys %ccdconfhash) {
502 if ($ccdconfhash{$key}[0] eq $oldname) {
503 foreach my $key1 (keys %ccdconfhash) {
504 if ($ccdconfhash{$key1}[0] eq $newname){
505 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
506 return;
507 }else{
508 $ccdconfhash{$key}[0]= $newname;
509 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
510 last;
511 }
512 }
513 }
514 }
515
516 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
517 foreach my $key (keys %ccdhash) {
518 if ($ccdhash{$key}[32] eq $oldname) {
519 $ccdhash{$key}[32]=$newname;
520 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
521 last;
522 }
523 }
524
525 return 0;
526 }
527 sub ccdmaxclients
528 {
529 my $ccdnetwork=$_[0];
530 my @octets=();
531 my @subnet=();
532 @octets=split("\/",$ccdnetwork);
533 @subnet= split /\./, &General::cidrtosub($octets[1]);
534 my ($a,$b,$c,$d,$e);
535 $a=256-$subnet[0];
536 $b=256-$subnet[1];
537 $c=256-$subnet[2];
538 $d=256-$subnet[3];
539 $e=($a*$b*$c*$d)/4;
540 return $e-1;
541 }
542
543 sub getccdadresses
544 {
545 my $ipin=$_[0];
546 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
547 my $cidr=$_[1];
548 chomp($cidr);
549 my $count=$_[2];
550 my $hasip=$_[3];
551 chomp($hasip);
552 my @iprange=();
553 my %ccdhash=();
554 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
555 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
556 for (my $i=1;$i<=$count;$i++) {
557 my $tmpip=$iprange[$i-1];
558 my $stepper=$i*4;
559 $iprange[$i]= &General::getnextip($tmpip,4);
560 }
561 my $r=0;
562 foreach my $key (keys %ccdhash) {
563 $r=0;
564 foreach my $tmp (@iprange){
565 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
566 if ($net eq $tmp) {
567 if ( $hasip ne $ccdhash{$key}[33] ){
568 splice (@iprange,$r,1);
569 }
570 }
571 $r++;
572 }
573 }
574 return @iprange;
575 }
576
577 sub fillselectbox
578 {
579 my $boxname=$_[1];
580 my ($ccdip,$subcidr) = split("/",$_[0]);
581 my $tz=$_[2];
582 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
583 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
584 foreach (@allccdips) {
585 my $ip=$_."/30";
586 chomp($ip);
587 print "<option value='$ip' ";
588 if ( $ip eq $cgiparams{$boxname} ){
589 print"selected";
590 }
591 print ">$ip</option>";
592 }
593 print "</select>";
594 }
595
596 sub hostsinnet
597 {
598 my $name=$_[0];
599 my %ccdhash=();
600 my $i=0;
601 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
602 foreach my $key (keys %ccdhash) {
603 if ($ccdhash{$key}[32] eq $name){ $i++;}
604 }
605 return $i;
606 }
607
608 sub check_routes_push
609 {
610 my $val=$_[0];
611 my ($ip,$cidr) = split (/\//, $val);
612 ##check for existing routes in routes_push
613 if (-e "${General::swroot}/ovpn/routes_push") {
614 open(FILE,"${General::swroot}/ovpn/routes_push");
615 while (<FILE>) {
616 $_=~s/\s*$//g;
617
618 my ($ip2,$cidr2) = split (/\//,"$_");
619 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
620
621 if($val eq $val2){
622 return 0;
623 }
624 #subnetcheck
625 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
626 return 0;
627 }
628 };
629 close(FILE);
630 }
631 return 1;
632 }
633
634 sub check_ccdroute
635 {
636 my %ccdroutehash=();
637 my $val=$_[0];
638 my ($ip,$cidr) = split (/\//, $val);
639 #check for existing routes in ccdroute
640 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
641 foreach my $key (keys %ccdroutehash) {
642 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
643 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
644 return 0;
645 }
646 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
647 #subnetcheck
648 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
649 return 0;
650 }
651 }
652 }
653 return 1;
654 }
655 sub check_ccdconf
656 {
657 my %ccdconfhash=();
658 my $val=$_[0];
659 my ($ip,$cidr) = split (/\//, $val);
660 #check for existing routes in ccdroute
661 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
662 foreach my $key (keys %ccdconfhash) {
663 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
664 return 0;
665 }
666 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
667 #subnetcheck
668 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
669 return 0;
670 }
671
672 }
673 return 1;
674 }
675
676 ###
677 # m.a.d net2net
678 ###
679
680 sub validdotmask
681 {
682 my $ipdotmask = $_[0];
683 if (&General::validip($ipdotmask)) { return 0; }
684 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
685 my $mask = $2;
686 if (($mask =~ /\./ )) { return 0; }
687 return 1;
688 }
689
690 # -------------------------------------------------------------------
691
692 sub write_routepushfile
693 {
694 open(FILE, ">$routes_push_file");
695 flock(FILE, 2);
696 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
697 print FILE $vpnsettings{'ROUTES_PUSH'};
698 }
699 close(FILE);
700 }
701
702 sub read_routepushfile
703 {
704 if (-e "$routes_push_file") {
705 open(FILE,"$routes_push_file");
706 delete $vpnsettings{'ROUTES_PUSH'};
707 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
708 close(FILE);
709 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
710
711 }
712 }
713
714
715 #hier die refresh page
716 if ( -e "${General::swroot}/ovpn/gencanow") {
717 my $refresh = '';
718 $refresh = "<meta http-equiv='refresh' content='15;' />";
719 &Header::showhttpheaders();
720 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
721 &Header::openbigbox('100%', 'center');
722 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
723 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
724 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
725 &Header::closebox();
726 &Header::closebigbox();
727 &Header::closepage();
728 exit (0);
729 }
730 ##hier die refresh page
731
732
733 ###
734 ### OpenVPN Server Control
735 ###
736 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
737 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
738 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
739 #start openvpn server
740 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
741 &emptyserverlog();
742 system('/usr/local/bin/openvpnctrl', '-s');
743 }
744 #stop openvpn server
745 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
746 system('/usr/local/bin/openvpnctrl', '-k');
747 &emptyserverlog();
748 }
749 # #restart openvpn server
750 # if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
751 #workarund, till SIGHUP also works when running as nobody
752 # system('/usr/local/bin/openvpnctrl', '-r');
753 # &emptyserverlog();
754 # }
755 }
756
757 ###
758 ### Save Advanced options
759 ###
760
761 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
762 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
763 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
764 #DAN this value has to leave.
765 #new settings for daemon
766 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
767 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
768 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
769 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
770 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
771 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
772 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
773 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
774 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
775 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
776 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
777 my @temp=();
778
779 if ($cgiparams{'FRAGMENT'} eq '') {
780 delete $vpnsettings{'FRAGMENT'};
781 } else {
782 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
783 $errormessage = "Incorrect value, please insert only numbers.";
784 goto ADV_ERROR;
785 } else {
786 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
787 }
788 }
789 if ($cgiparams{'MSSFIX'} ne 'on') {
790 delete $vpnsettings{'MSSFIX'};
791 } else {
792 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
793 }
794
795 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
796 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
797 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
798
799 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
800 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
801 goto ADV_ERROR;
802 }
803 }
804
805 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
806 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
807 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
808 goto ADV_ERROR;
809 }
810 }
811 if ($cgiparams{'DHCP_DNS'} ne ''){
812 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
813 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
814 goto ADV_ERROR;
815 }
816 }
817 if ($cgiparams{'DHCP_WINS'} ne ''){
818 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
819 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
820 goto ADV_ERROR;
821 }
822 }
823 if ($cgiparams{'ROUTES_PUSH'} ne ''){
824 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
825 undef $vpnsettings{'ROUTES_PUSH'};
826
827 foreach my $tmpip (@temp)
828 {
829 s/^\s+//g; s/\s+$//g;
830
831 if ($tmpip)
832 {
833 $tmpip=~s/\s*$//g;
834 unless (&General::validipandmask($tmpip)) {
835 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
836 goto ADV_ERROR;
837 }
838 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
839
840 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
841 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
842 goto ADV_ERROR;
843 }
844 # a.marx ccd
845 my %ccdroutehash=();
846 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
847 foreach my $key (keys %ccdroutehash) {
848 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
849 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
850 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
851 goto ADV_ERROR;
852 }
853 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
854 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
855 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
856 goto ADV_ERROR;
857 }
858 }
859 }
860
861 # ccd end
862
863 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
864 }
865 }
866 &write_routepushfile;
867 undef $vpnsettings{'ROUTES_PUSH'};
868 }
869 else {
870 undef $vpnsettings{'ROUTES_PUSH'};
871 &write_routepushfile;
872 }
873 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
874 $errormessage = $Lang::tr{'invalid input for max clients'};
875 goto ADV_ERROR;
876 }
877 if ($cgiparams{'KEEPALIVE_1'} ne '') {
878 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
879 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
880 goto ADV_ERROR;
881 }
882 }
883 if ($cgiparams{'KEEPALIVE_2'} ne ''){
884 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
885 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
886 goto ADV_ERROR;
887 }
888 }
889 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
890 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
891 goto ADV_ERROR;
892 }
893
894 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
895 &writeserverconf();#hier ok
896 }
897
898 ###
899 # m.a.d net2net
900 ###
901
902 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
903 {
904
905 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
906 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
907 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
908 my $tunmtu = '';
909
910 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
911 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
912
913 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
914
915 flock SERVERCONF, 2;
916 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
917 print SERVERCONF "\n";
918 print SERVERCONF "# User Security\n";
919 print SERVERCONF "user nobody\n";
920 print SERVERCONF "group nobody\n";
921 print SERVERCONF "persist-tun\n";
922 print SERVERCONF "persist-key\n";
923 print SERVERCONF "script-security 2\n";
924 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
925
926 if ($cgiparams{'REMOTE'} ne '') {
927 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
928 }
929
930 print SERVERCONF "float\n";
931 print SERVERCONF "# IP adresses of the VPN Subnet\n";
932 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
933 print SERVERCONF "# Client Gateway Network\n";
934 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
935 print SERVERCONF "# tun Device\n";
936 print SERVERCONF "dev tun\n";
937 print SERVERCONF "# Port and Protokol\n";
938 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
939
940 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
941 print SERVERCONF "proto tcp-server\n";
942 print SERVERCONF "# Packet size\n";
943 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
944 print SERVERCONF "tun-mtu $tunmtu\n";
945 }
946
947 if ($cgiparams{'PROTOCOL'} eq 'udp') {
948 print SERVERCONF "proto udp\n";
949 print SERVERCONF "# Paketsize\n";
950 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
951 print SERVERCONF "tun-mtu $tunmtu\n";
952 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
953 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
954 }
955
956 # Check if a valid operating mode has been choosen and use it.
957 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
958 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
959 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
960 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
961 if($cgiparams{'MTU'} eq '1500') {
962 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
963 }
964 }
965 }
966 print SERVERCONF "# Auth. Server\n";
967 print SERVERCONF "tls-server\n";
968 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
969 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
970 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
971 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
972 print SERVERCONF "# Cipher\n";
973 print SERVERCONF "cipher AES-256-CBC\n";
974 if ($cgiparams{'COMPLZO'} eq 'on') {
975 print SERVERCONF "# Enable Compression\n";
976 print SERVERCONF "comp-lzo\r\n";
977 }
978 print SERVERCONF "# Debug Level\n";
979 print SERVERCONF "verb 3\n";
980 print SERVERCONF "# Tunnel check\n";
981 print SERVERCONF "keepalive 10 60\n";
982 print SERVERCONF "# Start as daemon\n";
983 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
984 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
985 print SERVERCONF "# Activate Management Interface and Port\n";
986 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
987 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
988 close(SERVERCONF);
989
990 }
991
992 ###
993 # m.a.d net2net
994 ###
995
996 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
997 {
998 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
999 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1000 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
1001 my $tunmtu = '';
1002
1003 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1004 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1005
1006 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1007
1008 flock CLIENTCONF, 2;
1009 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1010 print CLIENTCONF "#\n";
1011 print CLIENTCONF "# User Security\n";
1012 print CLIENTCONF "user nobody\n";
1013 print CLIENTCONF "group nobody\n";
1014 print CLIENTCONF "persist-tun\n";
1015 print CLIENTCONF "persist-key\n";
1016 print CLIENTCONF "script-security 2\n";
1017 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1018 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1019 print CLIENTCONF "float\n";
1020 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1021 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1022 print CLIENTCONF "# Server Gateway Network\n";
1023 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1024 print CLIENTCONF "# tun Device\n";
1025 print CLIENTCONF "dev tun\n";
1026 print CLIENTCONF "# Port and Protokol\n";
1027 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1028
1029 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1030 print CLIENTCONF "proto tcp-client\n";
1031 print CLIENTCONF "# Packet size\n";
1032 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1033 print CLIENTCONF "tun-mtu $tunmtu\n";
1034 }
1035
1036 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1037 print CLIENTCONF "proto udp\n";
1038 print CLIENTCONF "# Paketsize\n";
1039 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1040 print CLIENTCONF "tun-mtu $tunmtu\n";
1041 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1042 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1043 }
1044
1045 # Check if a valid operating mode has been choosen and use it.
1046 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1047 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1048 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
1049 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1050 if ($cgiparams{'MTU'} eq '1500') {
1051 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1052 }
1053 }
1054 }
1055
1056 print CLIENTCONF "ns-cert-type server\n";
1057 print CLIENTCONF "# Auth. Client\n";
1058 print CLIENTCONF "tls-client\n";
1059 print CLIENTCONF "# Cipher\n";
1060 print CLIENTCONF "cipher AES-256-CBC\n";
1061 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1062 if ($cgiparams{'COMPLZO'} eq 'on') {
1063 print CLIENTCONF "# Enable Compression\n";
1064 print CLIENTCONF "comp-lzo\r\n";
1065 }
1066 print CLIENTCONF "# Debug Level\n";
1067 print CLIENTCONF "verb 3\n";
1068 print CLIENTCONF "# Tunnel check\n";
1069 print CLIENTCONF "keepalive 10 60\n";
1070 print CLIENTCONF "# Start as daemon\n";
1071 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1072 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1073 print CLIENTCONF "# Activate Management Interface and Port\n";
1074 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1075 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1076 close(CLIENTCONF);
1077
1078 }
1079
1080 ###
1081 ### Save main settings
1082 ###
1083
1084
1085 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1086 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1087 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1088 #DAN this value has to leave.
1089 if ($cgiparams{'ENABLED'} eq 'on'){
1090 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1091 $errormessage = $Lang::tr{'invalid input for hostname'};
1092 goto SETTINGS_ERROR;
1093 }
1094 }
1095 if ($cgiparams{'ENABLED'} eq 'on'){
1096 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
1097 }
1098 if ($errormessage) { goto SETTINGS_ERROR; }
1099
1100
1101 if ($cgiparams{'ENABLED'} eq 'on'){
1102 &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
1103 }
1104
1105 if ($errormessage) { goto SETTINGS_ERROR; }
1106
1107 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1108 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1109 goto SETTINGS_ERROR;
1110 }
1111 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1112
1113 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1114 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1115 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1116 goto SETTINGS_ERROR;
1117 }
1118
1119 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1120 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1121 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1122 goto SETTINGS_ERROR;
1123 }
1124
1125 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1126 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1127 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1128 goto SETTINGS_ERROR;
1129 }
1130
1131 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1132 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1133 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1134 goto SETTINGS_ERROR;
1135 }
1136 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1137 while (<ALIASES>)
1138 {
1139 chomp($_);
1140 my @tempalias = split(/\,/,$_);
1141 if ($tempalias[1] eq 'on') {
1142 if (&General::IpInSubnet ($tempalias[0] ,
1143 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1144 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1145 }
1146 }
1147 }
1148 close(ALIASES);
1149 if ($errormessage ne ''){
1150 goto SETTINGS_ERROR;
1151 }
1152 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1153 $errormessage = $Lang::tr{'invalid input'};
1154 goto SETTINGS_ERROR;
1155 }
1156 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1157 $errormessage = $Lang::tr{'invalid mtu input'};
1158 goto SETTINGS_ERROR;
1159 }
1160
1161 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1162 $errormessage = $Lang::tr{'invalid port'};
1163 goto SETTINGS_ERROR;
1164 }
1165 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1166 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1167 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1168 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1169 #new settings for daemon
1170 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1171 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1172 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1173 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1174 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1175 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1176 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1177 #wrtie enable
1178
1179 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1180 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1181 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1182 #new settings for daemon
1183 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1184 &writeserverconf();#hier ok
1185 SETTINGS_ERROR:
1186 ###
1187 ### Reset all step 2
1188 ###
1189 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1190 my $file = '';
1191 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1192
1193 foreach my $key (keys %confighash) {
1194 if ($confighash{$key}[4] eq 'cert') {
1195 delete $confighash{$cgiparams{'$key'}};
1196 }
1197 }
1198 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1199 unlink $file
1200 }
1201 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1202 unlink $file
1203 }
1204 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1205 unlink $file
1206 }
1207 &cleanssldatabase();
1208 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1209 print FILE "";
1210 close FILE;
1211 }
1212 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1213 #&writeserverconf();
1214 ###
1215 ### Reset all step 1
1216 ###
1217 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1218 &Header::showhttpheaders();
1219 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1220 &Header::openbigbox('100%', 'LEFT', '', '');
1221 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1222 print <<END
1223 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1224 <tr><td align='center'>
1225 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1226 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1227 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1228 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1229 </form></table>
1230 END
1231 ;
1232 &Header::closebox();
1233 &Header::closebigbox();
1234 &Header::closepage();
1235 exit (0);
1236
1237 ###
1238 ### Upload CA Certificate
1239 ###
1240 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1241 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1242
1243 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1244 $errormessage = $Lang::tr{'name must only contain characters'};
1245 goto UPLOADCA_ERROR;
1246 }
1247
1248 if (length($cgiparams{'CA_NAME'}) >60) {
1249 $errormessage = $Lang::tr{'name too long'};
1250 goto VPNCONF_ERROR;
1251 }
1252
1253 if ($cgiparams{'CA_NAME'} eq 'ca') {
1254 $errormessage = $Lang::tr{'name is invalid'};
1255 goto UPLOAD_CA_ERROR;
1256 }
1257
1258 # Check if there is no other entry with this name
1259 foreach my $key (keys %cahash) {
1260 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1261 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1262 goto UPLOADCA_ERROR;
1263 }
1264 }
1265
1266 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1267 $errormessage = $Lang::tr{'there was no file upload'};
1268 goto UPLOADCA_ERROR;
1269 }
1270 # Move uploaded ca to a temporary file
1271 (my $fh, my $filename) = tempfile( );
1272 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1273 $errormessage = $!;
1274 goto UPLOADCA_ERROR;
1275 }
1276 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1277 if ($temp !~ /CA:TRUE/i) {
1278 $errormessage = $Lang::tr{'not a valid ca certificate'};
1279 unlink ($filename);
1280 goto UPLOADCA_ERROR;
1281 } else {
1282 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1283 if ($? ne 0) {
1284 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1285 unlink ($filename);
1286 goto UPLOADCA_ERROR;
1287 }
1288 }
1289
1290 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1291 $casubject =~ /Subject: (.*)[\n]/;
1292 $casubject = $1;
1293 $casubject =~ s+/Email+, E+;
1294 $casubject =~ s/ ST=/ S=/;
1295 $casubject = &Header::cleanhtml($casubject);
1296
1297 my $key = &General::findhasharraykey (\%cahash);
1298 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1299 $cahash{$key}[1] = $casubject;
1300 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1301 # system('/usr/local/bin/ipsecctrl', 'R');
1302
1303 UPLOADCA_ERROR:
1304
1305 ###
1306 ### Display ca certificate
1307 ###
1308 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1309 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1310
1311 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1312 &Header::showhttpheaders();
1313 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1314 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1315 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1316 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1317 $output = &Header::cleanhtml($output,"y");
1318 print "<pre>$output</pre>\n";
1319 &Header::closebox();
1320 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1321 &Header::closebigbox();
1322 &Header::closepage();
1323 exit(0);
1324 } else {
1325 $errormessage = $Lang::tr{'invalid key'};
1326 }
1327
1328 ###
1329 ### Download ca certificate
1330 ###
1331 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1332 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1333
1334 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1335 print "Content-Type: application/octet-stream\r\n";
1336 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1337 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1338 exit(0);
1339 } else {
1340 $errormessage = $Lang::tr{'invalid key'};
1341 }
1342
1343 ###
1344 ### Remove ca certificate (step 2)
1345 ###
1346 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1347 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1348 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1349
1350 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1351 foreach my $key (keys %confighash) {
1352 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1353 if ($test =~ /: OK/) {
1354 # Delete connection
1355 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1356 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1357 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1358 # }
1359 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1360 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1361 delete $confighash{$key};
1362 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1363 # &writeipsecfiles();
1364 }
1365 }
1366 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1367 delete $cahash{$cgiparams{'KEY'}};
1368 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1369 # system('/usr/local/bin/ipsecctrl', 'R');
1370 } else {
1371 $errormessage = $Lang::tr{'invalid key'};
1372 }
1373 ###
1374 ### Remove ca certificate (step 1)
1375 ###
1376 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1377 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1378 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1379
1380 my $assignedcerts = 0;
1381 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1382 foreach my $key (keys %confighash) {
1383 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1384 if ($test =~ /: OK/) {
1385 $assignedcerts++;
1386 }
1387 }
1388 if ($assignedcerts) {
1389 &Header::showhttpheaders();
1390 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1391 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1392 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1393 print <<END
1394 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1395 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1396 <tr><td align='center'>
1397 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1398 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1399 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1400 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1401 </form></table>
1402 END
1403 ;
1404 &Header::closebox();
1405 &Header::closebigbox();
1406 &Header::closepage();
1407 exit (0);
1408 } else {
1409 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1410 delete $cahash{$cgiparams{'KEY'}};
1411 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1412 # system('/usr/local/bin/ipsecctrl', 'R');
1413 }
1414 } else {
1415 $errormessage = $Lang::tr{'invalid key'};
1416 }
1417
1418 ###
1419 ### Display root certificate
1420 ###
1421 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1422 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1423 my $output;
1424 &Header::showhttpheaders();
1425 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1426 &Header::openbigbox('100%', 'LEFT', '', '');
1427 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1428 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1429 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1430 } else {
1431 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1432 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1433 }
1434 $output = &Header::cleanhtml($output,"y");
1435 print "<pre>$output</pre>\n";
1436 &Header::closebox();
1437 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1438 &Header::closebigbox();
1439 &Header::closepage();
1440 exit(0);
1441
1442 ###
1443 ### Download root certificate
1444 ###
1445 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1446 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1447 print "Content-Type: application/octet-stream\r\n";
1448 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1449 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1450 exit(0);
1451 }
1452
1453 ###
1454 ### Download host certificate
1455 ###
1456 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1457 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1458 print "Content-Type: application/octet-stream\r\n";
1459 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1460 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1461 exit(0);
1462 }
1463 ###
1464 ### Form for generating a root certificate
1465 ###
1466 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1467 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1468
1469 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1470 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1471 $errormessage = $Lang::tr{'valid root certificate already exists'};
1472 $cgiparams{'ACTION'} = '';
1473 goto ROOTCERT_ERROR;
1474 }
1475
1476 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1477 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1478 my $ipaddr = <IPADDR>;
1479 close IPADDR;
1480 chomp ($ipaddr);
1481 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1482 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1483 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1484 }
1485 }
1486 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1487
1488 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1489 $errormessage = $Lang::tr{'there was no file upload'};
1490 goto ROOTCERT_ERROR;
1491 }
1492
1493 # Move uploaded certificate request to a temporary file
1494 (my $fh, my $filename) = tempfile( );
1495 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1496 $errormessage = $!;
1497 goto ROOTCERT_ERROR;
1498 }
1499
1500 # Create a temporary dirctory
1501 my $tempdir = tempdir( CLEANUP => 1 );
1502
1503 # Extract the CA certificate from the file
1504 my $pid = open(OPENSSL, "|-");
1505 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1506 if ($pid) { # parent
1507 if ($cgiparams{'P12_PASS'} ne '') {
1508 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1509 }
1510 close (OPENSSL);
1511 if ($?) {
1512 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1513 unlink ($filename);
1514 goto ROOTCERT_ERROR;
1515 }
1516 } else { # child
1517 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1518 '-in', $filename,
1519 '-out', "$tempdir/cacert.pem")) {
1520 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1521 unlink ($filename);
1522 goto ROOTCERT_ERROR;
1523 }
1524 }
1525
1526 # Extract the Host certificate from the file
1527 $pid = open(OPENSSL, "|-");
1528 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1529 if ($pid) { # parent
1530 if ($cgiparams{'P12_PASS'} ne '') {
1531 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1532 }
1533 close (OPENSSL);
1534 if ($?) {
1535 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1536 unlink ($filename);
1537 goto ROOTCERT_ERROR;
1538 }
1539 } else { # child
1540 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1541 '-in', $filename,
1542 '-out', "$tempdir/hostcert.pem")) {
1543 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1544 unlink ($filename);
1545 goto ROOTCERT_ERROR;
1546 }
1547 }
1548
1549 # Extract the Host key from the file
1550 $pid = open(OPENSSL, "|-");
1551 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1552 if ($pid) { # parent
1553 if ($cgiparams{'P12_PASS'} ne '') {
1554 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1555 }
1556 close (OPENSSL);
1557 if ($?) {
1558 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1559 unlink ($filename);
1560 goto ROOTCERT_ERROR;
1561 }
1562 } else { # child
1563 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1564 '-nodes',
1565 '-in', $filename,
1566 '-out', "$tempdir/serverkey.pem")) {
1567 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1568 unlink ($filename);
1569 goto ROOTCERT_ERROR;
1570 }
1571 }
1572
1573 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1574 if ($? ne 0) {
1575 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1576 unlink ($filename);
1577 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1578 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1579 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1580 goto ROOTCERT_ERROR;
1581 }
1582
1583 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1584 if ($? ne 0) {
1585 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1586 unlink ($filename);
1587 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1588 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1589 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1590 goto ROOTCERT_ERROR;
1591 }
1592
1593 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1594 if ($? ne 0) {
1595 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1596 unlink ($filename);
1597 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1598 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1599 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1600 goto ROOTCERT_ERROR;
1601 }
1602
1603 goto ROOTCERT_SUCCESS;
1604
1605 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1606
1607 # Validate input since the form was submitted
1608 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1609 $errormessage = $Lang::tr{'organization cant be empty'};
1610 goto ROOTCERT_ERROR;
1611 }
1612 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1613 $errormessage = $Lang::tr{'organization too long'};
1614 goto ROOTCERT_ERROR;
1615 }
1616 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1617 $errormessage = $Lang::tr{'invalid input for organization'};
1618 goto ROOTCERT_ERROR;
1619 }
1620 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1621 $errormessage = $Lang::tr{'hostname cant be empty'};
1622 goto ROOTCERT_ERROR;
1623 }
1624 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1625 $errormessage = $Lang::tr{'invalid input for hostname'};
1626 goto ROOTCERT_ERROR;
1627 }
1628 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1629 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1630 goto ROOTCERT_ERROR;
1631 }
1632 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1633 $errormessage = $Lang::tr{'e-mail address too long'};
1634 goto ROOTCERT_ERROR;
1635 }
1636 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1637 $errormessage = $Lang::tr{'invalid input for department'};
1638 goto ROOTCERT_ERROR;
1639 }
1640 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1641 $errormessage = $Lang::tr{'invalid input for city'};
1642 goto ROOTCERT_ERROR;
1643 }
1644 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1645 $errormessage = $Lang::tr{'invalid input for state or province'};
1646 goto ROOTCERT_ERROR;
1647 }
1648 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1649 $errormessage = $Lang::tr{'invalid input for country'};
1650 goto ROOTCERT_ERROR;
1651 }
1652
1653 # Copy the cgisettings to vpnsettings and save the configfile
1654 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1655 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1656 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1657 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1658 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1659 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1660 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1661 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1662
1663 # Replace empty strings with a .
1664 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1665 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1666 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1667
1668 # refresh
1669 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1670
1671 # Create the CA certificate
1672 my $pid = open(OPENSSL, "|-");
1673 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1674 if ($pid) { # parent
1675 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1676 print OPENSSL "$state\n";
1677 print OPENSSL "$city\n";
1678 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1679 print OPENSSL "$ou\n";
1680 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1681 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1682 close (OPENSSL);
1683 if ($?) {
1684 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1685 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1686 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1687 goto ROOTCERT_ERROR;
1688 }
1689 } else { # child
1690 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1691 '-days', '999999', '-newkey', 'rsa:2048',
1692 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1693 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1694 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1695 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1696 goto ROOTCERT_ERROR;
1697 }
1698 }
1699
1700 # Create the Host certificate request
1701 $pid = open(OPENSSL, "|-");
1702 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1703 if ($pid) { # parent
1704 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1705 print OPENSSL "$state\n";
1706 print OPENSSL "$city\n";
1707 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1708 print OPENSSL "$ou\n";
1709 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1710 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1711 print OPENSSL ".\n";
1712 print OPENSSL ".\n";
1713 close (OPENSSL);
1714 if ($?) {
1715 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1716 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1717 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1718 goto ROOTCERT_ERROR;
1719 }
1720 } else { # child
1721 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1722 '-newkey', 'rsa:1024',
1723 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1724 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1725 '-extensions', 'server',
1726 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1727 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1728 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1729 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1730 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1731 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1732 goto ROOTCERT_ERROR;
1733 }
1734 }
1735
1736 # Sign the host certificate request
1737 system('/usr/bin/openssl', 'ca', '-days', '999999',
1738 '-batch', '-notext',
1739 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1740 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1741 '-extensions', 'server',
1742 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1743 if ($?) {
1744 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1745 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1746 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1747 unlink ("${General::swroot}/ovpn/serverkey.pem");
1748 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1749 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1750 &newcleanssldatabase();
1751 goto ROOTCERT_ERROR;
1752 } else {
1753 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1754 &deletebackupcert();
1755 }
1756
1757 # Create an empty CRL
1758 system('/usr/bin/openssl', 'ca', '-gencrl',
1759 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1760 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1761 if ($?) {
1762 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1763 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1764 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1765 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1766 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1767 &cleanssldatabase();
1768 goto ROOTCERT_ERROR;
1769 # } else {
1770 # &cleanssldatabase();
1771 }
1772 # Create Diffie Hellmann Parameter
1773 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1774 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1775 '1024' );
1776 if ($?) {
1777 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1778 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1779 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1780 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1781 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1782 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1783 &cleanssldatabase();
1784 goto ROOTCERT_ERROR;
1785 # } else {
1786 # &cleanssldatabase();
1787 }
1788 goto ROOTCERT_SUCCESS;
1789 }
1790 ROOTCERT_ERROR:
1791 if ($cgiparams{'ACTION'} ne '') {
1792 &Header::showhttpheaders();
1793 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1794 &Header::openbigbox('100%', 'LEFT', '', '');
1795 if ($errormessage) {
1796 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1797 print "<class name='base'>$errormessage";
1798 print "&nbsp;</class>";
1799 &Header::closebox();
1800 }
1801 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1802 print <<END
1803 <form method='post' enctype='multipart/form-data'>
1804 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1805 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1806 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1807 <td width='35%' colspan='2'>&nbsp;</td></tr>
1808 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1809 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1810 <td colspan='2'>&nbsp;</td></tr>
1811 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1812 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1813 <td colspan='2'>&nbsp;</td></tr>
1814 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1815 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1816 <td colspan='2'>&nbsp;</td></tr>
1817 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1818 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1819 <td colspan='2'>&nbsp;</td></tr>
1820 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1821 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1822 <td colspan='2'>&nbsp;</td></tr>
1823 <tr><td class='base'>$Lang::tr{'country'}:</td>
1824 <td class='base'><select name='ROOTCERT_COUNTRY'>
1825
1826 END
1827 ;
1828 foreach my $country (sort keys %{Countries::countries}) {
1829 print "<option value='$Countries::countries{$country}'";
1830 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1831 print " selected='selected'";
1832 }
1833 print ">$country</option>";
1834 }
1835 print <<END
1836 </select></td>
1837 <td colspan='2'>&nbsp;</td></tr>
1838 <tr><td>&nbsp;</td>
1839 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1840 <td>&nbsp;</td><td>&nbsp;</td></tr>
1841 <tr><td class='base' colspan='4' align='left'>
1842 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1843 <tr><td class='base' colspan='4' align='left'>
1844 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1845 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1846 </td></tr>
1847 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1848 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1849 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1850 <td colspan='2'>&nbsp;</td></tr>
1851 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1852 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1853 <td colspan='2'>&nbsp;</td></tr>
1854 <tr><td>&nbsp;</td>
1855 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1856 <td colspan='2'>&nbsp;</td></tr>
1857 <tr><td class='base' colspan='4' align='left'>
1858 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1859 </form></table>
1860 END
1861 ;
1862 &Header::closebox();
1863
1864 &Header::closebigbox();
1865 &Header::closepage();
1866 exit(0)
1867 }
1868
1869 ROOTCERT_SUCCESS:
1870 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1871 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1872 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1873 # system('/usr/local/bin/ipsecctrl', 'S');
1874 # }
1875
1876 ###
1877 ### Enable/Disable connection
1878 ###
1879
1880 ###
1881 # m.a.d net2net
1882 ###
1883
1884 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1885
1886 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1887 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1888 # my $n2nactive = '';
1889 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1890
1891 if ($confighash{$cgiparams{'KEY'}}) {
1892 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1893 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1894 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1895
1896 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1897 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1898 }
1899 } else {
1900
1901 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1902 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1903
1904 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1905 if ($n2nactive ne ''){
1906 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1907 }
1908
1909 } else {
1910 $errormessage = $Lang::tr{'invalid key'};
1911 }
1912 }
1913 }
1914
1915 ###
1916 ### Download OpenVPN client package
1917 ###
1918
1919
1920 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1921 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1922 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1923 my $file = '';
1924 my $clientovpn = '';
1925 my @fileholder;
1926 my $tempdir = tempdir( CLEANUP => 1 );
1927 my $zippath = "$tempdir/";
1928
1929 ###
1930 # m.a.d net2net
1931 ###
1932
1933 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1934
1935 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1936 my $zippathname = "$zippath$zipname";
1937 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1938 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1939 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1940 my $tunmtu = '';
1941 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1942 my $n2nfragment = '';
1943
1944 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1945 flock CLIENTCONF, 2;
1946
1947 my $zip = Archive::Zip->new();
1948 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1949 print CLIENTCONF "# \n";
1950 print CLIENTCONF "# User Security\n";
1951 print CLIENTCONF "user nobody\n";
1952 print CLIENTCONF "group nobody\n";
1953 print CLIENTCONF "persist-tun\n";
1954 print CLIENTCONF "persist-key\n";
1955 print CLIENTCONF "script-security 2\n";
1956 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1957 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1958 print CLIENTCONF "float\n";
1959 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1960 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1961 print CLIENTCONF "# Server Gateway Network\n";
1962 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1963 print CLIENTCONF "# tun Device\n";
1964 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1965 print CLIENTCONF "# Port and Protokoll\n";
1966 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1967
1968 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1969 print CLIENTCONF "proto tcp-client\n";
1970 print CLIENTCONF "# Packet size\n";
1971 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1972 print CLIENTCONF "tun-mtu $tunmtu\n";
1973 }
1974
1975 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1976 print CLIENTCONF "proto udp\n";
1977 print CLIENTCONF "# Paketsize\n";
1978 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1979 print CLIENTCONF "tun-mtu $tunmtu\n";
1980 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1981 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1982 }
1983 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
1984 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
1985 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
1986 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
1987 if ($tunmtu eq '1500' ) {
1988 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
1989 }
1990 }
1991 }
1992 print CLIENTCONF "ns-cert-type server\n";
1993 print CLIENTCONF "# Auth. Client\n";
1994 print CLIENTCONF "tls-client\n";
1995 print CLIENTCONF "# Cipher\n";
1996 print CLIENTCONF "cipher AES-256-CBC\n";
1997 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1998 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1999 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2000 }
2001 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2002 print CLIENTCONF "# Enable Compression\n";
2003 print CLIENTCONF "comp-lzo\r\n";
2004 }
2005 print CLIENTCONF "# Debug Level\n";
2006 print CLIENTCONF "verb 3\n";
2007 print CLIENTCONF "# Tunnel check\n";
2008 print CLIENTCONF "keepalive 10 60\n";
2009 print CLIENTCONF "# Start as daemon\n";
2010 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2011 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2012 print CLIENTCONF "# Activate Management Interface and Port\n";
2013 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2014 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2015 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2016
2017
2018 close(CLIENTCONF);
2019
2020 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2021 my $status = $zip->writeToFileNamed($zippathname);
2022
2023 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2024 @fileholder = <DLFILE>;
2025 print "Content-Type:application/x-download\n";
2026 print "Content-Disposition:attachment;filename=$zipname\n\n";
2027 print @fileholder;
2028 exit (0);
2029 }
2030 else
2031 {
2032 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2033 my $zippathname = "$zippath$zipname";
2034 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2035
2036 ###
2037 # m.a.d net2net
2038 ###
2039
2040 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2041 flock CLIENTCONF, 2;
2042
2043 my $zip = Archive::Zip->new();
2044
2045 print CLIENTCONF "#OpenVPN Client conf\r\n";
2046 print CLIENTCONF "tls-client\r\n";
2047 print CLIENTCONF "client\r\n";
2048 print CLIENTCONF "nobind\r\n";
2049 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2050 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2051
2052 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2053 # or use configured value.
2054 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2055 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2056 elsif ($vpnsettings{MSSFIX} eq 'on')
2057 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2058 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2059 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2060 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2061 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2062 else
2063 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2064
2065 if ( $vpnsettings{'ENABLED'} eq 'on'){
2066 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2067 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2068 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2069 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2070 }
2071 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2072 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2073 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2074 }
2075 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2076 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2077 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2078 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2079 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2080 }
2081 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2082 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2083 }
2084
2085 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2086 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2087 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2088 } else {
2089 print CLIENTCONF "ca cacert.pem\r\n";
2090 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2091 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2092 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2093 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2094 }
2095 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2096 if ($vpnsettings{DCOMPLZO} eq 'on') {
2097 print CLIENTCONF "comp-lzo\r\n";
2098 }
2099 print CLIENTCONF "verb 3\r\n";
2100 print CLIENTCONF "ns-cert-type server\r\n";
2101 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2102 if ($vpnsettings{MSSFIX} eq 'on') {
2103 print CLIENTCONF "mssfix\r\n";
2104 }
2105 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2106 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2107 }
2108
2109 # Check if a valid operating mode has been choosen and use it.
2110 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2111 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2112 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2113 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2114 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2115 }
2116 }
2117 close(CLIENTCONF);
2118
2119 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2120 my $status = $zip->writeToFileNamed($zippathname);
2121
2122 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2123 @fileholder = <DLFILE>;
2124 print "Content-Type:application/x-download\n";
2125 print "Content-Disposition:attachment;filename=$zipname\n\n";
2126 print @fileholder;
2127 exit (0);
2128 }
2129
2130
2131
2132 ###
2133 ### Remove connection
2134 ###
2135
2136
2137 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2138 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2139 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2140
2141 if ($confighash{$cgiparams{'KEY'}}) {
2142 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2143 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2144 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2145 # }
2146 #
2147 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2148
2149 ###
2150 # m.a.d net2net
2151 ###
2152
2153 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2154 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2155 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2156 unlink ($certfile);
2157 unlink ($conffile);
2158
2159 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2160 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2161 }
2162 }
2163
2164 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2165 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2166
2167 # A.Marx CCD delete ccd files and routes
2168
2169
2170 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2171 {
2172 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2173 }
2174
2175 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2176 foreach my $key (keys %ccdroutehash) {
2177 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2178 delete $ccdroutehash{$key};
2179 }
2180 }
2181 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2182
2183 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2184 foreach my $key (keys %ccdroute2hash) {
2185 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2186 delete $ccdroute2hash{$key};
2187 }
2188 }
2189 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2190 &writeserverconf;
2191
2192
2193 # CCD end
2194
2195
2196 delete $confighash{$cgiparams{'KEY'}};
2197 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2198 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2199
2200 #&writeserverconf();
2201 } else {
2202 $errormessage = $Lang::tr{'invalid key'};
2203 }
2204
2205
2206 ###
2207 ### Download PKCS12 file
2208 ###
2209 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2210 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2211
2212 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2213 print "Content-Type: application/octet-stream\r\n\r\n";
2214 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2215 exit (0);
2216
2217 ###
2218 ### Display certificate
2219 ###
2220 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2221 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2222
2223 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2224 &Header::showhttpheaders();
2225 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2226 &Header::openbigbox('100%', 'LEFT', '', '');
2227 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2228 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2229 $output = &Header::cleanhtml($output,"y");
2230 print "<pre>$output</pre>\n";
2231 &Header::closebox();
2232 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2233 &Header::closebigbox();
2234 &Header::closepage();
2235 exit(0);
2236 }
2237 ###
2238 ### Display Certificate Revoke List
2239 ###
2240 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2241 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2242
2243 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
2244 &Header::showhttpheaders();
2245 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2246 &Header::openbigbox('100%', 'LEFT', '', '');
2247 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2248 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2249 $output = &Header::cleanhtml($output,"y");
2250 print "<pre>$output</pre>\n";
2251 &Header::closebox();
2252 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2253 &Header::closebigbox();
2254 &Header::closepage();
2255 exit(0);
2256 }
2257
2258 ###
2259 ### Advanced Server Settings
2260 ###
2261
2262 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2263 %cgiparams = ();
2264 %cahash = ();
2265 %confighash = ();
2266 my $disabled;
2267 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2268 read_routepushfile;
2269
2270
2271 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2272 # $cgiparams{'CLIENT2CLIENT'} = 'on';
2273 # }
2274 ADV_ERROR:
2275 if ($cgiparams{'MAX_CLIENTS'} eq '') {
2276 $cgiparams{'MAX_CLIENTS'} = '100';
2277 }
2278 if ($cgiparams{'KEEPALIVE_1'} eq '') {
2279 $cgiparams{'KEEPALIVE_1'} = '10';
2280 }
2281 if ($cgiparams{'KEEPALIVE_2'} eq '') {
2282 $cgiparams{'KEEPALIVE_2'} = '60';
2283 }
2284 if ($cgiparams{'LOG_VERB'} eq '') {
2285 $cgiparams{'LOG_VERB'} = '3';
2286 }
2287 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
2288 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2289 }
2290 $checked{'CLIENT2CLIENT'}{'off'} = '';
2291 $checked{'CLIENT2CLIENT'}{'on'} = '';
2292 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2293 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2294 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2295 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2296 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2297 $checked{'MSSFIX'}{'off'} = '';
2298 $checked{'MSSFIX'}{'on'} = '';
2299 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2300 $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
2301 $selected{'LOG_VERB'}{'1'} = '';
2302 $selected{'LOG_VERB'}{'2'} = '';
2303 $selected{'LOG_VERB'}{'3'} = '';
2304 $selected{'LOG_VERB'}{'4'} = '';
2305 $selected{'LOG_VERB'}{'5'} = '';
2306 $selected{'LOG_VERB'}{'6'} = '';
2307 $selected{'LOG_VERB'}{'7'} = '';
2308 $selected{'LOG_VERB'}{'8'} = '';
2309 $selected{'LOG_VERB'}{'9'} = '';
2310 $selected{'LOG_VERB'}{'10'} = '';
2311 $selected{'LOG_VERB'}{'11'} = '';
2312 $selected{'LOG_VERB'}{'0'} = '';
2313 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2314
2315 &Header::showhttpheaders();
2316 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2317 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2318 if ($errormessage) {
2319 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2320 print "<class name='base'>$errormessage\n";
2321 print "&nbsp;</class>\n";
2322 &Header::closebox();
2323 }
2324 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2325 print <<END
2326 <form method='post' enctype='multipart/form-data'>
2327 <table width='100%' border=0>
2328 <tr>
2329 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2330 </tr>
2331 <tr>
2332 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2333 </tr>
2334 <tr>
2335 <td class='base'>Domain</td>
2336 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
2337 </tr>
2338 <tr>
2339 <td class='base'>DNS</td>
2340 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2341 </tr>
2342 <tr>
2343 <td class='base'>WINS</td>
2344 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2345 </tr>
2346 <tr>
2347 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2348 </tr>
2349 <tr>
2350 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2351 <td colspan='2'>
2352 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2353 END
2354 ;
2355
2356 if ($cgiparams{'ROUTES_PUSH'} ne '')
2357 {
2358 print $cgiparams{'ROUTES_PUSH'};
2359 }
2360
2361 print <<END;
2362 </textarea></td>
2363 </tr>
2364 </tr>
2365 </table>
2366 <hr size='1'>
2367 <table width='100%'>
2368 <tr>
2369 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2370 </tr>
2371 <tr>
2372 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
2373 </tr>
2374 <tr>
2375 <td class='base'>Client-To-Client</td>
2376 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2377 </tr>
2378 <tr>
2379 <td class='base'>Redirect-Gateway def1</td>
2380 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2381 </tr>
2382 <tr>
2383 <td class='base'>Max-Clients</td>
2384 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2385 </tr>
2386 <tr>
2387 <td class='base'>Keepalive <br />
2388 (ping/ping-restart)</td>
2389 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2390 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2391 </tr>
2392 <tr>
2393 <td class='base'>fragment <br></td>
2394 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2395 <td>Default: <span class="base">1300</span></td>
2396 </tr>
2397 <tr>
2398 <td class='base'>mssfix</td>
2399 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2400 <td>Default: on</td>
2401 </tr>
2402
2403 <tr>
2404 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2405 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2406 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2407 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2408 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2409 </tr>
2410 </table>
2411
2412 <!--
2413 <hr size='1'>
2414 <table width='100%'>
2415 <tr>
2416 <td class'base'><b>Crypto-Engines</b></td>
2417 </tr>
2418 <tr>
2419 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2420 </tr>
2421 <tr><td class='base'>Engines:</td>
2422 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2423 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2424 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2425 </select>
2426 </td>
2427 </table>
2428 -->
2429 <hr size='1'>
2430 <table width='100%'>
2431 <tr>
2432 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2433 </tr>
2434 <tr>
2435 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2436 </tr>
2437
2438 <tr><td class='base'>VERB</td>
2439 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2440 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2441 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2442 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2443 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2444 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2445 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2446 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2447 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2448 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2449 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2450 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2451 </table><hr>
2452 END
2453
2454 if ( -e "/var/run/openvpn.pid"){
2455 print" <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2456 $Lang::tr{'server restart'}<br><br>
2457 <hr>";
2458 print<<END
2459 <table width='100%'>
2460 <tr>
2461 <td>&nbsp;</td>
2462 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2463 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2464 <td>&nbsp;</td>
2465 </tr>
2466 </table>
2467 </form>
2468 END
2469 ;
2470
2471
2472 }else{
2473
2474 print<<END
2475 <table width='100%'>
2476 <tr>
2477 <td>&nbsp;</td>
2478 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2479 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2480 <td>&nbsp;</td>
2481 </tr>
2482 </table>
2483 </form>
2484 END
2485 ;
2486 }
2487 &Header::closebox();
2488 # print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2489 &Header::closebigbox();
2490 &Header::closepage();
2491 exit(0);
2492
2493
2494 # A.Marx CCD Add,delete or edit CCD net
2495
2496 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2497 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2498 $cgiparams{'ACTION'} eq "kill" ||
2499 $cgiparams{'ACTION'} eq "edit" ||
2500 $cgiparams{'ACTION'} eq 'editsave'){
2501 &Header::showhttpheaders();
2502 &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2503 &Header::openbigbox('100%', 'LEFT', '', '');
2504
2505 if ($cgiparams{'ACTION'} eq "kill"){
2506 &delccdnet($cgiparams{'net'});
2507 }
2508
2509 if ($cgiparams{'ACTION'} eq 'editsave'){
2510 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2511 if ( $a ne $b){ &modccdnet($a,$b);}
2512 $cgiparams{'ccdname'}='';
2513 $cgiparams{'ccdsubnet'}='';
2514 }
2515
2516 if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
2517 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
2518 }
2519 if ($errormessage) {
2520 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2521 print "<class name='base'>$errormessage";
2522 print "&nbsp;</class>";
2523 &Header::closebox();
2524 }
2525 if ($cgiparams{'ACTION'} eq "edit"){
2526
2527 &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2528
2529 print <<END
2530 <table width='100%' border=0>
2531 <tr><form method='post'>
2532 <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2533 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
2534 <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2535 <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2536 </td></tr>
2537 </table></form>
2538 END
2539 ;
2540 &Header::closebox();
2541
2542 &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2543 print <<END
2544 <table width='100%' border='0' cellpadding='0' cellspacing='1'>