990fe6600bc7867d4c26027fed9786092c9e5c5c
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2011 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 ###
22 # Based on IPFireCore 55
23 ###
24 use CGI;
25 use CGI qw/:standard/;
26 use Net::DNS;
27 use Net::Ping;
28 use Net::Telnet;
29 use File::Copy;
30 use File::Temp qw/ tempfile tempdir /;
31 use strict;
32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
33 require '/var/ipfire/general-functions.pl';
34 require "${General::swroot}/lang.pl";
35 require "${General::swroot}/header.pl";
36 require "${General::swroot}/countries.pl";
37
38 # enable only the following on debugging purpose
39 use warnings;
40 use CGI::Carp 'fatalsToBrowser';
41 #workaround to suppress a warning when a variable is used only once
42 my @dummy = ( ${Header::colourgreen} );
43 undef (@dummy);
44
45 my %color = ();
46 my %mainsettings = ();
47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
49
50 ###
51 ### Initialize variables
52 ###
53 my %netsettings=();
54 my %cgiparams=();
55 my %vpnsettings=();
56 my %checked=();
57 my %confighash=();
58 my %cahash=();
59 my %selected=();
60 my $warnmessage = '';
61 my $errormessage = '';
62 my %settings=();
63 my $routes_push_file = '';
64 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
65 $cgiparams{'ENABLED'} = 'off';
66 $cgiparams{'ENABLED_BLUE'} = 'off';
67 $cgiparams{'ENABLED_ORANGE'} = 'off';
68 $cgiparams{'EDIT_ADVANCED'} = 'off';
69 $cgiparams{'NAT'} = 'off';
70 $cgiparams{'COMPRESSION'} = 'off';
71 $cgiparams{'ONLY_PROPOSED'} = 'off';
72 $cgiparams{'ACTION'} = '';
73 $cgiparams{'CA_NAME'} = '';
74 $cgiparams{'DHCP_DOMAIN'} = '';
75 $cgiparams{'DHCP_DNS'} = '';
76 $cgiparams{'DHCP_WINS'} = '';
77 $cgiparams{'ROUTES_PUSH'} = '';
78 $cgiparams{'DCOMPLZO'} = 'off';
79 $cgiparams{'MSSFIX'} = '';
80 $routes_push_file = "${General::swroot}/ovpn/routes_push";
81 unless (-e $routes_push_file) { system("touch $routes_push_file"); }
82
83 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
84
85 # prepare openvpn config file
86 ###
87 ### Useful functions
88 ###
89 sub haveOrangeNet
90 {
91 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
92 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
93 return 0;
94 }
95
96 sub haveBlueNet
97 {
98 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
99 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
100 return 0;
101 }
102
103 sub sizeformat{
104 my $bytesize = shift;
105 my $i = 0;
106
107 while(abs($bytesize) >= 1024){
108 $bytesize=$bytesize/1024;
109 $i++;
110 last if($i==6);
111 }
112
113 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
114 my $newsize=(int($bytesize*100 +0.5))/100;
115 return("$newsize $units[$i]");
116 }
117
118 sub valid_dns_host {
119 my $hostname = $_[0];
120 unless ($hostname) { return "No hostname"};
121 my $res = new Net::DNS::Resolver;
122 my $query = $res->search("$hostname");
123 if ($query) {
124 foreach my $rr ($query->answer) {
125 ## Potential bug - we are only looking at A records:
126 return 0 if $rr->type eq "A";
127 }
128 } else {
129 return $res->errorstring;
130 }
131 }
132
133 sub cleanssldatabase
134 {
135 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
136 print FILE "01";
137 close FILE;
138 }
139 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
140 print FILE "";
141 close FILE;
142 }
143 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
144 unlink ("${General::swroot}/ovpn/certs/serial.old");
145 unlink ("${General::swroot}/ovpn/certs/01.pem");
146 }
147
148 sub newcleanssldatabase
149 {
150 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
151 open(FILE, ">${General::swroot}(ovpn/certs/serial");
152 print FILE "01";
153 close FILE;
154 }
155 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
156 system ("touch ${General::swroot}/ovpn/certs/index.txt");
157 }
158 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
159 unlink ("${General::swroot}/ovpn/certs/serial.old");
160 }
161
162 sub deletebackupcert
163 {
164 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
165 my $hexvalue = <FILE>;
166 chomp $hexvalue;
167 close FILE;
168 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
169 }
170 }
171
172 sub checkportfw {
173 my $KEY2 = $_[0]; # key2
174 my $SRC_PORT = $_[1]; # src_port
175 my $PROTOCOL = $_[2]; # protocol
176 my $SRC_IP = $_[3]; # sourceip
177
178 my $pfwfilename = "${General::swroot}/portfw/config";
179 open(FILE, $pfwfilename) or die 'Unable to open config file.';
180 my @pfwcurrent = <FILE>;
181 close(FILE);
182 my $pfwkey1 = 0; # used for finding last sequence number used
183 foreach my $pfwline (@pfwcurrent)
184 {
185 my @pfwtemp = split(/\,/,$pfwline);
186
187 chomp ($pfwtemp[8]);
188 if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
189 if ( $SRC_PORT eq $pfwtemp[3] &&
190 $PROTOCOL eq $pfwtemp[2] &&
191 $SRC_IP eq $pfwtemp[7])
192 {
193 $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
194 }
195 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
196 if ( $pfwtemp[1] eq "0") {
197 $pfwkey1=$pfwtemp[0];
198 }
199 # Darren Critchley - Duplicate or overlapping Port range check
200 if ($pfwtemp[1] eq "0" &&
201 $PROTOCOL eq $pfwtemp[2] &&
202 $SRC_IP eq $pfwtemp[7] &&
203 $errormessage eq '')
204 {
205 &portchecks($SRC_PORT, $pfwtemp[5]);
206 # &portchecks($pfwtemp[3], $pfwtemp[5]);
207 # &portchecks($pfwtemp[3], $SRC_IP);
208 }
209 }
210 }
211 # $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
212
213 return;
214 }
215
216 sub checkportoverlap
217 {
218 my $portrange1 = $_[0]; # New port range
219 my $portrange2 = $_[1]; # existing port range
220 my @tempr1 = split(/\:/,$portrange1);
221 my @tempr2 = split(/\:/,$portrange2);
222
223 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
224 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
225
226 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
227 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
228
229 return 1; # Everything checks out!
230 }
231
232 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
233 sub checkportinc
234 {
235 my $port1 = $_[0]; # Port
236 my $portrange2 = $_[1]; # Port range
237 my @tempr1 = split(/\:/,$portrange2);
238
239 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
240 return 1;
241 } else {
242 return 0;
243 }
244 }
245 # Darren Critchley - Duplicate or overlapping Port range check
246 sub portchecks
247 {
248 my $p1 = $_[0]; # New port range
249 my $p2 = $_[1]; # existing port range
250 # $_ = $_[0];
251 our ($prtrange1, $prtrange2);
252 $prtrange1 = 0;
253 # if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
254 # unless (&checkportoverlap($p1,$p2)) {
255 # $errormessage = "$Lang::tr{'source port overlaps'} $p1";
256 # }
257 # }
258 if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
259 unless (&checkportinc($p2,$p1)) {
260 $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
261 }
262 }
263 $prtrange1 = 1;
264 if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
265 unless (&checkportinc($p1,$p2)) {
266 $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
267 }
268 }
269 return;
270 }
271
272 # Darren Critchley - certain ports are reserved for IPFire
273 # TCP 67,68,81,222,445
274 # UDP 67,68
275 # Params passed in -> port, rangeyn, protocol
276 sub disallowreserved
277 {
278 # port 67 and 68 same for tcp and udp, don't bother putting in an array
279 my $msg = "";
280 my @tcp_reserved = (81,222,445);
281 my $prt = $_[0]; # the port or range
282 my $ryn = $_[1]; # tells us whether or not it is a port range
283 my $prot = $_[2]; # protocol
284 my $srcdst = $_[3]; # source or destination
285 if ($ryn) { # disect port range
286 if ($srcdst eq "src") {
287 $msg = "$Lang::tr{'rsvd src port overlap'}";
288 } else {
289 $msg = "$Lang::tr{'rsvd dst port overlap'}";
290 }
291 my @tmprng = split(/\:/,$prt);
292 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
293 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
294 if ($prot eq "tcp") {
295 foreach my $prange (@tcp_reserved) {
296 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
297 }
298 }
299 } else {
300 if ($srcdst eq "src") {
301 $msg = "$Lang::tr{'reserved src port'}";
302 } else {
303 $msg = "$Lang::tr{'reserved dst port'}";
304 }
305 if ($prt == 67) { $errormessage="$msg 67"; return; }
306 if ($prt == 68) { $errormessage="$msg 68"; return; }
307 if ($prot eq "tcp") {
308 foreach my $prange (@tcp_reserved) {
309 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
310 }
311 }
312 }
313 return;
314 }
315
316
317 sub writeserverconf {
318 my %sovpnsettings = ();
319 my @temp = ();
320 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
321 &read_routepushfile;
322
323 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
324 flock CONF, 2;
325 print CONF "#OpenVPN Server conf\n";
326 print CONF "\n";
327 print CONF "daemon openvpnserver\n";
328 print CONF "writepid /var/run/openvpn.pid\n";
329 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
330 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
331 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
332 print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
333 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
334 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
335 print CONF "script-security 3 system\n";
336 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
337 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
338 print CONF "tls-server\n";
339 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
340 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
341 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
342 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
343 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
344 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
345 print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
346
347 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
348 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
349 foreach (@temp)
350 {
351 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
352 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
353 }
354 }
355
356 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
357 print CONF "client-to-client\n";
358 }
359 if ($sovpnsettings{MSSFIX} eq 'on') {
360 print CONF "mssfix\n";
361 }
362 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
363 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
364 }
365 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
366 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
367 }
368 print CONF "status-version 1\n";
369 print CONF "status /var/log/ovpnserver.log 30\n";
370 print CONF "cipher $sovpnsettings{DCIPHER}\n";
371 if ($sovpnsettings{DCOMPLZO} eq 'on') {
372 print CONF "comp-lzo\n";
373 }
374 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
375 print CONF "push \"redirect-gateway def1\"\n";
376 }
377 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
378 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
379 }
380
381 if ($sovpnsettings{DHCP_DNS} ne '') {
382 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
383 }
384
385 if ($sovpnsettings{DHCP_WINS} ne '') {
386 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
387 }
388
389 if ($sovpnsettings{DHCP_WINS} eq '') {
390 print CONF "max-clients 100\n";
391 }
392 if ($sovpnsettings{DHCP_WINS} ne '') {
393 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
394 }
395 print CONF "tls-verify /var/ipfire/ovpn/verify\n";
396 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
397 print CONF "user nobody\n";
398 print CONF "group nobody\n";
399 print CONF "persist-key\n";
400 print CONF "persist-tun\n";
401 if ($sovpnsettings{LOG_VERB} ne '') {
402 print CONF "verb $sovpnsettings{LOG_VERB}\n";
403 } else {
404 print CONF "verb 3\n";
405 }
406 print CONF "\n";
407
408 close(CONF);
409 }
410 #
411 sub emptyserverlog{
412 if (open(FILE, ">/var/log/ovpnserver.log")) {
413 flock FILE, 2;
414 print FILE "";
415 close FILE;
416 }
417
418 }
419
420 ###
421 # m.a.d net2net
422 ###
423
424 sub validdotmask
425 {
426 my $ipdotmask = $_[0];
427 if (&General::validip($ipdotmask)) { return 0; }
428 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
429 my $mask = $2;
430 if (($mask =~ /\./ )) { return 0; }
431 return 1;
432 }
433
434 # -------------------------------------------------------------------
435
436 sub write_routepushfile
437 {
438 open(FILE, ">$routes_push_file");
439 flock(FILE, 2);
440 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
441 print FILE $vpnsettings{'ROUTES_PUSH'};
442 }
443 close(FILE);
444 }
445
446 sub read_routepushfile
447 {
448 if (-e "$routes_push_file") {
449 open(FILE,"$routes_push_file");
450 delete $vpnsettings{'ROUTES_PUSH'};
451 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
452 close(FILE);
453 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
454 }
455 }
456
457
458 #hier die refresh page
459 if ( -e "${General::swroot}/ovpn/gencanow") {
460 my $refresh = '';
461 $refresh = "<meta http-equiv='refresh' content='15;' />";
462 &Header::showhttpheaders();
463 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
464 &Header::openbigbox('100%', 'center');
465 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
466 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
467 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
468 &Header::closebox();
469 &Header::closebigbox();
470 &Header::closepage();
471 exit (0);
472 }
473 ##hier die refresh page
474
475
476 ###
477 ### OpenVPN Server Control
478 ###
479 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
480 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
481 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
482 #start openvpn server
483 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
484 &emptyserverlog();
485 system('/usr/local/bin/openvpnctrl', '-s');
486 }
487 #stop openvpn server
488 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
489 system('/usr/local/bin/openvpnctrl', '-k');
490 &emptyserverlog();
491 }
492 # #restart openvpn server
493 if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
494 #workarund, till SIGHUP also works when running as nobody
495 system('/usr/local/bin/openvpnctrl', '-r');
496 &emptyserverlog();
497 }
498 }
499
500 ###
501 ### Save Advanced options
502 ###
503
504 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
505 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
506 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
507 #DAN this value has to leave.
508 #new settings for daemon
509 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
510 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
511 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
512 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
513 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
514 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
515 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
516 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
517 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
518 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
519 my @temp=();
520
521 if ($cgiparams{'FRAGMENT'} eq '') {
522 delete $vpnsettings{'FRAGMENT'};
523 } else {
524 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
525 $errormessage = "Incorrect value, please insert only numbers.";
526 goto ADV_ERROR;
527 } else {
528 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
529 }
530 }
531 if ($cgiparams{'MSSFIX'} ne 'on') {
532 delete $vpnsettings{'MSSFIX'};
533 } else {
534 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
535 }
536 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
537 unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
538 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
539 goto ADV_ERROR;
540 }
541 }
542 if ($cgiparams{'DHCP_DNS'} ne ''){
543 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
544 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
545 goto ADV_ERROR;
546 }
547 }
548 if ($cgiparams{'DHCP_WINS'} ne ''){
549 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
550 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
551 goto ADV_ERROR;
552 }
553 }
554 if ($cgiparams{'ROUTES_PUSH'} ne ''){
555 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
556 undef $vpnsettings{'ROUTES_PUSH'};
557 foreach (@temp)
558 {
559 s/^\s+//g; s/\s+$//g;
560 if ($_)
561 {
562 unless (&General::validipandmask($_)) {
563 $errormessage = $Lang::tr{'ovpn errmsg invalid ip or mask'};
564 goto ADV_ERROR;
565 }
566 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($_));
567 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
568 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
569 goto ADV_ERROR;
570 }
571 $vpnsettings{'ROUTES_PUSH'} .= $_."\n";
572 }
573 }
574 &write_routepushfile;
575 undef $vpnsettings{'ROUTES_PUSH'};
576 }
577 else {
578 undef $vpnsettings{'ROUTES_PUSH'};
579 &write_routepushfile;
580 }
581 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
582 $errormessage = $Lang::tr{'invalid input for max clients'};
583 goto ADV_ERROR;
584 }
585 if ($cgiparams{'KEEPALIVE_1'} ne '') {
586 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
587 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
588 goto ADV_ERROR;
589 }
590 }
591 if ($cgiparams{'KEEPALIVE_2'} ne ''){
592 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
593 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
594 goto ADV_ERROR;
595 }
596 }
597 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
598 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
599 goto ADV_ERROR;
600 }
601
602 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
603 &writeserverconf();#hier ok
604 }
605
606 ###
607 # m.a.d net2net
608 ###
609
610 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
611 {
612
613 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
614 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
615 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
616 my $tunmtu = '';
617
618 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
619 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
620
621 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
622
623 flock SERVERCONF, 2;
624 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
625 print SERVERCONF "\n";
626 print SERVERCONF "# User Security\n";
627 print SERVERCONF "user nobody\n";
628 print SERVERCONF "group nobody\n";
629 print SERVERCONF "persist-tun\n";
630 print SERVERCONF "persist-key\n";
631 print SERVERCONF "script-security 2\n";
632 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
633 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
634 print SERVERCONF "float\n";
635 print SERVERCONF "# IP adresses of the VPN Subnet\n";
636 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
637 print SERVERCONF "# Client Gateway Network\n";
638 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
639 print SERVERCONF "# tun Device\n";
640 print SERVERCONF "dev tun\n";
641 print SERVERCONF "# Port and Protokol\n";
642 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
643
644 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
645 print SERVERCONF "proto tcp-server\n";
646 print SERVERCONF "# Packet size\n";
647 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
648 print SERVERCONF "tun-mtu $tunmtu\n";
649 }
650
651 if ($cgiparams{'PROTOCOL'} eq 'udp') {
652 print SERVERCONF "proto udp\n";
653 print SERVERCONF "# Paketsize\n";
654 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
655 print SERVERCONF "tun-mtu $tunmtu\n";
656 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
657 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
658 }
659 print SERVERCONF "# Auth. Server\n";
660 print SERVERCONF "tls-server\n";
661 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
662 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
663 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
664 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
665 print SERVERCONF "# Cipher\n";
666 print SERVERCONF "cipher AES-256-CBC\n";
667 if ($cgiparams{'COMPLZO'} eq 'on') {
668 print SERVERCONF "# Enable Compression\n";
669 print SERVERCONF "comp-lzo\r\n";
670 }
671 print SERVERCONF "# Debug Level\n";
672 print SERVERCONF "verb 3\n";
673 print SERVERCONF "# Tunnel check\n";
674 print SERVERCONF "keepalive 10 60\n";
675 print SERVERCONF "# Start as daemon\n";
676 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
677 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
678 print SERVERCONF "# Activate Management Interface and Port\n";
679 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
680 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
681 close(SERVERCONF);
682
683 }
684
685 ###
686 # m.a.d net2net
687 ###
688
689 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
690 {
691 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
692 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
693 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
694 my $tunmtu = '';
695
696 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
697 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
698
699 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
700
701 flock CLIENTCONF, 2;
702 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
703 print CLIENTCONF "#\n";
704 print CLIENTCONF "# User Security\n";
705 print CLIENTCONF "user nobody\n";
706 print CLIENTCONF "group nobody\n";
707 print CLIENTCONF "persist-tun\n";
708 print CLIENTCONF "persist-key\n";
709 print CLIENTCONF "script-security 2\n";
710 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
711 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
712 print CLIENTCONF "float\n";
713 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
714 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
715 print CLIENTCONF "# Server Gateway Network\n";
716 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
717 print CLIENTCONF "# tun Device\n";
718 print CLIENTCONF "dev tun\n";
719 print CLIENTCONF "# Port and Protokol\n";
720 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
721
722 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
723 print CLIENTCONF "proto tcp-client\n";
724 print CLIENTCONF "# Packet size\n";
725 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
726 print CLIENTCONF "tun-mtu $tunmtu\n";
727 }
728
729 if ($cgiparams{'PROTOCOL'} eq 'udp') {
730 print CLIENTCONF "proto udp\n";
731 print CLIENTCONF "# Paketsize\n";
732 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
733 print CLIENTCONF "tun-mtu $tunmtu\n";
734 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
735 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
736 }
737
738 print CLIENTCONF "ns-cert-type server\n";
739 print CLIENTCONF "# Auth. Client\n";
740 print CLIENTCONF "tls-client\n";
741 print CLIENTCONF "# Cipher\n";
742 print CLIENTCONF "cipher AES-256-CBC\n";
743 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
744 if ($cgiparams{'COMPLZO'} eq 'on') {
745 print CLIENTCONF "# Enable Compression\n";
746 print CLIENTCONF "comp-lzo\r\n";
747 }
748 print CLIENTCONF "# Debug Level\n";
749 print CLIENTCONF "verb 3\n";
750 print CLIENTCONF "# Tunnel check\n";
751 print CLIENTCONF "keepalive 10 60\n";
752 print CLIENTCONF "# Start as daemon\n";
753 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
754 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
755 print CLIENTCONF "# Activate Management Interface and Port\n";
756 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
757 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
758 close(CLIENTCONF);
759
760 }
761
762 ###
763 ### Save main settings
764 ###
765
766
767 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
768 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
769 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
770 #DAN this value has to leave.
771 if ($cgiparams{'ENABLED'} eq 'on'){
772 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
773 $errormessage = $Lang::tr{'invalid input for hostname'};
774 goto SETTINGS_ERROR;
775 }
776 }
777 if ($cgiparams{'ENABLED'} eq 'on'){
778 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
779 }
780 if ($errormessage) { goto SETTINGS_ERROR; }
781
782
783 if ($cgiparams{'ENABLED'} eq 'on'){
784 &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
785 }
786
787 if ($errormessage) { goto SETTINGS_ERROR; }
788
789 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
790 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
791 goto SETTINGS_ERROR;
792 }
793 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
794
795 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
796 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
797 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
798 goto SETTINGS_ERROR;
799 }
800
801 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
802 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
803 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
804 goto SETTINGS_ERROR;
805 }
806
807 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
808 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
809 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
810 goto SETTINGS_ERROR;
811 }
812
813 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
814 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
815 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
816 goto SETTINGS_ERROR;
817 }
818 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
819 while (<ALIASES>)
820 {
821 chomp($_);
822 my @tempalias = split(/\,/,$_);
823 if ($tempalias[1] eq 'on') {
824 if (&General::IpInSubnet ($tempalias[0] ,
825 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
826 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
827 }
828 }
829 }
830 close(ALIASES);
831 if ($errormessage ne ''){
832 goto SETTINGS_ERROR;
833 }
834 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
835 $errormessage = $Lang::tr{'invalid input'};
836 goto SETTINGS_ERROR;
837 }
838 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
839 $errormessage = $Lang::tr{'invalid mtu input'};
840 goto SETTINGS_ERROR;
841 }
842
843 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
844 $errormessage = $Lang::tr{'invalid port'};
845 goto SETTINGS_ERROR;
846 }
847 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
848 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
849 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
850 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
851 #new settings for daemon
852 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
853 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
854 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
855 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
856 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
857 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
858 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
859 #wrtie enable
860
861 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
862 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
863 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
864 #new settings for daemon
865 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
866 &writeserverconf();#hier ok
867 SETTINGS_ERROR:
868 ###
869 ### Reset all step 2
870 ###
871 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
872 my $file = '';
873 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
874
875 foreach my $key (keys %confighash) {
876 if ($confighash{$key}[4] eq 'cert') {
877 delete $confighash{$cgiparams{'$key'}};
878 }
879 }
880 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
881 unlink $file
882 }
883 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
884 unlink $file
885 }
886 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
887 unlink $file
888 }
889 &cleanssldatabase();
890 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
891 print FILE "";
892 close FILE;
893 }
894 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
895 #&writeserverconf();
896 ###
897 ### Reset all step 1
898 ###
899 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
900 &Header::showhttpheaders();
901 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
902 &Header::openbigbox('100%', 'LEFT', '', '');
903 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
904 print <<END
905 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
906 <tr><td align='center'>
907 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
908 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
909 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
910 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
911 </form></table>
912 END
913 ;
914 &Header::closebox();
915 &Header::closebigbox();
916 &Header::closepage();
917 exit (0);
918
919 ###
920 ### Upload CA Certificate
921 ###
922 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
923 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
924
925 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
926 $errormessage = $Lang::tr{'name must only contain characters'};
927 goto UPLOADCA_ERROR;
928 }
929
930 if (length($cgiparams{'CA_NAME'}) >60) {
931 $errormessage = $Lang::tr{'name too long'};
932 goto VPNCONF_ERROR;
933 }
934
935 if ($cgiparams{'CA_NAME'} eq 'ca') {
936 $errormessage = $Lang::tr{'name is invalid'};
937 goto UPLOAD_CA_ERROR;
938 }
939
940 # Check if there is no other entry with this name
941 foreach my $key (keys %cahash) {
942 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
943 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
944 goto UPLOADCA_ERROR;
945 }
946 }
947
948 if (ref ($cgiparams{'FH'}) ne 'Fh') {
949 $errormessage = $Lang::tr{'there was no file upload'};
950 goto UPLOADCA_ERROR;
951 }
952 # Move uploaded ca to a temporary file
953 (my $fh, my $filename) = tempfile( );
954 if (copy ($cgiparams{'FH'}, $fh) != 1) {
955 $errormessage = $!;
956 goto UPLOADCA_ERROR;
957 }
958 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
959 if ($temp !~ /CA:TRUE/i) {
960 $errormessage = $Lang::tr{'not a valid ca certificate'};
961 unlink ($filename);
962 goto UPLOADCA_ERROR;
963 } else {
964 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
965 if ($? ne 0) {
966 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
967 unlink ($filename);
968 goto UPLOADCA_ERROR;
969 }
970 }
971
972 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
973 $casubject =~ /Subject: (.*)[\n]/;
974 $casubject = $1;
975 $casubject =~ s+/Email+, E+;
976 $casubject =~ s/ ST=/ S=/;
977 $casubject = &Header::cleanhtml($casubject);
978
979 my $key = &General::findhasharraykey (\%cahash);
980 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
981 $cahash{$key}[1] = $casubject;
982 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
983 # system('/usr/local/bin/ipsecctrl', 'R');
984
985 UPLOADCA_ERROR:
986
987 ###
988 ### Display ca certificate
989 ###
990 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
991 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
992
993 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
994 &Header::showhttpheaders();
995 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
996 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
997 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
998 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
999 $output = &Header::cleanhtml($output,"y");
1000 print "<pre>$output</pre>\n";
1001 &Header::closebox();
1002 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1003 &Header::closebigbox();
1004 &Header::closepage();
1005 exit(0);
1006 } else {
1007 $errormessage = $Lang::tr{'invalid key'};
1008 }
1009
1010 ###
1011 ### Download ca certificate
1012 ###
1013 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1014 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1015
1016 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1017 print "Content-Type: application/octet-stream\r\n";
1018 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1019 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1020 exit(0);
1021 } else {
1022 $errormessage = $Lang::tr{'invalid key'};
1023 }
1024
1025 ###
1026 ### Remove ca certificate (step 2)
1027 ###
1028 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1029 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1030 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1031
1032 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1033 foreach my $key (keys %confighash) {
1034 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1035 if ($test =~ /: OK/) {
1036 # Delete connection
1037 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1038 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1039 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1040 # }
1041 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1042 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1043 delete $confighash{$key};
1044 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1045 # &writeipsecfiles();
1046 }
1047 }
1048 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1049 delete $cahash{$cgiparams{'KEY'}};
1050 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1051 # system('/usr/local/bin/ipsecctrl', 'R');
1052 } else {
1053 $errormessage = $Lang::tr{'invalid key'};
1054 }
1055 ###
1056 ### Remove ca certificate (step 1)
1057 ###
1058 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1059 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1060 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1061
1062 my $assignedcerts = 0;
1063 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1064 foreach my $key (keys %confighash) {
1065 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1066 if ($test =~ /: OK/) {
1067 $assignedcerts++;
1068 }
1069 }
1070 if ($assignedcerts) {
1071 &Header::showhttpheaders();
1072 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1073 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1074 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1075 print <<END
1076 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1077 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1078 <tr><td align='center'>
1079 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1080 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1081 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1082 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1083 </form></table>
1084 END
1085 ;
1086 &Header::closebox();
1087 &Header::closebigbox();
1088 &Header::closepage();
1089 exit (0);
1090 } else {
1091 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1092 delete $cahash{$cgiparams{'KEY'}};
1093 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1094 # system('/usr/local/bin/ipsecctrl', 'R');
1095 }
1096 } else {
1097 $errormessage = $Lang::tr{'invalid key'};
1098 }
1099
1100 ###
1101 ### Display root certificate
1102 ###
1103 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1104 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1105 my $output;
1106 &Header::showhttpheaders();
1107 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1108 &Header::openbigbox('100%', 'LEFT', '', '');
1109 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1110 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1111 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1112 } else {
1113 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1114 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1115 }
1116 $output = &Header::cleanhtml($output,"y");
1117 print "<pre>$output</pre>\n";
1118 &Header::closebox();
1119 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1120 &Header::closebigbox();
1121 &Header::closepage();
1122 exit(0);
1123
1124 ###
1125 ### Download root certificate
1126 ###
1127 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1128 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1129 print "Content-Type: application/octet-stream\r\n";
1130 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1131 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1132 exit(0);
1133 }
1134
1135 ###
1136 ### Download host certificate
1137 ###
1138 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1139 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1140 print "Content-Type: application/octet-stream\r\n";
1141 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1142 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1143 exit(0);
1144 }
1145 ###
1146 ### Form for generating a root certificate
1147 ###
1148 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1149 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1150
1151 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1152 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1153 $errormessage = $Lang::tr{'valid root certificate already exists'};
1154 $cgiparams{'ACTION'} = '';
1155 goto ROOTCERT_ERROR;
1156 }
1157
1158 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1159 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1160 my $ipaddr = <IPADDR>;
1161 close IPADDR;
1162 chomp ($ipaddr);
1163 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1164 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1165 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1166 }
1167 }
1168 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1169
1170 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1171 $errormessage = $Lang::tr{'there was no file upload'};
1172 goto ROOTCERT_ERROR;
1173 }
1174
1175 # Move uploaded certificate request to a temporary file
1176 (my $fh, my $filename) = tempfile( );
1177 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1178 $errormessage = $!;
1179 goto ROOTCERT_ERROR;
1180 }
1181
1182 # Create a temporary dirctory
1183 my $tempdir = tempdir( CLEANUP => 1 );
1184
1185 # Extract the CA certificate from the file
1186 my $pid = open(OPENSSL, "|-");
1187 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1188 if ($pid) { # parent
1189 if ($cgiparams{'P12_PASS'} ne '') {
1190 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1191 }
1192 close (OPENSSL);
1193 if ($?) {
1194 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1195 unlink ($filename);
1196 goto ROOTCERT_ERROR;
1197 }
1198 } else { # child
1199 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1200 '-in', $filename,
1201 '-out', "$tempdir/cacert.pem")) {
1202 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1203 unlink ($filename);
1204 goto ROOTCERT_ERROR;
1205 }
1206 }
1207
1208 # Extract the Host certificate from the file
1209 $pid = open(OPENSSL, "|-");
1210 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1211 if ($pid) { # parent
1212 if ($cgiparams{'P12_PASS'} ne '') {
1213 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1214 }
1215 close (OPENSSL);
1216 if ($?) {
1217 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1218 unlink ($filename);
1219 goto ROOTCERT_ERROR;
1220 }
1221 } else { # child
1222 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1223 '-in', $filename,
1224 '-out', "$tempdir/hostcert.pem")) {
1225 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1226 unlink ($filename);
1227 goto ROOTCERT_ERROR;
1228 }
1229 }
1230
1231 # Extract the Host key from the file
1232 $pid = open(OPENSSL, "|-");
1233 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1234 if ($pid) { # parent
1235 if ($cgiparams{'P12_PASS'} ne '') {
1236 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1237 }
1238 close (OPENSSL);
1239 if ($?) {
1240 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1241 unlink ($filename);
1242 goto ROOTCERT_ERROR;
1243 }
1244 } else { # child
1245 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1246 '-nodes',
1247 '-in', $filename,
1248 '-out', "$tempdir/serverkey.pem")) {
1249 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1250 unlink ($filename);
1251 goto ROOTCERT_ERROR;
1252 }
1253 }
1254
1255 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1256 if ($? ne 0) {
1257 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1258 unlink ($filename);
1259 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1260 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1261 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1262 goto ROOTCERT_ERROR;
1263 }
1264
1265 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1266 if ($? ne 0) {
1267 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1268 unlink ($filename);
1269 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1270 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1271 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1272 goto ROOTCERT_ERROR;
1273 }
1274
1275 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1276 if ($? ne 0) {
1277 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1278 unlink ($filename);
1279 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1280 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1281 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1282 goto ROOTCERT_ERROR;
1283 }
1284
1285 goto ROOTCERT_SUCCESS;
1286
1287 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1288
1289 # Validate input since the form was submitted
1290 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1291 $errormessage = $Lang::tr{'organization cant be empty'};
1292 goto ROOTCERT_ERROR;
1293 }
1294 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1295 $errormessage = $Lang::tr{'organization too long'};
1296 goto ROOTCERT_ERROR;
1297 }
1298 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1299 $errormessage = $Lang::tr{'invalid input for organization'};
1300 goto ROOTCERT_ERROR;
1301 }
1302 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1303 $errormessage = $Lang::tr{'hostname cant be empty'};
1304 goto ROOTCERT_ERROR;
1305 }
1306 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1307 $errormessage = $Lang::tr{'invalid input for hostname'};
1308 goto ROOTCERT_ERROR;
1309 }
1310 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1311 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1312 goto ROOTCERT_ERROR;
1313 }
1314 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1315 $errormessage = $Lang::tr{'e-mail address too long'};
1316 goto ROOTCERT_ERROR;
1317 }
1318 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1319 $errormessage = $Lang::tr{'invalid input for department'};
1320 goto ROOTCERT_ERROR;
1321 }
1322 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1323 $errormessage = $Lang::tr{'invalid input for city'};
1324 goto ROOTCERT_ERROR;
1325 }
1326 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1327 $errormessage = $Lang::tr{'invalid input for state or province'};
1328 goto ROOTCERT_ERROR;
1329 }
1330 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1331 $errormessage = $Lang::tr{'invalid input for country'};
1332 goto ROOTCERT_ERROR;
1333 }
1334
1335 # Copy the cgisettings to vpnsettings and save the configfile
1336 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1337 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1338 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1339 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1340 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1341 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1342 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1343 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1344
1345 # Replace empty strings with a .
1346 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1347 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1348 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1349
1350 # refresh
1351 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1352
1353 # Create the CA certificate
1354 my $pid = open(OPENSSL, "|-");
1355 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1356 if ($pid) { # parent
1357 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1358 print OPENSSL "$state\n";
1359 print OPENSSL "$city\n";
1360 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1361 print OPENSSL "$ou\n";
1362 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1363 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1364 close (OPENSSL);
1365 if ($?) {
1366 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1367 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1368 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1369 goto ROOTCERT_ERROR;
1370 }
1371 } else { # child
1372 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1373 '-days', '999999', '-newkey', 'rsa:2048',
1374 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1375 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1376 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1377 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1378 goto ROOTCERT_ERROR;
1379 }
1380 }
1381
1382 # Create the Host certificate request
1383 $pid = open(OPENSSL, "|-");
1384 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1385 if ($pid) { # parent
1386 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1387 print OPENSSL "$state\n";
1388 print OPENSSL "$city\n";
1389 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1390 print OPENSSL "$ou\n";
1391 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1392 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1393 print OPENSSL ".\n";
1394 print OPENSSL ".\n";
1395 close (OPENSSL);
1396 if ($?) {
1397 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1398 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1399 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1400 goto ROOTCERT_ERROR;
1401 }
1402 } else { # child
1403 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1404 '-newkey', 'rsa:1024',
1405 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1406 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1407 '-extensions', 'server',
1408 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1409 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1410 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1411 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1412 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1413 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1414 goto ROOTCERT_ERROR;
1415 }
1416 }
1417
1418 # Sign the host certificate request
1419 system('/usr/bin/openssl', 'ca', '-days', '999999',
1420 '-batch', '-notext',
1421 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1422 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1423 '-extensions', 'server',
1424 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1425 if ($?) {
1426 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1427 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1428 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1429 unlink ("${General::swroot}/ovpn/serverkey.pem");
1430 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1431 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1432 &newcleanssldatabase();
1433 goto ROOTCERT_ERROR;
1434 } else {
1435 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1436 &deletebackupcert();
1437 }
1438
1439 # Create an empty CRL
1440 system('/usr/bin/openssl', 'ca', '-gencrl',
1441 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1442 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1443 if ($?) {
1444 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1445 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1446 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1447 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1448 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1449 &cleanssldatabase();
1450 goto ROOTCERT_ERROR;
1451 # } else {
1452 # &cleanssldatabase();
1453 }
1454 # Create Diffie Hellmann Parameter
1455 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1456 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1457 '1024' );
1458 if ($?) {
1459 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1460 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1461 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1462 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1463 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1464 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1465 &cleanssldatabase();
1466 goto ROOTCERT_ERROR;
1467 # } else {
1468 # &cleanssldatabase();
1469 }
1470 goto ROOTCERT_SUCCESS;
1471 }
1472 ROOTCERT_ERROR:
1473 if ($cgiparams{'ACTION'} ne '') {
1474 &Header::showhttpheaders();
1475 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1476 &Header::openbigbox('100%', 'LEFT', '', '');
1477 if ($errormessage) {
1478 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1479 print "<class name='base'>$errormessage";
1480 print "&nbsp;</class>";
1481 &Header::closebox();
1482 }
1483 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1484 print <<END
1485 <form method='post' enctype='multipart/form-data'>
1486 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1487 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1488 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1489 <td width='35%' colspan='2'>&nbsp;</td></tr>
1490 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1491 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1492 <td colspan='2'>&nbsp;</td></tr>
1493 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1494 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1495 <td colspan='2'>&nbsp;</td></tr>
1496 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1497 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1498 <td colspan='2'>&nbsp;</td></tr>
1499 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1500 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1501 <td colspan='2'>&nbsp;</td></tr>
1502 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1503 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1504 <td colspan='2'>&nbsp;</td></tr>
1505 <tr><td class='base'>$Lang::tr{'country'}:</td>
1506 <td class='base'><select name='ROOTCERT_COUNTRY'>
1507
1508 END
1509 ;
1510 foreach my $country (sort keys %{Countries::countries}) {
1511 print "<option value='$Countries::countries{$country}'";
1512 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1513 print " selected='selected'";
1514 }
1515 print ">$country</option>";
1516 }
1517 print <<END
1518 </select></td>
1519 <td colspan='2'>&nbsp;</td></tr>
1520 <tr><td>&nbsp;</td>
1521 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1522 <td>&nbsp;</td><td>&nbsp;</td></tr>
1523 <tr><td class='base' colspan='4' align='left'>
1524 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1525 <tr><td class='base' colspan='4' align='left'>
1526 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1527 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1528 </td></tr>
1529 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1530 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1531 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1532 <td colspan='2'>&nbsp;</td></tr>
1533 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1534 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1535 <td colspan='2'>&nbsp;</td></tr>
1536 <tr><td>&nbsp;</td>
1537 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1538 <td colspan='2'>&nbsp;</td></tr>
1539 <tr><td class='base' colspan='4' align='left'>
1540 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1541 </form></table>
1542 END
1543 ;
1544 &Header::closebox();
1545
1546 &Header::closebigbox();
1547 &Header::closepage();
1548 exit(0)
1549 }
1550
1551 ROOTCERT_SUCCESS:
1552 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1553 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1554 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1555 # system('/usr/local/bin/ipsecctrl', 'S');
1556 # }
1557
1558 ###
1559 ### Enable/Disable connection
1560 ###
1561
1562 ###
1563 # m.a.d net2net
1564 ###
1565
1566 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1567
1568 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1569 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1570 # my $n2nactive = '';
1571 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1572
1573 if ($confighash{$cgiparams{'KEY'}}) {
1574
1575
1576 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1577 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1578 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1579
1580 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1581 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1582 }
1583
1584 } else {
1585
1586 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1587 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1588
1589 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1590 if ($n2nactive ne ''){
1591 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1592 }
1593
1594 } else {
1595 $errormessage = $Lang::tr{'invalid key'};
1596 }
1597 }
1598 }
1599
1600 ###
1601 ### Download OpenVPN client package
1602 ###
1603
1604
1605 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1606 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1607 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1608 my $file = '';
1609 my $clientovpn = '';
1610 my @fileholder;
1611 my $tempdir = tempdir( CLEANUP => 1 );
1612 my $zippath = "$tempdir/";
1613
1614 ###
1615 # m.a.d net2net
1616 ###
1617
1618 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1619
1620 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1621 my $zippathname = "$zippath$zipname";
1622 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1623 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1624 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1625 my $tunmtu = '';
1626 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1627 my $n2nfragment = '';
1628
1629 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1630 flock CLIENTCONF, 2;
1631
1632 my $zip = Archive::Zip->new();
1633 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1634 print CLIENTCONF "# \n";
1635 print CLIENTCONF "# User Security\n";
1636 print CLIENTCONF "user nobody\n";
1637 print CLIENTCONF "group nobody\n";
1638 print CLIENTCONF "persist-tun\n";
1639 print CLIENTCONF "persist-key\n";
1640 print CLIENTCONF "script-security 2\n";
1641 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1642 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1643 print CLIENTCONF "float\n";
1644 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1645 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1646 print CLIENTCONF "# Server Gateway Network\n";
1647 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1648 print CLIENTCONF "# tun Device\n";
1649 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1650 print CLIENTCONF "# Port and Protokoll\n";
1651 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1652
1653 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1654 print CLIENTCONF "proto tcp-client\n";
1655 print CLIENTCONF "# Packet size\n";
1656 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1657 print CLIENTCONF "tun-mtu $tunmtu\n";
1658 }
1659
1660 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1661 print CLIENTCONF "proto udp\n";
1662 print CLIENTCONF "# Paketsize\n";
1663 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1664 print CLIENTCONF "tun-mtu $tunmtu\n";
1665 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1666 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1667 }
1668 print CLIENTCONF "ns-cert-type server\n";
1669 print CLIENTCONF "# Auth. Client\n";
1670 print CLIENTCONF "tls-client\n";
1671 print CLIENTCONF "# Cipher\n";
1672 print CLIENTCONF "cipher AES-256-CBC\n";
1673 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1674 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1675 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1676 }
1677 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1678 print CLIENTCONF "# Enable Compression\n";
1679 print CLIENTCONF "comp-lzo\r\n";
1680 }
1681 print CLIENTCONF "# Debug Level\n";
1682 print CLIENTCONF "verb 3\n";
1683 print CLIENTCONF "# Tunnel check\n";
1684 print CLIENTCONF "keepalive 10 60\n";
1685 print CLIENTCONF "# Start as daemon\n";
1686 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1687 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
1688 print CLIENTCONF "# Activate Management Interface and Port\n";
1689 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
1690 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
1691 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
1692
1693
1694 close(CLIENTCONF);
1695
1696 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1697 my $status = $zip->writeToFileNamed($zippathname);
1698
1699 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1700 @fileholder = <DLFILE>;
1701 print "Content-Type:application/x-download\n";
1702 print "Content-Disposition:attachment;filename=$zipname\n\n";
1703 print @fileholder;
1704 exit (0);
1705 }
1706 else
1707 {
1708 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1709 my $zippathname = "$zippath$zipname";
1710 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1711
1712 ###
1713 # m.a.d net2net
1714 ###
1715
1716 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1717 flock CLIENTCONF, 2;
1718
1719 my $zip = Archive::Zip->new();
1720
1721 print CLIENTCONF "#OpenVPN Server conf\r\n";
1722 print CLIENTCONF "tls-client\r\n";
1723 print CLIENTCONF "client\r\n";
1724 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
1725 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
1726 print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1727 if ( $vpnsettings{'ENABLED'} eq 'on'){
1728 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
1729 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1730 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1731 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1732 }
1733 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1734 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1735 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1736 }
1737 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1738 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1739 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1740 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1741 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1742 }
1743 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1744 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1745 }
1746
1747 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1748 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1749 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1750 } else {
1751 print CLIENTCONF "ca cacert.pem\r\n";
1752 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1753 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1754 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
1755 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
1756 }
1757 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1758 if ($vpnsettings{DCOMPLZO} eq 'on') {
1759 print CLIENTCONF "comp-lzo\r\n";
1760 }
1761 print CLIENTCONF "verb 3\r\n";
1762 print CLIENTCONF "ns-cert-type server\r\n";
1763 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1764 if ($vpnsettings{MSSFIX} eq 'on') {
1765 print CLIENTCONF "mssfix\r\n";
1766 }
1767 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
1768 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1769 }
1770 close(CLIENTCONF);
1771
1772 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1773 my $status = $zip->writeToFileNamed($zippathname);
1774
1775 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1776 @fileholder = <DLFILE>;
1777 print "Content-Type:application/x-download\n";
1778 print "Content-Disposition:attachment;filename=$zipname\n\n";
1779 print @fileholder;
1780 exit (0);
1781 }
1782
1783
1784
1785 ###
1786 ### Remove connection
1787 ###
1788
1789
1790 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1791 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1792 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1793
1794 if ($confighash{$cgiparams{'KEY'}}) {
1795 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1796 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1797 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1798 # }
1799 #
1800 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1801
1802 ###
1803 # m.a.d net2net
1804 ###
1805
1806 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1807
1808 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1809 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1810 unlink ($certfile) or die "Removing $certfile fail: $!";
1811 unlink ($conffile) or die "Removing $conffile fail: $!";
1812 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1813
1814 }
1815
1816 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1817 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1818 delete $confighash{$cgiparams{'KEY'}};
1819 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1820 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1821 #&writeserverconf();
1822 } else {
1823 $errormessage = $Lang::tr{'invalid key'};
1824 }
1825
1826
1827 ###
1828 ### Download PKCS12 file
1829 ###
1830 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1831 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1832
1833 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1834 print "Content-Type: application/octet-stream\r\n\r\n";
1835 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1836 exit (0);
1837
1838 ###
1839 ### Display certificate
1840 ###
1841 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1842 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1843
1844 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1845 &Header::showhttpheaders();
1846 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1847 &Header::openbigbox('100%', 'LEFT', '', '');
1848 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1849 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1850 $output = &Header::cleanhtml($output,"y");
1851 print "<pre>$output</pre>\n";
1852 &Header::closebox();
1853 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1854 &Header::closebigbox();
1855 &Header::closepage();
1856 exit(0);
1857 }
1858 ###
1859 ### Display Certificate Revoke List
1860 ###
1861 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
1862 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1863
1864 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
1865 &Header::showhttpheaders();
1866 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1867 &Header::openbigbox('100%', 'LEFT', '', '');
1868 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1869 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1870 $output = &Header::cleanhtml($output,"y");
1871 print "<pre>$output</pre>\n";
1872 &Header::closebox();
1873 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1874 &Header::closebigbox();
1875 &Header::closepage();
1876 exit(0);
1877 }
1878
1879 ###
1880 ### Advanced Server Settings
1881 ###
1882
1883 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1884 %cgiparams = ();
1885 %cahash = ();
1886 %confighash = ();
1887 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
1888 read_routepushfile;
1889
1890 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1891 # $cgiparams{'CLIENT2CLIENT'} = 'on';
1892 # }
1893 ADV_ERROR:
1894 if ($cgiparams{'MAX_CLIENTS'} eq '') {
1895 $cgiparams{'MAX_CLIENTS'} = '100';
1896 }
1897 if ($cgiparams{'KEEPALIVE_1'} eq '') {
1898 $cgiparams{'KEEPALIVE_1'} = '10';
1899 }
1900 if ($cgiparams{'KEEPALIVE_2'} eq '') {
1901 $cgiparams{'KEEPALIVE_2'} = '60';
1902 }
1903 if ($cgiparams{'LOG_VERB'} eq '') {
1904 $cgiparams{'LOG_VERB'} = '3';
1905 }
1906 $checked{'CLIENT2CLIENT'}{'off'} = '';
1907 $checked{'CLIENT2CLIENT'}{'on'} = '';
1908 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1909 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1910 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1911 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
1912 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1913 $checked{'MSSFIX'}{'off'} = '';
1914 $checked{'MSSFIX'}{'on'} = '';
1915 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
1916 $selected{'LOG_VERB'}{'1'} = '';
1917 $selected{'LOG_VERB'}{'2'} = '';
1918 $selected{'LOG_VERB'}{'3'} = '';
1919 $selected{'LOG_VERB'}{'4'} = '';
1920 $selected{'LOG_VERB'}{'5'} = '';
1921 $selected{'LOG_VERB'}{'6'} = '';
1922 $selected{'LOG_VERB'}{'7'} = '';
1923 $selected{'LOG_VERB'}{'8'} = '';
1924 $selected{'LOG_VERB'}{'9'} = '';
1925 $selected{'LOG_VERB'}{'10'} = '';
1926 $selected{'LOG_VERB'}{'11'} = '';
1927 $selected{'LOG_VERB'}{'0'} = '';
1928 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
1929
1930
1931
1932 &Header::showhttpheaders();
1933 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1934 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1935 if ($errormessage) {
1936 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1937 print "<class name='base'>$errormessage\n";
1938 print "&nbsp;</class>\n";
1939 &Header::closebox();
1940 }
1941 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1942 print <<END
1943 <form method='post' enctype='multipart/form-data'>
1944 <table width='100%'>
1945 <tr>
1946 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1947 </tr>
1948 <tr>
1949 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1950 </tr>
1951 <tr>
1952 <td class='base'>Domain</td>
1953 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1954 </tr>
1955 <tr>
1956 <td class='base'>DNS</td>
1957 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1958 </tr>
1959 <tr>
1960 <td class='base'>WINS</td>
1961 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
1962 </tr>
1963 <tr>
1964 <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
1965 </tr>
1966 <tr>
1967 <td class='base'>$Lang::tr{'ovpn routes push'}</td>
1968 <td colspan='2'>
1969 <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
1970 END
1971 ;
1972
1973 if ($cgiparams{'ROUTES_PUSH'} ne '')
1974 {
1975 print $cgiparams{'ROUTES_PUSH'};
1976 }
1977
1978 print <<END
1979 </textarea></td>
1980 </tr>
1981 </tr>
1982 </table>
1983 <hr size='1'>
1984 <table width='100%'>
1985 <tr>
1986 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1987 </tr>
1988 <tr>
1989 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
1990 </tr>
1991 <tr>
1992 <td class='base'>Client-To-Client</td>
1993 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
1994 </tr>
1995 <tr>
1996 <td class='base'>Redirect-Gateway def1</td>
1997 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
1998 </tr>
1999 <tr>
2000 <td class='base'>Max-Clients</td>
2001 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2002 </tr>
2003 <tr>
2004 <td class='base'>Keppalive <br />
2005 (ping/ping-restart)</td>
2006 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2007 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2008 </tr>
2009 <tr>
2010 <td class='base'>fragment <br></td>
2011 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2012 <td>Default: <span class="base">1300</span></td>
2013 </tr>
2014 <tr>
2015 <td class='base'>mssfix</td>
2016 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2017 <td>Default: on</td>
2018 </tr>
2019 </table>
2020
2021 <!--
2022 <hr size='1'>
2023 <table width='100%'>
2024 <tr>
2025 <td class'base'><b>Crypto-Engines</b></td>
2026 </tr>
2027 <tr>
2028 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2029 </tr>
2030 <tr><td class='base'>Engines:</td>
2031 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2032 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2033 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2034 </select>
2035 </td>
2036 </table>
2037 -->
2038 <hr size='1'>
2039 <table width='100%'>
2040 <tr>
2041 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2042 </tr>
2043 <tr>
2044 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2045 </tr>
2046
2047 <tr><td class='base'>VERB</td>
2048 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
2049 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
2050 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
2051 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
2052 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
2053 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
2054 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
2055 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
2056 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
2057 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2058 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2059 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2060 </table>
2061 <hr size='1'>
2062 <table width='100%'>
2063 <tr>
2064 <td>&nbsp;</td>
2065 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2066 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2067 <td>&nbsp;</td>
2068 </tr>
2069 </table>
2070 </form>
2071 END
2072 ;
2073
2074 &Header::closebox();
2075 # print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2076 &Header::closebigbox();
2077 &Header::closepage();
2078 exit(0);
2079
2080 ###
2081 ### Openvpn Connections Statistics
2082 ###
2083 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2084 &Header::showhttpheaders();
2085 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2086 &Header::openbigbox('100%', 'LEFT', '', '');
2087 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2088
2089 #
2090 # <td><b>$Lang::tr{'protocol'}</b></td>
2091 # protocol temp removed
2092 print <<END
2093 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2094 <tr>
2095 <td><b>$Lang::tr{'common name'}</b></td>
2096 <td><b>$Lang::tr{'real address'}</b></td>
2097 <td><b>$Lang::tr{'virtual address'}</b></td>
2098 <td><b>$Lang::tr{'loged in at'}</b></td>
2099 <td><b>$Lang::tr{'bytes sent'}</b></td>
2100 <td><b>$Lang::tr{'bytes received'}</b></td>
2101 <td><b>$Lang::tr{'last activity'}</b></td>
2102 </tr>
2103 END
2104 ;
2105 my $filename = "/var/log/ovpnserver.log";
2106 open(FILE, $filename) or die 'Unable to open config file.';
2107 my @current = <FILE>;
2108 close(FILE);
2109 my @users =();
2110 my $status;
2111 my $uid = 0;
2112 my $cn;
2113 my @match = ();
2114 my $proto = "udp";
2115 my $address;
2116 my %userlookup = ();
2117 foreach my $line (@current)
2118 {
2119 chomp($line);
2120 if ( $line =~ /^Updated,(.+)/){
2121 @match = split( /^Updated,(.+)/, $line);
2122 $status = $match[1];
2123 }
2124 #gian
2125 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2126 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2127 if ($match[1] ne "Common Name") {
2128 $cn = $match[1];
2129 $userlookup{$match[2]} = $uid;
2130 $users[$uid]{'CommonName'} = $match[1];
2131 $users[$uid]{'RealAddress'} = $match[2];
2132 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2133 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2134 $users[$uid]{'Since'} = $match[5];
2135 $users[$uid]{'Proto'} = $proto;
2136 $uid++;
2137 }
2138 }
2139 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2140 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2141 if ($match[1] ne "Virtual Address") {
2142 $address = $match[3];
2143 #find the uid in the lookup table
2144 $uid = $userlookup{$address};
2145 $users[$uid]{'VirtualAddress'} = $match[1];
2146 $users[$uid]{'LastRef'} = $match[4];
2147 }
2148 }
2149 }
2150 my $user2 = @users;
2151 if ($user2 >= 1){
2152 for (my $idx = 1; $idx <= $user2; $idx++){
2153 if ($idx % 2) {
2154 print "<tr bgcolor='$color{'color20'}'>\n";
2155 } else {
2156 print "<tr bgcolor='$color{'color22'}'>\n";
2157 }
2158 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2159 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2160 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2161 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2162 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2163 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2164 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2165 # print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2166 }
2167 }
2168
2169 print "</table>";
2170 print <<END
2171 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2172 <tr><td></td></tr>
2173 <tr><td></td></tr>
2174 <tr><td></td></tr>
2175 <tr><td></td></tr>
2176 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2177 </table>
2178 END
2179 ;
2180 &Header::closebox();
2181 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2182 &Header::closebigbox();
2183 &Header::closepage();
2184 exit(0);
2185
2186 ###
2187 ### Download Certificate
2188 ###
2189 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2190 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2191
2192 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2193 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2194 print "Content-Type: application/octet-stream\r\n\r\n";
2195 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2196 exit (0);
2197 }
2198
2199 ###
2200 ### Enable/Disable connection
2201 ###
2202
2203 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2204
2205 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2206 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2207
2208 if ($confighash{$cgiparams{'KEY'}}) {
2209 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2210 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2211 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2212 #&writeserverconf();
2213 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2214 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2215 # system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2216 # }
2217 } else {
2218 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2219 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2220 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2221 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2222 # }
2223 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2224 #&writeserverconf();
2225 }
2226 } else {
2227 $errormessage = $Lang::tr{'invalid key'};
2228 }
2229
2230 ###
2231 ### Restart connection
2232 ###
2233 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2234 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2235 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2236
2237 if ($confighash{$cgiparams{'KEY'}}) {
2238 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2239 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2240 # system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2241 # }
2242 } else {
2243 $errormessage = $Lang::tr{'invalid key'};
2244 }
2245
2246 ###
2247 ### Remove connection
2248 ###
2249 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2250 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2251 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2252
2253 if ($confighash{$cgiparams{'KEY'}}) {
2254 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2255 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2256 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2257 # }
2258 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2259 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2260 delete $confighash{$cgiparams{'KEY'}};
2261 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2262 #&writeserverconf();
2263 } else {
2264 $errormessage = $Lang::tr{'invalid key'};
2265 }
2266 #test33
2267
2268 ###
2269 ### Choose between adding a host-net or net-net connection
2270 ###
2271
2272 ###
2273 # m.a.d net2net
2274 ###
2275
2276 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2277 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2278 &Header::showhttpheaders();
2279 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2280 &Header::openbigbox('100%', 'LEFT', '', '');
2281 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2282
2283 if ( -s "${General::swroot}/ovpn/settings") {
2284
2285 print <<END
2286 <b>$Lang::tr{'connection type'}:</b><br />
2287 <table><form method='post' ENCTYPE="multipart/form-data">
2288 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2289 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2290 <tr><td><input type='radio' name='TYPE' value='net' /></td>
2291 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2292 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2293 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2294 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2295 <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2296 <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'><td class='base'>Default : Client Packagename</td></td></tr>
2297 <tr><td colspan='3'><hr /></td></tr>
2298 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2299 <tr><td>&nbsp;</td></tr>
2300 <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2301 </form></table>
2302 END
2303 ;
2304
2305 } else {
2306 print <<END
2307 <b>$Lang::tr{'connection type'}:</b><br />
2308 <table><form method='post' ENCTYPE="multipart/form-data">
2309 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2310 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2311 </form></table>
2312 END
2313 ;
2314
2315 }
2316
2317 &Header::closebox();
2318 &Header::closebigbox();
2319 &Header::closepage();
2320 exit (0);
2321
2322 ###
2323 # m.a.d net2net
2324 ###
2325
2326 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2327
2328 my @firen2nconf;
2329 my @confdetails;
2330 my $uplconffilename ='';
2331 my $uplconffilename2 ='';
2332 my $uplp12name = '';
2333 my $uplp12name2 = '';
2334 my @rem_subnet;
2335 my @rem_subnet2;
2336 my @tmposupnet3;
2337 my $key;
2338 my @n2nname;
2339
2340 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2341
2342 # Check if a file is uploaded
2343
2344 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2345 $errormessage = $Lang::tr{'there was no file upload'};
2346 goto N2N_ERROR;
2347 }
2348
2349 # Move uploaded IPfire n2n package to temporary file
2350
2351 (my $fh, my $filename) = tempfile( );
2352 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2353 $errormessage = $!;
2354 goto N2N_ERROR;
2355 }
2356
2357 my $zip = Archive::Zip->new();
2358 my $zipName = $filename;
2359 my $status = $zip->read( $zipName );
2360 if ($status != AZ_OK) {
2361 $errormessage = "Read of $zipName failed\n";
2362 goto N2N_ERROR;
2363 }
2364
2365 my $tempdir = tempdir( CLEANUP => 1 );
2366 my @files = $zip->memberNames();
2367 for(@files) {
2368 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2369 }
2370 my $countfiles = @files;
2371
2372 # Check if we have not more then 2 files
2373
2374 if ( $countfiles == 2){
2375 foreach (@files){
2376 if ( $_ =~ /.conf$/){
2377 $uplconffilename = $_;
2378 }
2379 if ( $_ =~ /.p12$/){
2380 $uplp12name = $_;
2381 }
2382 }
2383 if (($uplconffilename eq '') || ($uplp12name eq '')){
2384 $errormessage = "Either no *.conf or no *.p12 file found\n";
2385 goto N2N_ERROR;
2386 }
2387
2388 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2389 @firen2nconf = <FILE>;
2390 close (FILE);
2391 chomp(@firen2nconf);
2392
2393 } else {
2394
2395 $errormessage = "Filecount does not match only 2 files are allowed\n";
2396 goto N2N_ERROR;
2397 }
2398
2399 ###
2400 # m.a.d net2net
2401 ###
2402
2403 if ($cgiparams{'n2nname'} ne ''){
2404
2405 $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2406 $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2407 $n2nname[0] = $cgiparams{'n2nname'};
2408 my @n2nname2 = split(/\./,$uplconffilename);
2409 $n2nname2[0] =~ s/\n|\r//g;
2410 my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2411 my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2412 my $input2 = "$n2nname2[0]n2n";
2413 my $output2 = "$n2nname[0]n2n";
2414 my $filename = "$tempdir/$uplconffilename";
2415 open(FILE, "< $filename") or die 'Unable to open config file.';
2416 my @current = <FILE>;
2417 close(FILE);
2418 foreach (@current) {s/$input1/$output1/g;}
2419 foreach (@current) {s/$input2/$output2/g;}
2420 open (OUT, "> $filename") || die 'Unable to open config file.';
2421 print OUT @current;
2422 close OUT;
2423
2424 }else{
2425 $uplconffilename2 = $uplconffilename;
2426 $uplp12name2 = $uplp12name;
2427 @n2nname = split(/\./,$uplconffilename);
2428 $n2nname[0] =~ s/\n|\r//g;
2429 }
2430 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2431 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2432
2433 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
2434
2435 if ($? ne 0) {
2436 $errormessage = "*.conf move failed: $!";
2437 unlink ($filename);
2438 goto N2N_ERROR;
2439 }
2440
2441 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
2442 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2443
2444 if ($? ne 0) {
2445 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2446 unlink ($filename);
2447 goto N2N_ERROR;
2448 }
2449
2450 my $complzoactive;
2451 my $mssfixactive;
2452 my $n2nfragment;
2453 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2454 my @n2nproto = split(/-/, $n2nproto2[1]);
2455 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2456 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2457 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2458 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2459 my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
2460 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2461 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
2462 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
2463 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2464 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2465 my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
2466 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2467 my @n2nmgmt = split(/ /, (grep { /^management/ } @firen2nconf)[0]);
2468 my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2469
2470
2471 ###
2472 # m.a.d delete CR and LF from arrays for this chomp doesnt work
2473 ###
2474
2475 $n2nremote[1] =~ s/\n|\r//g;
2476 $n2novpnsub[0] =~ s/\n|\r//g;
2477 $n2novpnsub[1] =~ s/\n|\r//g;
2478 $n2novpnsub[2] =~ s/\n|\r//g;
2479 $n2nproto[0] =~ s/\n|\r//g;
2480 $n2nport[1] =~ s/\n|\r//g;
2481 $n2ntunmtu[1] =~ s/\n|\r//g;
2482 $n2nremsub[1] =~ s/\n|\r//g;
2483 $n2nremsub[2] =~ s/\n|\r//g;
2484 $n2nlocalsub[2] =~ s/\n|\r//g;
2485 $n2nfragment[1] =~ s/\n|\r//g;
2486 $n2nmgmt[2] =~ s/\n|\r//g;
2487 chomp ($complzoactive);
2488 chomp ($mssfixactive);
2489
2490 ###
2491 # m.a.d net2net
2492 ###
2493
2494 ###
2495 # Check if there is no other entry with this name
2496 ###
2497
2498 foreach my $dkey (keys %confighash) {
2499 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2500 $errormessage = $Lang::tr{'a connection with this name already exists'};
2501 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2502 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2503 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2504 goto N2N_ERROR;
2505 }
2506 }
2507
2508 ###
2509 # Check if OpenVPN Subnet is valid
2510 ###
2511
2512 foreach my $dkey (keys %confighash) {
2513 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2514 $errormessage = 'The OpenVPN Subnet is already in use';
2515 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2516 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2517 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2518 goto N2N_ERROR;
2519 }
2520 }
2521
2522 ###
2523 # Check im Dest Port is vaild
2524 ###
2525
2526 foreach my $dkey (keys %confighash) {
2527 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2528 $errormessage = 'The OpenVPN Port is already in use';
2529 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2530 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2531 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2532 goto N2N_ERROR;
2533 }
2534 }
2535
2536
2537
2538 $key = &General::findhasharraykey (\%confighash);
2539
2540 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2541 $confighash{$key}[0] = 'off';
2542 $confighash{$key}[1] = $n2nname[0];
2543 $confighash{$key}[2] = $n2nname[0];
2544 $confighash{$key}[3] = 'net';
2545 $confighash{$key}[4] = 'cert';
2546 $confighash{$key}[6] = 'client';
2547 $confighash{$key}[8] = $n2nlocalsub[2];
2548 $confighash{$key}[10] = $n2nremote[1];
2549 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
2550 $confighash{$key}[22] = $n2nmgmt[2];
2551 $confighash{$key}[23] = $mssfixactive;
2552 $confighash{$key}[24] = $n2nfragment[1];
2553 $confighash{$key}[25] = 'IPFire n2n Client';
2554 $confighash{$key}[26] = 'red';
2555 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
2556 $confighash{$key}[28] = $n2nproto[0];
2557 $confighash{$key}[29] = $n2nport[1];
2558 $confighash{$key}[30] = $complzoactive;
2559 $confighash{$key}[31] = $n2ntunmtu[1];
2560
2561
2562 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2563
2564 N2N_ERROR:
2565
2566 &Header::showhttpheaders();
2567 &Header::openpage('Validate imported configuration', 1, '');
2568 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2569 if ($errormessage) {
2570 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2571 print "<class name='base'>$errormessage";
2572 print "&nbsp;</class>";
2573 &Header::closebox();
2574
2575 } else
2576 {
2577 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2578 }
2579 if ($errormessage eq ''){
2580 print <<END
2581 <!-- ipfire net2net config gui -->
2582 <table width='100%'>
2583 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2584 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2585 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2586 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2587 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2588 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2589 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2590 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2591 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2592 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2593 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
2594 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
2595 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
2596 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
2597 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
2598 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2599 </table>
2600 END
2601 ;
2602 &Header::closebox();
2603 }
2604
2605 if ($errormessage) {
2606 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2607 } else {
2608 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2609 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2610 print "<input type='hidden' name='KEY' value='$key' />";
2611 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2612 }
2613 &Header::closebigbox();
2614 &Header::closepage();
2615 exit(0);
2616
2617
2618 ##
2619 ### Accept IPFire n2n Package Settings
2620 ###
2621
2622 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2623
2624 ###
2625 ### Discard and Rollback IPFire n2n Package Settings
2626 ###
2627
2628 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2629
2630 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2631
2632 if ($confighash{$cgiparams{'KEY'}}) {
2633
2634 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2635 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2636 unlink ($certfile) or die "Removing $certfile fail: $!";
2637 unlink ($conffile) or die "Removing $conffile fail: $!";
2638 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2639 delete $confighash{$cgiparams{'KEY'}};
2640 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2641
2642 } else {
2643 $errormessage = $Lang::tr{'invalid key'};
2644 }
2645
2646
2647 ###
2648 # m.a.d net2net
2649 ###
2650
2651
2652 ###
2653 ### Adding a new connection
2654 ###
2655 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2656 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2657 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2658
2659 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2660 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2661 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2662
2663 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
2664 if (! $confighash{$cgiparams{'KEY'}}[0]) {
2665 $errormessage = $Lang::tr{'invalid key'};
2666 goto VPNCONF_END;
2667 }
2668 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
2669 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
2670 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
2671 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
2672 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
2673 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
2674 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
2675 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
2676 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
2677 # n2n m.a.d new fields
2678 $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
2679 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2680 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
2681 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
2682 $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
2683 #new fields
2684 $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
2685 $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28];
2686 $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29];
2687 $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30];
2688 $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31];
2689
2690 #new fields
2691 #ab hiere error uebernehmen
2692
2693 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2694 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
2695
2696 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
2697 $errormessage = $Lang::tr{'connection type is invalid'};
2698 if ($cgiparams{'TYPE'} eq 'net') {
2699 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2700 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2701 }
2702 goto VPNCONF_ERROR;
2703 }
2704
2705
2706 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
2707 $errormessage = $Lang::tr{'name must only contain characters'};
2708 if ($cgiparams{'TYPE'} eq 'net') {
2709 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2710 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2711 }
2712 goto VPNCONF_ERROR;
2713 }
2714
2715 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
2716 $errormessage = $Lang::tr{'name is invalid'};
2717 if ($cgiparams{'TYPE'} eq 'net') {
2718 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2719 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2720 }
2721 goto VPNCONF_ERROR;
2722 }
2723
2724 if (length($cgiparams{'NAME'}) >60) {
2725 $errormessage = $Lang::tr{'name too long'};
2726 if ($cgiparams{'TYPE'} eq 'net') {
2727 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2728 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2729 }
2730 goto VPNCONF_ERROR;
2731 }
2732
2733 ###
2734 # m.a.d net2net
2735 ###
2736
2737 if ($cgiparams{'TYPE'} eq 'net') {
2738
2739 if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) {
2740 $errormessage = $Lang::tr{'openvpn destination port used'};
2741 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2742 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2743 goto VPNCONF_ERROR;
2744 }
2745
2746 if ($cgiparams{'DEST_PORT'} eq '') {
2747 $errormessage = $Lang::tr{'openvpn destination port used'};
2748 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2749 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2750 goto VPNCONF_ERROR;
2751 }
2752
2753 if ($cgiparams{'OVPN_SUBNET'} eq $vpnsettings{'DOVPN_SUBNET'}) {
2754 $errormessage = $Lang::tr{'openvpn subnet is used'};
2755 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2756 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2757 goto VPNCONF_ERROR;
2758 }
2759
2760 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
2761 $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
2762 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2763 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2764 goto VPNCONF_ERROR;
2765 }
2766
2767 if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
2768 $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
2769 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2770 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2771 goto VPNCONF_ERROR;
2772 }
2773
2774 if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) {
2775 $errormessage = $Lang::tr{'openvpn prefix local subnet'};
2776 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2777 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2778 goto VPNCONF_ERROR;
2779 }
2780
2781 if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) {
2782 $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
2783 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2784 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2785 goto VPNCONF_ERROR;
2786 }
2787
2788 if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) {
2789 $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
2790 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2791 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2792 goto VPNCONF_ERROR;
2793 }
2794
2795 if ($cgiparams{'OVPN_MGMT'} eq '') {
2796 $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
2797 }
2798
2799 }
2800
2801 # if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
2802 # $errormessage = $Lang::tr{'ipfire side is invalid'};
2803 # goto VPNCONF_ERROR;
2804 # }
2805
2806 # Check if there is no other entry with this name
2807 if (! $cgiparams{'KEY'}) {
2808 foreach my $key (keys %confighash) {
2809 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
2810 $errormessage = $Lang::tr{'a connection with this name already exists'};
2811 if ($cgiparams{'TYPE'} eq 'net') {
2812 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2813 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2814 }
2815 goto VPNCONF_ERROR;
2816 }
2817 }
2818 }
2819
2820 if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
2821 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2822 if ($cgiparams{'TYPE'} eq 'net') {
2823 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2824 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2825 }
2826 goto VPNCONF_ERROR;
2827 }
2828
2829 if ($cgiparams{'REMOTE'}) {
2830 if (! &General::validip($cgiparams{'REMOTE'})) {
2831 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
2832 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2833 if ($cgiparams{'TYPE'} eq 'net') {
2834 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2835 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2836 }
2837 goto VPNCONF_ERROR;
2838 } else {
2839 if (&valid_dns_host($cgiparams{'REMOTE'})) {
2840 $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
2841 if ($cgiparams{'TYPE'} eq 'net') {