core60: add strongswan security update.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2011 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21
22 use CGI;
23 use CGI qw/:standard/;
24 use Net::DNS;
25 use Net::Ping;
26 use File::Copy;
27 use File::Temp qw/ tempfile tempdir /;
28 use strict;
29 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
30 require '/var/ipfire/general-functions.pl';
31 require "${General::swroot}/lang.pl";
32 require "${General::swroot}/header.pl";
33 require "${General::swroot}/countries.pl";
34
35 # enable only the following on debugging purpose
36 #use warnings;
37 #use CGI::Carp 'fatalsToBrowser';
38 #workaround to suppress a warning when a variable is used only once
39 my @dummy = ( ${Header::colourgreen} );
40 undef (@dummy);
41
42 my %color = ();
43 my %mainsettings = ();
44 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
45 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
46
47 ###
48 ### Initialize variables
49 ###
50 my %netsettings=();
51 my %cgiparams=();
52 my %vpnsettings=();
53 my %checked=();
54 my %confighash=();
55 my %cahash=();
56 my %selected=();
57 my $warnmessage = '';
58 my $errormessage = '';
59 my %settings=();
60 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
61 $cgiparams{'ENABLED'} = 'off';
62 $cgiparams{'ENABLED_BLUE'} = 'off';
63 $cgiparams{'ENABLED_ORANGE'} = 'off';
64 $cgiparams{'EDIT_ADVANCED'} = 'off';
65 $cgiparams{'NAT'} = 'off';
66 $cgiparams{'COMPRESSION'} = 'off';
67 $cgiparams{'ONLY_PROPOSED'} = 'off';
68 $cgiparams{'ACTION'} = '';
69 $cgiparams{'CA_NAME'} = '';
70 $cgiparams{'DHCP_DOMAIN'} = '';
71 $cgiparams{'DHCP_DNS'} = '';
72 $cgiparams{'DHCP_WINS'} = '';
73 $cgiparams{'DCOMPLZO'} = 'off';
74 $cgiparams{'MSSFIX'} = '';
75
76
77 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
78
79 # prepare openvpn config file
80 ###
81 ### Useful functions
82 ###
83 sub haveOrangeNet
84 {
85 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
86 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
87 return 0;
88 }
89
90 sub haveBlueNet
91 {
92 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
93 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
94 return 0;
95 }
96
97 sub sizeformat{
98 my $bytesize = shift;
99 my $i = 0;
100
101 while(abs($bytesize) >= 1024){
102 $bytesize=$bytesize/1024;
103 $i++;
104 last if($i==6);
105 }
106
107 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
108 my $newsize=(int($bytesize*100 +0.5))/100;
109 return("$newsize $units[$i]");
110 }
111
112 sub valid_dns_host {
113 my $hostname = $_[0];
114 unless ($hostname) { return "No hostname"};
115 my $res = new Net::DNS::Resolver;
116 my $query = $res->search("$hostname");
117 if ($query) {
118 foreach my $rr ($query->answer) {
119 ## Potential bug - we are only looking at A records:
120 return 0 if $rr->type eq "A";
121 }
122 } else {
123 return $res->errorstring;
124 }
125 }
126
127 sub cleanssldatabase
128 {
129 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
130 print FILE "01";
131 close FILE;
132 }
133 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
134 print FILE "";
135 close FILE;
136 }
137 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
138 unlink ("${General::swroot}/ovpn/certs/serial.old");
139 unlink ("${General::swroot}/ovpn/certs/01.pem");
140 }
141
142 sub newcleanssldatabase
143 {
144 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
145 open(FILE, ">${General::swroot}(ovpn/certs/serial");
146 print FILE "01";
147 close FILE;
148 }
149 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
150 system ("touch ${General::swroot}/ovpn/certs/index.txt");
151 }
152 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
153 unlink ("${General::swroot}/ovpn/certs/serial.old");
154 }
155
156 sub deletebackupcert
157 {
158 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
159 my $hexvalue = <FILE>;
160 chomp $hexvalue;
161 close FILE;
162 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
163 }
164 }
165
166 sub checkportfw {
167 my $KEY2 = $_[0]; # key2
168 my $SRC_PORT = $_[1]; # src_port
169 my $PROTOCOL = $_[2]; # protocol
170 my $SRC_IP = $_[3]; # sourceip
171
172 my $pfwfilename = "${General::swroot}/portfw/config";
173 open(FILE, $pfwfilename) or die 'Unable to open config file.';
174 my @pfwcurrent = <FILE>;
175 close(FILE);
176 my $pfwkey1 = 0; # used for finding last sequence number used
177 foreach my $pfwline (@pfwcurrent)
178 {
179 my @pfwtemp = split(/\,/,$pfwline);
180
181 chomp ($pfwtemp[8]);
182 if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
183 if ( $SRC_PORT eq $pfwtemp[3] &&
184 $PROTOCOL eq $pfwtemp[2] &&
185 $SRC_IP eq $pfwtemp[7])
186 {
187 $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
188 }
189 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
190 if ( $pfwtemp[1] eq "0") {
191 $pfwkey1=$pfwtemp[0];
192 }
193 # Darren Critchley - Duplicate or overlapping Port range check
194 if ($pfwtemp[1] eq "0" &&
195 $PROTOCOL eq $pfwtemp[2] &&
196 $SRC_IP eq $pfwtemp[7] &&
197 $errormessage eq '')
198 {
199 &portchecks($SRC_PORT, $pfwtemp[5]);
200 # &portchecks($pfwtemp[3], $pfwtemp[5]);
201 # &portchecks($pfwtemp[3], $SRC_IP);
202 }
203 }
204 }
205 # $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
206
207 return;
208 }
209
210 sub checkportoverlap
211 {
212 my $portrange1 = $_[0]; # New port range
213 my $portrange2 = $_[1]; # existing port range
214 my @tempr1 = split(/\:/,$portrange1);
215 my @tempr2 = split(/\:/,$portrange2);
216
217 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
218 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
219
220 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
221 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
222
223 return 1; # Everything checks out!
224 }
225
226 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
227 sub checkportinc
228 {
229 my $port1 = $_[0]; # Port
230 my $portrange2 = $_[1]; # Port range
231 my @tempr1 = split(/\:/,$portrange2);
232
233 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
234 return 1;
235 } else {
236 return 0;
237 }
238 }
239 # Darren Critchley - Duplicate or overlapping Port range check
240 sub portchecks
241 {
242 my $p1 = $_[0]; # New port range
243 my $p2 = $_[1]; # existing port range
244 # $_ = $_[0];
245 our ($prtrange1, $prtrange2);
246 $prtrange1 = 0;
247 # if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
248 # unless (&checkportoverlap($p1,$p2)) {
249 # $errormessage = "$Lang::tr{'source port overlaps'} $p1";
250 # }
251 # }
252 if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
253 unless (&checkportinc($p2,$p1)) {
254 $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
255 }
256 }
257 $prtrange1 = 1;
258 if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
259 unless (&checkportinc($p1,$p2)) {
260 $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
261 }
262 }
263 return;
264 }
265
266 # Darren Critchley - certain ports are reserved for IPFire
267 # TCP 67,68,81,222,445
268 # UDP 67,68
269 # Params passed in -> port, rangeyn, protocol
270 sub disallowreserved
271 {
272 # port 67 and 68 same for tcp and udp, don't bother putting in an array
273 my $msg = "";
274 my @tcp_reserved = (81,222,445);
275 my $prt = $_[0]; # the port or range
276 my $ryn = $_[1]; # tells us whether or not it is a port range
277 my $prot = $_[2]; # protocol
278 my $srcdst = $_[3]; # source or destination
279 if ($ryn) { # disect port range
280 if ($srcdst eq "src") {
281 $msg = "$Lang::tr{'rsvd src port overlap'}";
282 } else {
283 $msg = "$Lang::tr{'rsvd dst port overlap'}";
284 }
285 my @tmprng = split(/\:/,$prt);
286 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
287 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
288 if ($prot eq "tcp") {
289 foreach my $prange (@tcp_reserved) {
290 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
291 }
292 }
293 } else {
294 if ($srcdst eq "src") {
295 $msg = "$Lang::tr{'reserved src port'}";
296 } else {
297 $msg = "$Lang::tr{'reserved dst port'}";
298 }
299 if ($prt == 67) { $errormessage="$msg 67"; return; }
300 if ($prt == 68) { $errormessage="$msg 68"; return; }
301 if ($prot eq "tcp") {
302 foreach my $prange (@tcp_reserved) {
303 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
304 }
305 }
306 }
307 return;
308 }
309
310 sub writeserverconf {
311 my %sovpnsettings = ();
312 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
313
314 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
315 flock CONF, 2;
316 print CONF "#OpenVPN Server conf\n";
317 print CONF "\n";
318 print CONF "daemon openvpnserver\n";
319 print CONF "writepid /var/run/openvpn.pid\n";
320 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
321 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
322 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
323 print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
324 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
325 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
326 print CONF "script-security 3 system\n";
327 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
328 print CONF "tls-server\n";
329 print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
330 print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
331 print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
332 print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
333 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
334 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
335 print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
336 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
337 print CONF "client-to-client\n";
338 }
339 if ($sovpnsettings{MSSFIX} eq 'on') {
340 print CONF "mssfix\n";
341 }
342 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
343 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
344 }
345 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
346 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
347 }
348 print CONF "status-version 1\n";
349 print CONF "status /var/log/ovpnserver.log 30\n";
350 print CONF "cipher $sovpnsettings{DCIPHER}\n";
351 if ($sovpnsettings{DCOMPLZO} eq 'on') {
352 print CONF "comp-lzo\n";
353 }
354 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
355 print CONF "push \"redirect-gateway def1\"\n";
356 }
357 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
358 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
359 }
360
361 if ($sovpnsettings{DHCP_DNS} ne '') {
362 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
363 }
364
365 if ($sovpnsettings{DHCP_WINS} ne '') {
366 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
367 }
368
369 if ($sovpnsettings{DHCP_WINS} eq '') {
370 print CONF "max-clients 100\n";
371 }
372 if ($sovpnsettings{DHCP_WINS} ne '') {
373 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
374 }
375 print CONF "tls-verify /var/ipfire/ovpn/verify\n";
376 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
377 print CONF "user nobody\n";
378 print CONF "group nobody\n";
379 print CONF "persist-key\n";
380 print CONF "persist-tun\n";
381 if ($sovpnsettings{LOG_VERB} ne '') {
382 print CONF "verb $sovpnsettings{LOG_VERB}\n";
383 } else {
384 print CONF "verb 3\n";
385 }
386 print CONF "\n";
387
388 close(CONF);
389 }
390 #
391 sub emptyserverlog{
392 if (open(FILE, ">/var/log/ovpnserver.log")) {
393 flock FILE, 2;
394 print FILE "";
395 close FILE;
396 }
397
398 }
399
400 ###
401 # m.a.d net2net
402 ###
403
404 sub validdotmask
405 {
406 my $ipdotmask = $_[0];
407 if (&General::validip($ipdotmask)) { return 0; }
408 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
409 my $mask = $2;
410 if (($mask =~ /\./ )) { return 0; }
411 return 1;
412 }
413
414
415
416 #hier die refresh page
417 if ( -e "${General::swroot}/ovpn/gencanow") {
418 my $refresh = '';
419 $refresh = "<meta http-equiv='refresh' content='15;' />";
420 &Header::showhttpheaders();
421 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
422 &Header::openbigbox('100%', 'center');
423 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
424 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
425 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
426 &Header::closebox();
427 &Header::closebigbox();
428 &Header::closepage();
429 exit (0);
430 }
431 ##hier die refresh page
432
433
434 ###
435 ### OpenVPN Server Control
436 ###
437 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
438 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
439 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
440 #start openvpn server
441 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
442 &emptyserverlog();
443 system('/usr/local/bin/openvpnctrl', '-s');
444 }
445 #stop openvpn server
446 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
447 system('/usr/local/bin/openvpnctrl', '-k');
448 &emptyserverlog();
449 }
450 # #restart openvpn server
451 if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
452 #workarund, till SIGHUP also works when running as nobody
453 system('/usr/local/bin/openvpnctrl', '-r');
454 &emptyserverlog();
455 }
456 }
457
458 ###
459 ### Save Advanced options
460 ###
461
462 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
463 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
464 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
465 #DAN this value has to leave.
466 #new settings for daemon
467 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
468 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
469 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
470 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
471 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
472 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
473 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
474 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
475 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
476
477 if ($cgiparams{'FRAGMENT'} eq '') {
478 delete $vpnsettings{'FRAGMENT'};
479 } else {
480 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
481 $errormessage = "Incorrect value, please insert only numbers.";
482 goto ADV_ERROR;
483 } else {
484 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
485 }
486 }
487 if ($cgiparams{'MSSFIX'} ne 'on') {
488 delete $vpnsettings{'MSSFIX'};
489 } else {
490 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
491 }
492 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
493 unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
494 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
495 goto ADV_ERROR;
496 }
497 }
498 if ($cgiparams{'DHCP_DNS'} ne ''){
499 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
500 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
501 goto ADV_ERROR;
502 }
503 }
504 if ($cgiparams{'DHCP_WINS'} ne ''){
505 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
506 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
507 goto ADV_ERROR;
508 }
509 }
510 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
511 $errormessage = $Lang::tr{'invalid input for max clients'};
512 goto ADV_ERROR;
513 }
514 if ($cgiparams{'KEEPALIVE_1'} ne '') {
515 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
516 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
517 goto ADV_ERROR;
518 }
519 }
520 if ($cgiparams{'KEEPALIVE_2'} ne ''){
521 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
522 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
523 goto ADV_ERROR;
524 }
525 }
526 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
527 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
528 goto ADV_ERROR;
529 }
530
531 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
532 &writeserverconf();#hier ok
533 }
534
535 ###
536 # m.a.d net2net
537 ###
538
539 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
540 {
541
542 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
543 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
544 my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]";
545 my $tunmtu = '';
546
547 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
548 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
549
550 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
551
552 flock SERVERCONF, 2;
553 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
554 print SERVERCONF "\n";
555 print SERVERCONF "# User Security\n";
556 print SERVERCONF "user nobody\n";
557 print SERVERCONF "group nobody\n";
558 print SERVERCONF "persist-tun\n";
559 print SERVERCONF "persist-key\n";
560 print SERVERCONF "script-security 2\n";
561 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
562 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
563 print SERVERCONF "float\n";
564 print SERVERCONF "# IP adresses of the VPN Subnet\n";
565 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
566 print SERVERCONF "# Client Gateway Network\n";
567 print SERVERCONF "route @remsubnet[0] @remsubnet[1]\n";
568 print SERVERCONF "# tun Device\n";
569 print SERVERCONF "dev tun\n";
570 print SERVERCONF "# Port and Protokol\n";
571 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
572
573 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
574 print SERVERCONF "proto tcp-server\n";
575 print SERVERCONF "# Packet size\n";
576 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
577 print SERVERCONF "tun-mtu $tunmtu\n";
578 }
579
580 if ($cgiparams{'PROTOCOL'} eq 'udp') {
581 print SERVERCONF "proto udp\n";
582 print SERVERCONF "# Paketsize\n";
583 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
584 print SERVERCONF "tun-mtu $tunmtu\n";
585 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
586 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n";}
587 }
588
589 print SERVERCONF "# Auth. Server\n";
590 print SERVERCONF "tls-server\n";
591 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
592 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
593 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
594 print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
595 print SERVERCONF "# Cipher\n";
596 print SERVERCONF "cipher AES-256-CBC\n";
597 if ($cgiparams{'COMPLZO'} eq 'on') {
598 print SERVERCONF "# Enable Compression\n";
599 print SERVERCONF "comp-lzo\r\n";
600 }
601 print SERVERCONF "# Debug Level\n";
602 print SERVERCONF "verb 3\n";
603 print SERVERCONF "# Tunnel check\n";
604 print SERVERCONF "keepalive 10 60\n";
605 print SERVERCONF "# Start as daemon\n";
606 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
607 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
608 print SERVERCONF "# Activate Management Interface and Port\n";
609 print SERVERCONF "#management localhost 4711\n";
610 close(SERVERCONF);
611
612 }
613
614 ###
615 # m.a.d net2net
616 ###
617
618 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
619 {
620 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
621 my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]";
622 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
623 my $tunmtu = '';
624
625 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
626 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
627
628 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
629
630 flock CLIENTCONF, 2;
631 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
632 print CLIENTCONF "#\n";
633 print CLIENTCONF "# User Security\n";
634 print CLIENTCONF "user nobody\n";
635 print CLIENTCONF "group nobody\n";
636 print CLIENTCONF "persist-tun\n";
637 print CLIENTCONF "persist-key\n";
638 print CLIENTCONF "script-security 2\n";
639 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
640 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
641 print CLIENTCONF "float\n";
642 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
643 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
644 print CLIENTCONF "# Server Gateway Network\n";
645 print CLIENTCONF "route @remsubnet[0] @remsubnet[1]\n";
646 print CLIENTCONF "# tun Device\n";
647 print CLIENTCONF "dev tun\n";
648 print CLIENTCONF "# Port and Protokol\n";
649 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
650
651 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
652 print CLIENTCONF "proto tcp-client\n";
653 print CLIENTCONF "# Packet size\n";
654 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
655 print CLIENTCONF "tun-mtu $tunmtu\n";
656 print CLIENTCONF "ns-cert-type server\n";
657 }
658
659 if ($cgiparams{'PROTOCOL'} eq 'udp') {
660 print CLIENTCONF "proto udp\n";
661 print CLIENTCONF "# Paketsize\n";
662 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
663 print CLIENTCONF "tun-mtu $tunmtu\n";
664 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
665 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n";}
666 }
667
668 print CLIENTCONF "# Auth. Client\n";
669 print CLIENTCONF "tls-client\n";
670 print CLIENTCONF "# Cipher\n";
671 print CLIENTCONF "cipher AES-256-CBC\n";
672 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
673 if ($cgiparams{'COMPLZO'} eq 'on') {
674 print CLIENTCONF "# Enable Compression\n";
675 print CLIENTCONF "comp-lzo\r\n";
676 }
677 print CLIENTCONF "# Debug Level\n";
678 print CLIENTCONF "verb 3\n";
679 print CLIENTCONF "# Tunnel check\n";
680 print CLIENTCONF "keepalive 10 60\n";
681 print CLIENTCONF "# Start as daemon\n";
682 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
683 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
684 print CLIENTCONF "# Activate Management Interface and Port\n";
685 print CLIENTCONF "# management localhost 4711\n";
686 close(CLIENTCONF);
687
688 }
689
690 ###
691 ### Save main settings
692 ###
693
694
695 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
696 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
697 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
698 #DAN this value has to leave.
699 if ($cgiparams{'ENABLED'} eq 'on'){
700 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
701 $errormessage = $Lang::tr{'invalid input for hostname'};
702 goto SETTINGS_ERROR;
703 }
704 }
705 if ($cgiparams{'ENABLED'} eq 'on'){
706 &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
707 }
708 if ($errormessage) { goto SETTINGS_ERROR; }
709
710
711 if ($cgiparams{'ENABLED'} eq 'on'){
712 &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
713 }
714
715 if ($errormessage) { goto SETTINGS_ERROR; }
716
717 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
718 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
719 goto SETTINGS_ERROR;
720 }
721 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
722
723 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
724 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
725 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
726 goto SETTINGS_ERROR;
727 }
728
729 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
730 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
731 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
732 goto SETTINGS_ERROR;
733 }
734
735 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
736 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
737 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
738 goto SETTINGS_ERROR;
739 }
740
741 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
742 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
743 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
744 goto SETTINGS_ERROR;
745 }
746 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
747 while (<ALIASES>)
748 {
749 chomp($_);
750 my @tempalias = split(/\,/,$_);
751 if ($tempalias[1] eq 'on') {
752 if (&General::IpInSubnet ($tempalias[0] ,
753 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
754 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
755 }
756 }
757 }
758 close(ALIASES);
759 if ($errormessage ne ''){
760 goto SETTINGS_ERROR;
761 }
762 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
763 $errormessage = $Lang::tr{'invalid input'};
764 goto SETTINGS_ERROR;
765 }
766 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
767 $errormessage = $Lang::tr{'invalid mtu input'};
768 goto SETTINGS_ERROR;
769 }
770
771 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
772 $errormessage = $Lang::tr{'invalid port'};
773 goto SETTINGS_ERROR;
774 }
775 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
776 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
777 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
778 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
779 #new settings for daemon
780 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
781 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
782 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
783 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
784 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
785 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
786 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
787 #wrtie enable
788
789 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
790 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
791 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
792 #new settings for daemon
793 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
794 &writeserverconf();#hier ok
795 SETTINGS_ERROR:
796 ###
797 ### Reset all step 2
798 ###
799 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
800 my $file = '';
801 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
802
803 foreach my $key (keys %confighash) {
804 if ($confighash{$key}[4] eq 'cert') {
805 delete $confighash{$cgiparams{'$key'}};
806 }
807 }
808 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
809 unlink $file
810 }
811 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
812 unlink $file
813 }
814 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
815 unlink $file
816 }
817 &cleanssldatabase();
818 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
819 print FILE "";
820 close FILE;
821 }
822 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
823 #&writeserverconf();
824 ###
825 ### Reset all step 1
826 ###
827 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
828 &Header::showhttpheaders();
829 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
830 &Header::openbigbox('100%', 'LEFT', '', '');
831 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
832 print <<END
833 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
834 <tr><td align='center'>
835 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
836 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
837 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
838 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
839 </form></table>
840 END
841 ;
842 &Header::closebox();
843 &Header::closebigbox();
844 &Header::closepage();
845 exit (0);
846
847 ###
848 ### Upload CA Certificate
849 ###
850 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
851 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
852
853 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
854 $errormessage = $Lang::tr{'name must only contain characters'};
855 goto UPLOADCA_ERROR;
856 }
857
858 if (length($cgiparams{'CA_NAME'}) >60) {
859 $errormessage = $Lang::tr{'name too long'};
860 goto VPNCONF_ERROR;
861 }
862
863 if ($cgiparams{'CA_NAME'} eq 'ca') {
864 $errormessage = $Lang::tr{'name is invalid'};
865 goto UPLOAD_CA_ERROR;
866 }
867
868 # Check if there is no other entry with this name
869 foreach my $key (keys %cahash) {
870 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
871 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
872 goto UPLOADCA_ERROR;
873 }
874 }
875
876 if (ref ($cgiparams{'FH'}) ne 'Fh') {
877 $errormessage = $Lang::tr{'there was no file upload'};
878 goto UPLOADCA_ERROR;
879 }
880 # Move uploaded ca to a temporary file
881 (my $fh, my $filename) = tempfile( );
882 if (copy ($cgiparams{'FH'}, $fh) != 1) {
883 $errormessage = $!;
884 goto UPLOADCA_ERROR;
885 }
886 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
887 if ($temp !~ /CA:TRUE/i) {
888 $errormessage = $Lang::tr{'not a valid ca certificate'};
889 unlink ($filename);
890 goto UPLOADCA_ERROR;
891 } else {
892 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
893 if ($? ne 0) {
894 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
895 unlink ($filename);
896 goto UPLOADCA_ERROR;
897 }
898 }
899
900 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
901 $casubject =~ /Subject: (.*)[\n]/;
902 $casubject = $1;
903 $casubject =~ s+/Email+, E+;
904 $casubject =~ s/ ST=/ S=/;
905 $casubject = &Header::cleanhtml($casubject);
906
907 my $key = &General::findhasharraykey (\%cahash);
908 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
909 $cahash{$key}[1] = $casubject;
910 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
911 # system('/usr/local/bin/ipsecctrl', 'R');
912
913 UPLOADCA_ERROR:
914
915 ###
916 ### Display ca certificate
917 ###
918 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
919 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
920
921 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
922 &Header::showhttpheaders();
923 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
924 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
925 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
926 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
927 $output = &Header::cleanhtml($output,"y");
928 print "<pre>$output</pre>\n";
929 &Header::closebox();
930 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
931 &Header::closebigbox();
932 &Header::closepage();
933 exit(0);
934 } else {
935 $errormessage = $Lang::tr{'invalid key'};
936 }
937
938 ###
939 ### Download ca certificate
940 ###
941 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
942 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
943
944 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
945 print "Content-Type: application/octet-stream\r\n";
946 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
947 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
948 exit(0);
949 } else {
950 $errormessage = $Lang::tr{'invalid key'};
951 }
952
953 ###
954 ### Remove ca certificate (step 2)
955 ###
956 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
957 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
958 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
959
960 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
961 foreach my $key (keys %confighash) {
962 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
963 if ($test =~ /: OK/) {
964 # Delete connection
965 # if ($vpnsettings{'ENABLED'} eq 'on' ||
966 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
967 # system('/usr/local/bin/ipsecctrl', 'D', $key);
968 # }
969 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
970 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
971 delete $confighash{$key};
972 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
973 # &writeipsecfiles();
974 }
975 }
976 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
977 delete $cahash{$cgiparams{'KEY'}};
978 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
979 # system('/usr/local/bin/ipsecctrl', 'R');
980 } else {
981 $errormessage = $Lang::tr{'invalid key'};
982 }
983 ###
984 ### Remove ca certificate (step 1)
985 ###
986 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
987 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
988 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
989
990 my $assignedcerts = 0;
991 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
992 foreach my $key (keys %confighash) {
993 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
994 if ($test =~ /: OK/) {
995 $assignedcerts++;
996 }
997 }
998 if ($assignedcerts) {
999 &Header::showhttpheaders();
1000 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1001 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1002 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1003 print <<END
1004 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1005 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1006 <tr><td align='center'>
1007 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1008 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1009 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1010 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1011 </form></table>
1012 END
1013 ;
1014 &Header::closebox();
1015 &Header::closebigbox();
1016 &Header::closepage();
1017 exit (0);
1018 } else {
1019 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1020 delete $cahash{$cgiparams{'KEY'}};
1021 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1022 # system('/usr/local/bin/ipsecctrl', 'R');
1023 }
1024 } else {
1025 $errormessage = $Lang::tr{'invalid key'};
1026 }
1027
1028 ###
1029 ### Display root certificate
1030 ###
1031 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1032 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1033 my $output;
1034 &Header::showhttpheaders();
1035 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1036 &Header::openbigbox('100%', 'LEFT', '', '');
1037 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1038 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1039 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1040 } else {
1041 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1042 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1043 }
1044 $output = &Header::cleanhtml($output,"y");
1045 print "<pre>$output</pre>\n";
1046 &Header::closebox();
1047 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1048 &Header::closebigbox();
1049 &Header::closepage();
1050 exit(0);
1051
1052 ###
1053 ### Download root certificate
1054 ###
1055 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1056 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1057 print "Content-Type: application/octet-stream\r\n";
1058 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1059 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1060 exit(0);
1061 }
1062
1063 ###
1064 ### Download host certificate
1065 ###
1066 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1067 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1068 print "Content-Type: application/octet-stream\r\n";
1069 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1070 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1071 exit(0);
1072 }
1073 ###
1074 ### Form for generating a root certificate
1075 ###
1076 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1077 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1078
1079 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1080 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1081 $errormessage = $Lang::tr{'valid root certificate already exists'};
1082 $cgiparams{'ACTION'} = '';
1083 goto ROOTCERT_ERROR;
1084 }
1085
1086 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1087 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1088 my $ipaddr = <IPADDR>;
1089 close IPADDR;
1090 chomp ($ipaddr);
1091 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1092 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1093 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1094 }
1095 }
1096 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1097
1098 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1099 $errormessage = $Lang::tr{'there was no file upload'};
1100 goto ROOTCERT_ERROR;
1101 }
1102
1103 # Move uploaded certificate request to a temporary file
1104 (my $fh, my $filename) = tempfile( );
1105 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1106 $errormessage = $!;
1107 goto ROOTCERT_ERROR;
1108 }
1109
1110 # Create a temporary dirctory
1111 my $tempdir = tempdir( CLEANUP => 1 );
1112
1113 # Extract the CA certificate from the file
1114 my $pid = open(OPENSSL, "|-");
1115 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1116 if ($pid) { # parent
1117 if ($cgiparams{'P12_PASS'} ne '') {
1118 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1119 }
1120 close (OPENSSL);
1121 if ($?) {
1122 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1123 unlink ($filename);
1124 goto ROOTCERT_ERROR;
1125 }
1126 } else { # child
1127 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1128 '-in', $filename,
1129 '-out', "$tempdir/cacert.pem")) {
1130 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1131 unlink ($filename);
1132 goto ROOTCERT_ERROR;
1133 }
1134 }
1135
1136 # Extract the Host certificate from the file
1137 $pid = open(OPENSSL, "|-");
1138 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1139 if ($pid) { # parent
1140 if ($cgiparams{'P12_PASS'} ne '') {
1141 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1142 }
1143 close (OPENSSL);
1144 if ($?) {
1145 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1146 unlink ($filename);
1147 goto ROOTCERT_ERROR;
1148 }
1149 } else { # child
1150 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1151 '-in', $filename,
1152 '-out', "$tempdir/hostcert.pem")) {
1153 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1154 unlink ($filename);
1155 goto ROOTCERT_ERROR;
1156 }
1157 }
1158
1159 # Extract the Host key from the file
1160 $pid = open(OPENSSL, "|-");
1161 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1162 if ($pid) { # parent
1163 if ($cgiparams{'P12_PASS'} ne '') {
1164 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1165 }
1166 close (OPENSSL);
1167 if ($?) {
1168 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1169 unlink ($filename);
1170 goto ROOTCERT_ERROR;
1171 }
1172 } else { # child
1173 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1174 '-nodes',
1175 '-in', $filename,
1176 '-out', "$tempdir/serverkey.pem")) {
1177 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1178 unlink ($filename);
1179 goto ROOTCERT_ERROR;
1180 }
1181 }
1182
1183 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1184 if ($? ne 0) {
1185 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1186 unlink ($filename);
1187 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1188 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1189 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1190 goto ROOTCERT_ERROR;
1191 }
1192
1193 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1194 if ($? ne 0) {
1195 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1196 unlink ($filename);
1197 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1198 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1199 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1200 goto ROOTCERT_ERROR;
1201 }
1202
1203 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1204 if ($? ne 0) {
1205 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1206 unlink ($filename);
1207 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1208 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1209 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1210 goto ROOTCERT_ERROR;
1211 }
1212
1213 goto ROOTCERT_SUCCESS;
1214
1215 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1216
1217 # Validate input since the form was submitted
1218 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1219 $errormessage = $Lang::tr{'organization cant be empty'};
1220 goto ROOTCERT_ERROR;
1221 }
1222 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1223 $errormessage = $Lang::tr{'organization too long'};
1224 goto ROOTCERT_ERROR;
1225 }
1226 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1227 $errormessage = $Lang::tr{'invalid input for organization'};
1228 goto ROOTCERT_ERROR;
1229 }
1230 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1231 $errormessage = $Lang::tr{'hostname cant be empty'};
1232 goto ROOTCERT_ERROR;
1233 }
1234 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1235 $errormessage = $Lang::tr{'invalid input for hostname'};
1236 goto ROOTCERT_ERROR;
1237 }
1238 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1239 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1240 goto ROOTCERT_ERROR;
1241 }
1242 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1243 $errormessage = $Lang::tr{'e-mail address too long'};
1244 goto ROOTCERT_ERROR;
1245 }
1246 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1247 $errormessage = $Lang::tr{'invalid input for department'};
1248 goto ROOTCERT_ERROR;
1249 }
1250 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1251 $errormessage = $Lang::tr{'invalid input for city'};
1252 goto ROOTCERT_ERROR;
1253 }
1254 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1255 $errormessage = $Lang::tr{'invalid input for state or province'};
1256 goto ROOTCERT_ERROR;
1257 }
1258 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1259 $errormessage = $Lang::tr{'invalid input for country'};
1260 goto ROOTCERT_ERROR;
1261 }
1262
1263 # Copy the cgisettings to vpnsettings and save the configfile
1264 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1265 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1266 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1267 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1268 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1269 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1270 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1271 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1272
1273 # Replace empty strings with a .
1274 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1275 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1276 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1277
1278 # refresh
1279 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1280
1281 # Create the CA certificate
1282 my $pid = open(OPENSSL, "|-");
1283 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1284 if ($pid) { # parent
1285 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1286 print OPENSSL "$state\n";
1287 print OPENSSL "$city\n";
1288 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1289 print OPENSSL "$ou\n";
1290 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1291 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1292 close (OPENSSL);
1293 if ($?) {
1294 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1295 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1296 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1297 goto ROOTCERT_ERROR;
1298 }
1299 } else { # child
1300 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1301 '-days', '999999', '-newkey', 'rsa:2048',
1302 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1303 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1304 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1305 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1306 goto ROOTCERT_ERROR;
1307 }
1308 }
1309
1310 # Create the Host certificate request
1311 $pid = open(OPENSSL, "|-");
1312 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1313 if ($pid) { # parent
1314 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1315 print OPENSSL "$state\n";
1316 print OPENSSL "$city\n";
1317 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1318 print OPENSSL "$ou\n";
1319 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1320 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1321 print OPENSSL ".\n";
1322 print OPENSSL ".\n";
1323 close (OPENSSL);
1324 if ($?) {
1325 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1326 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1327 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1328 goto ROOTCERT_ERROR;
1329 }
1330 } else { # child
1331 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1332 '-newkey', 'rsa:1024',
1333 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1334 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1335 '-extensions', 'server',
1336 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1337 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1338 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1339 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1340 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1341 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1342 goto ROOTCERT_ERROR;
1343 }
1344 }
1345
1346 # Sign the host certificate request
1347 system('/usr/bin/openssl', 'ca', '-days', '999999',
1348 '-batch', '-notext',
1349 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1350 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1351 '-extensions', 'server',
1352 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1353 if ($?) {
1354 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1355 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1356 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1357 unlink ("${General::swroot}/ovpn/serverkey.pem");
1358 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1359 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1360 &newcleanssldatabase();
1361 goto ROOTCERT_ERROR;
1362 } else {
1363 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1364 &deletebackupcert();
1365 }
1366
1367 # Create an empty CRL
1368 system('/usr/bin/openssl', 'ca', '-gencrl',
1369 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1370 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1371 if ($?) {
1372 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1373 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1374 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1375 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1376 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1377 &cleanssldatabase();
1378 goto ROOTCERT_ERROR;
1379 # } else {
1380 # &cleanssldatabase();
1381 }
1382 # Create Diffie Hellmann Parameter
1383 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1384 '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1385 '1024' );
1386 if ($?) {
1387 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1388 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1389 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1390 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1391 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1392 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1393 &cleanssldatabase();
1394 goto ROOTCERT_ERROR;
1395 # } else {
1396 # &cleanssldatabase();
1397 }
1398 goto ROOTCERT_SUCCESS;
1399 }
1400 ROOTCERT_ERROR:
1401 if ($cgiparams{'ACTION'} ne '') {
1402 &Header::showhttpheaders();
1403 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1404 &Header::openbigbox('100%', 'LEFT', '', '');
1405 if ($errormessage) {
1406 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1407 print "<class name='base'>$errormessage";
1408 print "&nbsp;</class>";
1409 &Header::closebox();
1410 }
1411 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1412 print <<END
1413 <form method='post' enctype='multipart/form-data'>
1414 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1415 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1416 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1417 <td width='35%' colspan='2'>&nbsp;</td></tr>
1418 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1419 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1420 <td colspan='2'>&nbsp;</td></tr>
1421 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1422 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1423 <td colspan='2'>&nbsp;</td></tr>
1424 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1425 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1426 <td colspan='2'>&nbsp;</td></tr>
1427 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1428 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1429 <td colspan='2'>&nbsp;</td></tr>
1430 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1431 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1432 <td colspan='2'>&nbsp;</td></tr>
1433 <tr><td class='base'>$Lang::tr{'country'}:</td>
1434 <td class='base'><select name='ROOTCERT_COUNTRY'>
1435
1436 END
1437 ;
1438 foreach my $country (sort keys %{Countries::countries}) {
1439 print "<option value='$Countries::countries{$country}'";
1440 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1441 print " selected='selected'";
1442 }
1443 print ">$country</option>";
1444 }
1445 print <<END
1446 </select></td>
1447 <td colspan='2'>&nbsp;</td></tr>
1448 <tr><td>&nbsp;</td>
1449 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1450 <td>&nbsp;</td><td>&nbsp;</td></tr>
1451 <tr><td class='base' colspan='4' align='left'>
1452 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1453 <tr><td class='base' colspan='4' align='left'>
1454 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1455 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1456 </td></tr>
1457 <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1458 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1459 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1460 <td colspan='2'>&nbsp;</td></tr>
1461 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1462 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1463 <td colspan='2'>&nbsp;</td></tr>
1464 <tr><td>&nbsp;</td>
1465 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1466 <td colspan='2'>&nbsp;</td></tr>
1467 <tr><td class='base' colspan='4' align='left'>
1468 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1469 </form></table>
1470 END
1471 ;
1472 &Header::closebox();
1473
1474 &Header::closebigbox();
1475 &Header::closepage();
1476 exit(0)
1477 }
1478
1479 ROOTCERT_SUCCESS:
1480 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1481 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1482 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1483 # system('/usr/local/bin/ipsecctrl', 'S');
1484 # }
1485
1486 ###
1487 ### Enable/Disable connection
1488 ###
1489
1490 ###
1491 # m.a.d net2net
1492 ###
1493
1494 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1495
1496 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1497 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1498 # my $n2nactive = '';
1499 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1500
1501 if ($confighash{$cgiparams{'KEY'}}) {
1502
1503
1504 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1505 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1506 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1507
1508 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1509 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1510 }
1511
1512 } else {
1513
1514 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1515 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1516
1517 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1518 if ($n2nactive ne ''){
1519 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1520 }
1521
1522 } else {
1523 $errormessage = $Lang::tr{'invalid key'};
1524 }
1525 }
1526 }
1527
1528 ###
1529 ### Download OpenVPN client package
1530 ###
1531
1532
1533 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1534 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1535 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1536 my $file = '';
1537 my $clientovpn = '';
1538 my @fileholder;
1539 my $tempdir = tempdir( CLEANUP => 1 );
1540 my $zippath = "$tempdir/";
1541
1542 ###
1543 # m.a.d net2net
1544 ###
1545
1546 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1547
1548 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1549 my $zippathname = "$zippath$zipname";
1550 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1551 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1552 my $ovsubnet = "@ovsubnettemp[0].@ovsubnettemp[1].@ovsubnettemp[2]";
1553 my $tunmtu = '';
1554 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1555
1556 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1557 flock CLIENTCONF, 2;
1558
1559 my $zip = Archive::Zip->new();
1560 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1561 print CLIENTCONF "# \n";
1562 print CLIENTCONF "# User Security\n";
1563 print CLIENTCONF "user nobody\n";
1564 print CLIENTCONF "group nobody\n";
1565 print CLIENTCONF "persist-tun\n";
1566 print CLIENTCONF "persist-key\n";
1567 print CLIENTCONF "script-security 2\n";
1568 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1569 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1570 print CLIENTCONF "float\n";
1571 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1572 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1573 print CLIENTCONF "# Server Gateway Network\n";
1574 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1575 print CLIENTCONF "# tun Device\n";
1576 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1577 print CLIENTCONF "# Port and Protokoll\n";
1578 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1579
1580 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1581 print CLIENTCONF "proto tcp-client\n";
1582 print CLIENTCONF "# Packet size\n";
1583 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1584 print CLIENTCONF "tun-mtu $tunmtu\n";
1585 print CLIENTCONF "ns-cert-type server\n";
1586 }
1587
1588 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1589 print CLIENTCONF "proto udp\n";
1590 print CLIENTCONF "# Paketsize\n";
1591 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1592 print CLIENTCONF "tun-mtu $tunmtu\n";
1593 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1594 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1595 }
1596
1597 print CLIENTCONF "# Auth. Client\n";
1598 print CLIENTCONF "tls-client\n";
1599 print CLIENTCONF "# Cipher\n";
1600 print CLIENTCONF "cipher AES-256-CBC\n";
1601 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1602 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1603 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1604 }
1605 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1606 print CLIENTCONF "# Enable Compression\n";
1607 print CLIENTCONF "comp-lzo\r\n";
1608 }
1609 print CLIENTCONF "# Debug Level\n";
1610 print CLIENTCONF "verb 3\n";
1611 print CLIENTCONF "# Tunnel check\n";
1612 print CLIENTCONF "keepalive 10 60\n";
1613 print CLIENTCONF "# Start as daemon\n";
1614 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1615 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
1616 print CLIENTCONF "# Activate Management Interface and Port\n";
1617 print CLIENTCONF "# management localhost 4711\n";
1618 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
1619
1620
1621 close(CLIENTCONF);
1622
1623 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1624 my $status = $zip->writeToFileNamed($zippathname);
1625
1626 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1627 @fileholder = <DLFILE>;
1628 print "Content-Type:application/x-download\n";
1629 print "Content-Disposition:attachment;filename=$zipname\n\n";
1630 print @fileholder;
1631 exit (0);
1632 }
1633 else
1634 {
1635 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1636 my $zippathname = "$zippath$zipname";
1637 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1638
1639 ###
1640 # m.a.d net2net
1641 ###
1642
1643 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1644 flock CLIENTCONF, 2;
1645
1646 my $zip = Archive::Zip->new();
1647
1648 print CLIENTCONF "#OpenVPN Server conf\r\n";
1649 print CLIENTCONF "tls-client\r\n";
1650 print CLIENTCONF "client\r\n";
1651 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
1652 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
1653 print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1654 if ( $vpnsettings{'ENABLED'} eq 'on'){
1655 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
1656 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1657 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1658 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1659 }
1660 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1661 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1662 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1663 }
1664 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1665 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1666 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1667 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1668 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1669 }
1670 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1671 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1672 }
1673
1674 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1675 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1676 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1677 } else {
1678 print CLIENTCONF "ca cacert.pem\r\n";
1679 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1680 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1681 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
1682 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
1683 }
1684 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1685 if ($vpnsettings{DCOMPLZO} eq 'on') {
1686 print CLIENTCONF "comp-lzo\r\n";
1687 }
1688 print CLIENTCONF "verb 3\r\n";
1689 print CLIENTCONF "ns-cert-type server\r\n";
1690 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1691 if ($vpnsettings{MSSFIX} eq 'on') {
1692 print CLIENTCONF "mssfix\r\n";
1693 }
1694 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
1695 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1696 }
1697 close(CLIENTCONF);
1698
1699 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1700 my $status = $zip->writeToFileNamed($zippathname);
1701
1702 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1703 @fileholder = <DLFILE>;
1704 print "Content-Type:application/x-download\n";
1705 print "Content-Disposition:attachment;filename=$zipname\n\n";
1706 print @fileholder;
1707 exit (0);
1708 }
1709
1710
1711
1712 ###
1713 ### Remove connection
1714 ###
1715
1716
1717 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1718 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1719 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1720
1721 if ($confighash{$cgiparams{'KEY'}}) {
1722 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1723 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1724 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1725 # }
1726 #
1727 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1728
1729 ###
1730 # m.a.d net2net
1731 ###
1732
1733 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1734
1735 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1736 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1737 unlink ($certfile) or die "Removing $certfile fail: $!";
1738 unlink ($conffile) or die "Removing $conffile fail: $!";
1739 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1740
1741 }
1742
1743 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1744 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1745 delete $confighash{$cgiparams{'KEY'}};
1746 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1747 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1748 #&writeserverconf();
1749 } else {
1750 $errormessage = $Lang::tr{'invalid key'};
1751 }
1752
1753
1754 ###
1755 ### Download PKCS12 file
1756 ###
1757 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1758 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1759
1760 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1761 print "Content-Type: application/octet-stream\r\n\r\n";
1762 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1763 exit (0);
1764
1765 ###
1766 ### Display certificate
1767 ###
1768 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1769 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1770
1771 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1772 &Header::showhttpheaders();
1773 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1774 &Header::openbigbox('100%', 'LEFT', '', '');
1775 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1776 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1777 $output = &Header::cleanhtml($output,"y");
1778 print "<pre>$output</pre>\n";
1779 &Header::closebox();
1780 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1781 &Header::closebigbox();
1782 &Header::closepage();
1783 exit(0);
1784 }
1785 ###
1786 ### Display Certificate Revoke List
1787 ###
1788 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
1789 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1790
1791 if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
1792 &Header::showhttpheaders();
1793 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1794 &Header::openbigbox('100%', 'LEFT', '', '');
1795 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1796 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1797 $output = &Header::cleanhtml($output,"y");
1798 print "<pre>$output</pre>\n";
1799 &Header::closebox();
1800 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1801 &Header::closebigbox();
1802 &Header::closepage();
1803 exit(0);
1804 }
1805
1806 ###
1807 ### Advanced Server Settings
1808 ###
1809
1810 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1811 %cgiparams = ();
1812 %cahash = ();
1813 %confighash = ();
1814 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
1815
1816 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1817 # $cgiparams{'CLIENT2CLIENT'} = 'on';
1818 # }
1819 ADV_ERROR:
1820 if ($cgiparams{'MAX_CLIENTS'} eq '') {
1821 $cgiparams{'MAX_CLIENTS'} = '100';
1822 }
1823
1824 if ($cgiparams{'KEEPALIVE_1'} eq '') {
1825 $cgiparams{'KEEPALIVE_1'} = '10';
1826 }
1827 if ($cgiparams{'KEEPALIVE_2'} eq '') {
1828 $cgiparams{'KEEPALIVE_2'} = '60';
1829 }
1830 if ($cgiparams{'LOG_VERB'} eq '') {
1831 $cgiparams{'LOG_VERB'} = '3';
1832 }
1833 $checked{'CLIENT2CLIENT'}{'off'} = '';
1834 $checked{'CLIENT2CLIENT'}{'on'} = '';
1835 $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1836 $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1837 $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1838 $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
1839 $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1840 $checked{'MSSFIX'}{'off'} = '';
1841 $checked{'MSSFIX'}{'on'} = '';
1842 $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
1843 $selected{'LOG_VERB'}{'1'} = '';
1844 $selected{'LOG_VERB'}{'2'} = '';
1845 $selected{'LOG_VERB'}{'3'} = '';
1846 $selected{'LOG_VERB'}{'4'} = '';
1847 $selected{'LOG_VERB'}{'5'} = '';
1848 $selected{'LOG_VERB'}{'6'} = '';
1849 $selected{'LOG_VERB'}{'7'} = '';
1850 $selected{'LOG_VERB'}{'8'} = '';
1851 $selected{'LOG_VERB'}{'9'} = '';
1852 $selected{'LOG_VERB'}{'10'} = '';
1853 $selected{'LOG_VERB'}{'11'} = '';
1854 $selected{'LOG_VERB'}{'0'} = '';
1855 $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
1856
1857
1858
1859 &Header::showhttpheaders();
1860 &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1861 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1862 if ($errormessage) {
1863 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1864 print "<class name='base'>$errormessage\n";
1865 print "&nbsp;</class>\n";
1866 &Header::closebox();
1867 }
1868 &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1869 print <<END
1870 <form method='post' enctype='multipart/form-data'>
1871 <table width='100%'>
1872 <tr>
1873 <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1874 </tr>
1875 <tr>
1876 <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1877 </tr>
1878 <tr>
1879 <td class='base'>Domain</td>
1880 <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1881 </tr>
1882 <tr>
1883 <td class='base'>DNS</td>
1884 <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1885 </tr>
1886 <tr>
1887 <td class='base'>WINS</td>
1888 <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
1889 </tr>
1890 </table>
1891 <hr size='1'>
1892 <table width='100%'>
1893 <tr>
1894 <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1895 </tr>
1896 <tr>
1897 <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
1898 </tr>
1899 <tr>
1900 <td class='base'>Client-To-Client</td>
1901 <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
1902 </tr>
1903 <tr>
1904 <td class='base'>Redirect-Gateway def1</td>
1905 <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
1906 </tr>
1907 <tr>
1908 <td class='base'>Max-Clients</td>
1909 <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
1910 </tr>
1911 <tr>
1912 <td class='base'>Keppalive <br />
1913 (ping/ping-restart)</td>
1914 <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
1915 <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
1916 </tr>
1917 <tr>
1918 <td class='base'>fragment <br></td>
1919 <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
1920 <td>Default: <span class="base">1300</span></td>
1921 </tr>
1922 <tr>
1923 <td class='base'>mssfix</td>
1924 <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
1925 <td>Default: on</td>
1926 </tr>
1927 </table>
1928
1929 <!--
1930 <hr size='1'>
1931 <table width='100%'>
1932 <tr>
1933 <td class'base'><b>Crypto-Engines</b></td>
1934 </tr>
1935 <tr>
1936 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
1937 </tr>
1938 <tr><td class='base'>Engines:</td>
1939 <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
1940 <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
1941 <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
1942 </select>
1943 </td>
1944 </table>
1945 -->
1946 <hr size='1'>
1947 <table width='100%'>
1948 <tr>
1949 <td class'base'><b>$Lang::tr{'log-options'}</b></td>
1950 </tr>
1951 <tr>
1952 <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
1953 </tr>
1954
1955 <tr><td class='base'>VERB</td>
1956 <td><select name='LOG_VERB'><option value='1' $selected{'LOG_VERB'}{'1'}>1</option>
1957 <option value='2' $selected{'LOG_VERB'}{'2'}>2</option>
1958 <option value='3' $selected{'LOG_VERB'}{'3'}>3</option>
1959 <option value='4' $selected{'LOG_VERB'}{'4'}>4</option>
1960 <option value='5' $selected{'LOG_VERB'}{'5'}>5</option>
1961 <option value='6' $selected{'LOG_VERB'}{'6'}>6</option>
1962 <option value='7' $selected{'LOG_VERB'}{'7'}>7</option>
1963 <option value='8' $selected{'LOG_VERB'}{'8'}>8</option>
1964 <option value='9' $selected{'LOG_VERB'}{'9'}>9</option>
1965 <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
1966 <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
1967 <option value='0' $selected{'LOG_VERB'}{'0'}>0</option></select></td>
1968 </table>
1969 <hr size='1'>
1970 <table width='100%'>
1971 <tr>
1972 <td>&nbsp;</td>
1973 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
1974 <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
1975 <td>&nbsp;</td>
1976 </tr>
1977 </table>
1978 </form>
1979 END
1980 ;
1981
1982 &Header::closebox();
1983 # print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1984 &Header::closebigbox();
1985 &Header::closepage();
1986 exit(0);
1987
1988 ###
1989 ### Openvpn Connections Statistics
1990 ###
1991 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
1992 &Header::showhttpheaders();
1993 &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
1994 &Header::openbigbox('100%', 'LEFT', '', '');
1995 &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
1996
1997 #
1998 # <td><b>$Lang::tr{'protocol'}</b></td>
1999 # protocol temp removed
2000 print <<END
2001 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2002 <tr>
2003 <td><b>$Lang::tr{'common name'}</b></td>
2004 <td><b>$Lang::tr{'real address'}</b></td>
2005 <td><b>$Lang::tr{'virtual address'}</b></td>
2006 <td><b>$Lang::tr{'loged in at'}</b></td>
2007 <td><b>$Lang::tr{'bytes sent'}</b></td>
2008 <td><b>$Lang::tr{'bytes received'}</b></td>
2009 <td><b>$Lang::tr{'last activity'}</b></td>
2010 </tr>
2011 END
2012 ;
2013 my $filename = "/var/log/ovpnserver.log";
2014 open(FILE, $filename) or die 'Unable to open config file.';
2015 my @current = <FILE>;
2016 close(FILE);
2017 my @users =();
2018 my $status;
2019 my $uid = 0;
2020 my $cn;
2021 my @match = ();
2022 my $proto = "udp";
2023 my $address;
2024 my %userlookup = ();
2025 foreach my $line (@current)
2026 {
2027 chomp($line);
2028 if ( $line =~ /^Updated,(.+)/){
2029 @match = split( /^Updated,(.+)/, $line);
2030 $status = $match[1];
2031 }
2032 #gian
2033 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2034 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2035 if ($match[1] ne "Common Name") {
2036 $cn = $match[1];
2037 $userlookup{$match[2]} = $uid;
2038 $users[$uid]{'CommonName'} = $match[1];
2039 $users[$uid]{'RealAddress'} = $match[2];
2040 $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2041 $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2042 $users[$uid]{'Since'} = $match[5];
2043 $users[$uid]{'Proto'} = $proto;
2044 $uid++;
2045 }
2046 }
2047 if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2048 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2049 if ($match[1] ne "Virtual Address") {
2050 $address = $match[3];
2051 #find the uid in the lookup table
2052 $uid = $userlookup{$address};
2053 $users[$uid]{'VirtualAddress'} = $match[1];
2054 $users[$uid]{'LastRef'} = $match[4];
2055 }
2056 }
2057 }
2058 my $user2 = @users;
2059 if ($user2 >= 1){
2060 for (my $idx = 1; $idx <= $user2; $idx++){
2061 if ($idx % 2) {
2062 print "<tr bgcolor='$color{'color20'}'>\n";
2063 } else {
2064 print "<tr bgcolor='$color{'color22'}'>\n";
2065 }
2066 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2067 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2068 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2069 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2070 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2071 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2072 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2073 # print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2074 }
2075 }
2076
2077 print "</table>";
2078 print <<END
2079 <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2080 <tr><td></td></tr>
2081 <tr><td></td></tr>
2082 <tr><td></td></tr>
2083 <tr><td></td></tr>
2084 <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2085 </table>
2086 END
2087 ;
2088 &Header::closebox();
2089 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2090 &Header::closebigbox();
2091 &Header::closepage();
2092 exit(0);
2093
2094 ###
2095 ### Download Certificate
2096 ###
2097 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2098 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2099
2100 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2101 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2102 print "Content-Type: application/octet-stream\r\n\r\n";
2103 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2104 exit (0);
2105 }
2106
2107 ###
2108 ### Enable/Disable connection
2109 ###
2110
2111 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2112
2113 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2114 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2115
2116 if ($confighash{$cgiparams{'KEY'}}) {
2117 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2118 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2119 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2120 #&writeserverconf();
2121 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2122 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2123 # system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2124 # }
2125 } else {
2126 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2127 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2128 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2129 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2130 # }
2131 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2132 #&writeserverconf();
2133 }
2134 } else {
2135 $errormessage = $Lang::tr{'invalid key'};
2136 }
2137
2138 ###
2139 ### Restart connection
2140 ###
2141 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2142 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2143 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2144
2145 if ($confighash{$cgiparams{'KEY'}}) {
2146 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2147 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2148 # system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2149 # }
2150 } else {
2151 $errormessage = $Lang::tr{'invalid key'};
2152 }
2153
2154 ###
2155 ### Remove connection
2156 ###
2157 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2158 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2159 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2160
2161 if ($confighash{$cgiparams{'KEY'}}) {
2162 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2163 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2164 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2165 # }
2166 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2167 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2168 delete $confighash{$cgiparams{'KEY'}};
2169 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2170 #&writeserverconf();
2171 } else {
2172 $errormessage = $Lang::tr{'invalid key'};
2173 }
2174 #test33
2175
2176 ###
2177 ### Choose between adding a host-net or net-net connection
2178 ###
2179
2180 ###
2181 # m.a.d net2net
2182 ###
2183
2184 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2185 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2186 &Header::showhttpheaders();
2187 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2188 &Header::openbigbox('100%', 'LEFT', '', '');
2189 &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2190
2191 if ( -s "${General::swroot}/ovpn/settings") {
2192
2193 print <<END
2194 <b>$Lang::tr{'connection type'}:</b><br />
2195 <table><form method='post' ENCTYPE="multipart/form-data">
2196 <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2197 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2198 <tr><td><input type='radio' name='TYPE' value='net' /></td>
2199 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2200 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2201 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2202 <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2203 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2204 </form></table>
2205 END
2206 ;
2207
2208 } else {
2209 print <<END
2210 <b>$Lang::tr{'connection type'}:</b><br />
2211 <table><form method='post' ENCTYPE="multipart/form-data">
2212 <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2213 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2214 </form></table>
2215 END
2216 ;
2217
2218 }
2219
2220 &Header::closebox();
2221 &Header::closebigbox();
2222 &Header::closepage();
2223 exit (0);
2224
2225 ###
2226 # m.a.d net2net
2227 ###
2228
2229 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2230
2231 my @firen2nconf;
2232 my @confdetails;
2233 my $uplconffilename ='';
2234 my $uplp12name = '';
2235 my @rem_subnet;
2236 my @rem_subnet2;
2237 my @tmposupnet3;
2238 my $key;
2239
2240 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2241
2242 # Check if a file is uploaded
2243
2244 if (ref ($cgiparams{'FH'}) ne 'Fh') {
2245 $errormessage = $Lang::tr{'there was no file upload'};
2246 goto N2N_ERROR;
2247 }
2248
2249 # Move uploaded IPfire n2n package to temporary file
2250
2251 (my $fh, my $filename) = tempfile( );
2252 if (copy ($cgiparams{'FH'}, $fh) != 1) {
2253 $errormessage = $!;
2254 goto N2N_ERROR;
2255 }
2256
2257 my $zip = Archive::Zip->new();
2258 my $zipName = $filename;
2259 my $status = $zip->read( $zipName );
2260 if ($status != AZ_OK) {
2261 $errormessage = "Read of $zipName failed\n";
2262 goto N2N_ERROR;
2263 }
2264
2265 my $tempdir = tempdir( CLEANUP => 1 );
2266 my @files = $zip->memberNames();
2267 for(@files) {
2268 $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2269 }
2270 my $countfiles = @files;
2271
2272 # Check if we have not more then 2 files
2273
2274 if ( $countfiles == 2){
2275 foreach (@files){
2276 if ( $_ =~ /.conf$/){
2277 $uplconffilename = $_;
2278 }
2279 if ( $_ =~ /.p12$/){
2280 $uplp12name = $_;
2281 }
2282 }
2283 if (($uplconffilename eq '') || ($uplp12name eq '')){
2284 $errormessage = "Either no *.conf or no *.p12 file found\n";
2285 goto N2N_ERROR;
2286 }
2287
2288 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2289 @firen2nconf = <FILE>;
2290 close (FILE);
2291 chomp(@firen2nconf);
2292
2293 } else {
2294
2295 $errormessage = "Filecount does not match only 2 files are allowed\n";
2296 goto N2N_ERROR;
2297 }
2298
2299 ###
2300 # m.a.d net2net
2301 ###
2302
2303 my @n2nname = split(/\./,$uplconffilename);
2304 $n2nname[0] =~ s/\n|\r//g;
2305
2306 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2307 unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2308
2309 move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename");
2310
2311 if ($? ne 0) {
2312 $errormessage = "*.conf move failed: $!";
2313 unlink ($filename);
2314 goto N2N_ERROR;
2315 }
2316
2317 move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name");
2318 chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2319
2320 if ($? ne 0) {
2321 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2322 unlink ($filename);
2323 goto N2N_ERROR;
2324 }
2325
2326 my $complzoactive;
2327 my $mssfixactive;
2328 my $n2nfragment;
2329 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2330 my @n2nproto = split(/-/, @n2nproto2[1]);
2331 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2332 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2333 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2334 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2335 my @n2nmssfix = grep { /^mssfix/ } @firen2nconf;
2336 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2337 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
2338 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2339 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2340 my @n2novpnsub = split(/\./,$n2novpnsuball[1]);
2341 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2342 my @n2nlocalsub = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2343
2344
2345 ###
2346 # m.a.d delete CR and LF from arrays for this chomp doesnt work
2347 ###
2348
2349 $n2nremote[1] =~ s/\n|\r//g;
2350 $n2novpnsub[0] =~ s/\n|\r//g;
2351 $n2novpnsub[1] =~ s/\n|\r//g;
2352 $n2novpnsub[2] =~ s/\n|\r//g;
2353 $n2nproto[0] =~ s/\n|\r//g;
2354 $n2nport[1] =~ s/\n|\r//g;
2355 $n2ntunmtu[1] =~ s/\n|\r//g;
2356 $n2nremsub[1] =~ s/\n|\r//g;
2357 $n2nremsub[2] =~ s/\n|\r//g;
2358 $n2nlocalsub[2] =~ s/\n|\r//g;
2359 $n2nfragment[1] =~ s/\n|\r//g;
2360 chomp ($complzoactive);
2361 chomp ($mssfixactive);
2362
2363 ###
2364 # m.a.d net2net
2365 ###
2366
2367 ###
2368 # Check if there is no other entry with this name
2369 ###
2370
2371 foreach my $dkey (keys %confighash) {
2372 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2373 $errormessage = $Lang::tr{'a connection with this name already exists'};
2374 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2375 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2376 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2377 goto N2N_ERROR;
2378 }
2379 }
2380
2381 ###
2382 # Check if OpenVPN Subnet is valid
2383 ###
2384
2385 foreach my $dkey (keys %confighash) {
2386 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2387 $errormessage = 'The OpenVPN Subnet is already in use';
2388 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2389 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2390 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2391 goto N2N_ERROR;
2392 }
2393 }
2394
2395 ###
2396 # Check im Dest Port is vaild
2397 ###
2398
2399 foreach my $dkey (keys %confighash) {
2400 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2401 $errormessage = 'The OpenVPN Port is already in use';
2402 unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2403 unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2404 rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2405 goto N2N_ERROR;
2406 }
2407 }
2408
2409
2410
2411 $key = &General::findhasharraykey (\%confighash);
2412
2413 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2414 $confighash{$key}[0] = 'off';
2415 $confighash{$key}[1] = $n2nname[0];
2416 $confighash{$key}[2] = $n2nname[0];
2417 $confighash{$key}[3] = 'net';
2418 $confighash{$key}[4] = 'cert';
2419 $confighash{$key}[6] = 'client';
2420 $confighash{$key}[8] = $n2nlocalsub[2];
2421 $confighash{$key}[10] = $n2nremote[1];
2422 $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
2423 $confighash{$key}[23] = $mssfixactive;
2424 $confighash{$key}[24] = $n2nfragment[1];
2425 $confighash{$key}[25] = 'IPFire n2n Client';
2426 $confighash{$key}[26] = 'red';
2427 $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
2428 $confighash{$key}[28] = $n2nproto[0];
2429 $confighash{$key}[29] = $n2nport[1];
2430 $confighash{$key}[30] = $complzoactive;
2431 $confighash{$key}[31] = $n2ntunmtu[1];
2432
2433
2434 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2435
2436 N2N_ERROR:
2437
2438 &Header::showhttpheaders();
2439 &Header::openpage('Validate imported configuration', 1, '');
2440 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2441 if ($errormessage) {
2442 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2443 print "<class name='base'>$errormessage";
2444 print "&nbsp;</class>";
2445 &Header::closebox();
2446
2447 } else
2448 {
2449 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2450 }
2451 if ($errormessage eq ''){
2452 print <<END
2453 <!-- ipfire net2net config gui -->
2454 <table width='100%'>
2455 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2456 <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2457 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2458 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2459 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2460 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2461 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2462 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2463 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2464 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2465 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
2466 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
2467 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
2468 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
2469 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2470 </table>
2471 END
2472 ;
2473 &Header::closebox();
2474 }
2475
2476 if ($errormessage) {
2477 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2478 } else {
2479 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2480 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2481 print "<input type='hidden' name='KEY' value='$key' />";
2482 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2483 }
2484 &Header::closebigbox();
2485 &Header::closepage();
2486 exit(0);
2487
2488
2489 ##
2490 ### Accept IPFire n2n Package Settings
2491 ###
2492
2493 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2494
2495 ###
2496 ### Discard and Rollback IPFire n2n Package Settings
2497 ###
2498
2499 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2500
2501 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2502
2503 if ($confighash{$cgiparams{'KEY'}}) {
2504
2505 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2506 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2507 unlink ($certfile) or die "Removing $certfile fail: $!";
2508 unlink ($conffile) or die "Removing $conffile fail: $!";
2509 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2510 delete $confighash{$cgiparams{'KEY'}};
2511 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2512
2513 } else {
2514 $errormessage = $Lang::tr{'invalid key'};
2515 }
2516
2517
2518 ###
2519 # m.a.d net2net
2520 ###
2521
2522
2523 ###
2524 ### Adding a new connection
2525 ###
2526 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2527 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2528 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2529
2530 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2531 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2532 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2533
2534 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
2535 if (! $confighash{$cgiparams{'KEY'}}[0]) {
2536 $errormessage = $Lang::tr{'invalid key'};
2537 goto VPNCONF_END;
2538 }
2539 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
2540 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
2541 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
2542 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
2543 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
2544 $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6];
2545 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
2546 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
2547 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
2548 # n2n m.a.d new fields
2549 $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2550 $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
2551 $cgi