html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2013  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 use Sort::Naturally;
  34 require '/var/ipfire/general-functions.pl';
  35 require "${General::swroot}/lang.pl";
  36 require "${General::swroot}/header.pl";
  37 require "${General::swroot}/countries.pl";
  38
  39 # enable only the following on debugging purpose
  40 #use warnings;
  41 #use CGI::Carp 'fatalsToBrowser';
  42 #workaround to suppress a warning when a variable is used only once
  43 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
  44 undef (@dummy);
  45
  46 my %color = ();
  47 my %mainsettings = ();
  48 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  49 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  50
  51 ###
  52 ### Initialize variables
  53 ###
  54 my %ccdconfhash=();
  55 my %ccdroutehash=();
  56 my %ccdroute2hash=();
  57 my %netsettings=();
  58 my %cgiparams=();
  59 my %vpnsettings=();
  60 my %checked=();
  61 my %confighash=();
  62 my %cahash=();
  63 my %selected=();
  64 my $warnmessage = '';
  65 my $errormessage = '';
  66 my %settings=();
  67 my $routes_push_file = '';
  68 my $confighost="${General::swroot}/fwhosts/customhosts";
  69 my $configgrp="${General::swroot}/fwhosts/customgroups";
  70 my $customnet="${General::swroot}/fwhosts/customnetworks";
  71 my $name;
  72 my $col="";
  73 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  74 $cgiparams{'ENABLED'} = 'off';
  75 $cgiparams{'ENABLED_BLUE'} = 'off';
  76 $cgiparams{'ENABLED_ORANGE'} = 'off';
  77 $cgiparams{'EDIT_ADVANCED'} = 'off';
  78 $cgiparams{'NAT'} = 'off';
  79 $cgiparams{'COMPRESSION'} = 'off';
  80 $cgiparams{'ONLY_PROPOSED'} = 'off';
  81 $cgiparams{'ACTION'} = '';
  82 $cgiparams{'CA_NAME'} = '';
  83 $cgiparams{'DHCP_DOMAIN'} = '';
  84 $cgiparams{'DHCP_DNS'} = '';
  85 $cgiparams{'DHCP_WINS'} = '';
  86 $cgiparams{'ROUTES_PUSH'} = '';
  87 $cgiparams{'DCOMPLZO'} = 'off';
  88 $cgiparams{'MSSFIX'} = '';
  89 $cgiparams{'number'} = '';
  90 $cgiparams{'PMTU_DISCOVERY'} = '';
  91 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  92 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  93 unless (-e "${General::swroot}/ovpn/ccd.conf")    { system("touch ${General::swroot}/ovpn/ccd.conf"); }
  94 unless (-e "${General::swroot}/ovpn/ccdroute")    { system("touch ${General::swroot}/ovpn/ccdroute"); }
  95 unless (-e "${General::swroot}/ovpn/ccdroute2")    { system("touch ${General::swroot}/ovpn/ccdroute2"); }
  96
  97 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  98
  99 # prepare openvpn config file
 100 ###
 101 ### Useful functions
 102 ###
 103 sub haveOrangeNet
 104 {
 105         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
 106         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 107         return 0;
 108 }
 109
 110 sub haveBlueNet
 111 {
 112         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
 113         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 114         return 0;
 115 }
 116
 117 sub sizeformat{
 118     my $bytesize = shift;
 119     my $i = 0;
 120
 121     while(abs($bytesize) >= 1024){
 122         $bytesize=$bytesize/1024;
 123         $i++;
 124         last if($i==6);
 125     }
 126
 127     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 128     my $newsize=(int($bytesize*100 +0.5))/100;
 129     return("$newsize $units[$i]");
 130 }
 131
 132 sub cleanssldatabase
 133 {
 134     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 135         print FILE "01";
 136         close FILE;
 137     }
 138     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 139         print FILE "";
 140         close FILE;
 141     }
 142     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 143     unlink ("${General::swroot}/ovpn/certs/serial.old");
 144     unlink ("${General::swroot}/ovpn/certs/01.pem");
 145 }
 146
 147 sub newcleanssldatabase
 148 {
 149     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 150         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 151         print FILE "01";
 152         close FILE;
 153     }
 154     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 155         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 156     }
 157     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 158     unlink ("${General::swroot}/ovpn/certs/serial.old");
 159 }
 160
 161 sub deletebackupcert
 162 {
 163         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 164                 my $hexvalue = <FILE>;
 165                 chomp $hexvalue;
 166                 close FILE;
 167                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 168         }
 169 }
 170 sub checkportfw {
 171         my $DPORT = shift;
 172         my $DPROT = shift;
 173         my %natconfig =();
 174         my $confignat = "${General::swroot}/firewall/config";
 175         $DPROT= uc ($DPROT);
 176         &General::readhasharray($confignat, \%natconfig);
 177         foreach my $key (sort keys %natconfig){
 178                 my @portarray = split (/\|/,$natconfig{$key}[30]);
 179                 foreach my $value (@portarray){
 180                         if ($value =~ /:/i){
 181                                 my ($a,$b) = split (":",$value);
 182                                 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
 183                                         $errormessage= "$Lang::tr{'source port in use'} $DPORT";
 184                                 }
 185                         }else{
 186                                 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
 187                                         $errormessage= "$Lang::tr{'source port in use'} $DPORT";
 188                                 }
 189                         }
 190                 }
 191         }
 192         return;
 193 }
 194
 195 sub checkportoverlap
 196 {
 197         my $portrange1 = $_[0]; # New port range
 198         my $portrange2 = $_[1]; # existing port range
 199         my @tempr1 = split(/\:/,$portrange1);
 200         my @tempr2 = split(/\:/,$portrange2);
 201
 202         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 203         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 204
 205         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 206         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 207
 208         return 1; # Everything checks out!
 209 }
 210
 211 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 212 sub checkportinc
 213 {
 214         my $port1 = $_[0]; # Port
 215         my $portrange2 = $_[1]; # Port range
 216         my @tempr1 = split(/\:/,$portrange2);
 217
 218         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 219                 return 1;
 220         } else {
 221                 return 0;
 222         }
 223 }
 224
 225 # Darren Critchley - certain ports are reserved for IPFire
 226 # TCP 67,68,81,222,445
 227 # UDP 67,68
 228 # Params passed in -> port, rangeyn, protocol
 229 sub disallowreserved
 230 {
 231         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 232         my $msg = "";
 233         my @tcp_reserved = (81,222,445);
 234         my $prt = $_[0]; # the port or range
 235         my $ryn = $_[1]; # tells us whether or not it is a port range
 236         my $prot = $_[2]; # protocol
 237         my $srcdst = $_[3]; # source or destination
 238         if ($ryn) { # disect port range
 239                 if ($srcdst eq "src") {
 240                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 241                 } else {
 242                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 243                 }
 244                 my @tmprng = split(/\:/,$prt);
 245                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 246                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 247                 if ($prot eq "tcp") {
 248                         foreach my $prange (@tcp_reserved) {
 249                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 250                         }
 251                 }
 252         } else {
 253                 if ($srcdst eq "src") {
 254                         $msg = "$Lang::tr{'reserved src port'}";
 255                 } else {
 256                         $msg = "$Lang::tr{'reserved dst port'}";
 257                 }
 258                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 259                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 260                 if ($prot eq "tcp") {
 261                         foreach my $prange (@tcp_reserved) {
 262                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 263                         }
 264                 }
 265         }
 266         return;
 267 }
 268
 269 sub writeserverconf {
 270     my %sovpnsettings = ();
 271     my @temp = ();
 272     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 273     &read_routepushfile;
 274
 275     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 276     flock CONF, 2;
 277     print CONF "#OpenVPN Server conf\n";
 278     print CONF "\n";
 279     print CONF "daemon openvpnserver\n";
 280     print CONF "writepid /var/run/openvpn.pid\n";
 281     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 282     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 283     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 284     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 285     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 286     print CONF "script-security 3 system\n";
 287     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 288     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 289     print CONF "tls-server\n";
 290     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 291     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 292     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 293     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 294     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 295     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 296     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 297
 298     # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
 299     # If we doesn't use one of them, we can use the configured mtu value.
 300     if ($sovpnsettings{'MSSFIX'} eq 'on')
 301         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 302     elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
 303         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 304     elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
 305            ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
 306            ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
 307         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 308     else
 309         { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
 310
 311     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 312                 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 313                 foreach (@temp)
 314                 {
 315                         @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 316                         print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 317                 }
 318         }
 319 # a.marx ccd
 320         my %ccdconfhash=();
 321         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 322         foreach my $key (keys %ccdconfhash) {
 323                 my $a=$ccdconfhash{$key}[1];
 324                 my ($b,$c) = split (/\//, $a);
 325                 print CONF "route $b ".&General::cidrtosub($c)."\n";
 326         }
 327         my %ccdroutehash=();
 328         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 329         foreach my $key (keys %ccdroutehash) {
 330                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
 331                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
 332                         print CONF "route $a $b\n";
 333                 }
 334         }
 335 # ccd end
 336
 337         if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 338         print CONF "client-to-client\n";
 339     }
 340     if ($sovpnsettings{MSSFIX} eq 'on') {
 341         print CONF "mssfix\n";
 342     }
 343     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 344         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 345     }
 346
 347     # Check if a valid operating mode has been choosen and use it.
 348     if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
 349         ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
 350         ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
 351                 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
 352     }
 353
 354     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 355         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 356     }
 357     print CONF "status-version 1\n";
 358     print CONF "status /var/log/ovpnserver.log 30\n";
 359     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 360     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 361         print CONF "comp-lzo\n";
 362     }
 363     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 364         print CONF "push \"redirect-gateway def1\"\n";
 365     }
 366     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 367         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 368     }
 369
 370     if ($sovpnsettings{DHCP_DNS} ne '') {
 371         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 372     }
 373
 374     if ($sovpnsettings{DHCP_WINS} ne '') {
 375         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 376     }
 377
 378     if ($sovpnsettings{DHCP_WINS} eq '') {
 379         print CONF "max-clients 100\n";
 380     }
 381     if ($sovpnsettings{DHCP_WINS} ne '') {
 382         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 383     }
 384     print CONF "tls-verify /usr/lib/openvpn/verify\n";
 385     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 386     print CONF "user nobody\n";
 387     print CONF "group nobody\n";
 388     print CONF "persist-key\n";
 389     print CONF "persist-tun\n";
 390         if ($sovpnsettings{LOG_VERB} ne '') {
 391                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 392         } else {
 393                 print CONF "verb 3\n";
 394         }
 395     print CONF "\n";
 396
 397     close(CONF);
 398 }
 399
 400 sub emptyserverlog{
 401     if (open(FILE, ">/var/log/ovpnserver.log")) {
 402         flock FILE, 2;
 403         print FILE "";
 404         close FILE;
 405     }
 406
 407 }
 408
 409 sub delccdnet
 410 {
 411         my %ccdconfhash = ();
 412         my %ccdhash = ();
 413         my $ccdnetname=$_[0];
 414         if (-f "${General::swroot}/ovpn/ovpnconfig"){
 415                 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 416                 foreach my $key (keys %ccdhash) {
 417                         if ($ccdhash{$key}[32] eq $ccdnetname) {
 418                                 $errormessage=$Lang::tr{'ccd err hostinnet'};
 419                                 return;
 420                         }
 421                 }
 422         }
 423         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 424         foreach my $key (keys %ccdconfhash) {
 425                         if ($ccdconfhash{$key}[0] eq $ccdnetname){
 426                                 delete $ccdconfhash{$key};
 427                         }
 428         }
 429         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 430
 431         &writeserverconf;
 432         return 0;
 433 }
 434
 435 sub addccdnet
 436 {
 437         my %ccdconfhash=();
 438         my @ccdconf=();
 439         my $ccdname=$_[0];
 440         my $ccdnet=$_[1];
 441         my $subcidr;
 442         my @ip2=();
 443         my $checkup;
 444         my $ccdip;
 445         my $baseaddress;
 446
 447
 448         #check name
 449         if ($ccdname eq '')
 450         {
 451                 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
 452                 return
 453         }
 454
 455         if(!&General::validhostname($ccdname))
 456         {
 457                 $errormessage=$Lang::tr{'ccd err invalidname'};
 458                 return;
 459         }
 460
 461         ($ccdip,$subcidr) = split (/\//,$ccdnet);
 462         $subcidr=&General::iporsubtocidr($subcidr);
 463         #check subnet
 464         if ($subcidr > 30)
 465         {
 466                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 467                 return;
 468         }
 469         #check ip
 470         if (!&General::validipandmask($ccdnet)){
 471                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 472                 return;
 473         }
 474
 475         $errormessage=&General::checksubnets($ccdname,$ccdnet);
 476
 477
 478         if (!$errormessage) {
 479                 my %ccdconfhash=();
 480                 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
 481                 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 482                 my $key = &General::findhasharraykey (\%ccdconfhash);
 483                 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
 484                 $ccdconfhash{$key}[0] = $ccdname;
 485                 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
 486                 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 487                 &writeserverconf;
 488                 $cgiparams{'ccdname'}='';
 489                 $cgiparams{'ccdsubnet'}='';
 490                 return 1;
 491         }
 492 }
 493
 494 sub modccdnet
 495 {
 496
 497         my $newname=$_[0];
 498         my $oldname=$_[1];
 499         my %ccdconfhash=();
 500         my %ccdhash=();
 501         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 502         foreach my $key (keys %ccdconfhash) {
 503                 if ($ccdconfhash{$key}[0] eq $oldname) {
 504                         foreach my $key1 (keys %ccdconfhash) {
 505                                 if ($ccdconfhash{$key1}[0] eq $newname){
 506                                         $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
 507                                         return;
 508                                 }else{
 509                                         $ccdconfhash{$key}[0]= $newname;
 510                                         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 511                                         last;
 512                                 }
 513                         }
 514                 }
 515         }
 516
 517         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 518                 foreach my $key (keys %ccdhash) {
 519                         if ($ccdhash{$key}[32] eq $oldname) {
 520                                 $ccdhash{$key}[32]=$newname;
 521                                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 522                                 last;
 523                         }
 524                 }
 525
 526         return 0;
 527 }
 528 sub ccdmaxclients
 529 {
 530         my $ccdnetwork=$_[0];
 531         my @octets=();
 532         my @subnet=();
 533         @octets=split("\/",$ccdnetwork);
 534         @subnet= split /\./, &General::cidrtosub($octets[1]);
 535         my ($a,$b,$c,$d,$e);
 536         $a=256-$subnet[0];
 537         $b=256-$subnet[1];
 538         $c=256-$subnet[2];
 539         $d=256-$subnet[3];
 540         $e=($a*$b*$c*$d)/4;
 541         return $e-1;
 542 }
 543
 544 sub getccdadresses
 545 {
 546         my $ipin=$_[0];
 547         my ($ip1,$ip2,$ip3,$ip4)=split  /\./, $ipin;
 548         my $cidr=$_[1];
 549         chomp($cidr);
 550         my $count=$_[2];
 551         my $hasip=$_[3];
 552         chomp($hasip);
 553         my @iprange=();
 554         my %ccdhash=();
 555         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 556         $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
 557         for (my $i=1;$i<=$count;$i++) {
 558                 my $tmpip=$iprange[$i-1];
 559                 my $stepper=$i*4;
 560                 $iprange[$i]= &General::getnextip($tmpip,4);
 561         }
 562         my $r=0;
 563         foreach my $key (keys %ccdhash) {
 564                 $r=0;
 565                 foreach  my $tmp (@iprange){
 566                         my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
 567                         if ($net eq $tmp) {
 568                                 if ( $hasip ne  $ccdhash{$key}[33] ){
 569                                         splice (@iprange,$r,1);
 570                                 }
 571                         }
 572                         $r++;
 573                 }
 574         }
 575         return @iprange;
 576 }
 577
 578 sub fillselectbox
 579 {
 580         my $boxname=$_[1];
 581         my ($ccdip,$subcidr) = split("/",$_[0]);
 582         my $tz=$_[2];
 583         my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
 584         print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
 585         foreach (@allccdips) {
 586                 my $ip=$_."/30";
 587                 chomp($ip);
 588                 print "<option value='$ip' ";
 589                 if ( $ip eq $cgiparams{$boxname} ){
 590                         print"selected";
 591                 }
 592                 print ">$ip</option>";
 593         }
 594         print "</select>";
 595 }
 596
 597 sub hostsinnet
 598 {
 599         my $name=$_[0];
 600         my %ccdhash=();
 601         my $i=0;
 602         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 603         foreach my $key (keys %ccdhash) {
 604                 if ($ccdhash{$key}[32] eq $name){ $i++;}
 605         }
 606         return $i;
 607 }
 608
 609 sub check_routes_push
 610 {
 611                         my $val=$_[0];
 612                         my ($ip,$cidr) = split (/\//, $val);
 613                         ##check for existing routes in routes_push
 614                         if (-e "${General::swroot}/ovpn/routes_push") {
 615                                 open(FILE,"${General::swroot}/ovpn/routes_push");
 616                                 while (<FILE>) {
 617                                         $_=~s/\s*$//g;
 618
 619                                         my ($ip2,$cidr2) = split (/\//,"$_");
 620                                         my $val2=$ip2."/".&General::iporsubtodec($cidr2);
 621
 622                                         if($val eq $val2){
 623                                                 return 0;
 624                                         }
 625                                         #subnetcheck
 626                                         if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
 627                                                 return 0;
 628                                         }
 629                                 };
 630                                 close(FILE);
 631                         }
 632         return 1;
 633 }
 634
 635 sub check_ccdroute
 636 {
 637         my %ccdroutehash=();
 638         my $val=$_[0];
 639         my ($ip,$cidr) = split (/\//, $val);
 640         #check for existing routes in ccdroute
 641         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 642         foreach my $key (keys %ccdroutehash) {
 643                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 644                         if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
 645                                 return 0;
 646                         }
 647                         my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
 648                         #subnetcheck
 649                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
 650                                 return 0;
 651                         }
 652                 }
 653         }
 654         return 1;
 655 }
 656 sub check_ccdconf
 657 {
 658         my %ccdconfhash=();
 659         my $val=$_[0];
 660         my ($ip,$cidr) = split (/\//, $val);
 661         #check for existing routes in ccdroute
 662         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 663         foreach my $key (keys %ccdconfhash) {
 664                 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
 665                                 return 0;
 666                         }
 667                         my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
 668                         #subnetcheck
 669                         if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
 670                                 return 0;
 671                         }
 672
 673         }
 674         return 1;
 675 }
 676
 677 ###
 678 # m.a.d net2net
 679 ###
 680
 681 sub validdotmask
 682 {
 683         my $ipdotmask = $_[0];
 684         if (&General::validip($ipdotmask)) { return 0; }
 685         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 686         my $mask = $2;
 687         if (($mask =~ /\./ )) { return 0; }
 688   return 1;
 689 }
 690
 691 # -------------------------------------------------------------------
 692
 693 sub write_routepushfile
 694 {
 695         open(FILE, ">$routes_push_file");
 696         flock(FILE, 2);
 697         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 698                 print FILE $vpnsettings{'ROUTES_PUSH'};
 699         }
 700         close(FILE);
 701 }
 702
 703 sub read_routepushfile
 704 {
 705         if (-e "$routes_push_file") {
 706                 open(FILE,"$routes_push_file");
 707                 delete $vpnsettings{'ROUTES_PUSH'};
 708                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 709                 close(FILE);
 710                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 711
 712         }
 713 }
 714
 715
 716 #hier die refresh page
 717 if ( -e "${General::swroot}/ovpn/gencanow") {
 718     my $refresh = '';
 719     $refresh = "<meta http-equiv='refresh' content='15;' />";
 720     &Header::showhttpheaders();
 721     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 722     &Header::openbigbox('100%', 'center');
 723     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 724     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 725     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 726     &Header::closebox();
 727     &Header::closebigbox();
 728     &Header::closepage();
 729     exit (0);
 730 }
 731 ##hier die refresh page
 732
 733
 734 ###
 735 ### OpenVPN Server Control
 736 ###
 737 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 738     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 739     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 740     #start openvpn server
 741     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 742         &emptyserverlog();
 743         system('/usr/local/bin/openvpnctrl', '-s');
 744     }
 745     #stop openvpn server
 746     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 747         system('/usr/local/bin/openvpnctrl', '-k');
 748         &emptyserverlog();
 749     }
 750 #    #restart openvpn server
 751 #    if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 752 #workarund, till SIGHUP also works when running as nobody
 753 #       system('/usr/local/bin/openvpnctrl', '-r');
 754 #       &emptyserverlog();
 755 #    }
 756 }
 757
 758 ###
 759 ### Save Advanced options
 760 ###
 761
 762 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 763     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 764     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 765     #DAN this value has to leave.
 766 #new settings for daemon
 767     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 768     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 769     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 770     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 771     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 772     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 773     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 774     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 775     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 776     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 777     $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
 778     my @temp=();
 779
 780     if ($cgiparams{'FRAGMENT'} eq '') {
 781         delete $vpnsettings{'FRAGMENT'};
 782     } else {
 783         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 784             $errormessage = "Incorrect value, please insert only numbers.";
 785         goto ADV_ERROR;
 786                 } else {
 787                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 788         }
 789     }
 790     if ($cgiparams{'MSSFIX'} ne 'on') {
 791         delete $vpnsettings{'MSSFIX'};
 792     } else {
 793         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 794     }
 795
 796     if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
 797         ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
 798         ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
 799
 800         if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
 801                 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
 802                 goto ADV_ERROR;
 803         }
 804     }
 805
 806     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 807         unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 808                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 809         goto ADV_ERROR;
 810         }
 811     }
 812     if ($cgiparams{'DHCP_DNS'} ne ''){
 813         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 814                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 815         goto ADV_ERROR;
 816         }
 817     }
 818     if ($cgiparams{'DHCP_WINS'} ne ''){
 819         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 820                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 821                 goto ADV_ERROR;
 822         }
 823     }
 824     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 825         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 826         undef $vpnsettings{'ROUTES_PUSH'};
 827
 828         foreach my $tmpip (@temp)
 829         {
 830                 s/^\s+//g; s/\s+$//g;
 831
 832                 if ($tmpip)
 833                 {
 834                         $tmpip=~s/\s*$//g;
 835                         unless (&General::validipandmask($tmpip)) {
 836                                 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
 837                                 goto ADV_ERROR;
 838                         }
 839                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
 840
 841                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 842                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 843                                 goto ADV_ERROR;
 844                         }
 845 # a.marx ccd
 846                         my %ccdroutehash=();
 847                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 848                         foreach my $key (keys %ccdroutehash) {
 849                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 850                                         if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
 851                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 852                                                 goto ADV_ERROR;
 853                                         }
 854                                         my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
 855                                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
 856                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 857                                                 goto ADV_ERROR;
 858                                         }
 859                                 }
 860                         }
 861
 862 # ccd end
 863
 864                         $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
 865                 }
 866         }
 867     &write_routepushfile;
 868         undef $vpnsettings{'ROUTES_PUSH'};
 869     }
 870         else {
 871         undef $vpnsettings{'ROUTES_PUSH'};
 872         &write_routepushfile;
 873     }
 874     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 875         $errormessage = $Lang::tr{'invalid input for max clients'};
 876         goto ADV_ERROR;
 877     }
 878     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 879         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 880             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 881         goto ADV_ERROR;
 882         }
 883     }
 884     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 885         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 886             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 887         goto ADV_ERROR;
 888         }
 889     }
 890     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 891         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 892         goto ADV_ERROR;
 893     }
 894
 895     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 896     &writeserverconf();#hier ok
 897 }
 898
 899 ###
 900 # m.a.d net2net
 901 ###
 902
 903 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 904 {
 905
 906 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 907 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 908 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 909 my $tunmtu =  '';
 910
 911 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 912 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 913
 914   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 915
 916   flock SERVERCONF, 2;
 917   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 918   print SERVERCONF "\n";
 919   print SERVERCONF "# User Security\n";
 920   print SERVERCONF "user nobody\n";
 921   print SERVERCONF "group nobody\n";
 922   print SERVERCONF "persist-tun\n";
 923   print SERVERCONF "persist-key\n";
 924   print SERVERCONF "script-security 2\n";
 925   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 926
 927   if ($cgiparams{'REMOTE'} ne '') {
 928   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 929   }
 930
 931   print SERVERCONF "float\n";
 932   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 933   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 934   print SERVERCONF "# Client Gateway Network\n";
 935   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 936   print SERVERCONF "# tun Device\n";
 937   print SERVERCONF "dev tun\n";
 938   print SERVERCONF "# Port and Protokol\n";
 939   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 940
 941   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 942   print SERVERCONF "proto tcp-server\n";
 943   print SERVERCONF "# Packet size\n";
 944   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 945   print SERVERCONF "tun-mtu $tunmtu\n";
 946   }
 947
 948   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 949   print SERVERCONF "proto udp\n";
 950   print SERVERCONF "# Paketsize\n";
 951   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 952   print SERVERCONF "tun-mtu $tunmtu\n";
 953   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 954   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
 955   }
 956
 957   # Check if a valid operating mode has been choosen and use it.
 958   if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
 959       ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
 960       ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
 961         if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
 962                 if($cgiparams{'MTU'} eq '1500') {
 963                         print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
 964                 }
 965         }
 966   }
 967   print SERVERCONF "# Auth. Server\n";
 968   print SERVERCONF "tls-server\n";
 969   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 970   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 971   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 972   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
 973   print SERVERCONF "# Cipher\n";
 974   print SERVERCONF "cipher AES-256-CBC\n";
 975   if ($cgiparams{'COMPLZO'} eq 'on') {
 976    print SERVERCONF "# Enable Compression\n";
 977    print SERVERCONF "comp-lzo\r\n";
 978      }
 979   print SERVERCONF "# Debug Level\n";
 980   print SERVERCONF "verb 3\n";
 981   print SERVERCONF "# Tunnel check\n";
 982   print SERVERCONF "keepalive 10 60\n";
 983   print SERVERCONF "# Start as daemon\n";
 984   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
 985   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 986   print SERVERCONF "# Activate Management Interface and Port\n";
 987   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 988   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 989   close(SERVERCONF);
 990
 991 }
 992
 993 ###
 994 # m.a.d net2net
 995 ###
 996
 997 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
 998 {
 999         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
1000         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1001         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
1002         my $tunmtu =  '';
1003
1004 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1005 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1006
1007   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1008
1009   flock CLIENTCONF, 2;
1010   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1011   print CLIENTCONF "#\n";
1012   print CLIENTCONF "# User Security\n";
1013   print CLIENTCONF "user nobody\n";
1014   print CLIENTCONF "group nobody\n";
1015   print CLIENTCONF "persist-tun\n";
1016   print CLIENTCONF "persist-key\n";
1017   print CLIENTCONF "script-security 2\n";
1018   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1019   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1020   print CLIENTCONF "float\n";
1021   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1022   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1023   print CLIENTCONF "# Server Gateway Network\n";
1024   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1025   print CLIENTCONF "# tun Device\n";
1026   print CLIENTCONF "dev tun\n";
1027   print CLIENTCONF "# Port and Protokol\n";
1028   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1029
1030   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1031   print CLIENTCONF "proto tcp-client\n";
1032   print CLIENTCONF "# Packet size\n";
1033   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1034   print CLIENTCONF "tun-mtu $tunmtu\n";
1035   }
1036
1037   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1038   print CLIENTCONF "proto udp\n";
1039   print CLIENTCONF "# Paketsize\n";
1040   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1041   print CLIENTCONF "tun-mtu $tunmtu\n";
1042   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1043   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1044   }
1045
1046   # Check if a valid operating mode has been choosen and use it.
1047   if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1048       ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1049       ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
1050         if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1051                 if ($cgiparams{'MTU'} eq '1500') {
1052                         print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1053                 }
1054         }
1055   }
1056
1057   print CLIENTCONF "ns-cert-type server\n";
1058   print CLIENTCONF "# Auth. Client\n";
1059   print CLIENTCONF "tls-client\n";
1060   print CLIENTCONF "# Cipher\n";
1061   print CLIENTCONF "cipher AES-256-CBC\n";
1062   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1063   if ($cgiparams{'COMPLZO'} eq 'on') {
1064    print CLIENTCONF "# Enable Compression\n";
1065    print CLIENTCONF "comp-lzo\r\n";
1066      }
1067   print CLIENTCONF "# Debug Level\n";
1068   print CLIENTCONF "verb 3\n";
1069   print CLIENTCONF "# Tunnel check\n";
1070   print CLIENTCONF "keepalive 10 60\n";
1071   print CLIENTCONF "# Start as daemon\n";
1072   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1073   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1074   print CLIENTCONF "# Activate Management Interface and Port\n";
1075   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1076   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1077   close(CLIENTCONF);
1078
1079 }
1080
1081 ###
1082 ### Save main settings
1083 ###
1084
1085
1086 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1087     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1088     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1089     #DAN this value has to leave.
1090     if ($cgiparams{'ENABLED'} eq 'on'){
1091         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1092                 $errormessage = $Lang::tr{'invalid input for hostname'};
1093         goto SETTINGS_ERROR;
1094         }
1095     }
1096     if ($cgiparams{'ENABLED'} eq 'on'){
1097         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
1098     }
1099     if ($errormessage) { goto SETTINGS_ERROR; }
1100
1101
1102     if ($cgiparams{'ENABLED'} eq 'on'){
1103         &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
1104     }
1105
1106     if ($errormessage) { goto SETTINGS_ERROR; }
1107
1108     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1109             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1110         goto SETTINGS_ERROR;
1111     }
1112     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1113
1114     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1115         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1116         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1117         goto SETTINGS_ERROR;
1118     }
1119
1120     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1121         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1122         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1123         goto SETTINGS_ERROR;
1124     }
1125
1126     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1127         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1128         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1129         goto SETTINGS_ERROR;
1130     }
1131
1132     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1133         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1134         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1135         goto SETTINGS_ERROR;
1136     }
1137     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1138     while (<ALIASES>)
1139     {
1140         chomp($_);
1141         my @tempalias = split(/\,/,$_);
1142         if ($tempalias[1] eq 'on') {
1143             if (&General::IpInSubnet ($tempalias[0] ,
1144                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1145                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1146             }
1147         }
1148     }
1149     close(ALIASES);
1150     if ($errormessage ne ''){
1151         goto SETTINGS_ERROR;
1152     }
1153     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1154         $errormessage = $Lang::tr{'invalid input'};
1155         goto SETTINGS_ERROR;
1156     }
1157     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1158         $errormessage = $Lang::tr{'invalid mtu input'};
1159         goto SETTINGS_ERROR;
1160     }
1161
1162     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1163         $errormessage = $Lang::tr{'invalid port'};
1164         goto SETTINGS_ERROR;
1165     }
1166     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1167     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1168     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1169     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1170 #new settings for daemon
1171     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1172     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1173     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1174     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1175     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1176     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1177     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1178 #wrtie enable
1179
1180   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1181   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1182   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1183 #new settings for daemon
1184     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1185     &writeserverconf();#hier ok
1186 SETTINGS_ERROR:
1187 ###
1188 ### Reset all step 2
1189 ###
1190 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1191     my $file = '';
1192     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1193
1194     foreach my $key (keys %confighash) {
1195         if ($confighash{$key}[4] eq 'cert') {
1196             delete $confighash{$cgiparams{'$key'}};
1197         }
1198     }
1199     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1200         unlink $file
1201     }
1202     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1203         unlink $file
1204     }
1205     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1206         unlink $file
1207     }
1208     &cleanssldatabase();
1209     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1210         print FILE "";
1211         close FILE;
1212     }
1213     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1214     #&writeserverconf();
1215 ###
1216 ### Reset all step 1
1217 ###
1218 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1219     &Header::showhttpheaders();
1220     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1221     &Header::openbigbox('100%', 'LEFT', '', '');
1222     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1223     print <<END
1224         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1225             <tr><td align='center'>
1226                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1227                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1228             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1229                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1230         </form></table>
1231 END
1232     ;
1233     &Header::closebox();
1234     &Header::closebigbox();
1235     &Header::closepage();
1236     exit (0);
1237
1238 ###
1239 ### Upload CA Certificate
1240 ###
1241 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1242     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1243
1244     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1245         $errormessage = $Lang::tr{'name must only contain characters'};
1246         goto UPLOADCA_ERROR;
1247     }
1248
1249     if (length($cgiparams{'CA_NAME'}) >60) {
1250         $errormessage = $Lang::tr{'name too long'};
1251         goto VPNCONF_ERROR;
1252     }
1253
1254     if ($cgiparams{'CA_NAME'} eq 'ca') {
1255         $errormessage = $Lang::tr{'name is invalid'};
1256         goto UPLOAD_CA_ERROR;
1257     }
1258
1259     # Check if there is no other entry with this name
1260     foreach my $key (keys %cahash) {
1261         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1262             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1263             goto UPLOADCA_ERROR;
1264         }
1265     }
1266
1267     if (ref ($cgiparams{'FH'}) ne 'Fh') {
1268         $errormessage = $Lang::tr{'there was no file upload'};
1269         goto UPLOADCA_ERROR;
1270     }
1271     # Move uploaded ca to a temporary file
1272     (my $fh, my $filename) = tempfile( );
1273     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1274         $errormessage = $!;
1275         goto UPLOADCA_ERROR;
1276     }
1277     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1278     if ($temp !~ /CA:TRUE/i) {
1279         $errormessage = $Lang::tr{'not a valid ca certificate'};
1280         unlink ($filename);
1281         goto UPLOADCA_ERROR;
1282     } else {
1283         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1284         if ($? ne 0) {
1285             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1286             unlink ($filename);
1287             goto UPLOADCA_ERROR;
1288         }
1289     }
1290
1291     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1292     $casubject    =~ /Subject: (.*)[\n]/;
1293     $casubject    = $1;
1294     $casubject    =~ s+/Email+, E+;
1295     $casubject    =~ s/ ST=/ S=/;
1296     $casubject    = &Header::cleanhtml($casubject);
1297
1298     my $key = &General::findhasharraykey (\%cahash);
1299     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1300     $cahash{$key}[1] = $casubject;
1301     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1302 #    system('/usr/local/bin/ipsecctrl', 'R');
1303
1304     UPLOADCA_ERROR:
1305
1306 ###
1307 ### Display ca certificate
1308 ###
1309 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1310     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1311
1312     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1313         &Header::showhttpheaders();
1314         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1315         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1316         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1317         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1318         $output = &Header::cleanhtml($output,"y");
1319         print "<pre>$output</pre>\n";
1320         &Header::closebox();
1321         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1322         &Header::closebigbox();
1323         &Header::closepage();
1324         exit(0);
1325     } else {
1326         $errormessage = $Lang::tr{'invalid key'};
1327     }
1328
1329 ###
1330 ### Download ca certificate
1331 ###
1332 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1333     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1334
1335     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1336         print "Content-Type: application/octet-stream\r\n";
1337         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1338         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1339         exit(0);
1340     } else {
1341         $errormessage = $Lang::tr{'invalid key'};
1342     }
1343
1344 ###
1345 ### Remove ca certificate (step 2)
1346 ###
1347 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1348     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1349     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1350
1351     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1352         foreach my $key (keys %confighash) {
1353             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1354             if ($test =~ /: OK/) {
1355                 # Delete connection
1356 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1357 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1358 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1359 #               }
1360                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1361                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1362                 delete $confighash{$key};
1363                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1364 #               &writeipsecfiles();
1365             }
1366         }
1367         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1368         delete $cahash{$cgiparams{'KEY'}};
1369         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1370 #       system('/usr/local/bin/ipsecctrl', 'R');
1371     } else {
1372         $errormessage = $Lang::tr{'invalid key'};
1373     }
1374 ###
1375 ### Remove ca certificate (step 1)
1376 ###
1377 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1378     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1379     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1380
1381     my $assignedcerts = 0;
1382     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1383         foreach my $key (keys %confighash) {
1384             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1385             if ($test =~ /: OK/) {
1386                 $assignedcerts++;
1387             }
1388         }
1389         if ($assignedcerts) {
1390             &Header::showhttpheaders();
1391             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1392             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1393             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1394             print <<END
1395                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1396                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1397                     <tr><td align='center'>
1398                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1399                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1400                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1401                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1402                 </form></table>
1403 END
1404             ;
1405             &Header::closebox();
1406             &Header::closebigbox();
1407             &Header::closepage();
1408             exit (0);
1409         } else {
1410             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1411             delete $cahash{$cgiparams{'KEY'}};
1412             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1413 #           system('/usr/local/bin/ipsecctrl', 'R');
1414         }
1415     } else {
1416         $errormessage = $Lang::tr{'invalid key'};
1417     }
1418
1419 ###
1420 ### Display root certificate
1421 ###
1422 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1423     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1424     my $output;
1425     &Header::showhttpheaders();
1426     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1427     &Header::openbigbox('100%', 'LEFT', '', '');
1428     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1429         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1430         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1431     } else {
1432         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1433         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1434     }
1435     $output = &Header::cleanhtml($output,"y");
1436     print "<pre>$output</pre>\n";
1437     &Header::closebox();
1438     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1439     &Header::closebigbox();
1440     &Header::closepage();
1441     exit(0);
1442
1443 ###
1444 ### Download root certificate
1445 ###
1446 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1447     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1448         print "Content-Type: application/octet-stream\r\n";
1449         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1450         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1451         exit(0);
1452     }
1453
1454 ###
1455 ### Download host certificate
1456 ###
1457 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1458     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1459         print "Content-Type: application/octet-stream\r\n";
1460         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1461         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1462         exit(0);
1463     }
1464 ###
1465 ### Form for generating a root certificate
1466 ###
1467 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1468          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1469
1470     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1471     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1472         $errormessage = $Lang::tr{'valid root certificate already exists'};
1473         $cgiparams{'ACTION'} = '';
1474         goto ROOTCERT_ERROR;
1475     }
1476
1477     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1478         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1479             my $ipaddr = <IPADDR>;
1480             close IPADDR;
1481             chomp ($ipaddr);
1482             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1483             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1484                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1485             }
1486         }
1487     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1488
1489         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1490             $errormessage = $Lang::tr{'there was no file upload'};
1491             goto ROOTCERT_ERROR;
1492         }
1493
1494         # Move uploaded certificate request to a temporary file
1495         (my $fh, my $filename) = tempfile( );
1496         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1497             $errormessage = $!;
1498             goto ROOTCERT_ERROR;
1499         }
1500
1501         # Create a temporary dirctory
1502         my $tempdir = tempdir( CLEANUP => 1 );
1503
1504         # Extract the CA certificate from the file
1505         my $pid = open(OPENSSL, "|-");
1506         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1507         if ($pid) {     # parent
1508             if ($cgiparams{'P12_PASS'} ne '') {
1509                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1510             }
1511             close (OPENSSL);
1512             if ($?) {
1513                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1514                 unlink ($filename);
1515                 goto ROOTCERT_ERROR;
1516             }
1517         } else {        # child
1518             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1519                     '-in', $filename,
1520                     '-out', "$tempdir/cacert.pem")) {
1521                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1522                 unlink ($filename);
1523                 goto ROOTCERT_ERROR;
1524             }
1525         }
1526
1527         # Extract the Host certificate from the file
1528         $pid = open(OPENSSL, "|-");
1529         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1530         if ($pid) {     # parent
1531             if ($cgiparams{'P12_PASS'} ne '') {
1532                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1533             }
1534             close (OPENSSL);
1535             if ($?) {
1536                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1537                 unlink ($filename);
1538                 goto ROOTCERT_ERROR;
1539             }
1540         } else {        # child
1541             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1542                     '-in', $filename,
1543                     '-out', "$tempdir/hostcert.pem")) {
1544                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1545                 unlink ($filename);
1546                 goto ROOTCERT_ERROR;
1547             }
1548         }
1549
1550         # Extract the Host key from the file
1551         $pid = open(OPENSSL, "|-");
1552         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1553         if ($pid) {     # parent
1554             if ($cgiparams{'P12_PASS'} ne '') {
1555                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1556             }
1557             close (OPENSSL);
1558             if ($?) {
1559                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1560                 unlink ($filename);
1561                 goto ROOTCERT_ERROR;
1562             }
1563         } else {        # child
1564             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1565                     '-nodes',
1566                     '-in', $filename,
1567                     '-out', "$tempdir/serverkey.pem")) {
1568                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1569                 unlink ($filename);
1570                 goto ROOTCERT_ERROR;
1571             }
1572         }
1573
1574         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1575         if ($? ne 0) {
1576             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1577             unlink ($filename);
1578             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1579             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1580             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1581             goto ROOTCERT_ERROR;
1582         }
1583
1584         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1585         if ($? ne 0) {
1586             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1587             unlink ($filename);
1588             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1589             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1590             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1591             goto ROOTCERT_ERROR;
1592         }
1593
1594         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1595         if ($? ne 0) {
1596             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1597             unlink ($filename);
1598             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1599             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1600             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1601             goto ROOTCERT_ERROR;
1602         }
1603
1604         goto ROOTCERT_SUCCESS;
1605
1606     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1607
1608         # Validate input since the form was submitted
1609         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1610             $errormessage = $Lang::tr{'organization cant be empty'};
1611             goto ROOTCERT_ERROR;
1612         }
1613         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1614             $errormessage = $Lang::tr{'organization too long'};
1615             goto ROOTCERT_ERROR;
1616         }
1617         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1618             $errormessage = $Lang::tr{'invalid input for organization'};
1619             goto ROOTCERT_ERROR;
1620         }
1621         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1622             $errormessage = $Lang::tr{'hostname cant be empty'};
1623             goto ROOTCERT_ERROR;
1624         }
1625         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1626             $errormessage = $Lang::tr{'invalid input for hostname'};
1627             goto ROOTCERT_ERROR;
1628         }
1629         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1630             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1631             goto ROOTCERT_ERROR;
1632         }
1633         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1634             $errormessage = $Lang::tr{'e-mail address too long'};
1635             goto ROOTCERT_ERROR;
1636         }
1637         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1638             $errormessage = $Lang::tr{'invalid input for department'};
1639             goto ROOTCERT_ERROR;
1640         }
1641         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1642             $errormessage = $Lang::tr{'invalid input for city'};
1643             goto ROOTCERT_ERROR;
1644         }
1645         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1646             $errormessage = $Lang::tr{'invalid input for state or province'};
1647             goto ROOTCERT_ERROR;
1648         }
1649         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1650             $errormessage = $Lang::tr{'invalid input for country'};
1651             goto ROOTCERT_ERROR;
1652         }
1653
1654         # Copy the cgisettings to vpnsettings and save the configfile
1655         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1656         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1657         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1658         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1659         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1660         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1661         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1662         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1663
1664         # Replace empty strings with a .
1665         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1666         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1667         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1668
1669         # refresh
1670         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1671
1672         # Create the CA certificate
1673         my $pid = open(OPENSSL, "|-");
1674         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1675         if ($pid) {     # parent
1676             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1677             print OPENSSL "$state\n";
1678             print OPENSSL "$city\n";
1679             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1680             print OPENSSL "$ou\n";
1681             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1682             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1683             close (OPENSSL);
1684             if ($?) {
1685                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1686                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1687                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1688                 goto ROOTCERT_ERROR;
1689             }
1690         } else {        # child
1691             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1692                         '-days', '999999', '-newkey', 'rsa:2048',
1693                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1694                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1695                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1696                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1697                 goto ROOTCERT_ERROR;
1698             }
1699         }
1700
1701         # Create the Host certificate request
1702         $pid = open(OPENSSL, "|-");
1703         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1704         if ($pid) {     # parent
1705             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1706             print OPENSSL "$state\n";
1707             print OPENSSL "$city\n";
1708             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1709             print OPENSSL "$ou\n";
1710             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1711             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1712             print OPENSSL ".\n";
1713             print OPENSSL ".\n";
1714             close (OPENSSL);
1715             if ($?) {
1716                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1717                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1718                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1719                 goto ROOTCERT_ERROR;
1720             }
1721         } else {        # child
1722             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1723                         '-newkey', 'rsa:1024',
1724                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1725                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1726                         '-extensions', 'server',
1727                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1728                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1729                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1730                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1731                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1732                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1733                 goto ROOTCERT_ERROR;
1734             }
1735         }
1736
1737         # Sign the host certificate request
1738         system('/usr/bin/openssl', 'ca', '-days', '999999',
1739                 '-batch', '-notext',
1740                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1741                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1742                 '-extensions', 'server',
1743                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1744         if ($?) {
1745             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1746             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1747             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1748             unlink ("${General::swroot}/ovpn/serverkey.pem");
1749             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1750             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1751             &newcleanssldatabase();
1752             goto ROOTCERT_ERROR;
1753         } else {
1754             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1755             &deletebackupcert();
1756         }
1757
1758         # Create an empty CRL
1759         system('/usr/bin/openssl', 'ca', '-gencrl',
1760                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1761                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1762         if ($?) {
1763             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1764             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1765             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1766             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1767             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1768             &cleanssldatabase();
1769             goto ROOTCERT_ERROR;
1770 #       } else {
1771 #           &cleanssldatabase();
1772         }
1773         # Create Diffie Hellmann Parameter
1774         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1775                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1776                '1024' );
1777         if ($?) {
1778             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1779             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1780             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1781             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1782             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1783             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1784             &cleanssldatabase();
1785             goto ROOTCERT_ERROR;
1786 #       } else {
1787 #           &cleanssldatabase();
1788         }
1789         goto ROOTCERT_SUCCESS;
1790     }
1791     ROOTCERT_ERROR:
1792     if ($cgiparams{'ACTION'} ne '') {
1793         &Header::showhttpheaders();
1794         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1795         &Header::openbigbox('100%', 'LEFT', '', '');
1796         if ($errormessage) {
1797             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1798             print "<class name='base'>$errormessage";
1799             print "&nbsp;</class>";
1800             &Header::closebox();
1801         }
1802         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1803         print <<END
1804         <form method='post' enctype='multipart/form-data'>
1805         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1806         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1807             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1808             <td width='35%' colspan='2'>&nbsp;</td></tr>
1809         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1810             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1811             <td colspan='2'>&nbsp;</td></tr>
1812         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1813             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1814             <td colspan='2'>&nbsp;</td></tr>
1815         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1816             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1817             <td colspan='2'>&nbsp;</td></tr>
1818         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1819             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1820             <td colspan='2'>&nbsp;</td></tr>
1821         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1822             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1823             <td colspan='2'>&nbsp;</td></tr>
1824         <tr><td class='base'>$Lang::tr{'country'}:</td>
1825             <td class='base'><select name='ROOTCERT_COUNTRY'>
1826
1827 END
1828         ;
1829         foreach my $country (sort keys %{Countries::countries}) {
1830             print "<option value='$Countries::countries{$country}'";
1831             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1832                 print " selected='selected'";
1833             }
1834             print ">$country</option>";
1835         }
1836         print <<END
1837             </select></td>
1838             <td colspan='2'>&nbsp;</td></tr>
1839         <tr><td>&nbsp;</td>
1840             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1841             <td>&nbsp;</td><td>&nbsp;</td></tr>
1842         <tr><td class='base' colspan='4' align='left'>
1843             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1844         <tr><td class='base' colspan='4' align='left'>
1845             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1846             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1847         </td></tr>
1848         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1849         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1850             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1851             <td colspan='2'>&nbsp;</td></tr>
1852         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1853             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1854             <td colspan='2'>&nbsp;</td></tr>
1855         <tr><td>&nbsp;</td>
1856             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1857             <td colspan='2'>&nbsp;</td></tr>
1858         <tr><td class='base' colspan='4' align='left'>
1859             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1860         </form></table>
1861 END
1862         ;
1863         &Header::closebox();
1864
1865         &Header::closebigbox();
1866         &Header::closepage();
1867         exit(0)
1868     }
1869
1870     ROOTCERT_SUCCESS:
1871     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1872 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1873 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1874 #       system('/usr/local/bin/ipsecctrl', 'S');
1875 #    }
1876
1877 ###
1878 ### Enable/Disable connection
1879 ###
1880
1881 ###
1882 # m.a.d net2net
1883 ###
1884
1885 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1886
1887     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1888     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1889 #    my $n2nactive = '';
1890     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1891
1892     if ($confighash{$cgiparams{'KEY'}}) {
1893                 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1894                         $confighash{$cgiparams{'KEY'}}[0] = 'on';
1895                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1896
1897                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1898                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1899                         }
1900                 } else {
1901
1902                         $confighash{$cgiparams{'KEY'}}[0] = 'off';
1903                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1904
1905                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1906                     if ($n2nactive ne ''){
1907                                                 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1908                                         }
1909
1910                         } else {
1911                   $errormessage = $Lang::tr{'invalid key'};
1912                         }
1913       }
1914   }
1915
1916 ###
1917 ### Download OpenVPN client package
1918 ###
1919
1920
1921 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1922     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1923     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1924     my $file = '';
1925     my $clientovpn = '';
1926     my @fileholder;
1927     my $tempdir = tempdir( CLEANUP => 1 );
1928     my $zippath = "$tempdir/";
1929
1930 ###
1931 # m.a.d net2net
1932 ###
1933
1934 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1935
1936         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1937         my $zippathname = "$zippath$zipname";
1938         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1939         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1940         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1941         my $tunmtu = '';
1942         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1943         my $n2nfragment = '';
1944
1945     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1946     flock CLIENTCONF, 2;
1947
1948     my $zip = Archive::Zip->new();
1949    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1950    print CLIENTCONF "# \n";
1951    print CLIENTCONF "# User Security\n";
1952    print CLIENTCONF "user nobody\n";
1953    print CLIENTCONF "group nobody\n";
1954    print CLIENTCONF "persist-tun\n";
1955    print CLIENTCONF "persist-key\n";
1956    print CLIENTCONF "script-security 2\n";
1957    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1958    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1959    print CLIENTCONF "float\n";
1960    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1961    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1962    print CLIENTCONF "# Server Gateway Network\n";
1963    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1964    print CLIENTCONF "# tun Device\n";
1965    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1966    print CLIENTCONF "# Port and Protokoll\n";
1967    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1968
1969    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1970    print CLIENTCONF "proto tcp-client\n";
1971    print CLIENTCONF "# Packet size\n";
1972    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1973    print CLIENTCONF "tun-mtu $tunmtu\n";
1974    }
1975
1976    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1977    print CLIENTCONF "proto udp\n";
1978    print CLIENTCONF "# Paketsize\n";
1979    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1980    print CLIENTCONF "tun-mtu $tunmtu\n";
1981    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1982    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1983    }
1984    if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
1985        ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
1986        ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
1987         if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
1988                 if ($tunmtu eq '1500' ) {
1989                         print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
1990                 }
1991         }
1992    }
1993    print CLIENTCONF "ns-cert-type server\n";
1994    print CLIENTCONF "# Auth. Client\n";
1995    print CLIENTCONF "tls-client\n";
1996    print CLIENTCONF "# Cipher\n";
1997    print CLIENTCONF "cipher AES-256-CBC\n";
1998     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1999          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2000      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2001    }
2002     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2003    print CLIENTCONF "# Enable Compression\n";
2004    print CLIENTCONF "comp-lzo\r\n";
2005      }
2006    print CLIENTCONF "# Debug Level\n";
2007    print CLIENTCONF "verb 3\n";
2008    print CLIENTCONF "# Tunnel check\n";
2009    print CLIENTCONF "keepalive 10 60\n";
2010    print CLIENTCONF "# Start as daemon\n";
2011    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2012    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2013    print CLIENTCONF "# Activate Management Interface and Port\n";
2014    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2015     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2016    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2017
2018
2019     close(CLIENTCONF);
2020
2021     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2022     my $status = $zip->writeToFileNamed($zippathname);
2023
2024     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2025     @fileholder = <DLFILE>;
2026     print "Content-Type:application/x-download\n";
2027     print "Content-Disposition:attachment;filename=$zipname\n\n";
2028     print @fileholder;
2029     exit (0);
2030 }
2031 else
2032 {
2033         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2034         my $zippathname = "$zippath$zipname";
2035         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2036
2037 ###
2038 # m.a.d net2net
2039 ###
2040
2041     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2042     flock CLIENTCONF, 2;
2043
2044     my $zip = Archive::Zip->new();
2045
2046     print CLIENTCONF "#OpenVPN Client conf\r\n";
2047     print CLIENTCONF "tls-client\r\n";
2048     print CLIENTCONF "client\r\n";
2049     print CLIENTCONF "nobind\r\n";
2050     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2051     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2052
2053     # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2054     # or use configured value.
2055     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2056         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2057     elsif ($vpnsettings{MSSFIX} eq 'on')
2058         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2059     elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2060            ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2061            ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2062         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2063     else
2064         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2065
2066     if ( $vpnsettings{'ENABLED'} eq 'on'){
2067         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2068         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2069             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2070             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2071         }
2072         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2073             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2074             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2075         }
2076     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2077         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2078         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2079             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2080             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2081         }
2082     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2083         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2084     }
2085
2086     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2087         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2088         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2089     } else {
2090         print CLIENTCONF "ca cacert.pem\r\n";
2091         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2092         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2093         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2094         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2095     }
2096     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2097     if ($vpnsettings{DCOMPLZO} eq 'on') {
2098         print CLIENTCONF "comp-lzo\r\n";
2099     }
2100     print CLIENTCONF "verb 3\r\n";
2101     print CLIENTCONF "ns-cert-type server\r\n";
2102     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2103     if ($vpnsettings{MSSFIX} eq 'on') {
2104         print CLIENTCONF "mssfix\r\n";
2105     }
2106     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2107         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2108     }
2109
2110     # Check if a valid operating mode has been choosen and use it.
2111     if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2112         ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2113         ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2114         if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2115                 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2116         }
2117     }
2118     close(CLIENTCONF);
2119
2120     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2121     my $status = $zip->writeToFileNamed($zippathname);
2122
2123     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2124     @fileholder = <DLFILE>;
2125     print "Content-Type:application/x-download\n";
2126     print "Content-Disposition:attachment;filename=$zipname\n\n";
2127     print @fileholder;
2128     exit (0);
2129    }
2130
2131
2132
2133 ###
2134 ### Remove connection
2135 ###
2136
2137
2138 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2139     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2140     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2141
2142     if ($confighash{$cgiparams{'KEY'}}) {
2143 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2144 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2145 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2146 #       }
2147 #
2148         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2149
2150 ###
2151 # m.a.d net2net
2152 ###
2153
2154 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2155         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2156         my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2157         unlink ($certfile);
2158         unlink ($conffile);
2159
2160         if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2161                 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2162         }
2163 }
2164
2165   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2166   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2167
2168 # A.Marx CCD delete ccd files and routes
2169
2170
2171         if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2172         {
2173                 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2174         }
2175
2176         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2177         foreach my $key (keys %ccdroutehash) {
2178                 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2179                         delete $ccdroutehash{$key};
2180                 }
2181         }
2182         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2183
2184         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2185         foreach my $key (keys %ccdroute2hash) {
2186                 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2187                         delete $ccdroute2hash{$key};
2188                 }
2189         }
2190         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2191         &writeserverconf;
2192
2193
2194 # CCD end
2195
2196
2197         delete $confighash{$cgiparams{'KEY'}};
2198         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2199         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2200
2201         #&writeserverconf();
2202     } else {
2203         $errormessage = $Lang::tr{'invalid key'};
2204     }
2205
2206
2207 ###
2208 ### Download PKCS12 file
2209 ###
2210 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2211     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2212
2213     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2214     print "Content-Type: application/octet-stream\r\n\r\n";
2215     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2216     exit (0);
2217
2218 ###
2219 ### Display certificate
2220 ###
2221 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2222     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2223
2224     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2225         &Header::showhttpheaders();
2226         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2227         &Header::openbigbox('100%', 'LEFT', '', '');
2228         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2229         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2230         $output = &Header::cleanhtml($output,"y");
2231         print "<pre>$output</pre>\n";
2232         &Header::closebox();
2233         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2234         &Header::closebigbox();
2235         &Header::closepage();
2236         exit(0);
2237     }
2238 ###
2239 ### Display Certificate Revoke List
2240 ###
2241 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2242 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2243
2244     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
2245         &Header::showhttpheaders();
2246         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2247         &Header::openbigbox('100%', 'LEFT', '', '');
2248         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2249         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2250         $output = &Header::cleanhtml($output,"y");
2251         print "<pre>$output</pre>\n";
2252         &Header::closebox();
2253         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2254         &Header::closebigbox();
2255         &Header::closepage();
2256         exit(0);
2257     }
2258
2259 ###
2260 ### Advanced Server Settings
2261 ###
2262
2263 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2264     %cgiparams = ();
2265     %cahash = ();
2266     %confighash = ();
2267     my $disabled;
2268     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2269     read_routepushfile;
2270
2271
2272 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2273 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
2274 #    }
2275 ADV_ERROR:
2276     if ($cgiparams{'MAX_CLIENTS'} eq '') {
2277         $cgiparams{'MAX_CLIENTS'} =  '100';
2278     }
2279     if ($cgiparams{'KEEPALIVE_1'} eq '') {
2280         $cgiparams{'KEEPALIVE_1'} =  '10';
2281     }
2282     if ($cgiparams{'KEEPALIVE_2'} eq '') {
2283         $cgiparams{'KEEPALIVE_2'} =  '60';
2284     }
2285     if ($cgiparams{'LOG_VERB'} eq '') {
2286         $cgiparams{'LOG_VERB'} =  '3';
2287     }
2288     if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
2289         $cgiparams{'PMTU_DISCOVERY'} = 'off';
2290     }
2291     $checked{'CLIENT2CLIENT'}{'off'} = '';
2292     $checked{'CLIENT2CLIENT'}{'on'} = '';
2293     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2294     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2295     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2296     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2297     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2298     $checked{'MSSFIX'}{'off'} = '';
2299     $checked{'MSSFIX'}{'on'} = '';
2300     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2301     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
2302     $selected{'LOG_VERB'}{'1'} = '';
2303     $selected{'LOG_VERB'}{'2'} = '';
2304     $selected{'LOG_VERB'}{'3'} = '';
2305     $selected{'LOG_VERB'}{'4'} = '';
2306     $selected{'LOG_VERB'}{'5'} = '';
2307     $selected{'LOG_VERB'}{'6'} = '';
2308     $selected{'LOG_VERB'}{'7'} = '';
2309     $selected{'LOG_VERB'}{'8'} = '';
2310     $selected{'LOG_VERB'}{'9'} = '';
2311     $selected{'LOG_VERB'}{'10'} = '';
2312     $selected{'LOG_VERB'}{'11'} = '';
2313     $selected{'LOG_VERB'}{'0'} = '';
2314     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2315
2316     &Header::showhttpheaders();
2317     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2318     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2319     if ($errormessage) {
2320         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2321         print "<class name='base'>$errormessage\n";
2322         print "&nbsp;</class>\n";
2323         &Header::closebox();
2324     }
2325     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2326     print <<END
2327     <form method='post' enctype='multipart/form-data'>
2328     <table width='100%' border=0>
2329     <tr>
2330         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2331     </tr>
2332     <tr>
2333         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2334     </tr>
2335     <tr>
2336         <td class='base'>Domain</td>
2337         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30'  /></td>
2338     </tr>
2339     <tr>
2340         <td class='base'>DNS</td>
2341         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2342     </tr>
2343     <tr>
2344         <td class='base'>WINS</td>
2345         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2346        </tr>
2347     <tr>
2348         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2349     </tr>
2350     <tr>
2351         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2352   <td colspan='2'>
2353        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2354 END
2355 ;
2356
2357 if ($cgiparams{'ROUTES_PUSH'} ne '')
2358 {
2359         print $cgiparams{'ROUTES_PUSH'};
2360 }
2361
2362 print <<END;
2363 </textarea></td>
2364 </tr>
2365     </tr>
2366 </table>
2367 <hr size='1'>
2368     <table width='100%'>
2369     <tr>
2370         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2371     </tr>
2372     <tr>
2373         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
2374     </tr>
2375     <tr>
2376         <td class='base'>Client-To-Client</td>
2377         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2378     </tr>
2379     <tr>
2380         <td class='base'>Redirect-Gateway def1</td>
2381         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2382     </tr>
2383     <tr>
2384         <td class='base'>Max-Clients</td>
2385         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2386     </tr>
2387         <tr>
2388           <td class='base'>Keepalive <br />
2389             (ping/ping-restart)</td>
2390           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2391           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2392     </tr>
2393         <tr>
2394           <td class='base'>fragment <br></td>
2395           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2396         <td>Default: <span class="base">1300</span></td>
2397       </tr>
2398         <tr>
2399           <td class='base'>mssfix</td>
2400           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2401           <td>Default: on</td>
2402           </tr>
2403
2404         <tr>
2405                 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2406                 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2407                 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2408                 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2409                 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2410         </tr>
2411 </table>
2412
2413 <!--
2414 <hr size='1'>
2415     <table width='100%'>
2416     <tr>
2417  <td class'base'><b>Crypto-Engines</b></td>
2418     </tr>
2419     <tr>
2420         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2421     </tr>
2422     <tr><td class='base'>Engines:</td>
2423         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2424                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2425                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2426                         </select>
2427                 </td>
2428 </table>
2429 -->
2430 <hr size='1'>
2431     <table width='100%'>
2432     <tr>
2433         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2434     </tr>
2435     <tr>
2436         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2437     </tr>
2438
2439     <tr><td class='base'>VERB</td>
2440         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2441                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2442                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2443                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2444                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2445                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2446                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2447                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2448                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2449                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2450                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2451                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2452 </table><hr>
2453 END
2454
2455 if ( -e "/var/run/openvpn.pid"){
2456 print"  <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2457                 $Lang::tr{'server restart'}<br><br>
2458                 <hr>";
2459                 print<<END
2460 <table width='100%'>
2461 <tr>
2462     <td>&nbsp;</td>
2463     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2464     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2465     <td>&nbsp;</td>
2466 </tr>
2467 </table>
2468 </form>
2469 END
2470 ;
2471
2472
2473 }else{
2474
2475 print<<END
2476 <table width='100%'>
2477 <tr>
2478     <td>&nbsp;</td>
2479     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2480     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2481     <td>&nbsp;</td>
2482 </tr>
2483 </table>
2484 </form>
2485 END
2486 ;
2487 }
2488     &Header::closebox();
2489 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2490     &Header::closebigbox();
2491     &Header::closepage();
2492     exit(0);
2493
2494
2495 # A.Marx CCD   Add,delete or edit CCD net
2496
2497 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2498                 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2499                 $cgiparams{'ACTION'} eq "kill" ||
2500                 $cgiparams{'ACTION'} eq "edit" ||
2501                 $cgiparams{'ACTION'} eq 'editsave'){
2502         &Header::showhttpheaders();
2503         &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2504         &Header::openbigbox('100%', 'LEFT', '', '');
2505
2506         if ($cgiparams{'ACTION'} eq "kill"){
2507                 &delccdnet($cgiparams{'net'});
2508         }
2509
2510         if ($cgiparams{'ACTION'} eq 'editsave'){
2511                 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2512                 if ( $a ne $b){ &modccdnet($a,$b);}
2513                 $cgiparams{'ccdname'}='';
2514                 $cgiparams{'ccdsubnet'}='';
2515         }
2516
2517         if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
2518                 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
2519         }
2520         if ($errormessage) {
2521             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2522             print "<class name='base'>$errormessage";
2523             print "&nbsp;</class>";
2524             &Header::closebox();
2525         }
2526 if ($cgiparams{'ACTION'} eq "edit"){
2527
2528         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2529
2530         print <<END
2531     <table width='100%' border=0>
2532     <tr><form method='post'>
2533         <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2534         <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
2535         <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2536         <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2537         </td></tr>
2538         </table></form>
2539 END
2540 ;
2541         &Header::closebox();
2542
2543         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2544         print <<END
2545     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2546     <tr>
2547         <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2548 END
2549 ;
2550 }
2551 else{
2552         if (! -e "/var/run/openvpn.pid"){
2553         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2554                 print <<END;
2555             <table width='100%' border='0'>
2556             <tr><form method='post'>
2557                 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2558                 <tr>
2559                 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2560                 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2561                 <tr><td colspan=4><hr /></td></tr><tr>
2562                 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2563                 </table></form>
2564 END
2565
2566         &Header::closebox();
2567 }
2568         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2569         if ( -e "/var/run/openvpn.pid"){
2570                 print "<b>$Lang::tr{'attention'}:</b><br>";
2571                 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2572         }
2573
2574         print <<END
2575     <table width='100%' cellpadding='0' cellspacing='1'>
2576     <tr>
2577         <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2578 END
2579 ;
2580 }
2581         my %ccdconfhash=();
2582         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2583         my @ccdconf=();
2584         my $count=0;
2585         foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
2586                 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2587                 $count++;
2588                 my $ccdhosts = &hostsinnet($ccdconf[0]);
2589                 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2590                 else{            print" <tr bgcolor='$color{'color20'}'>";}
2591                 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
2592 print <<END
2593                 <form method='post' />
2594                 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
2595                 <input type='hidden' name='ACTION' value='edit'/>
2596                 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2597                 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2598                 </form></td>
2599                 <form method='post' />
2600                 <td><input type='hidden' name='ACTION' value='kill'/>
2601                 <input type='hidden' name='number' value='$count' />
2602                 <input type='hidden' name='net' value='$ccdconf[0]' />
2603                 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
2604 END
2605 ;
2606         }
2607         print "</table></form>";
2608         &Header::closebox();
2609         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2610         &Header::closebigbox();
2611         &Header::closepage();
2612         exit(0);
2613
2614 #END CCD
2615
2616 ###
2617 ### Openvpn Connections Statistics
2618 ###
2619 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2620         &Header::showhttpheaders();
2621         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2622         &Header::openbigbox('100%', 'LEFT', '', '');
2623     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2624
2625 #
2626 #       <td><b>$Lang::tr{'protocol'}</b></td>
2627 # protocol temp removed
2628     print <<END
2629     <table width='100%' cellpadding='2' cellspacing='0' class='tbl'>
2630     <tr>
2631         <th><b>$Lang::tr{'common name'}</b></th>
2632         <th><b>$Lang::tr{'real address'}</b></th>
2633         <th><b>$Lang::tr{'virtual address'}</b></th>
2634         <th><b>$Lang::tr{'loged in at'}</b></th>
2635         <th><b>$Lang::tr{'bytes sent'}</b></th>
2636         <th><b>$Lang::tr{'bytes received'}</b></th>
2637         <th><b>$Lang::tr{'last activity'}</b></th>
2638     </tr>
2639 END
2640 ;
2641         my $filename = "/var/log/ovpnserver.log";
2642         open(FILE, $filename) or die 'Unable to open config file.';
2643         my @current = <FILE>;
2644         close(FILE);
2645         my @users =();
2646         my $status;
2647         my $uid = 0;
2648         my $cn;
2649         my @match = ();
2650         my $proto = "udp";
2651         my $address;
2652         my %userlookup = ();
2653         foreach my $line (@current)
2654         {
2655             chomp($line);
2656             if ( $line =~ /^Updated,(.+)/){
2657                 @match = split( /^Updated,(.+)/, $line);
2658                 $status = $match[1];
2659             }
2660 #gian
2661             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2662                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2663                 if ($match[1] ne "Common Name") {
2664                     $cn = $match[1];
2665                     $userlookup{$match[2]} = $uid;
2666                     $users[$uid]{'CommonName'} = $match[1];
2667                     $users[$uid]{'RealAddress'} = $match[2];
2668                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2669                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2670                     $users[$uid]{'Since'} = $match[5];
2671                     $users[$uid]{'Proto'} = $proto;
2672                     $uid++;
2673                 }
2674             }
2675             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2676                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2677                 if ($match[1] ne "Virtual Address") {
2678                     $address = $match[3];
2679                     #find the uid in the lookup table
2680                     $uid = $userlookup{$address};
2681                     $users[$uid]{'VirtualAddress'} = $match[1];
2682                     $users[$uid]{'LastRef'} = $match[4];
2683                 }
2684             }
2685         }
2686         my $user2 = @users;
2687         if ($user2 >= 1){
2688                 for (my $idx = 1; $idx <= $user2; $idx++){
2689                                                 if ($idx % 2) {
2690                                                         print "<tr>";
2691                                                         $col="bgcolor='$color{'color22'}'";
2692                                                 } else {
2693                                                         print "<tr>";
2694                                                         $col="bgcolor='$color{'color20'}'";
2695                                                 }
2696                                                 print "<td align='left' $col>$users[$idx-1]{'CommonName'}</td>";
2697                                                 print "<td align='left' $col>$users[$idx-1]{'RealAddress'}</td>";
2698                                                 print "<td align='left' $col>$users[$idx-1]{'VirtualAddress'}</td>";
2699                                                 print "<td align='left' $col>$users[$idx-1]{'Since'}</td>";
2700                                                 print "<td align='left' $col>$users[$idx-1]{'BytesSent'}</td>";
2701                                                 print "<td align='left' $col>$users[$idx-1]{'BytesReceived'}</td>";
2702                                                 print "<td align='left' $col>$users[$idx-1]{'LastRef'}</td>";
2703                         }
2704         }
2705
2706         print "</table>";
2707         print <<END
2708         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2709         <tr><td></td></tr>
2710         <tr><td></td></tr>
2711         <tr><td></td></tr>
2712         <tr><td></td></tr>
2713         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2714         </table>
2715 END
2716 ;
2717         &Header::closebox();
2718         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2719         &Header::closebigbox();
2720         &Header::closepage();
2721         exit(0);
2722
2723 ###
2724 ### Download Certificate
2725 ###
2726 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2727     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2728
2729     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2730         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2731         print "Content-Type: application/octet-stream\r\n\r\n";
2732         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2733         exit (0);
2734     }
2735
2736 ###
2737 ### Enable/Disable connection
2738 ###
2739
2740 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2741
2742     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2743     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2744
2745     if ($confighash{$cgiparams{'KEY'}}) {
2746            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2747             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2748             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2749             #&writeserverconf();
2750 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2751 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2752 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2753 #           }
2754         } else {
2755             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2756 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2757 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2758 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2759 #           }
2760             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2761             #&writeserverconf();
2762         }
2763     } else {
2764         $errormessage = $Lang::tr{'invalid key'};
2765     }
2766
2767 ###
2768 ### Restart connection
2769 ###
2770 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2771     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2772     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2773
2774     if ($confighash{$cgiparams{'KEY'}}) {
2775 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2776 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2777 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2778 #       }
2779     } else {
2780         $errormessage = $Lang::tr{'invalid key'};
2781     }
2782
2783 ###
2784 ### Remove connection
2785 ###
2786 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2787     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2788     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2789
2790     if ($confighash{$cgiparams{'KEY'}}) {
2791 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2792 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2793 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2794 #       }
2795         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2796         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2797         delete $confighash{$cgiparams{'KEY'}};
2798         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2799         #&writeserverconf();
2800     } else {
2801         $errormessage = $Lang::tr{'invalid key'};
2802     }
2803 #test33
2804
2805 ###
2806 ### Choose between adding a host-net or net-net connection
2807 ###
2808
2809 ###
2810 # m.a.d net2net
2811 ###
2812
2813 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2814         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2815         &Header::showhttpheaders();
2816         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2817         &Header::openbigbox('100%', 'LEFT', '', '');
2818         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2819
2820 if ( -s "${General::swroot}/ovpn/settings") {
2821
2822         print <<END
2823             <b>$Lang::tr{'connection type'}:</b><br />
2824             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2825             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2826                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2827             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2828                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2829                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2830                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2831           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2832           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2833     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr>
2834           <tr><td colspan='3'><hr /></td></tr>
2835     <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2836           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2837             </form></table>
2838 END
2839         ;
2840
2841
2842 } else {
2843         print <<END
2844                     <b>$Lang::tr{'connection type'}:</b><br />
2845             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2846             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2847             <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2848             </form></table>
2849 END
2850         ;
2851
2852 }
2853
2854         &Header::closebox();
2855         &Header::closebigbox();
2856         &Header::closepage();
2857         exit (0);
2858
2859 ###
2860 # m.a.d net2net
2861 ###
2862
2863 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2864
2865         my @firen2nconf;
2866         my @confdetails;
2867         my $uplconffilename ='';
2868         my $uplconffilename2 ='';
2869         my $uplp12name = '';
2870         my $uplp12name2 = '';
2871         my @rem_subnet;
2872         my @rem_subnet2;
2873         my @tmposupnet3;
2874         my $key;
2875         my @n2nname;
2876
2877         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2878
2879 # Check if a file is uploaded
2880
2881         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2882                 $errormessage = $Lang::tr{'there was no file upload'};
2883                 goto N2N_ERROR;
2884     }
2885
2886 # Move uploaded IPfire n2n package to temporary file
2887
2888     (my $fh, my $filename) = tempfile( );
2889     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2890                 $errormessage = $!;
2891                 goto N2N_ERROR;
2892     }
2893
2894         my $zip = Archive::Zip->new();
2895         my $zipName = $filename;
2896         my $status = $zip->read( $zipName );
2897         if ($status != AZ_OK) {
2898                 $errormessage = "Read of $zipName failed\n";
2899                 goto N2N_ERROR;
2900         }
2901
2902         my $tempdir = tempdir( CLEANUP => 1 );
2903         my @files = $zip->memberNames();
2904         for(@files) {
2905         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2906         }
2907         my $countfiles = @files;
2908
2909 # Check if we have not more then 2 files
2910
2911         if ( $countfiles == 2){
2912                 foreach (@files){
2913                         if ( $_ =~ /.conf$/){
2914                                 $uplconffilename = $_;
2915                         }
2916                         if ( $_ =~ /.p12$/){
2917                                 $uplp12name = $_;
2918                         }
2919                 }
2920                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2921                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2922                         goto N2N_ERROR;
2923                 }
2924
2925                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2926                 @firen2nconf = <FILE>;
2927                 close (FILE);
2928                 chomp(@firen2nconf);
2929
2930         } else {
2931
2932                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2933                 goto N2N_ERROR;
2934         }
2935
2936 ###
2937 # m.a.d net2net
2938 ###
2939
2940  if ($cgiparams{'n2nname'} ne ''){
2941
2942   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2943   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2944   $n2nname[0] = $cgiparams{'n2nname'};
2945   my @n2nname2 = split(/\./,$uplconffilename);
2946   $n2nname2[0] =~ s/\n|\r//g;
2947   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2948         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2949         my $input2 = "$n2nname2[0]n2n";
2950   my $output2 = "$n2nname[0]n2n";
2951   my $filename = "$tempdir/$uplconffilename";
2952   open(FILE, "< $filename") or die 'Unable to open config file.';
2953         my @current = <FILE>;
2954         close(FILE);
2955         foreach (@current) {s/$input1/$output1/g;}
2956         foreach (@current) {s/$input2/$output2/g;}
2957   open (OUT, "> $filename") || die 'Unable to open config file.';
2958   print OUT @current;
2959   close OUT;
2960
2961     }else{
2962     $uplconffilename2 =  $uplconffilename;
2963     $uplp12name2 = $uplp12name;
2964     @n2nname = split(/\./,$uplconffilename);
2965     $n2nname[0] =~ s/\n|\r//g;
2966    }
2967     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2968     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2969
2970         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
2971
2972         if ($? ne 0) {
2973             $errormessage = "*.conf move failed: $!";
2974             unlink ($filename);
2975             goto N2N_ERROR;
2976         }
2977
2978         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
2979         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2980
2981         if ($? ne 0) {
2982             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2983             unlink ($filename);
2984             goto N2N_ERROR;
2985         }
2986
2987 my $complzoactive;
2988 my $mssfixactive;
2989 my $n2nfragment;
2990 my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);;
2991 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2992 my @n2nproto = split(/-/, $n2nproto2[1]);
2993 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2994 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2995 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2996 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2997 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
2998 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2999 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
3000 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
3001 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3002 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3003 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
3004 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
3005 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
3006 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3007
3008
3009 ###
3010 # m.a.d delete CR and LF from arrays for this chomp doesnt work
3011 ###
3012
3013 $n2nremote[1] =~ s/\n|\r//g;
3014 $n2novpnsub[0] =~ s/\n|\r//g;
3015 $n2novpnsub[1] =~ s/\n|\r//g;
3016 $n2novpnsub[2] =~ s/\n|\r//g;
3017 $n2nproto[0] =~ s/\n|\r//g;
3018 $n2nport[1] =~ s/\n|\r//g;
3019 $n2ntunmtu[1] =~ s/\n|\r//g;
3020 $n2nremsub[1] =~ s/\n|\r//g;
3021 $n2nremsub[2] =~ s/\n|\r//g;
3022 $n2nlocalsub[2] =~ s/\n|\r//g;
3023 $n2nfragment[1] =~ s/\n|\r//g;
3024 $n2nmgmt[2] =~ s/\n|\r//g;
3025 $n2nmtudisc[1] =~ s/\n|\r//g;
3026 chomp ($complzoactive);
3027 chomp ($mssfixactive);
3028
3029 ###
3030 # m.a.d net2net
3031 ###
3032
3033 ###
3034 # Check if there is no other entry with this name
3035 ###
3036
3037         foreach my $dkey (keys %confighash) {
3038                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3039                         $errormessage = $Lang::tr{'a connection with this name already exists'};
3040                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3041             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3042       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3043                         goto N2N_ERROR;
3044                 }
3045         }
3046
3047 ###
3048 # Check if OpenVPN Subnet is valid
3049 ###
3050
3051 foreach my $dkey (keys %confighash) {
3052                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3053                         $errormessage = 'The OpenVPN Subnet is already in use';
3054                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3055             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3056       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3057                         goto N2N_ERROR;
3058                 }
3059         }
3060
3061 ###
3062 # Check im Dest Port is vaild
3063 ###
3064
3065 foreach my $dkey (keys %confighash) {
3066                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3067                         $errormessage = 'The OpenVPN Port is already in use';
3068                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3069             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3070       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3071                         goto N2N_ERROR;
3072                 }
3073         }
3074
3075
3076
3077   $key = &General::findhasharraykey (\%confighash);
3078
3079         foreach my $i (0 .. 39) { $confighash{$key}[$i] = "";}
3080
3081         $confighash{$key}[0] = 'off';
3082         $confighash{$key}[1] = $n2nname[0];
3083         $confighash{$key}[2] = $n2nname[0];
3084         $confighash{$key}[3] = 'net';
3085         $confighash{$key}[4] = 'cert';
3086         $confighash{$key}[6] = 'client';
3087         $confighash{$key}[8] =  $n2nlocalsub[2];
3088         $confighash{$key}[10] = $n2nremote[1];
3089         $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3090         $confighash{$key}[22] = $n2nmgmt[2];
3091         $confighash{$key}[23] = $mssfixactive;
3092         $confighash{$key}[24] = $n2nfragment[1];
3093         $confighash{$key}[25] = 'IPFire n2n Client';
3094         $confighash{$key}[26] = 'red';
3095         $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3096         $confighash{$key}[28] = $n2nproto[0];
3097         $confighash{$key}[29] = $n2nport[1];
3098         $confighash{$key}[30] = $complzoactive;
3099         $confighash{$key}[31] = $n2ntunmtu[1];
3100         $confighash{$key}[38] = $n2nmtudisc[1];
3101
3102
3103   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3104
3105   N2N_ERROR:
3106
3107         &Header::showhttpheaders();
3108         &Header::openpage('Validate imported configuration', 1, '');
3109         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3110         if ($errormessage) {
3111             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3112             print "<class name='base'>$errormessage";
3113             print "&nbsp;</class>";
3114             &Header::closebox();
3115
3116         } else
3117   {
3118                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3119         }
3120         if ($errormessage eq ''){
3121                 print <<END
3122                 <!-- ipfire net2net config gui -->
3123                 <table width='100%'>
3124                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3125     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3126     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3127                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3128                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3129                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3130                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
3131                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3132                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3133                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3134                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3135                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
3136                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
3137                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3138                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td><b>$confighash{$key}[38]</b></td></tr>
3139                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3140                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3141     </table>
3142 END
3143 ;
3144                 &Header::closebox();
3145         }
3146
3147         if ($errormessage) {
3148                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3149         } else {
3150                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3151                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3152                 print "<input type='hidden' name='KEY' value='$key' />";
3153                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3154         }
3155         &Header::closebigbox();
3156         &Header::closepage();
3157         exit(0);
3158
3159
3160 ##
3161 ### Accept IPFire n2n Package Settings
3162 ###
3163
3164   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3165
3166 ###
3167 ### Discard and Rollback IPFire n2n Package Settings
3168 ###
3169
3170   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3171
3172      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3173
3174 if ($confighash{$cgiparams{'KEY'}}) {
3175
3176      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3177      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3178      unlink ($certfile) or die "Removing $certfile fail: $!";
3179      unlink ($conffile) or die "Removing $conffile fail: $!";
3180      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3181      delete $confighash{$cgiparams{'KEY'}};
3182     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3183
3184      } else {
3185                 $errormessage = $Lang::tr{'invalid key'};
3186    }
3187
3188
3189 ###
3190 # m.a.d net2net
3191 ###
3192
3193
3194 ###
3195 ### Adding a new connection
3196 ###
3197 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3198          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3199          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3200
3201     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3202     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3203     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3204
3205     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3206                 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3207                     $errormessage = $Lang::tr{'invalid key'};
3208                     goto VPNCONF_END;
3209                 }
3210                 $cgiparams{'ENABLED'}                   = $confighash{$cgiparams{'KEY'}}[0];
3211                 $cgiparams{'NAME'}                              = $confighash{$cgiparams{'KEY'}}[1];
3212                 $cgiparams{'TYPE'}                              = $confighash{$cgiparams{'KEY'}}[3];
3213                 $cgiparams{'AUTH'}                              = $confighash{$cgiparams{'KEY'}}[4];
3214                 $cgiparams{'PSK'}                               = $confighash{$cgiparams{'KEY'}}[5];
3215                 $cgiparams{'SIDE'}                              = $confighash{$cgiparams{'KEY'}}[6];
3216                 $cgiparams{'LOCAL_SUBNET'}              = $confighash{$cgiparams{'KEY'}}[8];
3217                 $cgiparams{'REMOTE'}                    = $confighash{$cgiparams{'KEY'}}[10];
3218                 $cgiparams{'REMOTE_SUBNET'}     = $confighash{$cgiparams{'KEY'}}[11];
3219                 $cgiparams{'OVPN_MGMT'}                 = $confighash{$cgiparams{'KEY'}}[22];
3220                 $cgiparams{'MSSFIX'}                    = $confighash{$cgiparams{'KEY'}}[23];
3221                 $cgiparams{'FRAGMENT'}                  = $confighash{$cgiparams{'KEY'}}[24];
3222                 $cgiparams{'REMARK'}                    = $confighash{$cgiparams{'KEY'}}[25];
3223                 $cgiparams{'INTERFACE'}                 = $confighash{$cgiparams{'KEY'}}[26];
3224                 $cgiparams{'OVPN_SUBNET'}               = $confighash{$cgiparams{'KEY'}}[27];
3225                 $cgiparams{'PROTOCOL'}                  = $confighash{$cgiparams{'KEY'}}[28];
3226                 $cgiparams{'DEST_PORT'}                 = $confighash{$cgiparams{'KEY'}}[29];
3227                 $cgiparams{'COMPLZO'}                   = $confighash{$cgiparams{'KEY'}}[30];
3228                 $cgiparams{'MTU'}                               = $confighash{$cgiparams{'KEY'}}[31];
3229                 $cgiparams{'CHECK1'}                    = $confighash{$cgiparams{'KEY'}}[32];
3230                 $name=$cgiparams{'CHECK1'}      ;
3231                 $cgiparams{$name}                               = $confighash{$cgiparams{'KEY'}}[33];
3232                 $cgiparams{'RG'}                                = $confighash{$cgiparams{'KEY'}}[34];
3233                 $cgiparams{'CCD_DNS1'}                  = $confighash{$cgiparams{'KEY'}}[35];
3234                 $cgiparams{'CCD_DNS2'}                  = $confighash{$cgiparams{'KEY'}}[36];
3235                 $cgiparams{'CCD_WINS'}                  = $confighash{$cgiparams{'KEY'}}[37];
3236                 $cgiparams{'PMTU_DISCOVERY'}    = $confighash{$cgiparams{'KEY'}}[38];
3237         } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3238         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3239
3240 #A.Marx CCD check iroute field and convert it to decimal
3241 if ($cgiparams{'TYPE'} eq 'host') {
3242         my @temp=();
3243         my %ccdroutehash=();
3244         my $keypoint=0;
3245         my $ip;
3246         my $cidr;
3247         if ($cgiparams{'IR'} ne ''){
3248                 @temp = split("\n",$cgiparams{'IR'});
3249                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3250                 #find key to use
3251                 foreach my $key (keys %ccdroutehash) {
3252                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3253                                 $keypoint=$key;
3254                                 delete $ccdroutehash{$key};
3255                         }else{
3256                                 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3257                         }
3258                 }
3259                 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3260                 my $i=1;
3261                 my $val=0;
3262                 foreach $val (@temp){
3263                         chomp($val);
3264                         $val=~s/\s*$//g;
3265                         #check if iroute exists in ccdroute or if new iroute is part of an existing one
3266                         foreach my $key (keys %ccdroutehash) {
3267                                 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3268                                                 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3269                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3270                                                         goto VPNCONF_ERROR;
3271                                                 }
3272                                                 my ($ip1,$cidr1) = split (/\//, $val);
3273                                                 $ip1 = &General::getnetworkip($ip1,&General::iporsubtocidr($cidr1));
3274                                                 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3275                                                 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3276                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3277                                                         goto VPNCONF_ERROR;
3278                                                 }
3279
3280                                 }
3281                         }
3282                         if (!&General::validipandmask($val)){
3283                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3284                                 goto VPNCONF_ERROR;
3285                         }else{
3286                                 ($ip,$cidr) = split(/\//,$val);
3287                                 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3288                                 $cidr=&General::iporsubtodec($cidr);
3289                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3290
3291                         }
3292
3293                         #check for existing network IP's
3294                         if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3295                         {
3296                                 $errormessage=$Lang::tr{'ccd err green'};
3297                                 goto VPNCONF_ERROR;
3298                         }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3299                         {
3300                                 $errormessage=$Lang::tr{'ccd err red'};
3301                                 goto VPNCONF_ERROR;
3302                         }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3303                         {
3304                                 $errormessage=$Lang::tr{'ccd err blue'};
3305                                 goto VPNCONF_ERROR;
3306                         }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3307                         {
3308                                 $errormessage=$Lang::tr{'ccd err orange'};
3309                                 goto VPNCONF_ERROR;
3310                         }
3311
3312                         if (&General::validipandmask($val)){
3313                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3314                         }else{
3315                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3316                                 goto VPNCONF_ERROR;
3317                         }
3318                         $i++;
3319                 }
3320                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3321                 &writeserverconf;
3322         }else{
3323                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3324                 foreach my $key (keys %ccdroutehash) {
3325                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3326                                 delete $ccdroutehash{$key};
3327                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3328                                 &writeserverconf;
3329                         }
3330                 }
3331         }
3332         undef @temp;
3333         #check route field and convert it to decimal
3334         my $val=0;
3335         my $i=1;
3336         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3337         #find key to use
3338         foreach my $key (keys %ccdroute2hash) {
3339                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3340                         $keypoint=$key;
3341                         delete $ccdroute2hash{$key};
3342                 }else{
3343                         $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3344                         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3345                         &writeserverconf;
3346                 }
3347         }
3348         $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3349         if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3350         @temp = split(/\|/,$cgiparams{'IFROUTE'});
3351         my %ownnet=();
3352         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3353         foreach $val (@temp){
3354                 chomp($val);
3355                 $val=~s/\s*$//g;
3356                 if ($val eq $Lang::tr{'green'})
3357                 {
3358                         $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3359                 }
3360                 if ($val eq $Lang::tr{'blue'})
3361                 {
3362                         $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3363                 }
3364                 if ($val eq $Lang::tr{'orange'})
3365                 {
3366                         $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3367                 }
3368                 my ($ip,$cidr) = split (/\//, $val);
3369
3370                 if ($val ne $Lang::tr{'ccd none'})
3371                 {
3372                         if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3373                         if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3374                         if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3375                         if (&General::validipandmask($val)){
3376                                 $val=$ip."/".&General::iporsubtodec($cidr);
3377                                 $ccdroute2hash{$keypoint}[$i] = $val;
3378                         }else{
3379                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3380                                 goto VPNCONF_ERROR;
3381                         }
3382                 }else{
3383                         $ccdroute2hash{$keypoint}[$i]='';
3384                 }
3385                 $i++;
3386         }
3387         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3388
3389         #check dns1 ip
3390         if ($cgiparams{'CCD_DNS1'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS1'})) {
3391                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3392                         goto VPNCONF_ERROR;
3393         }
3394         #check dns2 ip
3395         if ($cgiparams{'CCD_DNS2'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS2'})) {
3396                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3397                         goto VPNCONF_ERROR;
3398         }
3399         #check wins ip
3400         if ($cgiparams{'CCD_WINS'} ne '' &&  ! &General::validip($cgiparams{'CCD_WINS'})) {
3401                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3402                         goto VPNCONF_ERROR;
3403         }
3404 }
3405
3406 #CCD End
3407
3408
3409  if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3410             $errormessage = $Lang::tr{'connection type is invalid'};
3411             if ($cgiparams{'TYPE'} eq 'net') {
3412       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3413             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3414       }
3415             goto VPNCONF_ERROR;
3416         }
3417
3418
3419         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3420             $errormessage = $Lang::tr{'name must only contain characters'};
3421       if ($cgiparams{'TYPE'} eq 'net') {
3422       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3423             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3424       }
3425       goto VPNCONF_ERROR;
3426   }
3427
3428         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3429             $errormessage = $Lang::tr{'name is invalid'};
3430             if ($cgiparams{'TYPE'} eq 'net') {
3431       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3432             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3433       }
3434             goto VPNCONF_ERROR;
3435         }
3436
3437         if (length($cgiparams{'NAME'}) >60) {
3438             $errormessage = $Lang::tr{'name too long'};
3439             if ($cgiparams{'TYPE'} eq 'net') {
3440       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3441             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3442       }
3443             goto VPNCONF_ERROR;
3444         }
3445
3446 ###
3447 # m.a.d net2net
3448 ###
3449
3450 if ($cgiparams{'TYPE'} eq 'net') {
3451         if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
3452                         $errormessage = $Lang::tr{'openvpn destination port used'};
3453                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3454             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3455       goto VPNCONF_ERROR;
3456                 }
3457     #Bugfix 10357
3458     foreach my $key (sort keys %confighash){
3459                 if ( ($confighash{$key}[22] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1]) || ($confighash{$key}[29] eq $cgiparams{'DEST_PORT'} && $cgiparams{'NAME'} ne $confighash{$key}[1])){
3460                         $errormessage = $Lang::tr{'openvpn destination port used'};
3461                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3462             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3463       goto VPNCONF_ERROR;
3464                 }
3465         }
3466     if ($cgiparams{'DEST_PORT'} eq  '') {
3467                         $errormessage = $Lang::tr{'invalid port'};
3468                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3469             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3470       goto VPNCONF_ERROR;
3471                 }
3472
3473     # Check if the input for the transfer net is valid.
3474     if (!&General::validipandmask($cgiparams{'OVPN_SUBNET'})){
3475                         $errormessage = $Lang::tr{'ccd err invalidnet'};
3476                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3477             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3478                         goto VPNCONF_ERROR;
3479                 }
3480
3481     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
3482                         $errormessage = $Lang::tr{'openvpn subnet is used'};
3483                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3484             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3485                         goto VPNCONF_ERROR;
3486                 }
3487
3488           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3489             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3490             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3491             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3492             goto VPNCONF_ERROR;
3493     }
3494
3495     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3496             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3497             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3498             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3499             goto VPNCONF_ERROR;
3500     }
3501
3502     if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') {
3503         if (($cgiparams{'FRAGMENT'} ne '') || ($cgiparams{'MSSFIX'} eq 'on')) {
3504                 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
3505                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3506                 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3507                 goto VPNCONF_ERROR;
3508         }
3509     }
3510
3511     if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') && ($cgiparams{'MTU'} ne '1500')) {
3512         $errormessage = $Lang::tr{'ovpn mtu-disc and mtu not 1500'};
3513         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3514         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3515         goto VPNCONF_ERROR;
3516     }
3517
3518     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
3519                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3520                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3521             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3522                   goto VPNCONF_ERROR;
3523                 }
3524
3525     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
3526                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3527                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3528             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3529                   goto VPNCONF_ERROR;
3530                 }
3531
3532     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
3533                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
3534                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3535             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3536                   goto VPNCONF_ERROR;
3537                 }
3538
3539     if ($cgiparams{'OVPN_MGMT'} eq  '') {
3540                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
3541                 }
3542
3543 }
3544
3545 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
3546 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
3547 #           goto VPNCONF_ERROR;
3548 #       }
3549
3550         # Check if there is no other entry with this name
3551         if (! $cgiparams{'KEY'}) {
3552             foreach my $key (keys %confighash) {
3553                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
3554                     $errormessage = $Lang::tr{'a connection with this name already exists'};
3555                     if ($cgiparams{'TYPE'} eq 'net') {
3556         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3557               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3558         }
3559                     goto VPNCONF_ERROR;
3560                 }
3561             }
3562         }
3563
3564         # Check if a remote host/IP has been set for the client.
3565         if ($cgiparams{'TYPE'} eq 'net') {
3566                 if ($cgiparams{'SIDE'} ne 'server' && $cgiparams{'REMOTE'} eq '') {
3567                         $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3568
3569                         # Check if this is a N2N connection and drop temporary config.
3570                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3571                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3572
3573                         goto VPNCONF_ERROR;
3574                 }
3575
3576                 # Check if a remote host/IP has been configured - the field can be empty on the server side.
3577                 if ($cgiparams{'REMOTE'} ne '') {
3578                         # Check if the given IP is valid - otherwise check if it is a valid domain.
3579                         if (! &General::validip($cgiparams{'REMOTE'})) {
3580                                 # Check for a valid domain.
3581                                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
3582                                         $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3583
3584                                         # Check if this is a N2N connection and drop temporary config.
3585                                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3586                                         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3587
3588                                         goto VPNCONF_ERROR;
3589                                 }
3590                         }
3591                 }
3592         }
3593
3594         if ($cgiparams{'TYPE'} ne 'host') {
3595             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
3596                     $errormessage = $Lang::tr{'local subnet is invalid'};
3597                     if ($cgiparams{'TYPE'} eq 'net') {
3598               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3599                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3600               }
3601                         goto VPNCONF_ERROR;}
3602         }
3603         # Check if there is no other entry without IP-address and PSK
3604         if ($cgiparams{'REMOTE'} eq '') {
3605             foreach my $key (keys %confighash) {
3606                 if(($cgiparams{'KEY'} ne $key) &&
3607                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
3608                     $confighash{$key}[10] eq '') {
3609                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
3610                         goto VPNCONF_ERROR;
3611                 }
3612             }
3613         }
3614         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
3615                 $errormessage = $Lang::tr{'remote subnet is invalid'};
3616                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3617                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3618                 goto VPNCONF_ERROR;
3619         }
3620
3621         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
3622             $errormessage = $Lang::tr{'invalid input'};
3623             goto VPNCONF_ERROR;
3624         }
3625         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
3626             $errormessage = $Lang::tr{'invalid input'};
3627             goto VPNCONF_ERROR;
3628         }
3629
3630 #fixplausi
3631         if ($cgiparams{'AUTH'} eq 'psk')  {
3632 #           if (! length($cgiparams{'PSK'}) ) {
3633 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
3634 #               goto VPNCONF_ERROR;
3635 #           }
3636 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
3637 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
3638 #               goto VPNCONF_ERROR;
3639 #           }
3640         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
3641             if ($cgiparams{'KEY'}) {
3642                 $errormessage = $Lang::tr{'cant change certificates'};
3643                 goto VPNCONF_ERROR;
3644             }
3645             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3646                 $errormessage = $Lang::tr{'there was no file upload'};
3647                 goto VPNCONF_ERROR;
3648             }
3649
3650             # Move uploaded certificate request to a temporary file
3651             (my $fh, my $filename) = tempfile( );
3652             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3653                 $errormessage = $!;
3654                 goto VPNCONF_ERROR;
3655             }
3656
3657             # Sign the certificate request and move it
3658             # Sign the host certificate request
3659             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3660                 '-batch', '-notext',
3661                 '-in', $filename,
3662                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3663                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3664             if ($?) {
3665                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3666                 unlink ($filename);
3667                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3668                 &newcleanssldatabase();
3669                 goto VPNCONF_ERROR;
3670             } else {
3671                 unlink ($filename);
3672                 &deletebackupcert();
3673             }
3674
3675             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3676             $temp =~ /Subject:.*CN=(.*)[\n]/;
3677             $temp = $1;
3678             $temp =~ s+/Email+, E+;
3679             $temp =~ s/ ST=/ S=/;
3680             $cgiparams{'CERT_NAME'} = $temp;
3681             $cgiparams{'CERT_NAME'} =~ s/,//g;
3682             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3683             if ($cgiparams{'CERT_NAME'} eq '') {
3684                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3685                 goto VPNCONF_ERROR;
3686             }
3687         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
3688             if ($cgiparams{'KEY'}) {
3689                 $errormessage = $Lang::tr{'cant change certificates'};
3690                 goto VPNCONF_ERROR;
3691             }
3692             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3693                 $errormessage = $Lang::tr{'there was no file upload'};
3694                 goto VPNCONF_ERROR;
3695             }
3696             # Move uploaded certificate to a temporary file
3697             (my $fh, my $filename) = tempfile( );
3698             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3699                 $errormessage = $!;
3700                 goto VPNCONF_ERROR;
3701             }
3702
3703             # Verify the certificate has a valid CA and move it
3704             my $validca = 0;
3705             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
3706             if ($test =~ /: OK/) {
3707                 $validca = 1;
3708             } else {
3709                 foreach my $key (keys %cahash) {
3710                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
3711                     if ($test =~ /: OK/) {
3712                         $validca = 1;
3713                     }
3714                 }
3715             }
3716             if (! $validca) {
3717                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
3718                 unlink ($filename);
3719                 goto VPNCONF_ERROR;
3720             } else {
3721                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3722                 if ($? ne 0) {
3723                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3724                     unlink ($filename);
3725                     goto VPNCONF_ERROR;
3726                 }
3727             }
3728
3729             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3730             $temp =~ /Subject:.*CN=(.*)[\n]/;
3731             $temp = $1;
3732             $temp =~ s+/Email+, E+;
3733             $temp =~ s/ ST=/ S=/;
3734             $cgiparams{'CERT_NAME'} = $temp;
3735             $cgiparams{'CERT_NAME'} =~ s/,//g;
3736             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3737             if ($cgiparams{'CERT_NAME'} eq '') {
3738                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3739                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3740                 goto VPNCONF_ERROR;
3741             }
3742         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
3743             if ($cgiparams{'KEY'}) {
3744                 $errormessage = $Lang::tr{'cant change certificates'};
3745                 goto VPNCONF_ERROR;
3746             }
3747             # Validate input since the form was submitted
3748             if (length($cgiparams{'CERT_NAME'}) >60) {
3749                 $errormessage = $Lang::tr{'name too long'};
3750                 goto VPNCONF_ERROR;
3751             }
3752             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3753                 $errormessage = $Lang::tr{'invalid input for name'};
3754                 goto VPNCONF_ERROR;
3755             }
3756             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3757                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3758                 goto VPNCONF_ERROR;
3759             }
3760             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3761                 $errormessage = $Lang::tr{'e-mail address too long'};
3762                 goto VPNCONF_ERROR;
3763             }
3764             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3765                 $errormessage = $Lang::tr{'invalid input for department'};
3766                 goto VPNCONF_ERROR;
3767             }
3768             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3769                 $errormessage = $Lang::tr{'organization too long'};
3770                 goto VPNCONF_ERROR;
3771             }
3772             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3773                 $errormessage = $Lang::tr{'invalid input for organization'};
3774                 goto VPNCONF_ERROR;
3775             }
3776             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3777                 $errormessage = $Lang::tr{'invalid input for city'};
3778                 goto VPNCONF_ERROR;
3779             }
3780             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3781                 $errormessage = $Lang::tr{'invalid input for state or province'};
3782                 goto VPNCONF_ERROR;
3783             }
3784             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3785                 $errormessage = $Lang::tr{'invalid input for country'};
3786                 goto VPNCONF_ERROR;
3787             }
3788             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3789                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3790                     $errormessage = $Lang::tr{'password too short'};
3791                     goto VPNCONF_ERROR;
3792                 }
3793             }
3794             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3795                 $errormessage = $Lang::tr{'passwords do not match'};
3796                 goto VPNCONF_ERROR;
3797             }
3798
3799             # Replace empty strings with a .
3800             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3801             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3802             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3803
3804             # Create the Host certificate request client
3805             my $pid = open(OPENSSL, "|-");
3806             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3807             if ($pid) { # parent
3808                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3809                 print OPENSSL "$state\n";
3810                 print OPENSSL "$city\n";
3811                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3812                 print OPENSSL "$ou\n";
3813                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3814                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3815                 print OPENSSL ".\n";
3816                 print OPENSSL ".\n";
3817                 close (OPENSSL);
3818                 if ($?) {
3819                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3820                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3821                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3822                     goto VPNCONF_ERROR;
3823                 }
3824             } else {    # child
3825                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3826                         '-newkey', 'rsa:1024',
3827                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3828                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3829                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3830                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3831                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3832                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3833                     goto VPNCONF_ERROR;
3834                 }
3835             }
3836
3837             # Sign the host certificate request
3838             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3839                 '-batch', '-notext',
3840                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3841                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3842                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3843             if ($?) {
3844                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3845                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3846                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3847                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3848                 &newcleanssldatabase();
3849                 goto VPNCONF_ERROR;
3850             } else {
3851                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3852                 &deletebackupcert();
3853             }
3854
3855             # Create the pkcs12 file
3856             system('/usr/bin/openssl', 'pkcs12', '-export',
3857                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3858                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3859                 '-name', $cgiparams{'NAME'},
3860                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3861                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3862                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3863                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3864             if ($?) {
3865                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3866                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3867                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3868                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3869                 goto VPNCONF_ERROR;
3870             } else {
3871                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3872             }
3873         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3874             ;# Nothing, just editing
3875         } else {
3876             $errormessage = $Lang::tr{'invalid input for authentication method'};
3877             goto VPNCONF_ERROR;
3878         }
3879
3880         # Check if there is no other entry with this common name
3881         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3882             foreach my $key (keys %confighash) {
3883                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3884                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3885                     goto VPNCONF_ERROR;
3886                 }
3887             }
3888         }
3889
3890     # Save the config
3891         my $key = $cgiparams{'KEY'};
3892
3893         if (! $key) {
3894             $key = &General::findhasharraykey (\%confighash);
3895             foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";}
3896         }
3897         $confighash{$key}[0]            = $cgiparams{'ENABLED'};
3898         $confighash{$key}[1]            = $cgiparams{'NAME'};
3899         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3900             $confighash{$key}[2]        = $cgiparams{'CERT_NAME'};
3901         }
3902
3903         $confighash{$key}[3]            = $cgiparams{'TYPE'};
3904         if ($cgiparams{'AUTH'} eq 'psk') {
3905             $confighash{$key}[4]        = 'psk';
3906             $confighash{$key}[5]        = $cgiparams{'PSK'};
3907         } else {
3908             $confighash{$key}[4]        = 'cert';
3909         }
3910         if ($cgiparams{'TYPE'} eq 'net') {
3911             $confighash{$key}[6]        = $cgiparams{'SIDE'};
3912             $confighash{$key}[11]       = $cgiparams{'REMOTE_SUBNET'};
3913         }
3914         $confighash{$key}[8]                    = $cgiparams{'LOCAL_SUBNET'};
3915         $confighash{$key}[10]           = $cgiparams{'REMOTE'};
3916   if ($cgiparams{'OVPN_MGMT'} eq '') {
3917         $confighash{$key}[22]           = $confighash{$key}[29];
3918   } else {
3919         $confighash{$key}[22]           = $cgiparams{'OVPN_MGMT'};
3920   }
3921         $confighash{$key}[23]           = $cgiparams{'MSSFIX'};
3922         $confighash{$key}[24]           = $cgiparams{'FRAGMENT'};
3923         $confighash{$key}[25]           = $cgiparams{'REMARK'};
3924         $confighash{$key}[26]           = $cgiparams{'INTERFACE'};
3925 # new fields
3926         $confighash{$key}[27]           = $cgiparams{'OVPN_SUBNET'};
3927         $confighash{$key}[28]           = $cgiparams{'PROTOCOL'};
3928         $confighash{$key}[29]           = $cgiparams{'DEST_PORT'};
3929         $confighash{$key}[30]           = $cgiparams{'COMPLZO'};
3930         $confighash{$key}[31]           = $cgiparams{'MTU'};
3931         $confighash{$key}[32]           = $cgiparams{'CHECK1'};
3932         $name=$cgiparams{'CHECK1'};
3933         $confighash{$key}[33]           = $cgiparams{$name};
3934         $confighash{$key}[34]           = $cgiparams{'RG'};
3935         $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
3936         $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
3937         $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
3938         $confighash{$key}[38]                   = $cgiparams{'PMTU_DISCOVERY'};
3939
3940
3941         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3942
3943         if ($cgiparams{'CHECK1'} ){
3944
3945                 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
3946                 my ($a,$b,$c,$d) = split (/\./,$ccdip);
3947                         if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
3948                                 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
3949                         }
3950                         open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
3951                         print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n";
3952                         if($cgiparams{'CHECK1'} eq 'dynamic'){
3953                                 print CCDRWCONF "#This client uses the dynamic pool\n";
3954                         }else{
3955                                 print CCDRWCONF "#Ip address client and server\n";
3956                                 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
3957                         }
3958                         if ($confighash{$key}[34] eq 'on'){
3959                                 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
3960                                 print CCDRWCONF "push redirect-gateway\n";
3961                         }
3962                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3963                         if ($cgiparams{'IR'} ne ''){
3964                                 print CCDRWCONF "\n#Client routes these networks (behind Client)\n";
3965                                 foreach my $key (keys %ccdroutehash){
3966                                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
3967                                                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
3968                                                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
3969                                                         print CCDRWCONF "iroute $a $b\n";
3970                                                 }
3971                                         }
3972                                 }
3973                         }
3974                         if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
3975                         if ($cgiparams{'IFROUTE'} ne ''){
3976                                 print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n";
3977                                 foreach my $key (keys %ccdroute2hash){
3978                                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
3979                                                 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
3980                                                         if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
3981                                                                 my %blue=();
3982                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
3983                                                                 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
3984                                                         }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
3985                                                                 my %orange=();
3986                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
3987                                                                 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS}  $orange{ORANGE_NETMASK}\n";
3988                                                         }else{
3989                                                                 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
3990                                                                 print CCDRWCONF "push \"route $a $b\"\n";
3991                                                         }
3992                                                 }
3993                                         }
3994                                 }
3995                         }
3996                         if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
3997                         if($cgiparams{'CCD_DNS1'} ne ''){
3998                                 print CCDRWCONF "\n#Client gets these nameservers\n";
3999                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4000                         }
4001                         if($cgiparams{'CCD_DNS2'} ne ''){
4002                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4003                         }
4004                         if($cgiparams{'CCD_WINS'} ne ''){
4005                                 print CCDRWCONF "\n#Client gets this WINS server\n";
4006                                 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4007                         }
4008                         close CCDRWCONF;
4009         }
4010
4011 ###
4012 # m.a.d n2n begin
4013 ###
4014
4015         if ($cgiparams{'TYPE'} eq 'net') {
4016
4017         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4018   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
4019
4020   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4021         my $key = $cgiparams{'KEY'};
4022         if (! $key) {
4023             $key = &General::findhasharraykey (\%confighash);
4024             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
4025             }
4026   $confighash{$key}[0] = 'on';
4027   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4028
4029   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
4030          }
4031   }
4032
4033 ###
4034 # m.a.d n2n end
4035 ###
4036
4037         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4038             $cgiparams{'KEY'} = $key;
4039             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4040         }
4041         goto VPNCONF_END;
4042     } else {
4043         $cgiparams{'ENABLED'} = 'on';
4044 ###
4045 # m.a.d n2n begin
4046 ###
4047         $cgiparams{'MSSFIX'} = 'on';
4048         $cgiparams{'FRAGMENT'} = '1300';
4049         $cgiparams{'PMTU_DISCOVERY'} = 'off';
4050 ###
4051 # m.a.d n2n end
4052 ###
4053         $cgiparams{'SIDE'} = 'left';
4054         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4055             $cgiparams{'AUTH'} = 'psk';
4056         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4057             $cgiparams{'AUTH'} = 'certfile';
4058         } else {
4059             $cgiparams{'AUTH'} = 'certgen';
4060         }
4061         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4062         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4063         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
4064         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
4065         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
4066     }
4067
4068     VPNCONF_ERROR:
4069     $checked{'ENABLED'}{'off'} = '';
4070     $checked{'ENABLED'}{'on'} = '';
4071     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4072     $checked{'ENABLED_BLUE'}{'off'} = '';
4073     $checked{'ENABLED_BLUE'}{'on'} = '';
4074     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4075     $checked{'ENABLED_ORANGE'}{'off'} = '';
4076     $checked{'ENABLED_ORANGE'}{'on'} = '';
4077     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4078
4079
4080     $checked{'EDIT_ADVANCED'}{'off'} = '';
4081     $checked{'EDIT_ADVANCED'}{'on'} = '';
4082     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
4083
4084     $selected{'SIDE'}{'server'} = '';
4085     $selected{'SIDE'}{'client'} = '';
4086     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
4087
4088     $selected{'PROTOCOL'}{'udp'} = '';
4089     $selected{'PROTOCOL'}{'tcp'} = '';
4090     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4091
4092
4093     $checked{'AUTH'}{'psk'} = '';
4094     $checked{'AUTH'}{'certreq'} = '';
4095     $checked{'AUTH'}{'certgen'} = '';
4096     $checked{'AUTH'}{'certfile'} = '';
4097     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
4098
4099     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
4100
4101     $checked{'COMPLZO'}{'off'} = '';
4102     $checked{'COMPLZO'}{'on'} = '';
4103     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
4104
4105     $checked{'MSSFIX'}{'off'} = '';
4106     $checked{'MSSFIX'}{'on'} = '';
4107     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4108
4109     if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
4110         $cgiparams{'PMTU_DISCOVERY'} = 'off';
4111     }
4112     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
4113
4114
4115     if (1) {
4116         &Header::showhttpheaders();
4117         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
4118         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4119         if ($errormessage) {
4120             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4121             print "<class name='base'>$errormessage";
4122             print "&nbsp;</class>";
4123             &Header::closebox();
4124         }
4125
4126         if ($warnmessage) {
4127             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4128             print "<class name='base'>$warnmessage";
4129             print "&nbsp;</class>";
4130             &Header::closebox();
4131         }
4132
4133         print "<form method='post' enctype='multipart/form-data'>";
4134         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
4135
4136         if ($cgiparams{'KEY'}) {
4137             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4138             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4139         }
4140
4141         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4142         print "<table width='100%'  border='0'>\n";
4143
4144
4145
4146         print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}: </td>";
4147
4148         if ($cgiparams{'TYPE'} eq 'host') {
4149             if ($cgiparams{'KEY'}) {
4150                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4151             } else {
4152
4153                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4154             }
4155 #           print "<tr><td>$Lang::tr{'interface'}</td>";
4156 #           print "<td><select name='INTERFACE'>";
4157 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4158 #           if ($netsettings{'BLUE_DEV'} ne '') {
4159 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4160 #           }
4161 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4162 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4163 #           print "</select></td></tr>";
4164 #           print <<END
4165         } else {
4166             print "<input type='hidden' name='INTERFACE' value='red' />";
4167             if ($cgiparams{'KEY'}) {
4168                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4169             } else {
4170                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4171             }
4172
4173
4174
4175             print <<END
4176                     <td width='25%'>&nbsp;</td>
4177                     <td width='25%'>&nbsp;</td></tr>
4178                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4179                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4180                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
4181                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4182                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
4183                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
4184                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4185                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
4186                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
4187                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
4188                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
4189                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4190
4191      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4192                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4193
4194         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4195                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
4196                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
4197                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4198
4199                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
4200                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4201         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4202
4203           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
4204                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4205                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4206
4207                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
4208                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4209         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4210
4211         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
4212                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4213         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
4214
4215         <tr>
4216                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td>
4217                 <td colspan='3'>
4218                         <input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}
4219                         <input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}
4220                         <input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}
4221                         <input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}
4222                 </td>
4223         </tr>
4224
4225 END
4226 ;
4227         }
4228 #jumper
4229         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
4230         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4231
4232         if ($cgiparams{'TYPE'} eq 'host') {
4233       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4234     }
4235
4236                 print"</tr></table><br><br>";
4237 #A.Marx CCD new client
4238 if ($cgiparams{'TYPE'} eq 'host') {
4239             print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4240             my %vpnnet=();
4241             my $vpnip;
4242             &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4243             $vpnip=$vpnnet{'DOVPN_SUBNET'};
4244             &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4245             my @ccdconf=();
4246                 my $count=0;
4247                 my $checked;
4248                 $checked{'check1'}{'off'} = '';
4249             $checked{'check1'}{'on'} = '';
4250             $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4251             print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4252             print"</td></tr></table><br><br>";
4253                 my $name=$cgiparams{'CHECK1'};
4254                 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4255
4256         if (! -z "${General::swroot}/ovpn/ccd.conf"){
4257                 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4258                 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
4259                         $count++;
4260                         @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4261                         if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4262                         print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4263                         &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4264                         print"</td></tr>";
4265                 }
4266                 print "</table><br><br><hr><br><br>";
4267         }
4268 }
4269 # ccd end
4270         &Header::closebox();
4271         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4272
4273                 } elsif (! $cgiparams{'KEY'}) {
4274
4275
4276             my $disabled='';
4277             my $cakeydisabled='';
4278             my $cacrtdisabled='';
4279             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4280             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4281
4282             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4283
4284
4285  if ($cgiparams{'TYPE'} eq 'host') {
4286
4287 print <<END
4288             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4289
4290             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4291             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4292             <tr><td colspan='3'>&nbsp;</td></tr>
4293       <tr><td colspan='3'><hr /></td></tr>
4294       <tr><td colspan='3'>&nbsp;</td></tr>
4295             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4296             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4297             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4298             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4299             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4300             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4301             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4302             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4303 END
4304 ;
4305
4306 ###
4307 # m.a.d net2net
4308 ###
4309
4310 } else {
4311
4312 print <<END
4313             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4314
4315             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4316             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4317             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4318             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4319             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4320             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4321             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4322             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4323
4324
4325 END
4326 ;
4327
4328 }
4329
4330 ###
4331 # m.a.d net2net
4332 ###
4333
4334             foreach my $country (sort keys %{Countries::countries}) {
4335                 print "<option value='$Countries::countries{$country}'";
4336                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4337                     print " selected='selected'";
4338                 }
4339                 print ">$country</option>";
4340             }
4341 ###
4342 # m.a.d net2net
4343 ###
4344
4345 if ($cgiparams{'TYPE'} eq 'host') {
4346             print <<END
4347             </select></td></tr>
4348
4349         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
4350         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4351    <tr><td>&nbsp;</td>
4352                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
4353                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
4354             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
4355                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
4356      <tr><td colspan='3'>&nbsp;</td></tr>
4357      <tr><td colspan='3'><hr /></td></tr>
4358      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4359      </table>
4360 END
4361 }else{
4362             print <<END
4363             </select></td></tr>
4364    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4365          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4366          <tr><td colspan='3'><hr /></td></tr>
4367          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4368        </table>
4369
4370 END
4371 }
4372
4373 ###
4374 # m.a.d net2net
4375 ###
4376             ;
4377             &Header::closebox();
4378
4379         }
4380
4381 #A.Marx CCD new client
4382 if ($cgiparams{'TYPE'} eq 'host') {
4383             print"<br><br>";
4384             &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
4385
4386
4387         print <<END;
4388         <table border='0' width='100%'>
4389         <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
4390         <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
4391         <tr><td colspan='4'>&nbsp</td></tr>
4392         <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
4393 END
4394
4395         if ($cgiparams{'IR'} ne ''){
4396                 print $cgiparams{'IR'};
4397         }else{
4398                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4399                 foreach my $key (keys %ccdroutehash) {
4400                         if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
4401                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
4402                                                 if ($ccdroutehash{$key}[$i] ne ''){
4403                                                         print $ccdroutehash{$key}[$i]."\n";
4404                                                 }
4405                                                 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
4406                                 }
4407                         }
4408                 }
4409         }
4410
4411         print <<END;
4412 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
4413         <tr><td colspan='4'><br></td></tr>
4414         <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
4415 END
4416
4417         my $set=0;
4418         my $selorange=0;
4419         my $selblue=0;
4420         my $selgreen=0;
4421         my $helpblue=0;
4422         my $helporange=0;
4423         my $other=0;
4424         my $none=0;
4425         my @temp=();
4426
4427         our @current = ();
4428         open(FILE, "${General::swroot}/main/routing") ;
4429         @current = <FILE>;
4430         close (FILE);
4431         &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
4432         #check for "none"
4433         foreach my $key (keys %ccdroute2hash) {
4434                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4435                         if ($ccdroute2hash{$key}[1] eq ''){
4436                                 $none=1;
4437                                 last;
4438                         }
4439                 }
4440         }
4441         if ($none ne '1'){
4442                 print"<option>$Lang::tr{'ccd none'}</option>";
4443         }else{
4444                 print"<option selected>$Lang::tr{'ccd none'}</option>";
4445         }
4446         #check if static routes are defined for client
4447         foreach my $line (@current) {
4448                 chomp($line);
4449                 $line=~s/\s*$//g;                       # remove newline
4450                 @temp=split(/\,/,$line);
4451                 $temp[1] = '' unless defined $temp[1]; # not always populated
4452                 my ($a,$b) = split(/\//,$temp[1]);
4453                 $temp[1] = $a."/".&General::iporsubtocidr($b);
4454                 foreach my $key (keys %ccdroute2hash) {
4455                         if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4456                                 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4457                                         if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
4458                                                 $set=1;
4459                                         }
4460                                 }
4461                         }
4462                 }
4463                 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
4464         }
4465         #check if green,blue,orange are defined for client
4466         foreach my $key (keys %ccdroute2hash) {
4467                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4468                         $other=1;
4469                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4470                                 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
4471                                         $selgreen=1;
4472                                 }
4473                                 if (&haveBlueNet()){
4474                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
4475                                                 $selblue=1;
4476                                         }
4477                                 }
4478                                 if (&haveOrangeNet()){
4479                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
4480                                                 $selorange=1;
4481                                         }
4482                                 }
4483                         }
4484                 }
4485         }
4486         if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
4487         if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
4488         if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
4489
4490         print<<END
4491         </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
4492         <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
4493         <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
4494
4495 END
4496 ;
4497      &Header::closebox();
4498 }
4499         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4500         if ($cgiparams{'KEY'}) {
4501 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
4502         }
4503         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
4504         &Header::closebigbox();
4505         &Header::closepage();
4506         exit (0);
4507     }
4508     VPNCONF_END:
4509 }
4510
4511 #    SETTINGS_ERROR:
4512 ###
4513 ### Default status page
4514 ###
4515     %cgiparams = ();
4516     %cahash = ();
4517     %confighash = ();
4518     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
4519     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
4520     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4521
4522     my @status = `/bin/cat /var/log/ovpnserver.log`;
4523
4524     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
4525                 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
4526                     my $ipaddr = <IPADDR>;
4527                     close IPADDR;
4528                     chomp ($ipaddr);
4529                     $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
4530                     if ($cgiparams{'VPN_IP'} eq '') {
4531                                 $cgiparams{'VPN_IP'} = $ipaddr;
4532                     }
4533                 }
4534     }
4535
4536 #default setzen
4537     if ($cgiparams{'DCIPHER'} eq '') {
4538         $cgiparams{'DCIPHER'} =  'AES-256-CBC';
4539     }
4540     if ($cgiparams{'DDEST_PORT'} eq '') {
4541         $cgiparams{'DDEST_PORT'} =  '1194';
4542     }
4543     if ($cgiparams{'DMTU'} eq '') {
4544         $cgiparams{'DMTU'} =  '1400';
4545     }
4546     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
4547         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
4548     }
4549         $checked{'ENABLED'}{'off'} = '';
4550     $checked{'ENABLED'}{'on'} = '';
4551     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4552     $checked{'ENABLED_BLUE'}{'off'} = '';
4553     $checked{'ENABLED_BLUE'}{'on'} = '';
4554     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4555     $checked{'ENABLED_ORANGE'}{'off'} = '';
4556     $checked{'ENABLED_ORANGE'}{'on'} = '';
4557     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4558     $selected{'DDEVICE'}{'tun'} = '';
4559     $selected{'DDEVICE'}{'tap'} = '';
4560     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
4561
4562     $selected{'DPROTOCOL'}{'udp'} = '';
4563     $selected{'DPROTOCOL'}{'tcp'} = '';
4564     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
4565
4566     $selected{'DCIPHER'}{'DES-CBC'} = '';
4567     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4568     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4569     $selected{'DCIPHER'}{'DESX-CBC'} = '';
4570     $selected{'DCIPHER'}{'RC2-CBC'} = '';
4571     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
4572     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
4573     $selected{'DCIPHER'}{'BF-CBC'} = '';
4574     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4575     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4576     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4577     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4578     $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = '';
4579     $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = '';
4580     $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = '';
4581     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4582     $checked{'DCOMPLZO'}{'off'} = '';
4583     $checked{'DCOMPLZO'}{'on'} = '';
4584     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
4585 # m.a.d
4586     $checked{'MSSFIX'}{'off'} = '';
4587     $checked{'MSSFIX'}{'on'} = '';
4588     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4589 #new settings
4590     &Header::showhttpheaders();
4591     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
4592     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4593
4594     if ($errormessage) {
4595         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4596         print "<class name='base'>$errormessage\n";
4597         print "&nbsp;</class>\n";
4598         &Header::closebox();
4599     }
4600
4601     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
4602     my $srunning = "no";
4603     my $activeonrun = "";
4604     if ( -e "/var/run/openvpn.pid"){
4605         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
4606         $srunning ="yes";
4607         $activeonrun = "";
4608     } else {
4609         $activeonrun = "disabled='disabled'";
4610     }
4611     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
4612         print <<END
4613     <table width='100%' border=0>
4614     <form method='post'>
4615     <td width='25%'>&nbsp;</td>
4616     <td width='25%'>&nbsp;</td>
4617     <td width='25%'>&nbsp;</td></tr>
4618     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
4619     <td align='left'>$sactive</td>
4620     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
4621     <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
4622 END
4623 ;
4624     if (&haveBlueNet()) {
4625         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
4626         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
4627     }
4628     if (&haveOrangeNet()) {
4629         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
4630         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
4631     }
4632     print <<END
4633     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
4634         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
4635     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
4636         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
4637                                 <!-- this is still not working
4638                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
4639     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4640         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
4641                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
4642         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4643         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
4644     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
4645         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
4646     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4647         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
4648         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
4649         <td><select name='DCIPHER'>
4650                 <option value='CAMELLIA-256-CBC' $selected{'DCIPHER'}{'CAMELLIA-256-CBC'}>CAMELLIA-256-CBC</option>
4651                 <option value='CAMELLIA-192-CBC' $selected{'DCIPHER'}{'CAMELLIA-192-CBC'}>CAMELLIA-192-CBC</option>
4652                 <option value='CAMELLIA-128-CBC' $selected{'DCIPHER'}{'CAMELLIA-128-CBC'}>CAMELLIA-128-CBC</option>
4653                 <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option>
4654                 <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
4655                 <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
4656                 <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
4657                 <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
4658                 <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
4659                 <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
4660                 <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
4661                 <option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
4662                 <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
4663                 <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
4664                 <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
4665         </select></td></tr>
4666     <tr><td colspan='4'><br><br></td></tr>
4667 END
4668 ;
4669
4670     if ( $srunning eq "yes" ) {
4671         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
4672         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4673         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4674         print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
4675     } else{
4676         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4677         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4678         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4679         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
4680              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
4681              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
4682              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
4683             (( $cgiparams{'ENABLED'} eq 'on') ||
4684             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4685             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
4686             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
4687         } else {
4688             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
4689         }
4690     }
4691     print "</form></table>";
4692     &Header::closebox();
4693     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}");
4694     print <<EOF#'
4695     <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
4696     <tr>
4697         <th width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
4698         <th width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></th>
4699         <th width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></th>
4700     </tr>
4701 EOF
4702     ;
4703     my $col1="bgcolor='$color{'color22'}'";
4704         my $col2="bgcolor='$color{'color20'}'";
4705     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
4706         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
4707         $casubject    =~ /Subject: (.*)[\n]/;
4708         $casubject    = $1;
4709         $casubject    =~ s+/Email+, E+;
4710         $casubject    =~ s/ ST=/ S=/;
4711         print <<END
4712         <tr>
4713         <td class='base' $col1>$Lang::tr{'root certificate'}</td>
4714         <td class='base' $col1>$casubject</td>
4715         <form method='post' name='frmrootcrta'><td width='3%' align='center' $col1>
4716             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
4717             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
4718         </td></form>
4719         <form method='post' name='frmrootcrtb'><td width='3%' align='center' $col1>
4720             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
4721             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
4722         </td></form>
4723         <td width='4%' $col1>&nbsp;</td></tr>
4724 END
4725         ;
4726     } else {
4727         # display rootcert generation buttons
4728         print <<END
4729         <tr>
4730         <td class='base' $col1>$Lang::tr{'root certificate'}:</td>
4731         <td class='base' $col1>$Lang::tr{'not present'}</td>
4732         <td colspan='3' $col1>&nbsp;</td></tr>
4733 END
4734         ;
4735     }
4736
4737     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
4738         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
4739         $hostsubject    =~ /Subject: (.*)[\n]/;
4740         $hostsubject    = $1;
4741         $hostsubject    =~ s+/Email+, E+;
4742         $hostsubject    =~ s/ ST=/ S=/;
4743
4744         print <<END
4745         <tr>
4746         <td class='base' $col2>$Lang::tr{'host certificate'}</td>
4747         <td class='base' $col2>$hostsubject</td>
4748         <form method='post' name='frmhostcrta'><td width='3%' align='center' $col2>
4749             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
4750             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
4751         </td></form>
4752         <form method='post' name='frmhostcrtb'><td width='3%' align='center' $col2>
4753             <input type='image' name="$Lang::tr{'download host certificate'}" src='/images/media-floppy.png' alt="$Lang::tr{'download host certificate'}" title="$Lang::tr{'download host certificate'}" border='0' />
4754             <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
4755         </td></form>
4756         <td width='4%' $col2>&nbsp;</td></tr>
4757 END
4758         ;
4759     } else {
4760         # Nothing
4761         print <<END
4762         <tr>
4763         <td width='25%' class='base' $col2>$Lang::tr{'host certificate'}:</td>
4764         <td class='base' $col2>$Lang::tr{'not present'}</td>
4765         </td><td colspan='3' $col2>&nbsp;</td></tr>
4766 END
4767         ;
4768     }
4769
4770     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4771         print "<tr><td colspan='5' align='center'><form method='post'>";
4772         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
4773         print "</form></td></tr>\n";
4774     }
4775
4776     if (keys %cahash > 0) {
4777         foreach my $key (keys %cahash) {
4778             if (($key + 1) % 2) {
4779                 print "<tr bgcolor='$color{'color20'}'>\n";
4780             } else {
4781                 print "<tr bgcolor='$color{'color22'}'>\n";
4782             }
4783             print "<td class='base'>$cahash{$key}[0]</td>\n";
4784             print "<td class='base'>$cahash{$key}[1]</td>\n";
4785             print <<END
4786             <form method='post' name='cafrm${key}a'><td align='center'>
4787                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
4788                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
4789                 <input type='hidden' name='KEY' value='$key' />
4790             </td></form>
4791             <form method='post' name='cafrm${key}b'><td align='center'>
4792                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
4793                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
4794                 <input type='hidden' name='KEY' value='$key' />
4795             </td></form>
4796             <form method='post' name='cafrm${key}c'><td align='center'>
4797                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
4798                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
4799                 <input type='hidden' name='KEY' value='$key' />
4800             </td></form></tr>
4801 END
4802             ;
4803         }
4804     }
4805
4806     print "</table>";
4807
4808     # If the file contains entries, print Key to action icons
4809     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
4810     print <<END
4811     <table>
4812     <tr>
4813         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4814         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4815         <td class='base'>$Lang::tr{'show certificate'}</td>
4816         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
4817         <td class='base'>$Lang::tr{'download certificate'}</td>
4818     </tr>
4819     </table>
4820 END
4821 ;
4822     }
4823
4824 print <<END
4825 <form method='post' enctype='multipart/form-data'>
4826 <table width='100%' border='0'>
4827 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td><td nowrap='nowrap' width='8%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'/></td><td nowrap='nowrap' align='right'><input type='file' name='FH' size='25' /><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td></tr>
4828 <tr><td colspan='4'><br></td></tr>
4829 <tr align='right'><td colspan='4' align='right' width='80%'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td></tr>
4830 </table>
4831 END
4832 ;
4833
4834
4835     &Header::closebox();
4836     if ( $srunning eq "yes" ) {
4837         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
4838     }else{
4839         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
4840     }
4841     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
4842
4843 ###
4844 # m.a.d net2net
4845 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
4846 ###
4847
4848     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
4849     print <<END
4850
4851
4852     <table width='100%' cellspacing='1' cellpadding='0' class='tbl'>
4853 <tr>
4854     <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></th>
4855     <th width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></th>
4856     <th width='22%' class='boldbase' align='center'><b>$Lang::tr{'network'}</b></th>
4857     <th width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></th>
4858     <th width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></th>
4859     <th width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></th>
4860 </tr>
4861 END
4862         ;
4863         my $id = 0;
4864         my $gif;
4865         my $col1="";
4866         foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
4867         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
4868         if ($id % 2) {
4869                 print "<tr>";
4870                 $col="bgcolor='$color{'color20'}'";
4871         } else {
4872                 print "<tr>";
4873                 $col="bgcolor='$color{'color22'}'";
4874         }
4875         print "<td align='center' nowrap='nowrap' $col>$confighash{$key}[1]</td>";
4876         print "<td align='center' nowrap='nowrap' $col>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
4877         #if ($confighash{$key}[4] eq 'cert') {
4878             #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
4879         #} else {
4880             #print "<td align='left'>&nbsp;</td>";
4881         #}
4882         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
4883         $cavalid    =~ /Not After : (.*)[\n]/;
4884         $cavalid    = $1;
4885         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]="net-2-net";}
4886         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'host' ){$confighash{$key}[32]="dynamic";}
4887         print "<td align='center' $col>$confighash{$key}[32]</td>";
4888         print "<td align='center' $col>$confighash{$key}[25]</td>";
4889         $col1="bgcolor='${Header::colourred}'";
4890         my $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
4891
4892         if ($confighash{$key}[0] eq 'off') {
4893                 $col1="bgcolor='${Header::colourblue}'";
4894                 $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b>";
4895         } else {
4896
4897 ###
4898 # m.a.d net2net
4899 ###
4900
4901        if ($confighash{$key}[3] eq 'net') {
4902
4903         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4904           my @output = "";
4905           my @tustate = "";
4906           my $tport = $confighash{$key}[22];
4907           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
4908           if ($tport ne '') {
4909           $tnet->open('127.0.0.1');
4910           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
4911           @tustate = split(/\,/, $output[1]);
4912 ###
4913 #CONNECTING    -- OpenVPN's initial state.
4914 #WAIT          -- (Client only) Waiting for initial response from server.
4915 #AUTH          -- (Client only) Authenticating with server.
4916 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
4917 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
4918 #ADD_ROUTES    -- Adding routes to system.
4919 #CONNECTED     -- Initialization Sequence Completed.
4920 #RECONNECTING  -- A restart has occurred.
4921 #EXITING       -- A graceful exit is in progress.
4922 ####
4923
4924                 if ( $tustate[1] eq 'CONNECTED') {
4925                         $col1="bgcolor='${Header::colourgreen}'";
4926                         $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
4927                 }else {
4928                         $col1="bgcolor='${Header::colourred}'";
4929                         $active = "<b><font color='#FFFFFF'>$tustate[1]</font></b>";
4930                 }
4931            }
4932            }
4933         }else {
4934
4935                                 my $cn;
4936                                 my @match = ();
4937                 foreach my $line (@status) {
4938                         chomp($line);
4939                         if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
4940                                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
4941                                 if ($match[1] ne "Common Name") {
4942                                         $cn = $match[1];
4943                                 }
4944                                 $cn =~ s/[_]/ /g;
4945                                 if ($cn eq "$confighash{$key}[2]") {
4946                                         $col1="bgcolor='${Header::colourgreen}'";
4947                                         $active = "<b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b>";
4948                                 }
4949                         }
4950                 }
4951         }
4952 }
4953
4954
4955         print <<END
4956         <td align='center' $col1>$active</td>
4957
4958         <form method='post' name='frm${key}a'><td align='center' $col>
4959             <input type='image'  name='$Lang::tr{'dl client arch'}' src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
4960             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' />
4961             <input type='hidden' name='KEY' value='$key' />
4962         </td></form>
4963 END
4964         ;
4965         if ($confighash{$key}[4] eq 'cert') {
4966             print <<END
4967             <form method='post' name='frm${key}b'><td align='center' $col>
4968                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
4969                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
4970                 <input type='hidden' name='KEY' value='$key' />
4971             </td></form>
4972 END
4973         ; } else {
4974             print "<td>&nbsp;</td>";
4975         }
4976         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
4977             print <<END
4978             <form method='post' name='frm${key}c'><td align='center' $col>
4979                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
4980                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
4981                 <input type='hidden' name='KEY' value='$key' />
4982             </td></form>
4983 END
4984         ; } elsif ($confighash{$key}[4] eq 'cert') {
4985             print <<END
4986             <form method='post' name='frm${key}c'><td align='center' $col>
4987                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
4988                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
4989                 <input type='hidden' name='KEY' value='$key' />
4990             </td></form>
4991 END
4992         ; } else {
4993             print "<td>&nbsp;</td>";
4994         }
4995         print <<END
4996         <form method='post' name='frm${key}d'><td align='center' $col>
4997             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
4998             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
4999             <input type='hidden' name='KEY' value='$key' />
5000         </td></form>
5001
5002         <form method='post' name='frm${key}e'><td align='center' $col>
5003             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5004             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5005             <input type='hidden' name='KEY' value='$key' />
5006         </td></form>
5007         <form method='post' name='frm${key}f'><td align='center' $col>
5008             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5009             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5010             <input type='hidden' name='KEY' value='$key' />
5011         </td></form>
5012         </tr>
5013 END
5014         ;
5015         $id++;
5016     }
5017     ;
5018
5019     # If the config file contains entries, print Key to action icons
5020     if ( $id ) {
5021     print <<END
5022     <table border='0'>
5023     <tr>
5024         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5025         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5026         <td class='base'>$Lang::tr{'click to disable'}</td>
5027         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5028         <td class='base'>$Lang::tr{'show certificate'}</td>
5029         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5030         <td class='base'>$Lang::tr{'edit'}</td>
5031         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5032         <td class='base'>$Lang::tr{'remove'}</td>
5033     </tr>
5034     <tr>
5035         <td>&nbsp; </td>
5036         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5037         <td class='base'>$Lang::tr{'click to enable'}</td>
5038         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5039         <td class='base'>$Lang::tr{'download certificate'}</td>
5040         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5041         <td class='base'>$Lang::tr{'dl client arch'}</td>
5042     </tr>
5043     </table><br>
5044 END
5045     ;
5046     }
5047
5048     print <<END
5049     <table width='100%'>
5050     <form method='post'>
5051     <tr><td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5052     <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
5053     </form>
5054     </table>
5055 END
5056     ;
5057     &Header::closebox();
5058 }
5059 &Header::closepage();
5060
5061
5062