Re-apply: OpenVPN: Fix daemon stuck in WAIT state.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 ###
22 # Based on IPFireCore 77
23 ###
24 use CGI;
25 use CGI qw/:standard/;
26 use Net::DNS;
27 use Net::Ping;
28 use Net::Telnet;
29 use File::Copy;
30 use File::Temp qw/ tempfile tempdir /;
31 use strict;
32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
33 use Sort::Naturally;
34 require '/var/ipfire/general-functions.pl';
35 require "${General::swroot}/lang.pl";
36 require "${General::swroot}/header.pl";
37 require "${General::swroot}/countries.pl";
38
39 # enable only the following on debugging purpose
40 #use warnings;
41 #use CGI::Carp 'fatalsToBrowser';
42 #workaround to suppress a warning when a variable is used only once
43 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
44 undef (@dummy);
45
46 my %color = ();
47 my %mainsettings = ();
48 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
49 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
50
51 ###
52 ### Initialize variables
53 ###
54 my %ccdconfhash=();
55 my %ccdroutehash=();
56 my %ccdroute2hash=();
57 my %netsettings=();
58 my %cgiparams=();
59 my %vpnsettings=();
60 my %checked=();
61 my %confighash=();
62 my %cahash=();
63 my %selected=();
64 my $warnmessage = '';
65 my $errormessage = '';
66 my %settings=();
67 my $routes_push_file = '';
68 my $confighost="${General::swroot}/fwhosts/customhosts";
69 my $configgrp="${General::swroot}/fwhosts/customgroups";
70 my $customnet="${General::swroot}/fwhosts/customnetworks";
71 my $name;
72 my $col="";
73 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
74 $cgiparams{'ENABLED'} = 'off';
75 $cgiparams{'ENABLED_BLUE'} = 'off';
76 $cgiparams{'ENABLED_ORANGE'} = 'off';
77 $cgiparams{'EDIT_ADVANCED'} = 'off';
78 $cgiparams{'NAT'} = 'off';
79 $cgiparams{'COMPRESSION'} = 'off';
80 $cgiparams{'ONLY_PROPOSED'} = 'off';
81 $cgiparams{'ACTION'} = '';
82 $cgiparams{'CA_NAME'} = '';
83 $cgiparams{'DH_NAME'} = 'dh1024.pem';
84 $cgiparams{'DHLENGHT'} = '';
85 $cgiparams{'DHCP_DOMAIN'} = '';
86 $cgiparams{'DHCP_DNS'} = '';
87 $cgiparams{'DHCP_WINS'} = '';
88 $cgiparams{'ROUTES_PUSH'} = '';
89 $cgiparams{'DCOMPLZO'} = 'off';
90 $cgiparams{'MSSFIX'} = '';
91 $cgiparams{'number'} = '';
92 $cgiparams{'PMTU_DISCOVERY'} = '';
93 $cgiparams{'DCIPHER'} = '';
94 $cgiparams{'DAUTH'} = '';
95 $cgiparams{'TLSAUTH'} = '';
96 $routes_push_file = "${General::swroot}/ovpn/routes_push";
97 unless (-e $routes_push_file) { system("touch $routes_push_file"); }
98 unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
99 unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
100 unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
101
102 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
103
104 # prepare openvpn config file
105 ###
106 ### Useful functions
107 ###
108 sub haveOrangeNet
109 {
110 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
111 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
112 return 0;
113 }
114
115 sub haveBlueNet
116 {
117 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
118 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
119 return 0;
120 }
121
122 sub sizeformat{
123 my $bytesize = shift;
124 my $i = 0;
125
126 while(abs($bytesize) >= 1024){
127 $bytesize=$bytesize/1024;
128 $i++;
129 last if($i==6);
130 }
131
132 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
133 my $newsize=(int($bytesize*100 +0.5))/100;
134 return("$newsize $units[$i]");
135 }
136
137 sub cleanssldatabase
138 {
139 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
140 print FILE "01";
141 close FILE;
142 }
143 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
144 print FILE "";
145 close FILE;
146 }
147 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
148 unlink ("${General::swroot}/ovpn/certs/serial.old");
149 unlink ("${General::swroot}/ovpn/certs/01.pem");
150 }
151
152 sub newcleanssldatabase
153 {
154 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
155 open(FILE, ">${General::swroot}(ovpn/certs/serial");
156 print FILE "01";
157 close FILE;
158 }
159 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
160 system ("touch ${General::swroot}/ovpn/certs/index.txt");
161 }
162 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
163 unlink ("${General::swroot}/ovpn/certs/serial.old");
164 }
165
166 sub deletebackupcert
167 {
168 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
169 my $hexvalue = <FILE>;
170 chomp $hexvalue;
171 close FILE;
172 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
173 }
174 }
175 sub checkportfw {
176 my $DPORT = shift;
177 my $DPROT = shift;
178 my %natconfig =();
179 my $confignat = "${General::swroot}/firewall/config";
180 $DPROT= uc ($DPROT);
181 &General::readhasharray($confignat, \%natconfig);
182 foreach my $key (sort keys %natconfig){
183 my @portarray = split (/\|/,$natconfig{$key}[30]);
184 foreach my $value (@portarray){
185 if ($value =~ /:/i){
186 my ($a,$b) = split (":",$value);
187 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
188 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
189 }
190 }else{
191 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
192 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
193 }
194 }
195 }
196 }
197 return;
198 }
199
200 sub checkportoverlap
201 {
202 my $portrange1 = $_[0]; # New port range
203 my $portrange2 = $_[1]; # existing port range
204 my @tempr1 = split(/\:/,$portrange1);
205 my @tempr2 = split(/\:/,$portrange2);
206
207 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
208 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
209
210 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
211 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
212
213 return 1; # Everything checks out!
214 }
215
216 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
217 sub checkportinc
218 {
219 my $port1 = $_[0]; # Port
220 my $portrange2 = $_[1]; # Port range
221 my @tempr1 = split(/\:/,$portrange2);
222
223 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
224 return 1;
225 } else {
226 return 0;
227 }
228 }
229
230 # Darren Critchley - certain ports are reserved for IPFire
231 # TCP 67,68,81,222,444
232 # UDP 67,68
233 # Params passed in -> port, rangeyn, protocol
234 sub disallowreserved
235 {
236 # port 67 and 68 same for tcp and udp, don't bother putting in an array
237 my $msg = "";
238 my @tcp_reserved = (81,222,444);
239 my $prt = $_[0]; # the port or range
240 my $ryn = $_[1]; # tells us whether or not it is a port range
241 my $prot = $_[2]; # protocol
242 my $srcdst = $_[3]; # source or destination
243 if ($ryn) { # disect port range
244 if ($srcdst eq "src") {
245 $msg = "$Lang::tr{'rsvd src port overlap'}";
246 } else {
247 $msg = "$Lang::tr{'rsvd dst port overlap'}";
248 }
249 my @tmprng = split(/\:/,$prt);
250 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
251 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
252 if ($prot eq "tcp") {
253 foreach my $prange (@tcp_reserved) {
254 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
255 }
256 }
257 } else {
258 if ($srcdst eq "src") {
259 $msg = "$Lang::tr{'reserved src port'}";
260 } else {
261 $msg = "$Lang::tr{'reserved dst port'}";
262 }
263 if ($prt == 67) { $errormessage="$msg 67"; return; }
264 if ($prt == 68) { $errormessage="$msg 68"; return; }
265 if ($prot eq "tcp") {
266 foreach my $prange (@tcp_reserved) {
267 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
268 }
269 }
270 }
271 return;
272 }
273
274
275 sub writeserverconf {
276 my %sovpnsettings = ();
277 my @temp = ();
278 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
279 &read_routepushfile;
280
281 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
282 flock CONF, 2;
283 print CONF "#OpenVPN Server conf\n";
284 print CONF "\n";
285 print CONF "daemon openvpnserver\n";
286 print CONF "writepid /var/run/openvpn.pid\n";
287 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
288 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
289 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
290 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
291 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
292 print CONF "script-security 3 system\n";
293 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
294 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
295 print CONF "tls-server\n";
296 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
297 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
298 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
299 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
300 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
301 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
302 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
303
304 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
305 # If we doesn't use one of them, we can use the configured mtu value.
306 if ($sovpnsettings{'MSSFIX'} eq 'on')
307 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
308 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
309 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
310 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
311 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
312 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
313 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
314 else
315 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
316
317 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
318 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
319 foreach (@temp)
320 {
321 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
322 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
323 }
324 }
325 # a.marx ccd
326 my %ccdconfhash=();
327 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
328 foreach my $key (keys %ccdconfhash) {
329 my $a=$ccdconfhash{$key}[1];
330 my ($b,$c) = split (/\//, $a);
331 print CONF "route $b ".&General::cidrtosub($c)."\n";
332 }
333 my %ccdroutehash=();
334 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
335 foreach my $key (keys %ccdroutehash) {
336 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
337 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
338 print CONF "route $a $b\n";
339 }
340 }
341 # ccd end
342
343 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
344 print CONF "client-to-client\n";
345 }
346 if ($sovpnsettings{MSSFIX} eq 'on') {
347 print CONF "mssfix\n";
348 }
349 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
350 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
351 }
352
353 # Check if a valid operating mode has been choosen and use it.
354 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
355 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
356 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
357 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
358 }
359
360 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
361 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
362 }
363 print CONF "status-version 1\n";
364 print CONF "status /var/log/ovpnserver.log 30\n";
365 print CONF "cipher $sovpnsettings{DCIPHER}\n";
366 if ($sovpnsettings{'DAUTH'} eq '') {
367 print CONF "";
368 } else {
369 print CONF "auth $sovpnsettings{'DAUTH'}\n";
370 }
371 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
372 print CONF "tls-auth ${General::swroot}/ovpn/ca/ta.key 0\n";
373 }
374 if ($sovpnsettings{DCOMPLZO} eq 'on') {
375 print CONF "comp-lzo\n";
376 }
377 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
378 print CONF "push \"redirect-gateway def1\"\n";
379 }
380 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
381 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
382 }
383
384 if ($sovpnsettings{DHCP_DNS} ne '') {
385 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
386 }
387
388 if ($sovpnsettings{DHCP_WINS} ne '') {
389 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
390 }
391
392 if ($sovpnsettings{DHCP_WINS} eq '') {
393 print CONF "max-clients 100\n";
394 }
395 if ($sovpnsettings{DHCP_WINS} ne '') {
396 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
397 }
398 print CONF "tls-verify /usr/lib/openvpn/verify\n";
399 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
400 print CONF "user nobody\n";
401 print CONF "group nobody\n";
402 print CONF "persist-key\n";
403 print CONF "persist-tun\n";
404 if ($sovpnsettings{LOG_VERB} ne '') {
405 print CONF "verb $sovpnsettings{LOG_VERB}\n";
406 } else {
407 print CONF "verb 3\n";
408 }
409 print CONF "\n";
410
411 close(CONF);
412 }
413
414 sub emptyserverlog{
415 if (open(FILE, ">/var/log/ovpnserver.log")) {
416 flock FILE, 2;
417 print FILE "";
418 close FILE;
419 }
420
421 }
422
423 sub delccdnet
424 {
425 my %ccdconfhash = ();
426 my %ccdhash = ();
427 my $ccdnetname=$_[0];
428 if (-f "${General::swroot}/ovpn/ovpnconfig"){
429 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
430 foreach my $key (keys %ccdhash) {
431 if ($ccdhash{$key}[32] eq $ccdnetname) {
432 $errormessage=$Lang::tr{'ccd err hostinnet'};
433 return;
434 }
435 }
436 }
437 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
438 foreach my $key (keys %ccdconfhash) {
439 if ($ccdconfhash{$key}[0] eq $ccdnetname){
440 delete $ccdconfhash{$key};
441 }
442 }
443 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
444
445 &writeserverconf;
446 return 0;
447 }
448
449 sub addccdnet
450 {
451 my %ccdconfhash=();
452 my @ccdconf=();
453 my $ccdname=$_[0];
454 my $ccdnet=$_[1];
455 my $subcidr;
456 my @ip2=();
457 my $checkup;
458 my $ccdip;
459 my $baseaddress;
460
461
462 #check name
463 if ($ccdname eq '')
464 {
465 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
466 return
467 }
468
469 if(!&General::validhostname($ccdname))
470 {
471 $errormessage=$Lang::tr{'ccd err invalidname'};
472 return;
473 }
474
475 ($ccdip,$subcidr) = split (/\//,$ccdnet);
476 $subcidr=&General::iporsubtocidr($subcidr);
477 #check subnet
478 if ($subcidr > 30)
479 {
480 $errormessage=$Lang::tr{'ccd err invalidnet'};
481 return;
482 }
483 #check ip
484 if (!&General::validipandmask($ccdnet)){
485 $errormessage=$Lang::tr{'ccd err invalidnet'};
486 return;
487 }
488
489 $errormessage=&General::checksubnets($ccdname,$ccdnet);
490
491
492 if (!$errormessage) {
493 my %ccdconfhash=();
494 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
495 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
496 my $key = &General::findhasharraykey (\%ccdconfhash);
497 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
498 $ccdconfhash{$key}[0] = $ccdname;
499 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
500 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
501 &writeserverconf;
502 $cgiparams{'ccdname'}='';
503 $cgiparams{'ccdsubnet'}='';
504 return 1;
505 }
506 }
507
508 sub modccdnet
509 {
510
511 my $newname=$_[0];
512 my $oldname=$_[1];
513 my %ccdconfhash=();
514 my %ccdhash=();
515 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
516 foreach my $key (keys %ccdconfhash) {
517 if ($ccdconfhash{$key}[0] eq $oldname) {
518 foreach my $key1 (keys %ccdconfhash) {
519 if ($ccdconfhash{$key1}[0] eq $newname){
520 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
521 return;
522 }else{
523 $ccdconfhash{$key}[0]= $newname;
524 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
525 last;
526 }
527 }
528 }
529 }
530
531 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
532 foreach my $key (keys %ccdhash) {
533 if ($ccdhash{$key}[32] eq $oldname) {
534 $ccdhash{$key}[32]=$newname;
535 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
536 last;
537 }
538 }
539
540 return 0;
541 }
542 sub ccdmaxclients
543 {
544 my $ccdnetwork=$_[0];
545 my @octets=();
546 my @subnet=();
547 @octets=split("\/",$ccdnetwork);
548 @subnet= split /\./, &General::cidrtosub($octets[1]);
549 my ($a,$b,$c,$d,$e);
550 $a=256-$subnet[0];
551 $b=256-$subnet[1];
552 $c=256-$subnet[2];
553 $d=256-$subnet[3];
554 $e=($a*$b*$c*$d)/4;
555 return $e-1;
556 }
557
558 sub getccdadresses
559 {
560 my $ipin=$_[0];
561 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
562 my $cidr=$_[1];
563 chomp($cidr);
564 my $count=$_[2];
565 my $hasip=$_[3];
566 chomp($hasip);
567 my @iprange=();
568 my %ccdhash=();
569 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
570 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
571 for (my $i=1;$i<=$count;$i++) {
572 my $tmpip=$iprange[$i-1];
573 my $stepper=$i*4;
574 $iprange[$i]= &General::getnextip($tmpip,4);
575 }
576 my $r=0;
577 foreach my $key (keys %ccdhash) {
578 $r=0;
579 foreach my $tmp (@iprange){
580 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
581 if ($net eq $tmp) {
582 if ( $hasip ne $ccdhash{$key}[33] ){
583 splice (@iprange,$r,1);
584 }
585 }
586 $r++;
587 }
588 }
589 return @iprange;
590 }
591
592 sub fillselectbox
593 {
594 my $boxname=$_[1];
595 my ($ccdip,$subcidr) = split("/",$_[0]);
596 my $tz=$_[2];
597 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
598 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
599 foreach (@allccdips) {
600 my $ip=$_."/30";
601 chomp($ip);
602 print "<option value='$ip' ";
603 if ( $ip eq $cgiparams{$boxname} ){
604 print"selected";
605 }
606 print ">$ip</option>";
607 }
608 print "</select>";
609 }
610
611 sub hostsinnet
612 {
613 my $name=$_[0];
614 my %ccdhash=();
615 my $i=0;
616 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
617 foreach my $key (keys %ccdhash) {
618 if ($ccdhash{$key}[32] eq $name){ $i++;}
619 }
620 return $i;
621 }
622
623 sub check_routes_push
624 {
625 my $val=$_[0];
626 my ($ip,$cidr) = split (/\//, $val);
627 ##check for existing routes in routes_push
628 if (-e "${General::swroot}/ovpn/routes_push") {
629 open(FILE,"${General::swroot}/ovpn/routes_push");
630 while (<FILE>) {
631 $_=~s/\s*$//g;
632
633 my ($ip2,$cidr2) = split (/\//,"$_");
634 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
635
636 if($val eq $val2){
637 return 0;
638 }
639 #subnetcheck
640 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
641 return 0;
642 }
643 };
644 close(FILE);
645 }
646 return 1;
647 }
648
649 sub check_ccdroute
650 {
651 my %ccdroutehash=();
652 my $val=$_[0];
653 my ($ip,$cidr) = split (/\//, $val);
654 #check for existing routes in ccdroute
655 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
656 foreach my $key (keys %ccdroutehash) {
657 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
658 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
659 return 0;
660 }
661 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
662 #subnetcheck
663 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
664 return 0;
665 }
666 }
667 }
668 return 1;
669 }
670 sub check_ccdconf
671 {
672 my %ccdconfhash=();
673 my $val=$_[0];
674 my ($ip,$cidr) = split (/\//, $val);
675 #check for existing routes in ccdroute
676 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
677 foreach my $key (keys %ccdconfhash) {
678 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
679 return 0;
680 }
681 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
682 #subnetcheck
683 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
684 return 0;
685 }
686
687 }
688 return 1;
689 }
690
691 ###
692 # m.a.d net2net
693 ###
694
695 sub validdotmask
696 {
697 my $ipdotmask = $_[0];
698 if (&General::validip($ipdotmask)) { return 0; }
699 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
700 my $mask = $2;
701 if (($mask =~ /\./ )) { return 0; }
702 return 1;
703 }
704
705 # -------------------------------------------------------------------
706
707 sub write_routepushfile
708 {
709 open(FILE, ">$routes_push_file");
710 flock(FILE, 2);
711 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
712 print FILE $vpnsettings{'ROUTES_PUSH'};
713 }
714 close(FILE);
715 }
716
717 sub read_routepushfile
718 {
719 if (-e "$routes_push_file") {
720 open(FILE,"$routes_push_file");
721 delete $vpnsettings{'ROUTES_PUSH'};
722 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
723 close(FILE);
724 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
725
726 }
727 }
728
729
730 #hier die refresh page
731 if ( -e "${General::swroot}/ovpn/gencanow") {
732 my $refresh = '';
733 $refresh = "<meta http-equiv='refresh' content='15;' />";
734 &Header::showhttpheaders();
735 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
736 &Header::openbigbox('100%', 'center');
737 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
738 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
739 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
740 &Header::closebox();
741 &Header::closebigbox();
742 &Header::closepage();
743 exit (0);
744 }
745 ##hier die refresh page
746
747
748 ###
749 ### OpenVPN Server Control
750 ###
751 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
752 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
753 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
754 #start openvpn server
755 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
756 &emptyserverlog();
757 system('/usr/local/bin/openvpnctrl', '-s');
758 }
759 #stop openvpn server
760 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
761 system('/usr/local/bin/openvpnctrl', '-k');
762 &emptyserverlog();
763 }
764 # #restart openvpn server
765 # if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
766 #workarund, till SIGHUP also works when running as nobody
767 # system('/usr/local/bin/openvpnctrl', '-r');
768 # &emptyserverlog();
769 # }
770 }
771
772 ###
773 ### Save Advanced options
774 ###
775
776 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
777 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
778 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
779 #DAN this value has to leave.
780 #new settings for daemon
781 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
782 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
783 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
784 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
785 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
786 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
787 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
788 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
789 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
790 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
791 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
792 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
793 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
794 my @temp=();
795
796 if ($cgiparams{'FRAGMENT'} eq '') {
797 delete $vpnsettings{'FRAGMENT'};
798 } else {
799 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
800 $errormessage = "Incorrect value, please insert only numbers.";
801 goto ADV_ERROR;
802 } else {
803 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
804 }
805 }
806
807 if ($cgiparams{'MSSFIX'} ne 'on') {
808 delete $vpnsettings{'MSSFIX'};
809 } else {
810 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
811 }
812
813 # Create ta.key for tls-auth if not presant
814 if ($cgiparams{'TLSAUTH'} eq 'on') {
815 if ( ! -e "${General::swroot}/ovpn/ca/ta.key") {
816 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/ca/ta.key")
817 }
818 }
819
820 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
821 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
822 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
823
824 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
825 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
826 goto ADV_ERROR;
827 }
828 }
829
830 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
831 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
832 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
833 goto ADV_ERROR;
834 }
835 }
836 if ($cgiparams{'DHCP_DNS'} ne ''){
837 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
838 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
839 goto ADV_ERROR;
840 }
841 }
842 if ($cgiparams{'DHCP_WINS'} ne ''){
843 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
844 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
845 goto ADV_ERROR;
846 }
847 }
848 if ($cgiparams{'ROUTES_PUSH'} ne ''){
849 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
850 undef $vpnsettings{'ROUTES_PUSH'};
851
852 foreach my $tmpip (@temp)
853 {
854 s/^\s+//g; s/\s+$//g;
855
856 if ($tmpip)
857 {
858 $tmpip=~s/\s*$//g;
859 unless (&General::validipandmask($tmpip)) {
860 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
861 goto ADV_ERROR;
862 }
863 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
864
865 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
866 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
867 goto ADV_ERROR;
868 }
869 # a.marx ccd
870 my %ccdroutehash=();
871 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
872 foreach my $key (keys %ccdroutehash) {
873 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
874 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
875 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
876 goto ADV_ERROR;
877 }
878 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
879 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
880 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
881 goto ADV_ERROR;
882 }
883 }
884 }
885
886 # ccd end
887
888 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
889 }
890 }
891 &write_routepushfile;
892 undef $vpnsettings{'ROUTES_PUSH'};
893 }
894 else {
895 undef $vpnsettings{'ROUTES_PUSH'};
896 &write_routepushfile;
897 }
898 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
899 $errormessage = $Lang::tr{'invalid input for max clients'};
900 goto ADV_ERROR;
901 }
902 if ($cgiparams{'KEEPALIVE_1'} ne '') {
903 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
904 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
905 goto ADV_ERROR;
906 }
907 }
908 if ($cgiparams{'KEEPALIVE_2'} ne ''){
909 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
910 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
911 goto ADV_ERROR;
912 }
913 }
914 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
915 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
916 goto ADV_ERROR;
917 }
918
919 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
920 &writeserverconf();#hier ok
921 }
922
923 ###
924 # m.a.d net2net
925 ###
926
927 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
928 {
929
930 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
931 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
932 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
933 my $tunmtu = '';
934
935 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
936 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
937
938 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
939
940 flock SERVERCONF, 2;
941 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
942 print SERVERCONF "\n";
943 print SERVERCONF "# User Security\n";
944 print SERVERCONF "user nobody\n";
945 print SERVERCONF "group nobody\n";
946 print SERVERCONF "persist-tun\n";
947 print SERVERCONF "persist-key\n";
948 print SERVERCONF "script-security 2\n";
949 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
950
951 if ($cgiparams{'REMOTE'} ne '') {
952 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
953 }
954
955 print SERVERCONF "float\n";
956 print SERVERCONF "# IP adresses of the VPN Subnet\n";
957 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
958 print SERVERCONF "# Client Gateway Network\n";
959 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
960 print SERVERCONF "# tun Device\n";
961 print SERVERCONF "dev tun\n";
962 print SERVERCONF "# Port and Protokol\n";
963 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
964
965 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
966 print SERVERCONF "proto tcp-server\n";
967 print SERVERCONF "# Packet size\n";
968 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
969 print SERVERCONF "tun-mtu $tunmtu\n";
970 }
971
972 if ($cgiparams{'PROTOCOL'} eq 'udp') {
973 print SERVERCONF "proto udp\n";
974 print SERVERCONF "# Paketsize\n";
975 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
976 print SERVERCONF "tun-mtu $tunmtu\n";
977 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
978 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
979 }
980
981 # Check if a valid operating mode has been choosen and use it.
982 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
983 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
984 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
985 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
986 if($cgiparams{'MTU'} eq '1500') {
987 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
988 }
989 }
990 }
991 print SERVERCONF "# Auth. Server\n";
992 print SERVERCONF "tls-server\n";
993 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
994 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
995 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
996 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
997 print SERVERCONF "# Cipher\n";
998 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
999 if ($cgiparams{'DAUTH'} eq '') {
1000 print SERVERCONF "auth SHA1\n";
1001 } else {
1002 print SERVERCONF "# HMAC algorithm\n";
1003 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
1004 }
1005 if ($cgiparams{'COMPLZO'} eq 'on') {
1006 print SERVERCONF "# Enable Compression\n";
1007 print SERVERCONF "comp-lzo\r\n";
1008 }
1009 print SERVERCONF "# Debug Level\n";
1010 print SERVERCONF "verb 3\n";
1011 print SERVERCONF "# Tunnel check\n";
1012 print SERVERCONF "keepalive 10 60\n";
1013 print SERVERCONF "# Start as daemon\n";
1014 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1015 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1016 print SERVERCONF "# Activate Management Interface and Port\n";
1017 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1018 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1019 close(SERVERCONF);
1020
1021 }
1022
1023 ###
1024 # m.a.d net2net
1025 ###
1026
1027 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1028 {
1029
1030 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
1031 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1032 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
1033 my $tunmtu = '';
1034
1035 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1036 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1037
1038 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1039
1040 flock CLIENTCONF, 2;
1041 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1042 print CLIENTCONF "#\n";
1043 print CLIENTCONF "# User Security\n";
1044 print CLIENTCONF "user nobody\n";
1045 print CLIENTCONF "group nobody\n";
1046 print CLIENTCONF "persist-tun\n";
1047 print CLIENTCONF "persist-key\n";
1048 print CLIENTCONF "script-security 2\n";
1049 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1050 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1051 print CLIENTCONF "float\n";
1052 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1053 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1054 print CLIENTCONF "# Server Gateway Network\n";
1055 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1056 print CLIENTCONF "# tun Device\n";
1057 print CLIENTCONF "dev tun\n";
1058 print CLIENTCONF "# Port and Protokol\n";
1059 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1060
1061 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1062 print CLIENTCONF "proto tcp-client\n";
1063 print CLIENTCONF "# Packet size\n";
1064 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1065 print CLIENTCONF "tun-mtu $tunmtu\n";
1066 }
1067
1068 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1069 print CLIENTCONF "proto udp\n";
1070 print CLIENTCONF "# Paketsize\n";
1071 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1072 print CLIENTCONF "tun-mtu $tunmtu\n";
1073 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1074 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1075 }
1076
1077 # Check if a valid operating mode has been choosen and use it.
1078 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1079 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1080 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
1081 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1082 if ($cgiparams{'MTU'} eq '1500') {
1083 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1084 }
1085 }
1086 }
1087
1088 print CLIENTCONF "ns-cert-type server\n";
1089 print CLIENTCONF "# Auth. Client\n";
1090 print CLIENTCONF "tls-client\n";
1091 print CLIENTCONF "# Cipher\n";
1092 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
1093 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1094 if ($cgiparams{'DAUTH'} eq '') {
1095 print CLIENTCONF "auth SHA1\n";
1096 } else {
1097 print CLIENTCONF "# HMAC algorithm\n";
1098 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1099 }
1100 if ($cgiparams{'COMPLZO'} eq 'on') {
1101 print CLIENTCONF "# Enable Compression\n";
1102 print CLIENTCONF "comp-lzo\r\n";
1103 }
1104 print CLIENTCONF "# Debug Level\n";
1105 print CLIENTCONF "verb 3\n";
1106 print CLIENTCONF "# Tunnel check\n";
1107 print CLIENTCONF "keepalive 10 60\n";
1108 print CLIENTCONF "# Start as daemon\n";
1109 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1110 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1111 print CLIENTCONF "# Activate Management Interface and Port\n";
1112 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1113 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1114 close(CLIENTCONF);
1115
1116 }
1117
1118 ###
1119 ### Save main settings
1120 ###
1121
1122
1123 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1124 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1125 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1126 #DAN this value has to leave.
1127 if ($cgiparams{'ENABLED'} eq 'on'){
1128 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1129 $errormessage = $Lang::tr{'invalid input for hostname'};
1130 goto SETTINGS_ERROR;
1131 }
1132 }
1133 if ($errormessage) { goto SETTINGS_ERROR; }
1134
1135 if ($cgiparams{'ENABLED'} eq 'on'){
1136 &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
1137 }
1138 if ($errormessage) { goto SETTINGS_ERROR; }
1139
1140 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1141 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1142 goto SETTINGS_ERROR;
1143 }
1144 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1145
1146 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1147 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1148 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1149 goto SETTINGS_ERROR;
1150 }
1151
1152 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1153 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1154 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1155 goto SETTINGS_ERROR;
1156 }
1157
1158 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1159 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1160 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1161 goto SETTINGS_ERROR;
1162 }
1163
1164 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1165 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1166 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1167 goto SETTINGS_ERROR;
1168 }
1169 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1170 while (<ALIASES>)
1171 {
1172 chomp($_);
1173 my @tempalias = split(/\,/,$_);
1174 if ($tempalias[1] eq 'on') {
1175 if (&General::IpInSubnet ($tempalias[0] ,
1176 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1177 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1178 }
1179 }
1180 }
1181 close(ALIASES);
1182 if ($errormessage ne ''){
1183 goto SETTINGS_ERROR;
1184 }
1185 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1186 $errormessage = $Lang::tr{'invalid input'};
1187 goto SETTINGS_ERROR;
1188 }
1189 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1190 $errormessage = $Lang::tr{'invalid mtu input'};
1191 goto SETTINGS_ERROR;
1192 }
1193
1194 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1195 $errormessage = $Lang::tr{'invalid port'};
1196 goto SETTINGS_ERROR;
1197 }
1198
1199 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1200 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1201 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1202 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1203 #new settings for daemon
1204 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1205 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1206 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1207 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1208 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1209 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1210 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1211 #wrtie enable
1212
1213 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1214 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1215 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1216 #new settings for daemon
1217 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1218 &writeserverconf();#hier ok
1219 SETTINGS_ERROR:
1220 ###
1221 ### Reset all step 2
1222 ###
1223 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
1224 my $file = '';
1225 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1226
1227 foreach my $key (keys %confighash) {
1228 if ($confighash{$key}[4] eq 'cert') {
1229 delete $confighash{$cgiparams{'$key'}};
1230 }
1231 }
1232 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1233 unlink $file;
1234 }
1235 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1236 unlink $file;
1237 }
1238 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1239 unlink $file;
1240 }
1241 &cleanssldatabase();
1242 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1243 print FILE "";
1244 close FILE;
1245 }
1246 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1247 print FILE "";
1248 close FILE;
1249 }
1250 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1251 print FILE "";
1252 close FILE;
1253 }
1254 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1255 unlink $file
1256 }
1257 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1258 print FILE "";
1259 close FILE;
1260 }
1261 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1262 print FILE "";
1263 close FILE;
1264 }
1265 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1266 system ("rm -rf $file");
1267 }
1268
1269 #&writeserverconf();
1270 ###
1271 ### Reset all step 1
1272 ###
1273 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
1274 &Header::showhttpheaders();
1275 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1276 &Header::openbigbox('100%', 'left', '', '');
1277 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1278 print <<END;
1279 <form method='post'>
1280 <table width='100%'>
1281 <tr>
1282 <td align='center'>
1283 <input type='hidden' name='AREUSURE' value='yes' />
1284 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1285 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1286 </tr>
1287 <tr>
1288 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1289 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1290 </tr>
1291 </table>
1292 </form>
1293 END
1294 ;
1295 &Header::closebox();
1296 &Header::closebigbox();
1297 &Header::closepage();
1298 exit (0);
1299
1300 ###
1301 ### Generate DH key step 2
1302 ###
1303 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
1304 # Delete if old key exists
1305 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1306 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1307 }
1308 # Create Diffie Hellmann Parameter
1309 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1310 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1311 if ($?) {
1312 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1313 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1314 }
1315
1316 ###
1317 ### Generate DH key step 1
1318 ###
1319 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1320 &Header::showhttpheaders();
1321 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1322 &Header::openbigbox('100%', 'LEFT', '', '');
1323 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1324 print <<END;
1325 <table width='100%'>
1326 <tr>
1327 <td width='20%'> </td> <td width='15%'></td> <td width='65%'></td>
1328 </tr>
1329 <tr>
1330 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1331 <td align='center'>
1332 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1333 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1334 <select name='DHLENGHT'>
1335 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1336 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1337 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1338 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1339 </select>
1340 </td>
1341 </tr>
1342 <tr><td colspan='4'><br></td></tr>
1343 </table>
1344 <table width='100%'>
1345 <tr>
1346 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
1347 </tr>
1348 <tr>
1349 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1350 </tr>
1351 <tr><td colspan='2'><br></td></tr>
1352 <tr>
1353 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1354 </form>
1355 </tr>
1356 </table>
1357
1358 END
1359 ;
1360 &Header::closebox();
1361 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1362 &Header::closebigbox();
1363 &Header::closepage();
1364 exit (0);
1365
1366 ###
1367 ### Upload DH key
1368 ###
1369 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
1370 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1371 $errormessage = $Lang::tr{'there was no file upload'};
1372 goto UPLOADCA_ERROR;
1373 }
1374 # Move uploaded dh key to a temporary file
1375 (my $fh, my $filename) = tempfile( );
1376 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1377 $errormessage = $!;
1378 goto UPLOADCA_ERROR;
1379 }
1380 my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
1381 if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
1382 $errormessage = $Lang::tr{'not a valid dh key'};
1383 unlink ($filename);
1384 goto UPLOADCA_ERROR;
1385 } else {
1386 # Delete if old key exists
1387 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1388 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1389 }
1390 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
1391 if ($? ne 0) {
1392 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1393 unlink ($filename);
1394 goto UPLOADCA_ERROR;
1395 }
1396 }
1397
1398 ###
1399 ### Upload CA Certificate
1400 ###
1401 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1402 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1403
1404 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1405 $errormessage = $Lang::tr{'name must only contain characters'};
1406 goto UPLOADCA_ERROR;
1407 }
1408
1409 if (length($cgiparams{'CA_NAME'}) >60) {
1410 $errormessage = $Lang::tr{'name too long'};
1411 goto VPNCONF_ERROR;
1412 }
1413
1414 if ($cgiparams{'CA_NAME'} eq 'ca') {
1415 $errormessage = $Lang::tr{'name is invalid'};
1416 goto UPLOADCA_ERROR;
1417 }
1418
1419 # Check if there is no other entry with this name
1420 foreach my $key (keys %cahash) {
1421 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1422 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1423 goto UPLOADCA_ERROR;
1424 }
1425 }
1426
1427 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1428 $errormessage = $Lang::tr{'there was no file upload'};
1429 goto UPLOADCA_ERROR;
1430 }
1431 # Move uploaded ca to a temporary file
1432 (my $fh, my $filename) = tempfile( );
1433 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1434 $errormessage = $!;
1435 goto UPLOADCA_ERROR;
1436 }
1437 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1438 if ($temp !~ /CA:TRUE/i) {
1439 $errormessage = $Lang::tr{'not a valid ca certificate'};
1440 unlink ($filename);
1441 goto UPLOADCA_ERROR;
1442 } else {
1443 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1444 if ($? ne 0) {
1445 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1446 unlink ($filename);
1447 goto UPLOADCA_ERROR;
1448 }
1449 }
1450
1451 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1452 $casubject =~ /Subject: (.*)[\n]/;
1453 $casubject = $1;
1454 $casubject =~ s+/Email+, E+;
1455 $casubject =~ s/ ST=/ S=/;
1456 $casubject = &Header::cleanhtml($casubject);
1457
1458 my $key = &General::findhasharraykey (\%cahash);
1459 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1460 $cahash{$key}[1] = $casubject;
1461 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1462 # system('/usr/local/bin/ipsecctrl', 'R');
1463
1464 UPLOADCA_ERROR:
1465
1466 ###
1467 ### Display ca certificate
1468 ###
1469 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1470 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1471
1472 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1473 &Header::showhttpheaders();
1474 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1475 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1476 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1477 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1478 $output = &Header::cleanhtml($output,"y");
1479 print "<pre>$output</pre>\n";
1480 &Header::closebox();
1481 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1482 &Header::closebigbox();
1483 &Header::closepage();
1484 exit(0);
1485 } else {
1486 $errormessage = $Lang::tr{'invalid key'};
1487 }
1488
1489 ###
1490 ### Download ca certificate
1491 ###
1492 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1493 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1494
1495 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1496 print "Content-Type: application/octet-stream\r\n";
1497 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1498 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1499 exit(0);
1500 } else {
1501 $errormessage = $Lang::tr{'invalid key'};
1502 }
1503
1504 ###
1505 ### Remove ca certificate (step 2)
1506 ###
1507 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1508 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1509 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1510
1511 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1512 foreach my $key (keys %confighash) {
1513 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1514 if ($test =~ /: OK/) {
1515 # Delete connection
1516 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1517 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1518 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1519 # }
1520 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1521 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1522 delete $confighash{$key};
1523 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1524 # &writeipsecfiles();
1525 }
1526 }
1527 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1528 delete $cahash{$cgiparams{'KEY'}};
1529 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1530 # system('/usr/local/bin/ipsecctrl', 'R');
1531 } else {
1532 $errormessage = $Lang::tr{'invalid key'};
1533 }
1534 ###
1535 ### Remove ca certificate (step 1)
1536 ###
1537 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1538 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1539 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1540
1541 my $assignedcerts = 0;
1542 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1543 foreach my $key (keys %confighash) {
1544 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1545 if ($test =~ /: OK/) {
1546 $assignedcerts++;
1547 }
1548 }
1549 if ($assignedcerts) {
1550 &Header::showhttpheaders();
1551 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1552 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1553 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1554 print <<END;
1555 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1556 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1557 <tr><td align='center'>
1558 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1559 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1560 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1561 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1562 </form></table>
1563 END
1564 ;
1565 &Header::closebox();
1566 &Header::closebigbox();
1567 &Header::closepage();
1568 exit (0);
1569 } else {
1570 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1571 delete $cahash{$cgiparams{'KEY'}};
1572 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1573 # system('/usr/local/bin/ipsecctrl', 'R');
1574 }
1575 } else {
1576 $errormessage = $Lang::tr{'invalid key'};
1577 }
1578
1579 ###
1580 ### Display root certificate
1581 ###
1582 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1583 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1584 my $output;
1585 &Header::showhttpheaders();
1586 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1587 &Header::openbigbox('100%', 'LEFT', '', '');
1588 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1589 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1590 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1591 } else {
1592 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1593 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1594 }
1595 $output = &Header::cleanhtml($output,"y");
1596 print "<pre>$output</pre>\n";
1597 &Header::closebox();
1598 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1599 &Header::closebigbox();
1600 &Header::closepage();
1601 exit(0);
1602
1603 ###
1604 ### Download root certificate
1605 ###
1606 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1607 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1608 print "Content-Type: application/octet-stream\r\n";
1609 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1610 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1611 exit(0);
1612 }
1613
1614 ###
1615 ### Download host certificate
1616 ###
1617 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1618 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1619 print "Content-Type: application/octet-stream\r\n";
1620 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1621 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1622 exit(0);
1623 }
1624 ###
1625 ### Form for generating a root certificate
1626 ###
1627 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1628 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1629
1630 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1631 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1632 $errormessage = $Lang::tr{'valid root certificate already exists'};
1633 $cgiparams{'ACTION'} = '';
1634 goto ROOTCERT_ERROR;
1635 }
1636
1637 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1638 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1639 my $ipaddr = <IPADDR>;
1640 close IPADDR;
1641 chomp ($ipaddr);
1642 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1643 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1644 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1645 }
1646 }
1647 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1648
1649 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1650 $errormessage = $Lang::tr{'there was no file upload'};
1651 goto ROOTCERT_ERROR;
1652 }
1653
1654 # Move uploaded certificate request to a temporary file
1655 (my $fh, my $filename) = tempfile( );
1656 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1657 $errormessage = $!;
1658 goto ROOTCERT_ERROR;
1659 }
1660
1661 # Create a temporary dirctory
1662 my $tempdir = tempdir( CLEANUP => 1 );
1663
1664 # Extract the CA certificate from the file
1665 my $pid = open(OPENSSL, "|-");
1666 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1667 if ($pid) { # parent
1668 if ($cgiparams{'P12_PASS'} ne '') {
1669 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1670 }
1671 close (OPENSSL);
1672 if ($?) {
1673 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1674 unlink ($filename);
1675 goto ROOTCERT_ERROR;
1676 }
1677 } else { # child
1678 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1679 '-in', $filename,
1680 '-out', "$tempdir/cacert.pem")) {
1681 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1682 unlink ($filename);
1683 goto ROOTCERT_ERROR;
1684 }
1685 }
1686
1687 # Extract the Host certificate from the file
1688 $pid = open(OPENSSL, "|-");
1689 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1690 if ($pid) { # parent
1691 if ($cgiparams{'P12_PASS'} ne '') {
1692 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1693 }
1694 close (OPENSSL);
1695 if ($?) {
1696 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1697 unlink ($filename);
1698 goto ROOTCERT_ERROR;
1699 }
1700 } else { # child
1701 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1702 '-in', $filename,
1703 '-out', "$tempdir/hostcert.pem")) {
1704 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1705 unlink ($filename);
1706 goto ROOTCERT_ERROR;
1707 }
1708 }
1709
1710 # Extract the Host key from the file
1711 $pid = open(OPENSSL, "|-");
1712 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1713 if ($pid) { # parent
1714 if ($cgiparams{'P12_PASS'} ne '') {
1715 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1716 }
1717 close (OPENSSL);
1718 if ($?) {
1719 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1720 unlink ($filename);
1721 goto ROOTCERT_ERROR;
1722 }
1723 } else { # child
1724 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1725 '-nodes',
1726 '-in', $filename,
1727 '-out', "$tempdir/serverkey.pem")) {
1728 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1729 unlink ($filename);
1730 goto ROOTCERT_ERROR;
1731 }
1732 }
1733
1734 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1735 if ($? ne 0) {
1736 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1737 unlink ($filename);
1738 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1739 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1740 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1741 goto ROOTCERT_ERROR;
1742 }
1743
1744 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1745 if ($? ne 0) {
1746 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1747 unlink ($filename);
1748 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1749 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1750 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1751 goto ROOTCERT_ERROR;
1752 }
1753
1754 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1755 if ($? ne 0) {
1756 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1757 unlink ($filename);
1758 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1759 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1760 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1761 goto ROOTCERT_ERROR;
1762 }
1763
1764 goto ROOTCERT_SUCCESS;
1765
1766 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1767
1768 # Validate input since the form was submitted
1769 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1770 $errormessage = $Lang::tr{'organization cant be empty'};
1771 goto ROOTCERT_ERROR;
1772 }
1773 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1774 $errormessage = $Lang::tr{'organization too long'};
1775 goto ROOTCERT_ERROR;
1776 }
1777 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1778 $errormessage = $Lang::tr{'invalid input for organization'};
1779 goto ROOTCERT_ERROR;
1780 }
1781 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1782 $errormessage = $Lang::tr{'hostname cant be empty'};
1783 goto ROOTCERT_ERROR;
1784 }
1785 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1786 $errormessage = $Lang::tr{'invalid input for hostname'};
1787 goto ROOTCERT_ERROR;
1788 }
1789 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1790 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1791 goto ROOTCERT_ERROR;
1792 }
1793 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1794 $errormessage = $Lang::tr{'e-mail address too long'};
1795 goto ROOTCERT_ERROR;
1796 }
1797 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1798 $errormessage = $Lang::tr{'invalid input for department'};
1799 goto ROOTCERT_ERROR;
1800 }
1801 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1802 $errormessage = $Lang::tr{'invalid input for city'};
1803 goto ROOTCERT_ERROR;
1804 }
1805 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1806 $errormessage = $Lang::tr{'invalid input for state or province'};
1807 goto ROOTCERT_ERROR;
1808 }
1809 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1810 $errormessage = $Lang::tr{'invalid input for country'};
1811 goto ROOTCERT_ERROR;
1812 }
1813
1814 # Copy the cgisettings to vpnsettings and save the configfile
1815 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1816 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1817 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1818 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1819 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1820 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1821 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1822 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1823
1824 # Replace empty strings with a .
1825 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1826 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1827 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1828
1829 # refresh
1830 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1831
1832 # Create the CA certificate
1833 my $pid = open(OPENSSL, "|-");
1834 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1835 if ($pid) { # parent
1836 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1837 print OPENSSL "$state\n";
1838 print OPENSSL "$city\n";
1839 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1840 print OPENSSL "$ou\n";
1841 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1842 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1843 close (OPENSSL);
1844 if ($?) {
1845 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1846 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1847 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1848 goto ROOTCERT_ERROR;
1849 }
1850 } else { # child
1851 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1852 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
1853 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1854 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1855 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1856 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1857 goto ROOTCERT_ERROR;
1858 }
1859 }
1860
1861 # Create the Host certificate request
1862 $pid = open(OPENSSL, "|-");
1863 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1864 if ($pid) { # parent
1865 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1866 print OPENSSL "$state\n";
1867 print OPENSSL "$city\n";
1868 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1869 print OPENSSL "$ou\n";
1870 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1871 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1872 print OPENSSL ".\n";
1873 print OPENSSL ".\n";
1874 close (OPENSSL);
1875 if ($?) {
1876 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1877 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1878 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1879 goto ROOTCERT_ERROR;
1880 }
1881 } else { # child
1882 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1883 '-newkey', 'rsa:2048',
1884 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1885 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1886 '-extensions', 'server',
1887 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1888 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1889 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1890 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1891 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1892 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1893 goto ROOTCERT_ERROR;
1894 }
1895 }
1896
1897 # Sign the host certificate request
1898 system('/usr/bin/openssl', 'ca', '-days', '999999',
1899 '-batch', '-notext',
1900 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1901 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1902 '-extensions', 'server',
1903 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1904 if ($?) {
1905 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1906 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1907 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1908 unlink ("${General::swroot}/ovpn/serverkey.pem");
1909 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1910 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1911 &newcleanssldatabase();
1912 goto ROOTCERT_ERROR;
1913 } else {
1914 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1915 &deletebackupcert();
1916 }
1917
1918 # Create an empty CRL
1919 system('/usr/bin/openssl', 'ca', '-gencrl',
1920 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1921 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1922 if ($?) {
1923 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1924 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1925 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1926 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1927 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1928 &cleanssldatabase();
1929 goto ROOTCERT_ERROR;
1930 # } else {
1931 # &cleanssldatabase();
1932 }
1933 # Create Diffie Hellmann Parameter
1934 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1935 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1936 if ($?) {
1937 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1938 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1939 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1940 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1941 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1942 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1943 &cleanssldatabase();
1944 goto ROOTCERT_ERROR;
1945 # } else {
1946 # &cleanssldatabase();
1947 }
1948 goto ROOTCERT_SUCCESS;
1949 }
1950 ROOTCERT_ERROR:
1951 if ($cgiparams{'ACTION'} ne '') {
1952 &Header::showhttpheaders();
1953 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1954 &Header::openbigbox('100%', 'LEFT', '', '');
1955 if ($errormessage) {
1956 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1957 print "<class name='base'>$errormessage";
1958 print "&nbsp;</class>";
1959 &Header::closebox();
1960 }
1961 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1962 print <<END;
1963 <form method='post' enctype='multipart/form-data'>
1964 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1965 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1966 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1967 <td width='35%' colspan='2'>&nbsp;</td></tr>
1968 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1969 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1970 <td colspan='2'>&nbsp;</td></tr>
1971 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1972 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1973 <td colspan='2'>&nbsp;</td></tr>
1974 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1975 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1976 <td colspan='2'>&nbsp;</td></tr>
1977 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1978 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1979 <td colspan='2'>&nbsp;</td></tr>
1980 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1981 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1982 <td colspan='2'>&nbsp;</td></tr>
1983 <tr><td class='base'>$Lang::tr{'country'}:</td>
1984 <td class='base'><select name='ROOTCERT_COUNTRY'>
1985
1986 END
1987 ;
1988 foreach my $country (sort keys %{Countries::countries}) {
1989 print "<option value='$Countries::countries{$country}'";
1990 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1991 print " selected='selected'";
1992 }
1993 print ">$country</option>";
1994 }
1995 print <<END;
1996 </select></td>
1997 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
1998 <td class='base'><select name='DHLENGHT'>
1999 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
2000 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2001 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2002 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2003 </select>
2004 </td>
2005 </tr>
2006
2007 <tr><td>&nbsp;</td>
2008 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
2009 <td>&nbsp;</td><td>&nbsp;</td></tr>
2010 <tr><td class='base' colspan='4' align='left'>
2011 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2012 <tr><td colspan='2'><br></td></tr>
2013 <table width='100%'>
2014 <tr>
2015 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2016 <td class='base'>$Lang::tr{'dh key warn'}</td>
2017 </tr>
2018 <tr>
2019 <td class='base'>$Lang::tr{'dh key warn1'}</td>
2020 </tr>
2021 <tr><td colspan='2'><br></td></tr>
2022 <tr>
2023 </table>
2024
2025 <table width='100%'>
2026 <tr><td colspan='4'><hr></td></tr>
2027 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
2028 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2029 <td colspan='2'>&nbsp;</td></tr>
2030 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
2031 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2032 <td colspan='2'>&nbsp;</td></tr>
2033 <tr><td>&nbsp;</td>
2034 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2035 <td colspan='2'>&nbsp;</td></tr>
2036 <tr><td class='base' colspan='4' align='left'>
2037 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td>
2038 </tr>
2039 </form></table>
2040 END
2041 ;
2042 &Header::closebox();
2043 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2044 &Header::closebigbox();
2045 &Header::closepage();
2046 exit(0)
2047 }
2048
2049 ROOTCERT_SUCCESS:
2050 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
2051 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2052 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2053 # system('/usr/local/bin/ipsecctrl', 'S');
2054 # }
2055
2056 ###
2057 ### Enable/Disable connection
2058 ###
2059
2060 ###
2061 # m.a.d net2net
2062 ###
2063
2064 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2065
2066 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2067 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2068 # my $n2nactive = '';
2069 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
2070
2071 if ($confighash{$cgiparams{'KEY'}}) {
2072 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2073 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2074 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2075
2076 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2077 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
2078 }
2079 } else {
2080
2081 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2082 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2083
2084 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2085 if ($n2nactive ne ''){
2086 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
2087 }
2088
2089 } else {
2090 $errormessage = $Lang::tr{'invalid key'};
2091 }
2092 }
2093 }
2094
2095 ###
2096 ### Download OpenVPN client package
2097 ###
2098
2099
2100 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2101 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2102 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2103 my $file = '';
2104 my $clientovpn = '';
2105 my @fileholder;
2106 my $tempdir = tempdir( CLEANUP => 1 );
2107 my $zippath = "$tempdir/";
2108
2109 ###
2110 # m.a.d net2net
2111 ###
2112
2113 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2114
2115 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2116 my $zippathname = "$zippath$zipname";
2117 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2118 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
2119 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
2120 my $tunmtu = '';
2121 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
2122 my $n2nfragment = '';
2123
2124 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2125 flock CLIENTCONF, 2;
2126
2127 my $zip = Archive::Zip->new();
2128 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2129 print CLIENTCONF "# \n";
2130 print CLIENTCONF "# User Security\n";
2131 print CLIENTCONF "user nobody\n";
2132 print CLIENTCONF "group nobody\n";
2133 print CLIENTCONF "persist-tun\n";
2134 print CLIENTCONF "persist-key\n";
2135 print CLIENTCONF "script-security 2\n";
2136 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2137 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2138 print CLIENTCONF "float\n";
2139 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2140 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2141 print CLIENTCONF "# Server Gateway Network\n";
2142 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2143 print CLIENTCONF "# tun Device\n";
2144 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
2145 print CLIENTCONF "# Port and Protokoll\n";
2146 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2147
2148 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2149 print CLIENTCONF "proto tcp-client\n";
2150 print CLIENTCONF "# Packet size\n";
2151 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2152 print CLIENTCONF "tun-mtu $tunmtu\n";
2153 }
2154
2155 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2156 print CLIENTCONF "proto udp\n";
2157 print CLIENTCONF "# Paketsize\n";
2158 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2159 print CLIENTCONF "tun-mtu $tunmtu\n";
2160 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2161 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
2162 }
2163 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2164 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2165 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2166 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2167 if ($tunmtu eq '1500' ) {
2168 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2169 }
2170 }
2171 }
2172 print CLIENTCONF "ns-cert-type server\n";
2173 print CLIENTCONF "# Auth. Client\n";
2174 print CLIENTCONF "tls-client\n";
2175 print CLIENTCONF "# Cipher\n";
2176 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2177 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2178 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2179 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2180 }
2181 if ($confighash{$cgiparams{'KEY'}}[39] eq '') {
2182 print CLIENTCONF "# HMAC algorithm\n";
2183 print CLIENTCONF "auth SHA1\n";
2184 } else {
2185 print CLIENTCONF "# HMAC algorithm\n";
2186 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2187 }
2188 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2189 print CLIENTCONF "# Enable Compression\n";
2190 print CLIENTCONF "comp-lzo\r\n";
2191 }
2192 print CLIENTCONF "# Debug Level\n";
2193 print CLIENTCONF "verb 3\n";
2194 print CLIENTCONF "# Tunnel check\n";
2195 print CLIENTCONF "keepalive 10 60\n";
2196 print CLIENTCONF "# Start as daemon\n";
2197 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2198 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2199 print CLIENTCONF "# Activate Management Interface and Port\n";
2200 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2201 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2202 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2203
2204
2205 close(CLIENTCONF);
2206
2207 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2208 my $status = $zip->writeToFileNamed($zippathname);
2209
2210 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2211 @fileholder = <DLFILE>;
2212 print "Content-Type:application/x-download\n";
2213 print "Content-Disposition:attachment;filename=$zipname\n\n";
2214 print @fileholder;
2215 exit (0);
2216 }
2217 else
2218 {
2219 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2220 my $zippathname = "$zippath$zipname";
2221 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2222
2223 ###
2224 # m.a.d net2net
2225 ###
2226
2227 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2228 flock CLIENTCONF, 2;
2229
2230 my $zip = Archive::Zip->new();
2231
2232 print CLIENTCONF "#OpenVPN Client conf\r\n";
2233 print CLIENTCONF "tls-client\r\n";
2234 print CLIENTCONF "client\r\n";
2235 print CLIENTCONF "nobind\r\n";
2236 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2237 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2238
2239 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2240 # or use configured value.
2241 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2242 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2243 elsif ($vpnsettings{MSSFIX} eq 'on')
2244 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2245 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2246 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2247 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2248 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2249 else
2250 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2251
2252 if ( $vpnsettings{'ENABLED'} eq 'on'){
2253 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2254 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2255 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2256 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2257 }
2258 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2259 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2260 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2261 }
2262 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2263 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2264 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2265 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2266 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2267 }
2268 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2269 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2270 }
2271
2272 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2273 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2274 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2275 } else {
2276 print CLIENTCONF "ca cacert.pem\r\n";
2277 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2278 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2279 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2280 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2281 }
2282 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2283 if ($vpnsettings{'DAUTH'} eq '') {
2284 print CLIENTCONF "";
2285 } else {
2286 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2287 }
2288 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2289 print CLIENTCONF "tls-auth ta.key 1\r\n";
2290 $zip->addFile( "${General::swroot}/ovpn/ca/ta.key", "ta.key") or die "Can't add file ta.key\n";
2291 }
2292 if ($vpnsettings{DCOMPLZO} eq 'on') {
2293 print CLIENTCONF "comp-lzo\r\n";
2294 }
2295 print CLIENTCONF "verb 3\r\n";
2296 print CLIENTCONF "ns-cert-type server\r\n";
2297 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2298 if ($vpnsettings{MSSFIX} eq 'on') {
2299 print CLIENTCONF "mssfix\r\n";
2300 }
2301 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2302 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2303 }
2304
2305 # Check if a valid operating mode has been choosen and use it.
2306 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2307 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2308 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2309 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2310 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2311 }
2312 }
2313 close(CLIENTCONF);
2314
2315 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2316 my $status = $zip->writeToFileNamed($zippathname);
2317
2318 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2319 @fileholder = <DLFILE>;
2320 print "Content-Type:application/x-download\n";
2321 print "Content-Disposition:attachment;filename=$zipname\n\n";
2322 print @fileholder;
2323 exit (0);
2324 }
2325
2326
2327
2328 ###
2329 ### Remove connection
2330 ###
2331
2332
2333 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2334 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2335 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2336
2337 if ($confighash{$cgiparams{'KEY'}}) {
2338 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2339 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2340 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2341 # }
2342 #
2343 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2344
2345 ###
2346 # m.a.d net2net
2347 ###
2348
2349 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2350 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2351 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2352 unlink ($certfile);
2353 unlink ($conffile);
2354
2355 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2356 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2357 }
2358 }
2359
2360 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2361 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2362
2363 # A.Marx CCD delete ccd files and routes
2364
2365
2366 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2367 {
2368 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2369 }
2370
2371 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2372 foreach my $key (keys %ccdroutehash) {
2373 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2374 delete $ccdroutehash{$key};
2375 }
2376 }
2377 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2378
2379 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2380 foreach my $key (keys %ccdroute2hash) {
2381 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2382 delete $ccdroute2hash{$key};
2383 }
2384 }
2385 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2386 &writeserverconf;
2387
2388
2389 # CCD end
2390
2391
2392 delete $confighash{$cgiparams{'KEY'}};
2393 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2394 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2395
2396 #&writeserverconf();
2397 } else {
2398 $errormessage = $Lang::tr{'invalid key'};
2399 }
2400 &General::firewall_reload();
2401
2402 ###
2403 ### Download PKCS12 file
2404 ###
2405 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2406 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2407
2408 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2409 print "Content-Type: application/octet-stream\r\n\r\n";
2410 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2411 exit (0);
2412
2413 ###
2414 ### Display certificate
2415 ###
2416 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2417 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2418
2419 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2420 &Header::showhttpheaders();
2421 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2422 &Header::openbigbox('100%', 'LEFT', '', '');
2423 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2424 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2425 $output = &Header::cleanhtml($output,"y");
2426 print "<pre>$output</pre>\n";
2427 &Header::closebox();
2428 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2429 &Header::closebigbox();
2430 &Header::closepage();
2431 exit(0);
2432 }
2433
2434 ###
2435 ### Display Diffie-Hellman key
2436 ###
2437 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2438
2439 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
2440 $errormessage = $Lang::tr{'not present'};
2441 } else {
2442 &Header::showhttpheaders();
2443 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2444 &Header::openbigbox('100%', 'LEFT', '', '');
2445 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2446 my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
2447 $output = &Header::cleanhtml($output,"y");
2448 print "<pre>$output</pre>\n";
2449 &Header::closebox();
2450 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2451 &Header::closebigbox();
2452 &Header::closepage();
2453 exit(0);
2454 }
2455
2456 ###
2457 ### Display Certificate Revoke List
2458 ###
2459 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2460 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2461
2462 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2463 $errormessage = $Lang::tr{'not present'};
2464 } else {
2465 &Header::showhttpheaders();
2466 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2467 &Header::openbigbox('100%', 'LEFT', '', '');
2468 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2469 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2470 $output = &Header::cleanhtml($output,"y");
2471 print "<pre>$output</pre>\n";
2472 &Header::closebox();
2473 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2474 &Header::closebigbox();
2475 &Header::closepage();
2476 exit(0);
2477 }
2478
2479 ###
2480 ### Advanced Server Settings
2481 ###
2482
2483 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2484 %cgiparams = ();
2485 %cahash = ();
2486 %confighash = ();
2487 my $disabled;
2488 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2489 read_routepushfile;
2490
2491
2492 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2493 # $cgiparams{'CLIENT2CLIENT'} = 'on';
2494 # }
2495 ADV_ERROR:
2496 if ($cgiparams{'MAX_CLIENTS'} eq '') {
2497 $cgiparams{'MAX_CLIENTS'} = '100';
2498 }
2499 if ($cgiparams{'KEEPALIVE_1'} eq '') {
2500 $cgiparams{'KEEPALIVE_1'} = '10';
2501 }
2502 if ($cgiparams{'KEEPALIVE_2'} eq '') {
2503 $cgiparams{'KEEPALIVE_2'} = '60';
2504 }
2505 if ($cgiparams{'LOG_VERB'} eq '') {
2506 $cgiparams{'LOG_VERB'} = '3';
2507 }
2508 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
2509 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2510 }
2511 if ($cgiparams{'DAUTH'} eq '') {
2512 $cgiparams{'DAUTH'} = 'SHA1';
2513 }
2514 if ($cgiparams{'DAUTH'} eq '') {
2515 $cgiparams{'DAUTH'} = 'SHA1';
2516 }
2517 if ($cgiparams{'ENGINES'} eq '') {
2518 $cgiparams{'ENGINES'} = 'disabled';
2519 }
2520 if ($cgiparams{'TLSAUTH'} eq '') {
2521 $cgiparams{'TLSAUTH'} = 'off';
2522 }
2523 if ($cgiparams{'DAUTH'} eq '') {
2524 $cgiparams{'DAUTH'} = 'SHA1';
2525 }
2526 if ($cgiparams{'TLSAUTH'} eq '') {
2527 $cgiparams{'TLSAUTH'} = 'off';
2528 }
2529 $checked{'CLIENT2CLIENT'}{'off'} = '';
2530 $checked{'CLIENT2CLIENT'}{'on'} = '';
2531 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2532 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2533 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2534 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2535 $checked{'MSSFIX'}{'off'} = '';
2536 $checked{'MSSFIX'}{'on'} = '';
2537 $checked{'MS