html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/countries.pl";
  37
  38 # enable only the following on debugging purpose
  39 #use warnings;
  40 #use CGI::Carp 'fatalsToBrowser';
  41 #workaround to suppress a warning when a variable is used only once
  42 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
  43 undef (@dummy);
  44
  45 my %color = ();
  46 my %mainsettings = ();
  47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  49
  50 ###
  51 ### Initialize variables
  52 ###
  53 my %ccdconfhash=();
  54 my %ccdroutehash=();
  55 my %ccdroute2hash=();
  56 my %netsettings=();
  57 my %cgiparams=();
  58 my %vpnsettings=();
  59 my %checked=();
  60 my %confighash=();
  61 my %cahash=();
  62 my %selected=();
  63 my $warnmessage = '';
  64 my $errormessage = '';
  65 my %settings=();
  66 my $routes_push_file = '';
  67 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  68 $cgiparams{'ENABLED'} = 'off';
  69 $cgiparams{'ENABLED_BLUE'} = 'off';
  70 $cgiparams{'ENABLED_ORANGE'} = 'off';
  71 $cgiparams{'EDIT_ADVANCED'} = 'off';
  72 $cgiparams{'NAT'} = 'off';
  73 $cgiparams{'COMPRESSION'} = 'off';
  74 $cgiparams{'ONLY_PROPOSED'} = 'off';
  75 $cgiparams{'ACTION'} = '';
  76 $cgiparams{'CA_NAME'} = '';
  77 $cgiparams{'DHCP_DOMAIN'} = '';
  78 $cgiparams{'DHCP_DNS'} = '';
  79 $cgiparams{'DHCP_WINS'} = '';
  80 $cgiparams{'ROUTES_PUSH'} = '';
  81 $cgiparams{'DCOMPLZO'} = 'off';
  82 $cgiparams{'MSSFIX'} = '';
  83 $cgiparams{'number'} = '';
  84 $cgiparams{'PMTU_DISCOVERY'} = '';
  85 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  86 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  87 unless (-e "${General::swroot}/ovpn/ccd.conf")    { system("touch ${General::swroot}/ovpn/ccd.conf"); }
  88 unless (-e "${General::swroot}/ovpn/ccdroute")    { system("touch ${General::swroot}/ovpn/ccdroute"); }
  89 unless (-e "${General::swroot}/ovpn/ccdroute2")    { system("touch ${General::swroot}/ovpn/ccdroute2"); }
  90
  91 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  92
  93 # prepare openvpn config file
  94 ###
  95 ### Useful functions
  96 ###
  97 sub haveOrangeNet
  98 {
  99         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
 100         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 101         return 0;
 102 }
 103
 104 sub haveBlueNet
 105 {
 106         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
 107         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 108         return 0;
 109 }
 110
 111 sub sizeformat{
 112     my $bytesize = shift;
 113     my $i = 0;
 114
 115     while(abs($bytesize) >= 1024){
 116         $bytesize=$bytesize/1024;
 117         $i++;
 118         last if($i==6);
 119     }
 120
 121     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 122     my $newsize=(int($bytesize*100 +0.5))/100;
 123     return("$newsize $units[$i]");
 124 }
 125
 126 sub valid_dns_host {
 127         my $hostname = $_[0];
 128         unless ($hostname) { return "No hostname"};
 129         my $res = new Net::DNS::Resolver;
 130         my $query = $res->search("$hostname");
 131         if ($query) {
 132                 foreach my $rr ($query->answer) {
 133                         ## Potential bug - we are only looking at A records:
 134                         return 0 if $rr->type eq "A";
 135                 }
 136         } else {
 137                 return $res->errorstring;
 138         }
 139 }
 140
 141 sub cleanssldatabase
 142 {
 143     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 144         print FILE "01";
 145         close FILE;
 146     }
 147     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 148         print FILE "";
 149         close FILE;
 150     }
 151     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 152     unlink ("${General::swroot}/ovpn/certs/serial.old");
 153     unlink ("${General::swroot}/ovpn/certs/01.pem");
 154 }
 155
 156 sub newcleanssldatabase
 157 {
 158     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 159         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 160         print FILE "01";
 161         close FILE;
 162     }
 163     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 164         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 165     }
 166     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 167     unlink ("${General::swroot}/ovpn/certs/serial.old");
 168 }
 169
 170 sub deletebackupcert
 171 {
 172         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 173                 my $hexvalue = <FILE>;
 174                 chomp $hexvalue;
 175                 close FILE;
 176                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 177         }
 178 }
 179
 180 sub checkportfw {
 181     my $KEY2 = $_[0]; # key2
 182     my $SRC_PORT = $_[1]; # src_port
 183     my $PROTOCOL = $_[2]; # protocol
 184     my $SRC_IP = $_[3]; # sourceip
 185
 186     my $pfwfilename = "${General::swroot}/portfw/config";
 187     open(FILE, $pfwfilename) or die 'Unable to open config file.';
 188     my @pfwcurrent = <FILE>;
 189     close(FILE);
 190     my $pfwkey1 = 0; # used for finding last sequence number used
 191     foreach my $pfwline (@pfwcurrent)
 192     {
 193         my @pfwtemp = split(/\,/,$pfwline);
 194
 195         chomp ($pfwtemp[8]);
 196         if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
 197                 if ( $SRC_PORT eq $pfwtemp[3] &&
 198                         $PROTOCOL eq $pfwtemp[2] &&
 199                         $SRC_IP eq $pfwtemp[7])
 200                 {
 201                          $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
 202                 }
 203                 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
 204                 if ( $pfwtemp[1] eq "0") {
 205                         $pfwkey1=$pfwtemp[0];
 206                 }
 207                 # Darren Critchley - Duplicate or overlapping Port range check
 208                 if ($pfwtemp[1] eq "0" &&
 209                         $PROTOCOL eq $pfwtemp[2] &&
 210                         $SRC_IP eq $pfwtemp[7] &&
 211                         $errormessage eq '')
 212                 {
 213                         &portchecks($SRC_PORT, $pfwtemp[5]);
 214 #                       &portchecks($pfwtemp[3], $pfwtemp[5]);
 215 #                       &portchecks($pfwtemp[3], $SRC_IP);
 216                 }
 217         }
 218     }
 219 #    $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
 220
 221     return;
 222 }
 223
 224 sub checkportoverlap
 225 {
 226         my $portrange1 = $_[0]; # New port range
 227         my $portrange2 = $_[1]; # existing port range
 228         my @tempr1 = split(/\:/,$portrange1);
 229         my @tempr2 = split(/\:/,$portrange2);
 230
 231         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 232         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 233
 234         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 235         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 236
 237         return 1; # Everything checks out!
 238 }
 239
 240 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 241 sub checkportinc
 242 {
 243         my $port1 = $_[0]; # Port
 244         my $portrange2 = $_[1]; # Port range
 245         my @tempr1 = split(/\:/,$portrange2);
 246
 247         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 248                 return 1;
 249         } else {
 250                 return 0;
 251         }
 252 }
 253 # Darren Critchley - Duplicate or overlapping Port range check
 254 sub portchecks
 255 {
 256         my $p1 = $_[0]; # New port range
 257         my $p2 = $_[1]; # existing port range
 258 #       $_ = $_[0];
 259         our ($prtrange1, $prtrange2);
 260         $prtrange1 = 0;
 261 #       if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
 262 #               unless (&checkportoverlap($p1,$p2)) {
 263 #                       $errormessage = "$Lang::tr{'source port overlaps'} $p1";
 264 #               }
 265 #       }
 266         if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
 267                 unless (&checkportinc($p2,$p1)) {
 268                         $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
 269                 }
 270         }
 271         $prtrange1 = 1;
 272         if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
 273                 unless (&checkportinc($p1,$p2)) {
 274                         $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
 275                 }
 276         }
 277         return;
 278 }
 279
 280 # Darren Critchley - certain ports are reserved for IPFire
 281 # TCP 67,68,81,222,445
 282 # UDP 67,68
 283 # Params passed in -> port, rangeyn, protocol
 284 sub disallowreserved
 285 {
 286         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 287         my $msg = "";
 288         my @tcp_reserved = (81,222,445);
 289         my $prt = $_[0]; # the port or range
 290         my $ryn = $_[1]; # tells us whether or not it is a port range
 291         my $prot = $_[2]; # protocol
 292         my $srcdst = $_[3]; # source or destination
 293         if ($ryn) { # disect port range
 294                 if ($srcdst eq "src") {
 295                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 296                 } else {
 297                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 298                 }
 299                 my @tmprng = split(/\:/,$prt);
 300                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 301                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 302                 if ($prot eq "tcp") {
 303                         foreach my $prange (@tcp_reserved) {
 304                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 305                         }
 306                 }
 307         } else {
 308                 if ($srcdst eq "src") {
 309                         $msg = "$Lang::tr{'reserved src port'}";
 310                 } else {
 311                         $msg = "$Lang::tr{'reserved dst port'}";
 312                 }
 313                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 314                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 315                 if ($prot eq "tcp") {
 316                         foreach my $prange (@tcp_reserved) {
 317                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 318                         }
 319                 }
 320         }
 321         return;
 322 }
 323
 324 sub writeserverconf {
 325     my %sovpnsettings = ();
 326     my @temp = ();
 327     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 328     &read_routepushfile;
 329
 330     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 331     flock CONF, 2;
 332     print CONF "#OpenVPN Server conf\n";
 333     print CONF "\n";
 334     print CONF "daemon openvpnserver\n";
 335     print CONF "writepid /var/run/openvpn.pid\n";
 336     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 337     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 338     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 339     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 340     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 341     print CONF "script-security 3 system\n";
 342     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 343     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 344     print CONF "tls-server\n";
 345     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 346     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 347     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 348     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 349     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 350     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 351     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 352
 353     # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
 354     # If we doesn't use one of them, we can use the configured mtu value.
 355     if ($sovpnsettings{'MSSFIX'} eq 'on')
 356         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 357     elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
 358         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 359     elsif (($sovpnsettings{'PMTU_DISCOVERY'} ne 'off') || ($sovpnsettings{'PMTU_DISCOVERY'} ne ''))
 360         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 361     else
 362         { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
 363
 364     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 365                 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 366                 foreach (@temp)
 367                 {
 368                         @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 369                         print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 370                 }
 371         }
 372 # a.marx ccd
 373         my %ccdconfhash=();
 374         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 375         foreach my $key (keys %ccdconfhash) {
 376                 my $a=$ccdconfhash{$key}[1];
 377                 my ($b,$c) = split (/\//, $a);
 378                 print CONF "route $b ".&General::cidrtosub($c)."\n";
 379         }
 380         my %ccdroutehash=();
 381         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 382         foreach my $key (keys %ccdroutehash) {
 383                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
 384                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
 385                         print CONF "route $a $b\n";
 386                 }
 387         }
 388 # ccd end
 389
 390         if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 391         print CONF "client-to-client\n";
 392     }
 393     if ($sovpnsettings{MSSFIX} eq 'on') {
 394         print CONF "mssfix\n";
 395     }
 396     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 397         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 398     }
 399
 400     if (($sovpnsettings{PMTU_DISCOVERY} ne 'off') || ($sovpnsettings{'PMTU_DISCOVERY'} ne '')) {
 401         print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
 402     }
 403
 404     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 405         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 406     }
 407     print CONF "status-version 1\n";
 408     print CONF "status /var/log/ovpnserver.log 30\n";
 409     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 410     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 411         print CONF "comp-lzo\n";
 412     }
 413     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 414         print CONF "push \"redirect-gateway def1\"\n";
 415     }
 416     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 417         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 418     }
 419
 420     if ($sovpnsettings{DHCP_DNS} ne '') {
 421         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 422     }
 423
 424     if ($sovpnsettings{DHCP_WINS} ne '') {
 425         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 426     }
 427
 428     if ($sovpnsettings{DHCP_WINS} eq '') {
 429         print CONF "max-clients 100\n";
 430     }
 431     if ($sovpnsettings{DHCP_WINS} ne '') {
 432         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 433     }
 434     print CONF "tls-verify /var/ipfire/ovpn/verify\n";
 435     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 436     print CONF "user nobody\n";
 437     print CONF "group nobody\n";
 438     print CONF "persist-key\n";
 439     print CONF "persist-tun\n";
 440         if ($sovpnsettings{LOG_VERB} ne '') {
 441                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 442         } else {
 443                 print CONF "verb 3\n";
 444         }
 445     print CONF "\n";
 446
 447     close(CONF);
 448 }
 449
 450 sub emptyserverlog{
 451     if (open(FILE, ">/var/log/ovpnserver.log")) {
 452         flock FILE, 2;
 453         print FILE "";
 454         close FILE;
 455     }
 456
 457 }
 458
 459 sub delccdnet
 460 {
 461         my %ccdconfhash = ();
 462         my %ccdhash = ();
 463         my $ccdnetname=$_[0];
 464         if (-f "${General::swroot}/ovpn/ovpnconfig"){
 465                 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 466                 foreach my $key (keys %ccdhash) {
 467                         if ($ccdhash{$key}[32] eq $ccdnetname) {
 468                                 $errormessage=$Lang::tr{'ccd err hostinnet'};
 469                                 return;
 470                         }
 471                 }
 472         }
 473         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 474         foreach my $key (keys %ccdconfhash) {
 475                         if ($ccdconfhash{$key}[0] eq $ccdnetname){
 476                                 delete $ccdconfhash{$key};
 477                         }
 478         }
 479         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 480
 481         &writeserverconf;
 482         return 0;
 483 }
 484
 485 sub addccdnet
 486 {
 487         my %ccdconfhash=();
 488         my @ccdconf=();
 489         my $ccdname=$_[0];
 490         my $ccdnet=$_[1];
 491         my $ovpnsubnet=$_[2];
 492         my $subcidr;
 493         my @ip2=();
 494         my $checkup;
 495         my $ccdip;
 496         my $baseaddress;
 497
 498
 499         #check name
 500         if ($ccdname eq '')
 501         {
 502                 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
 503                 return
 504         }
 505
 506         if(!&General::validhostname($ccdname))
 507         {
 508                 $errormessage=$Lang::tr{'ccd err invalidname'};
 509                 return;
 510         }
 511
 512         ($ccdip,$subcidr) = split (/\//,$ccdnet);
 513         $subcidr=&General::iporsubtocidr($subcidr);
 514         #check subnet
 515         if ($subcidr > 30)
 516         {
 517                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 518                 return;
 519         }
 520         #check ip
 521         if (!&General::validipandmask($ccdnet)){
 522                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 523                 return;
 524         }
 525
 526
 527         #check if we try to use same network as ovpn server
 528         if (&General::iporsubtocidr($ccdnet) eq &General::iporsubtocidr($ovpnsubnet)) {
 529                         $errormessage=$errormessage.$Lang::tr{'ccd err isovpnnet'}."<br>";
 530         }
 531
 532         #check if we use a name/subnet that already exists
 533         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 534         foreach my $key (keys %ccdconfhash) {
 535                         @ccdconf=split(/\//,$ccdconfhash{$key}[1]);
 536                         if ($ccdname eq $ccdconfhash{$key}[0]) {$errormessage=$errormessage.$Lang::tr{'ccd err nameexist'}."<br>";}
 537                         my ($newip,$newsub) = split(/\//,$ccdnet);
 538                         if (&General::IpInSubnet($newip,$ccdconf[0],&General::iporsubtodec($ccdconf[1]))) {$errormessage=$errormessage.$Lang::tr{'ccd err issubnet'}."<br>";}
 539
 540         }
 541         #check if we use one of ipfire's networks (green,orange,blue)
 542         my %ownnet=();
 543         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
 544         if (($ownnet{'GREEN_NETADDRESS'}        ne '' && $ownnet{'GREEN_NETADDRESS'}    ne '0.0.0.0') && &General::IpInSubnet($ownnet{'GREEN_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err green'};}
 545         if (($ownnet{'ORANGE_NETADDRESS'}       ne '' && $ownnet{'ORANGE_NETADDRESS'}   ne '0.0.0.0') && &General::IpInSubnet($ownnet{'ORANGE_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err orange'};}
 546         if (($ownnet{'BLUE_NETADDRESS'}         ne '' && $ownnet{'BLUE_NETADDRESS'}     ne '0.0.0.0') && &General::IpInSubnet($ownnet{'BLUE_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err blue'};}
 547         if (($ownnet{'RED_NETADDRESS'}  ne '' && $ownnet{'RED_NETADDRESS'}      ne '0.0.0.0') && &General::IpInSubnet($ownnet{'RED_NETADDRESS'},$ccdip,&General::iporsubtodec($subcidr))){ $errormessage=$Lang::tr{'ccd err red'};}
 548
 549
 550         if (!$errormessage) {
 551                 my %ccdconfhash=();
 552                 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
 553                 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 554                 my $key = &General::findhasharraykey (\%ccdconfhash);
 555                 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
 556                 $ccdconfhash{$key}[0] = $ccdname;
 557                 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
 558                 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 559                 &writeserverconf;
 560                 $cgiparams{'ccdname'}='';
 561                 $cgiparams{'ccdsubnet'}='';
 562                 return 1;
 563         }
 564 }
 565
 566 sub modccdnet
 567 {
 568
 569         my $newname=$_[0];
 570         my $oldname=$_[1];
 571         my %ccdconfhash=();
 572         my %ccdhash=();
 573         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 574         foreach my $key (keys %ccdconfhash) {
 575                 if ($ccdconfhash{$key}[0] eq $oldname) {
 576                         foreach my $key1 (keys %ccdconfhash) {
 577                                 if ($ccdconfhash{$key1}[0] eq $newname){
 578                                         $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
 579                                         return;
 580                                 }else{
 581                                         $ccdconfhash{$key}[0]= $newname;
 582                                         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 583                                         last;
 584                                 }
 585                         }
 586                 }
 587         }
 588
 589         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 590                 foreach my $key (keys %ccdhash) {
 591                         if ($ccdhash{$key}[32] eq $oldname) {
 592                                 $ccdhash{$key}[32]=$newname;
 593                                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 594                                 last;
 595                         }
 596                 }
 597
 598         return 0;
 599 }
 600 sub ccdmaxclients
 601 {
 602         my $ccdnetwork=$_[0];
 603         my @octets=();
 604         my @subnet=();
 605         @octets=split("\/",$ccdnetwork);
 606         @subnet= split /\./, &General::cidrtosub($octets[1]);
 607         my ($a,$b,$c,$d,$e);
 608         $a=256-$subnet[0];
 609         $b=256-$subnet[1];
 610         $c=256-$subnet[2];
 611         $d=256-$subnet[3];
 612         $e=($a*$b*$c*$d)/4;
 613         return $e-1;
 614 }
 615
 616 sub getccdadresses
 617 {
 618         my $ipin=$_[0];
 619         my ($ip1,$ip2,$ip3,$ip4)=split  /\./, $ipin;
 620         my $cidr=$_[1];
 621         chomp($cidr);
 622         my $count=$_[2];
 623         my $hasip=$_[3];
 624         chomp($hasip);
 625         my @iprange=();
 626         my %ccdhash=();
 627         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 628         $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
 629         for (my $i=0;$i<=$count-1;$i++) {
 630                 my $tmpip=$iprange[$i-1];
 631                 my $stepper=$i*4;
 632                 $iprange[$i]= &General::getnextip($tmpip,4);
 633         }
 634         my $r=0;
 635         foreach my $key (keys %ccdhash) {
 636                 $r=0;
 637                 foreach  my $tmp (@iprange){
 638                         my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
 639                         if ($net eq $tmp) {
 640                                 if ( $hasip ne  $ccdhash{$key}[33] ){
 641                                         splice (@iprange,$r,1);
 642                                 }
 643                         }
 644                         $r++;
 645                 }
 646         }
 647         return @iprange;
 648 }
 649
 650 sub fillselectbox
 651 {
 652         my $boxname=$_[1];
 653         my ($ccdip,$subcidr) = split("/",$_[0]);
 654         my $tz=$_[2];
 655         my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
 656         print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
 657         foreach (@allccdips) {
 658                 my $ip=$_."/30";
 659                 chomp($ip);
 660                 print "<option value='$ip' ";
 661                 if ( $ip eq $cgiparams{$boxname} ){
 662                         print"selected";
 663                 }
 664                 print ">$ip</option>";
 665         }
 666         print "</select>";
 667 }
 668
 669 sub hostsinnet
 670 {
 671         my $name=$_[0];
 672         my %ccdhash=();
 673         my $i=0;
 674         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 675         foreach my $key (keys %ccdhash) {
 676                 if ($ccdhash{$key}[32] eq $name){ $i++;}
 677         }
 678         return $i;
 679 }
 680
 681 sub check_routes_push
 682 {
 683                         my $val=$_[0];
 684                         my ($ip,$cidr) = split (/\//, $val);
 685                         ##check for existing routes in routes_push
 686                         if (-e "${General::swroot}/ovpn/routes_push") {
 687                                 open(FILE,"${General::swroot}/ovpn/routes_push");
 688                                 while (<FILE>) {
 689                                         $_=~s/\s*$//g;
 690
 691                                         my ($ip2,$cidr2) = split (/\//,"$_");
 692                                         my $val2=$ip2."/".&General::iporsubtodec($cidr2);
 693
 694                                         if($val eq $val2){
 695                                                 return 0;
 696                                         }
 697                                         #subnetcheck
 698                                         if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
 699                                                 return 0;
 700                                         }
 701                                 };
 702                                 close(FILE);
 703                         }
 704         return 1;
 705 }
 706
 707 sub check_ccdroute
 708 {
 709         my %ccdroutehash=();
 710         my $val=$_[0];
 711         my ($ip,$cidr) = split (/\//, $val);
 712         #check for existing routes in ccdroute
 713         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 714         foreach my $key (keys %ccdroutehash) {
 715                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 716                         if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
 717                                 return 0;
 718                         }
 719                         my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
 720                         #subnetcheck
 721                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
 722                                 return 0;
 723                         }
 724                 }
 725         }
 726         return 1;
 727 }
 728 sub check_ccdconf
 729 {
 730         my %ccdconfhash=();
 731         my $val=$_[0];
 732         my ($ip,$cidr) = split (/\//, $val);
 733         #check for existing routes in ccdroute
 734         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 735         foreach my $key (keys %ccdconfhash) {
 736                 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
 737                                 return 0;
 738                         }
 739                         my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
 740                         #subnetcheck
 741                         if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
 742                                 return 0;
 743                         }
 744
 745         }
 746         return 1;
 747 }
 748
 749 ###
 750 # m.a.d net2net
 751 ###
 752
 753 sub validdotmask
 754 {
 755         my $ipdotmask = $_[0];
 756         if (&General::validip($ipdotmask)) { return 0; }
 757         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 758         my $mask = $2;
 759         if (($mask =~ /\./ )) { return 0; }
 760   return 1;
 761 }
 762
 763 # -------------------------------------------------------------------
 764
 765 sub write_routepushfile
 766 {
 767         open(FILE, ">$routes_push_file");
 768         flock(FILE, 2);
 769         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 770                 print FILE $vpnsettings{'ROUTES_PUSH'};
 771         }
 772         close(FILE);
 773 }
 774
 775 sub read_routepushfile
 776 {
 777         if (-e "$routes_push_file") {
 778                 open(FILE,"$routes_push_file");
 779                 delete $vpnsettings{'ROUTES_PUSH'};
 780                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 781                 close(FILE);
 782                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 783
 784         }
 785 }
 786
 787
 788 #hier die refresh page
 789 if ( -e "${General::swroot}/ovpn/gencanow") {
 790     my $refresh = '';
 791     $refresh = "<meta http-equiv='refresh' content='15;' />";
 792     &Header::showhttpheaders();
 793     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 794     &Header::openbigbox('100%', 'center');
 795     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 796     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 797     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 798     &Header::closebox();
 799     &Header::closebigbox();
 800     &Header::closepage();
 801     exit (0);
 802 }
 803 ##hier die refresh page
 804
 805
 806 ###
 807 ### OpenVPN Server Control
 808 ###
 809 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 810     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 811     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 812     #start openvpn server
 813     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 814         &emptyserverlog();
 815         system('/usr/local/bin/openvpnctrl', '-s');
 816     }
 817     #stop openvpn server
 818     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 819         system('/usr/local/bin/openvpnctrl', '-k');
 820         &emptyserverlog();
 821     }
 822 #    #restart openvpn server
 823 #    if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 824 #workarund, till SIGHUP also works when running as nobody
 825 #       system('/usr/local/bin/openvpnctrl', '-r');
 826 #       &emptyserverlog();
 827 #    }
 828 }
 829
 830 ###
 831 ### Save Advanced options
 832 ###
 833
 834 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 835     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 836     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 837     #DAN this value has to leave.
 838 #new settings for daemon
 839     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 840     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 841     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 842     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 843     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 844     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 845     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 846     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 847     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 848     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 849     $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
 850     my @temp=();
 851
 852     if ($cgiparams{'FRAGMENT'} eq '') {
 853         delete $vpnsettings{'FRAGMENT'};
 854     } else {
 855         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 856             $errormessage = "Incorrect value, please insert only numbers.";
 857         goto ADV_ERROR;
 858                 } else {
 859                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 860         }
 861     }
 862     if ($cgiparams{'MSSFIX'} ne 'on') {
 863         delete $vpnsettings{'MSSFIX'};
 864     } else {
 865         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 866     }
 867
 868     if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') {
 869         if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
 870                 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
 871                 goto ADV_ERROR;
 872         }
 873     }
 874
 875     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 876         unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 877                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 878         goto ADV_ERROR;
 879         }
 880     }
 881     if ($cgiparams{'DHCP_DNS'} ne ''){
 882         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 883                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 884         goto ADV_ERROR;
 885         }
 886     }
 887     if ($cgiparams{'DHCP_WINS'} ne ''){
 888         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 889                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 890                 goto ADV_ERROR;
 891         }
 892     }
 893     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 894         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 895         undef $vpnsettings{'ROUTES_PUSH'};
 896
 897         foreach my $tmpip (@temp)
 898         {
 899                 s/^\s+//g; s/\s+$//g;
 900
 901                 if ($tmpip)
 902                 {
 903                         $tmpip=~s/\s*$//g;
 904                         unless (&General::validipandmask($tmpip)) {
 905                                 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
 906                                 goto ADV_ERROR;
 907                         }
 908                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
 909
 910                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 911                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 912                                 goto ADV_ERROR;
 913                         }
 914 # a.marx ccd
 915                         my %ccdroutehash=();
 916                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 917                         foreach my $key (keys %ccdroutehash) {
 918                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 919                                         if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
 920                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 921                                                 goto ADV_ERROR;
 922                                         }
 923                                         my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
 924                                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
 925                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 926                                                 goto ADV_ERROR;
 927                                         }
 928                                 }
 929                         }
 930
 931 # ccd end
 932
 933                         $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
 934                 }
 935         }
 936     &write_routepushfile;
 937         undef $vpnsettings{'ROUTES_PUSH'};
 938     }
 939         else {
 940         undef $vpnsettings{'ROUTES_PUSH'};
 941         &write_routepushfile;
 942     }
 943     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 944         $errormessage = $Lang::tr{'invalid input for max clients'};
 945         goto ADV_ERROR;
 946     }
 947     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 948         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 949             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 950         goto ADV_ERROR;
 951         }
 952     }
 953     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 954         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 955             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 956         goto ADV_ERROR;
 957         }
 958     }
 959     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 960         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 961         goto ADV_ERROR;
 962     }
 963
 964     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 965     &writeserverconf();#hier ok
 966 }
 967
 968 ###
 969 # m.a.d net2net
 970 ###
 971
 972 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 973 {
 974
 975 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 976 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 977 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 978 my $tunmtu =  '';
 979
 980 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 981 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 982
 983   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 984
 985   flock SERVERCONF, 2;
 986   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 987   print SERVERCONF "\n";
 988   print SERVERCONF "# User Security\n";
 989   print SERVERCONF "user nobody\n";
 990   print SERVERCONF "group nobody\n";
 991   print SERVERCONF "persist-tun\n";
 992   print SERVERCONF "persist-key\n";
 993   print SERVERCONF "script-security 2\n";
 994   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 995   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 996   print SERVERCONF "float\n";
 997   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 998   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 999   print SERVERCONF "# Client Gateway Network\n";
1000   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
1001   print SERVERCONF "# tun Device\n";
1002   print SERVERCONF "dev tun\n";
1003   print SERVERCONF "# Port and Protokol\n";
1004   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
1005
1006   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1007   print SERVERCONF "proto tcp-server\n";
1008   print SERVERCONF "# Packet size\n";
1009   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1010   print SERVERCONF "tun-mtu $tunmtu\n";
1011   }
1012
1013   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1014   print SERVERCONF "proto udp\n";
1015   print SERVERCONF "# Paketsize\n";
1016   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1017   print SERVERCONF "tun-mtu $tunmtu\n";
1018   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1019   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
1020   }
1021   if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne '')) {
1022         if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1023                 if($cgiparams{'MTU'} eq '1500') {
1024                         print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1025                 }
1026         }
1027   }
1028   print SERVERCONF "# Auth. Server\n";
1029   print SERVERCONF "tls-server\n";
1030   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
1031   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
1032   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
1033   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
1034   print SERVERCONF "# Cipher\n";
1035   print SERVERCONF "cipher AES-256-CBC\n";
1036   if ($cgiparams{'COMPLZO'} eq 'on') {
1037    print SERVERCONF "# Enable Compression\n";
1038    print SERVERCONF "comp-lzo\r\n";
1039      }
1040   print SERVERCONF "# Debug Level\n";
1041   print SERVERCONF "verb 3\n";
1042   print SERVERCONF "# Tunnel check\n";
1043   print SERVERCONF "keepalive 10 60\n";
1044   print SERVERCONF "# Start as daemon\n";
1045   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1046   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1047   print SERVERCONF "# Activate Management Interface and Port\n";
1048   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1049   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1050   close(SERVERCONF);
1051
1052 }
1053
1054 ###
1055 # m.a.d net2net
1056 ###
1057
1058 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1059 {
1060         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
1061         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1062         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
1063         my $tunmtu =  '';
1064
1065 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1066 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1067
1068   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1069
1070   flock CLIENTCONF, 2;
1071   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1072   print CLIENTCONF "#\n";
1073   print CLIENTCONF "# User Security\n";
1074   print CLIENTCONF "user nobody\n";
1075   print CLIENTCONF "group nobody\n";
1076   print CLIENTCONF "persist-tun\n";
1077   print CLIENTCONF "persist-key\n";
1078   print CLIENTCONF "script-security 2\n";
1079   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1080   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1081   print CLIENTCONF "float\n";
1082   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1083   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1084   print CLIENTCONF "# Server Gateway Network\n";
1085   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1086   print CLIENTCONF "# tun Device\n";
1087   print CLIENTCONF "dev tun\n";
1088   print CLIENTCONF "# Port and Protokol\n";
1089   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1090
1091   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1092   print CLIENTCONF "proto tcp-client\n";
1093   print CLIENTCONF "# Packet size\n";
1094   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1095   print CLIENTCONF "tun-mtu $tunmtu\n";
1096   }
1097
1098   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1099   print CLIENTCONF "proto udp\n";
1100   print CLIENTCONF "# Paketsize\n";
1101   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1102   print CLIENTCONF "tun-mtu $tunmtu\n";
1103   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1104   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1105   }
1106    if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne '')) {
1107         if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1108                 if ($cgiparams{'MTU'} eq '1500') {
1109                         print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1110                 }
1111         }
1112   }
1113   print CLIENTCONF "ns-cert-type server\n";
1114   print CLIENTCONF "# Auth. Client\n";
1115   print CLIENTCONF "tls-client\n";
1116   print CLIENTCONF "# Cipher\n";
1117   print CLIENTCONF "cipher AES-256-CBC\n";
1118   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1119   if ($cgiparams{'COMPLZO'} eq 'on') {
1120    print CLIENTCONF "# Enable Compression\n";
1121    print CLIENTCONF "comp-lzo\r\n";
1122      }
1123   print CLIENTCONF "# Debug Level\n";
1124   print CLIENTCONF "verb 3\n";
1125   print CLIENTCONF "# Tunnel check\n";
1126   print CLIENTCONF "keepalive 10 60\n";
1127   print CLIENTCONF "# Start as daemon\n";
1128   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1129   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1130   print CLIENTCONF "# Activate Management Interface and Port\n";
1131   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1132   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1133   close(CLIENTCONF);
1134
1135 }
1136
1137 ###
1138 ### Save main settings
1139 ###
1140
1141
1142 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1143     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1144     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1145     #DAN this value has to leave.
1146     if ($cgiparams{'ENABLED'} eq 'on'){
1147         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1148                 $errormessage = $Lang::tr{'invalid input for hostname'};
1149         goto SETTINGS_ERROR;
1150         }
1151     }
1152     if ($cgiparams{'ENABLED'} eq 'on'){
1153         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
1154     }
1155     if ($errormessage) { goto SETTINGS_ERROR; }
1156
1157
1158     if ($cgiparams{'ENABLED'} eq 'on'){
1159         &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
1160     }
1161
1162     if ($errormessage) { goto SETTINGS_ERROR; }
1163
1164     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1165             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1166         goto SETTINGS_ERROR;
1167     }
1168     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1169
1170     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1171         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1172         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1173         goto SETTINGS_ERROR;
1174     }
1175
1176     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1177         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1178         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1179         goto SETTINGS_ERROR;
1180     }
1181
1182     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1183         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1184         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1185         goto SETTINGS_ERROR;
1186     }
1187
1188     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1189         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1190         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1191         goto SETTINGS_ERROR;
1192     }
1193     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1194     while (<ALIASES>)
1195     {
1196         chomp($_);
1197         my @tempalias = split(/\,/,$_);
1198         if ($tempalias[1] eq 'on') {
1199             if (&General::IpInSubnet ($tempalias[0] ,
1200                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1201                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1202             }
1203         }
1204     }
1205     close(ALIASES);
1206     if ($errormessage ne ''){
1207         goto SETTINGS_ERROR;
1208     }
1209     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1210         $errormessage = $Lang::tr{'invalid input'};
1211         goto SETTINGS_ERROR;
1212     }
1213     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1214         $errormessage = $Lang::tr{'invalid mtu input'};
1215         goto SETTINGS_ERROR;
1216     }
1217
1218     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1219         $errormessage = $Lang::tr{'invalid port'};
1220         goto SETTINGS_ERROR;
1221     }
1222     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1223     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1224     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1225     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1226 #new settings for daemon
1227     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1228     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1229     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1230     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1231     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1232     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1233     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1234 #wrtie enable
1235
1236   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1237   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1238   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1239 #new settings for daemon
1240     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1241     &writeserverconf();#hier ok
1242 SETTINGS_ERROR:
1243 ###
1244 ### Reset all step 2
1245 ###
1246 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1247     my $file = '';
1248     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1249
1250     foreach my $key (keys %confighash) {
1251         if ($confighash{$key}[4] eq 'cert') {
1252             delete $confighash{$cgiparams{'$key'}};
1253         }
1254     }
1255     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1256         unlink $file
1257     }
1258     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1259         unlink $file
1260     }
1261     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1262         unlink $file
1263     }
1264     &cleanssldatabase();
1265     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1266         print FILE "";
1267         close FILE;
1268     }
1269     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1270     #&writeserverconf();
1271 ###
1272 ### Reset all step 1
1273 ###
1274 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1275     &Header::showhttpheaders();
1276     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1277     &Header::openbigbox('100%', 'LEFT', '', '');
1278     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1279     print <<END
1280         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1281             <tr><td align='center'>
1282                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1283                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1284             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1285                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1286         </form></table>
1287 END
1288     ;
1289     &Header::closebox();
1290     &Header::closebigbox();
1291     &Header::closepage();
1292     exit (0);
1293
1294 ###
1295 ### Upload CA Certificate
1296 ###
1297 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1298     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1299
1300     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1301         $errormessage = $Lang::tr{'name must only contain characters'};
1302         goto UPLOADCA_ERROR;
1303     }
1304
1305     if (length($cgiparams{'CA_NAME'}) >60) {
1306         $errormessage = $Lang::tr{'name too long'};
1307         goto VPNCONF_ERROR;
1308     }
1309
1310     if ($cgiparams{'CA_NAME'} eq 'ca') {
1311         $errormessage = $Lang::tr{'name is invalid'};
1312         goto UPLOAD_CA_ERROR;
1313     }
1314
1315     # Check if there is no other entry with this name
1316     foreach my $key (keys %cahash) {
1317         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1318             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1319             goto UPLOADCA_ERROR;
1320         }
1321     }
1322
1323     if (ref ($cgiparams{'FH'}) ne 'Fh') {
1324         $errormessage = $Lang::tr{'there was no file upload'};
1325         goto UPLOADCA_ERROR;
1326     }
1327     # Move uploaded ca to a temporary file
1328     (my $fh, my $filename) = tempfile( );
1329     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1330         $errormessage = $!;
1331         goto UPLOADCA_ERROR;
1332     }
1333     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1334     if ($temp !~ /CA:TRUE/i) {
1335         $errormessage = $Lang::tr{'not a valid ca certificate'};
1336         unlink ($filename);
1337         goto UPLOADCA_ERROR;
1338     } else {
1339         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1340         if ($? ne 0) {
1341             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1342             unlink ($filename);
1343             goto UPLOADCA_ERROR;
1344         }
1345     }
1346
1347     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1348     $casubject    =~ /Subject: (.*)[\n]/;
1349     $casubject    = $1;
1350     $casubject    =~ s+/Email+, E+;
1351     $casubject    =~ s/ ST=/ S=/;
1352     $casubject    = &Header::cleanhtml($casubject);
1353
1354     my $key = &General::findhasharraykey (\%cahash);
1355     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1356     $cahash{$key}[1] = $casubject;
1357     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1358 #    system('/usr/local/bin/ipsecctrl', 'R');
1359
1360     UPLOADCA_ERROR:
1361
1362 ###
1363 ### Display ca certificate
1364 ###
1365 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1366     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1367
1368     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1369         &Header::showhttpheaders();
1370         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1371         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1372         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1373         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1374         $output = &Header::cleanhtml($output,"y");
1375         print "<pre>$output</pre>\n";
1376         &Header::closebox();
1377         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1378         &Header::closebigbox();
1379         &Header::closepage();
1380         exit(0);
1381     } else {
1382         $errormessage = $Lang::tr{'invalid key'};
1383     }
1384
1385 ###
1386 ### Download ca certificate
1387 ###
1388 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1389     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1390
1391     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1392         print "Content-Type: application/octet-stream\r\n";
1393         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1394         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1395         exit(0);
1396     } else {
1397         $errormessage = $Lang::tr{'invalid key'};
1398     }
1399
1400 ###
1401 ### Remove ca certificate (step 2)
1402 ###
1403 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1404     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1405     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1406
1407     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1408         foreach my $key (keys %confighash) {
1409             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1410             if ($test =~ /: OK/) {
1411                 # Delete connection
1412 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1413 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1414 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1415 #               }
1416                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1417                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1418                 delete $confighash{$key};
1419                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1420 #               &writeipsecfiles();
1421             }
1422         }
1423         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1424         delete $cahash{$cgiparams{'KEY'}};
1425         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1426 #       system('/usr/local/bin/ipsecctrl', 'R');
1427     } else {
1428         $errormessage = $Lang::tr{'invalid key'};
1429     }
1430 ###
1431 ### Remove ca certificate (step 1)
1432 ###
1433 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1434     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1435     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1436
1437     my $assignedcerts = 0;
1438     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1439         foreach my $key (keys %confighash) {
1440             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1441             if ($test =~ /: OK/) {
1442                 $assignedcerts++;
1443             }
1444         }
1445         if ($assignedcerts) {
1446             &Header::showhttpheaders();
1447             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1448             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1449             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1450             print <<END
1451                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1452                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1453                     <tr><td align='center'>
1454                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1455                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1456                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1457                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1458                 </form></table>
1459 END
1460             ;
1461             &Header::closebox();
1462             &Header::closebigbox();
1463             &Header::closepage();
1464             exit (0);
1465         } else {
1466             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1467             delete $cahash{$cgiparams{'KEY'}};
1468             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1469 #           system('/usr/local/bin/ipsecctrl', 'R');
1470         }
1471     } else {
1472         $errormessage = $Lang::tr{'invalid key'};
1473     }
1474
1475 ###
1476 ### Display root certificate
1477 ###
1478 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1479     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1480     my $output;
1481     &Header::showhttpheaders();
1482     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1483     &Header::openbigbox('100%', 'LEFT', '', '');
1484     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1485         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1486         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1487     } else {
1488         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1489         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1490     }
1491     $output = &Header::cleanhtml($output,"y");
1492     print "<pre>$output</pre>\n";
1493     &Header::closebox();
1494     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1495     &Header::closebigbox();
1496     &Header::closepage();
1497     exit(0);
1498
1499 ###
1500 ### Download root certificate
1501 ###
1502 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1503     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1504         print "Content-Type: application/octet-stream\r\n";
1505         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1506         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1507         exit(0);
1508     }
1509
1510 ###
1511 ### Download host certificate
1512 ###
1513 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1514     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1515         print "Content-Type: application/octet-stream\r\n";
1516         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1517         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1518         exit(0);
1519     }
1520 ###
1521 ### Form for generating a root certificate
1522 ###
1523 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1524          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1525
1526     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1527     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1528         $errormessage = $Lang::tr{'valid root certificate already exists'};
1529         $cgiparams{'ACTION'} = '';
1530         goto ROOTCERT_ERROR;
1531     }
1532
1533     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1534         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1535             my $ipaddr = <IPADDR>;
1536             close IPADDR;
1537             chomp ($ipaddr);
1538             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1539             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1540                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1541             }
1542         }
1543     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1544
1545         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1546             $errormessage = $Lang::tr{'there was no file upload'};
1547             goto ROOTCERT_ERROR;
1548         }
1549
1550         # Move uploaded certificate request to a temporary file
1551         (my $fh, my $filename) = tempfile( );
1552         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1553             $errormessage = $!;
1554             goto ROOTCERT_ERROR;
1555         }
1556
1557         # Create a temporary dirctory
1558         my $tempdir = tempdir( CLEANUP => 1 );
1559
1560         # Extract the CA certificate from the file
1561         my $pid = open(OPENSSL, "|-");
1562         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1563         if ($pid) {     # parent
1564             if ($cgiparams{'P12_PASS'} ne '') {
1565                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1566             }
1567             close (OPENSSL);
1568             if ($?) {
1569                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1570                 unlink ($filename);
1571                 goto ROOTCERT_ERROR;
1572             }
1573         } else {        # child
1574             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1575                     '-in', $filename,
1576                     '-out', "$tempdir/cacert.pem")) {
1577                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1578                 unlink ($filename);
1579                 goto ROOTCERT_ERROR;
1580             }
1581         }
1582
1583         # Extract the Host certificate from the file
1584         $pid = open(OPENSSL, "|-");
1585         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1586         if ($pid) {     # parent
1587             if ($cgiparams{'P12_PASS'} ne '') {
1588                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1589             }
1590             close (OPENSSL);
1591             if ($?) {
1592                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1593                 unlink ($filename);
1594                 goto ROOTCERT_ERROR;
1595             }
1596         } else {        # child
1597             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1598                     '-in', $filename,
1599                     '-out', "$tempdir/hostcert.pem")) {
1600                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1601                 unlink ($filename);
1602                 goto ROOTCERT_ERROR;
1603             }
1604         }
1605
1606         # Extract the Host key from the file
1607         $pid = open(OPENSSL, "|-");
1608         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1609         if ($pid) {     # parent
1610             if ($cgiparams{'P12_PASS'} ne '') {
1611                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1612             }
1613             close (OPENSSL);
1614             if ($?) {
1615                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1616                 unlink ($filename);
1617                 goto ROOTCERT_ERROR;
1618             }
1619         } else {        # child
1620             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1621                     '-nodes',
1622                     '-in', $filename,
1623                     '-out', "$tempdir/serverkey.pem")) {
1624                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1625                 unlink ($filename);
1626                 goto ROOTCERT_ERROR;
1627             }
1628         }
1629
1630         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1631         if ($? ne 0) {
1632             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1633             unlink ($filename);
1634             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1635             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1636             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1637             goto ROOTCERT_ERROR;
1638         }
1639
1640         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1641         if ($? ne 0) {
1642             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1643             unlink ($filename);
1644             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1645             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1646             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1647             goto ROOTCERT_ERROR;
1648         }
1649
1650         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1651         if ($? ne 0) {
1652             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1653             unlink ($filename);
1654             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1655             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1656             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1657             goto ROOTCERT_ERROR;
1658         }
1659
1660         goto ROOTCERT_SUCCESS;
1661
1662     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1663
1664         # Validate input since the form was submitted
1665         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1666             $errormessage = $Lang::tr{'organization cant be empty'};
1667             goto ROOTCERT_ERROR;
1668         }
1669         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1670             $errormessage = $Lang::tr{'organization too long'};
1671             goto ROOTCERT_ERROR;
1672         }
1673         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1674             $errormessage = $Lang::tr{'invalid input for organization'};
1675             goto ROOTCERT_ERROR;
1676         }
1677         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1678             $errormessage = $Lang::tr{'hostname cant be empty'};
1679             goto ROOTCERT_ERROR;
1680         }
1681         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1682             $errormessage = $Lang::tr{'invalid input for hostname'};
1683             goto ROOTCERT_ERROR;
1684         }
1685         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1686             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1687             goto ROOTCERT_ERROR;
1688         }
1689         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1690             $errormessage = $Lang::tr{'e-mail address too long'};
1691             goto ROOTCERT_ERROR;
1692         }
1693         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1694             $errormessage = $Lang::tr{'invalid input for department'};
1695             goto ROOTCERT_ERROR;
1696         }
1697         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1698             $errormessage = $Lang::tr{'invalid input for city'};
1699             goto ROOTCERT_ERROR;
1700         }
1701         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1702             $errormessage = $Lang::tr{'invalid input for state or province'};
1703             goto ROOTCERT_ERROR;
1704         }
1705         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1706             $errormessage = $Lang::tr{'invalid input for country'};
1707             goto ROOTCERT_ERROR;
1708         }
1709
1710         # Copy the cgisettings to vpnsettings and save the configfile
1711         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1712         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1713         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1714         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1715         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1716         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1717         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1718         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1719
1720         # Replace empty strings with a .
1721         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1722         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1723         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1724
1725         # refresh
1726         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1727
1728         # Create the CA certificate
1729         my $pid = open(OPENSSL, "|-");
1730         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1731         if ($pid) {     # parent
1732             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1733             print OPENSSL "$state\n";
1734             print OPENSSL "$city\n";
1735             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1736             print OPENSSL "$ou\n";
1737             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1738             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1739             close (OPENSSL);
1740             if ($?) {
1741                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1742                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1743                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1744                 goto ROOTCERT_ERROR;
1745             }
1746         } else {        # child
1747             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1748                         '-days', '999999', '-newkey', 'rsa:2048',
1749                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1750                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1751                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1752                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1753                 goto ROOTCERT_ERROR;
1754             }
1755         }
1756
1757         # Create the Host certificate request
1758         $pid = open(OPENSSL, "|-");
1759         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1760         if ($pid) {     # parent
1761             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1762             print OPENSSL "$state\n";
1763             print OPENSSL "$city\n";
1764             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1765             print OPENSSL "$ou\n";
1766             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1767             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1768             print OPENSSL ".\n";
1769             print OPENSSL ".\n";
1770             close (OPENSSL);
1771             if ($?) {
1772                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1773                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1774                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1775                 goto ROOTCERT_ERROR;
1776             }
1777         } else {        # child
1778             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1779                         '-newkey', 'rsa:1024',
1780                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1781                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1782                         '-extensions', 'server',
1783                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1784                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1785                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1786                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1787                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1788                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1789                 goto ROOTCERT_ERROR;
1790             }
1791         }
1792
1793         # Sign the host certificate request
1794         system('/usr/bin/openssl', 'ca', '-days', '999999',
1795                 '-batch', '-notext',
1796                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1797                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1798                 '-extensions', 'server',
1799                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1800         if ($?) {
1801             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1802             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1803             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1804             unlink ("${General::swroot}/ovpn/serverkey.pem");
1805             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1806             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1807             &newcleanssldatabase();
1808             goto ROOTCERT_ERROR;
1809         } else {
1810             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1811             &deletebackupcert();
1812         }
1813
1814         # Create an empty CRL
1815         system('/usr/bin/openssl', 'ca', '-gencrl',
1816                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1817                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1818         if ($?) {
1819             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1820             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1821             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1822             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1823             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1824             &cleanssldatabase();
1825             goto ROOTCERT_ERROR;
1826 #       } else {
1827 #           &cleanssldatabase();
1828         }
1829         # Create Diffie Hellmann Parameter
1830         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1831                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1832                '1024' );
1833         if ($?) {
1834             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1835             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1836             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1837             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1838             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1839             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1840             &cleanssldatabase();
1841             goto ROOTCERT_ERROR;
1842 #       } else {
1843 #           &cleanssldatabase();
1844         }
1845         goto ROOTCERT_SUCCESS;
1846     }
1847     ROOTCERT_ERROR:
1848     if ($cgiparams{'ACTION'} ne '') {
1849         &Header::showhttpheaders();
1850         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1851         &Header::openbigbox('100%', 'LEFT', '', '');
1852         if ($errormessage) {
1853             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1854             print "<class name='base'>$errormessage";
1855             print "&nbsp;</class>";
1856             &Header::closebox();
1857         }
1858         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1859         print <<END
1860         <form method='post' enctype='multipart/form-data'>
1861         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1862         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1863             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1864             <td width='35%' colspan='2'>&nbsp;</td></tr>
1865         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1866             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1867             <td colspan='2'>&nbsp;</td></tr>
1868         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1869             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1870             <td colspan='2'>&nbsp;</td></tr>
1871         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1872             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1873             <td colspan='2'>&nbsp;</td></tr>
1874         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1875             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1876             <td colspan='2'>&nbsp;</td></tr>
1877         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1878             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1879             <td colspan='2'>&nbsp;</td></tr>
1880         <tr><td class='base'>$Lang::tr{'country'}:</td>
1881             <td class='base'><select name='ROOTCERT_COUNTRY'>
1882
1883 END
1884         ;
1885         foreach my $country (sort keys %{Countries::countries}) {
1886             print "<option value='$Countries::countries{$country}'";
1887             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1888                 print " selected='selected'";
1889             }
1890             print ">$country</option>";
1891         }
1892         print <<END
1893             </select></td>
1894             <td colspan='2'>&nbsp;</td></tr>
1895         <tr><td>&nbsp;</td>
1896             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1897             <td>&nbsp;</td><td>&nbsp;</td></tr>
1898         <tr><td class='base' colspan='4' align='left'>
1899             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1900         <tr><td class='base' colspan='4' align='left'>
1901             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1902             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1903         </td></tr>
1904         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1905         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1906             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1907             <td colspan='2'>&nbsp;</td></tr>
1908         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1909             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1910             <td colspan='2'>&nbsp;</td></tr>
1911         <tr><td>&nbsp;</td>
1912             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1913             <td colspan='2'>&nbsp;</td></tr>
1914         <tr><td class='base' colspan='4' align='left'>
1915             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1916         </form></table>
1917 END
1918         ;
1919         &Header::closebox();
1920
1921         &Header::closebigbox();
1922         &Header::closepage();
1923         exit(0)
1924     }
1925
1926     ROOTCERT_SUCCESS:
1927     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1928 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1929 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1930 #       system('/usr/local/bin/ipsecctrl', 'S');
1931 #    }
1932
1933 ###
1934 ### Enable/Disable connection
1935 ###
1936
1937 ###
1938 # m.a.d net2net
1939 ###
1940
1941 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1942
1943     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1944     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1945 #    my $n2nactive = '';
1946     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1947
1948     if ($confighash{$cgiparams{'KEY'}}) {
1949                 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1950                         $confighash{$cgiparams{'KEY'}}[0] = 'on';
1951                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1952
1953                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1954                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1955                         }
1956                 } else {
1957
1958                         $confighash{$cgiparams{'KEY'}}[0] = 'off';
1959                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1960
1961                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1962                     if ($n2nactive ne ''){
1963                                                 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1964                                         }
1965
1966                         } else {
1967                   $errormessage = $Lang::tr{'invalid key'};
1968                         }
1969       }
1970   }
1971
1972 ###
1973 ### Download OpenVPN client package
1974 ###
1975
1976
1977 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1978     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1979     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1980     my $file = '';
1981     my $clientovpn = '';
1982     my @fileholder;
1983     my $tempdir = tempdir( CLEANUP => 1 );
1984     my $zippath = "$tempdir/";
1985
1986 ###
1987 # m.a.d net2net
1988 ###
1989
1990 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1991
1992         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1993         my $zippathname = "$zippath$zipname";
1994         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1995         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1996         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1997         my $tunmtu = '';
1998         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1999         my $n2nfragment = '';
2000
2001     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2002     flock CLIENTCONF, 2;
2003
2004     my $zip = Archive::Zip->new();
2005    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2006    print CLIENTCONF "# \n";
2007    print CLIENTCONF "# User Security\n";
2008    print CLIENTCONF "user nobody\n";
2009    print CLIENTCONF "group nobody\n";
2010    print CLIENTCONF "persist-tun\n";
2011    print CLIENTCONF "persist-key\n";
2012    print CLIENTCONF "script-security 2\n";
2013    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2014    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2015    print CLIENTCONF "float\n";
2016    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2017    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2018    print CLIENTCONF "# Server Gateway Network\n";
2019    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2020    print CLIENTCONF "# tun Device\n";
2021    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
2022    print CLIENTCONF "# Port and Protokoll\n";
2023    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2024
2025    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2026    print CLIENTCONF "proto tcp-client\n";
2027    print CLIENTCONF "# Packet size\n";
2028    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2029    print CLIENTCONF "tun-mtu $tunmtu\n";
2030    }
2031
2032    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2033    print CLIENTCONF "proto udp\n";
2034    print CLIENTCONF "# Paketsize\n";
2035    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2036    print CLIENTCONF "tun-mtu $tunmtu\n";
2037    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2038    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
2039    }
2040    if ($confighash{$cgiparams{'KEY'}}[38] ne 'off') {
2041         if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2042                 if ($tunmtu eq '1500' ) {
2043                         print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2044                 }
2045         }
2046    }
2047    print CLIENTCONF "ns-cert-type server\n";
2048    print CLIENTCONF "# Auth. Client\n";
2049    print CLIENTCONF "tls-client\n";
2050    print CLIENTCONF "# Cipher\n";
2051    print CLIENTCONF "cipher AES-256-CBC\n";
2052     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2053          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2054      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2055    }
2056     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2057    print CLIENTCONF "# Enable Compression\n";
2058    print CLIENTCONF "comp-lzo\r\n";
2059      }
2060    print CLIENTCONF "# Debug Level\n";
2061    print CLIENTCONF "verb 3\n";
2062    print CLIENTCONF "# Tunnel check\n";
2063    print CLIENTCONF "keepalive 10 60\n";
2064    print CLIENTCONF "# Start as daemon\n";
2065    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2066    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2067    print CLIENTCONF "# Activate Management Interface and Port\n";
2068    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2069     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2070    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2071
2072
2073     close(CLIENTCONF);
2074
2075     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2076     my $status = $zip->writeToFileNamed($zippathname);
2077
2078     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2079     @fileholder = <DLFILE>;
2080     print "Content-Type:application/x-download\n";
2081     print "Content-Disposition:attachment;filename=$zipname\n\n";
2082     print @fileholder;
2083     exit (0);
2084 }
2085 else
2086 {
2087         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2088         my $zippathname = "$zippath$zipname";
2089         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2090
2091 ###
2092 # m.a.d net2net
2093 ###
2094
2095     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2096     flock CLIENTCONF, 2;
2097
2098     my $zip = Archive::Zip->new();
2099
2100     print CLIENTCONF "#OpenVPN Client conf\r\n";
2101     print CLIENTCONF "tls-client\r\n";
2102     print CLIENTCONF "client\r\n";
2103     print CLIENTCONF "nobind\n";
2104     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2105     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2106
2107     # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2108     # or use configured value.
2109     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2110         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2111     elsif ($vpnsettings{MSSFIX} eq 'on')
2112         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2113     elsif (($vpnsettings{PMTU_DISCOVERY} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne ''))
2114         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2115     else
2116         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2117
2118     if ( $vpnsettings{'ENABLED'} eq 'on'){
2119         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2120         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2121             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2122             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2123         }
2124         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2125             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2126             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2127         }
2128     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2129         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2130         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2131             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2132             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2133         }
2134     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2135         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2136     }
2137
2138     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2139         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2140         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2141     } else {
2142         print CLIENTCONF "ca cacert.pem\r\n";
2143         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2144         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2145         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2146         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2147     }
2148     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2149     if ($vpnsettings{DCOMPLZO} eq 'on') {
2150         print CLIENTCONF "comp-lzo\r\n";
2151     }
2152     print CLIENTCONF "verb 3\r\n";
2153     print CLIENTCONF "ns-cert-type server\r\n";
2154     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2155     if ($vpnsettings{MSSFIX} eq 'on') {
2156         print CLIENTCONF "mssfix\r\n";
2157     }
2158     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2159         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2160     }
2161     if (($vpnsettings{PMTU_DISCOVERY} ne 'off') || ($cgiparams{'PMTU_DISCOVERY'} ne '')) {
2162         if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2163                 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\n";
2164         }
2165     }
2166     close(CLIENTCONF);
2167
2168     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2169     my $status = $zip->writeToFileNamed($zippathname);
2170
2171     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2172     @fileholder = <DLFILE>;
2173     print "Content-Type:application/x-download\n";
2174     print "Content-Disposition:attachment;filename=$zipname\n\n";
2175     print @fileholder;
2176     exit (0);
2177    }
2178
2179
2180
2181 ###
2182 ### Remove connection
2183 ###
2184
2185
2186 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2187     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2188     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2189
2190     if ($confighash{$cgiparams{'KEY'}}) {
2191 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2192 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2193 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2194 #       }
2195 #
2196         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2197
2198 ###
2199 # m.a.d net2net
2200 ###
2201
2202  if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2203
2204         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2205   my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2206   unlink ($certfile) or die "Removing $certfile fail: $!";
2207   unlink ($conffile) or die "Removing $conffile fail: $!";
2208   rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2209
2210 }
2211
2212   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2213   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2214
2215 # A.Marx CCD delete ccd files and routes
2216
2217
2218         if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2219         {
2220                 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2221         }
2222
2223         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2224         foreach my $key (keys %ccdroutehash) {
2225                 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2226                         delete $ccdroutehash{$key};
2227                 }
2228         }
2229         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2230
2231         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2232         foreach my $key (keys %ccdroute2hash) {
2233                 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2234                         delete $ccdroute2hash{$key};
2235                 }
2236         }
2237         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2238         &writeserverconf;
2239
2240
2241 # CCD end
2242
2243
2244         delete $confighash{$cgiparams{'KEY'}};
2245         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2246         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2247
2248         #&writeserverconf();
2249     } else {
2250         $errormessage = $Lang::tr{'invalid key'};
2251     }
2252
2253
2254 ###
2255 ### Download PKCS12 file
2256 ###
2257 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2258     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2259
2260     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2261     print "Content-Type: application/octet-stream\r\n\r\n";
2262     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2263     exit (0);
2264
2265 ###
2266 ### Display certificate
2267 ###
2268 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2269     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2270
2271     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2272         &Header::showhttpheaders();
2273         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2274         &Header::openbigbox('100%', 'LEFT', '', '');
2275         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2276         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2277         $output = &Header::cleanhtml($output,"y");
2278         print "<pre>$output</pre>\n";
2279         &Header::closebox();
2280         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2281         &Header::closebigbox();
2282         &Header::closepage();
2283         exit(0);
2284     }
2285 ###
2286 ### Display Certificate Revoke List
2287 ###
2288 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2289 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2290
2291     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
2292         &Header::showhttpheaders();
2293         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2294         &Header::openbigbox('100%', 'LEFT', '', '');
2295         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2296         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2297         $output = &Header::cleanhtml($output,"y");
2298         print "<pre>$output</pre>\n";
2299         &Header::closebox();
2300         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2301         &Header::closebigbox();
2302         &Header::closepage();
2303         exit(0);
2304     }
2305
2306 ###
2307 ### Advanced Server Settings
2308 ###
2309
2310 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2311     %cgiparams = ();
2312     %cahash = ();
2313     %confighash = ();
2314     my $disabled;
2315     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2316     read_routepushfile;
2317
2318
2319 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2320 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
2321 #    }
2322 ADV_ERROR:
2323     if ($cgiparams{'MAX_CLIENTS'} eq '') {
2324         $cgiparams{'MAX_CLIENTS'} =  '100';
2325     }
2326     if ($cgiparams{'KEEPALIVE_1'} eq '') {
2327         $cgiparams{'KEEPALIVE_1'} =  '10';
2328     }
2329     if ($cgiparams{'KEEPALIVE_2'} eq '') {
2330         $cgiparams{'KEEPALIVE_2'} =  '60';
2331     }
2332     if ($cgiparams{'LOG_VERB'} eq '') {
2333         $cgiparams{'LOG_VERB'} =  '3';
2334     }
2335     $checked{'CLIENT2CLIENT'}{'off'} = '';
2336     $checked{'CLIENT2CLIENT'}{'on'} = '';
2337     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2338     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2339     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2340     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2341     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2342     $checked{'MSSFIX'}{'off'} = '';
2343     $checked{'MSSFIX'}{'on'} = '';
2344     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2345     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
2346     $selected{'LOG_VERB'}{'1'} = '';
2347     $selected{'LOG_VERB'}{'2'} = '';
2348     $selected{'LOG_VERB'}{'3'} = '';
2349     $selected{'LOG_VERB'}{'4'} = '';
2350     $selected{'LOG_VERB'}{'5'} = '';
2351     $selected{'LOG_VERB'}{'6'} = '';
2352     $selected{'LOG_VERB'}{'7'} = '';
2353     $selected{'LOG_VERB'}{'8'} = '';
2354     $selected{'LOG_VERB'}{'9'} = '';
2355     $selected{'LOG_VERB'}{'10'} = '';
2356     $selected{'LOG_VERB'}{'11'} = '';
2357     $selected{'LOG_VERB'}{'0'} = '';
2358     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2359
2360     &Header::showhttpheaders();
2361     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2362     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2363     if ($errormessage) {
2364         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2365         print "<class name='base'>$errormessage\n";
2366         print "&nbsp;</class>\n";
2367         &Header::closebox();
2368     }
2369     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2370     print <<END
2371     <form method='post' enctype='multipart/form-data' disabled>
2372     <table width='100%' border=0>
2373     <tr>
2374         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2375     </tr>
2376     <tr>
2377         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2378     </tr>
2379     <tr>
2380         <td class='base'>Domain</td>
2381         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30'  /></td>
2382     </tr>
2383     <tr>
2384         <td class='base'>DNS</td>
2385         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2386     </tr>
2387     <tr>
2388         <td class='base'>WINS</td>
2389         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2390        </tr>
2391     <tr>
2392         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2393     </tr>
2394     <tr>
2395         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2396   <td colspan='2'>
2397        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2398 END
2399 ;
2400
2401 if ($cgiparams{'ROUTES_PUSH'} ne '')
2402 {
2403         print $cgiparams{'ROUTES_PUSH'};
2404 }
2405
2406 print <<END;
2407 </textarea></td>
2408 </tr>
2409     </tr>
2410 </table>
2411 <hr size='1'>
2412     <table width='100%'>
2413     <tr>
2414         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2415     </tr>
2416     <tr>
2417         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
2418     </tr>
2419     <tr>
2420         <td class='base'>Client-To-Client</td>
2421         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2422     </tr>
2423     <tr>
2424         <td class='base'>Redirect-Gateway def1</td>
2425         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2426     </tr>
2427     <tr>
2428         <td class='base'>Max-Clients</td>
2429         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2430     </tr>
2431         <tr>
2432           <td class='base'>Keppalive <br />
2433             (ping/ping-restart)</td>
2434           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2435           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2436     </tr>
2437         <tr>
2438           <td class='base'>fragment <br></td>
2439           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2440         <td>Default: <span class="base">1300</span></td>
2441       </tr>
2442         <tr>
2443           <td class='base'>mssfix</td>
2444           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2445           <td>Default: on</td>
2446           </tr>
2447
2448         <tr>
2449                 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2450                 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2451                 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2452                 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2453                 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2454         </tr>
2455 </table>
2456
2457 <!--
2458 <hr size='1'>
2459     <table width='100%'>
2460     <tr>
2461  <td class'base'><b>Crypto-Engines</b></td>
2462     </tr>
2463     <tr>
2464         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2465     </tr>
2466     <tr><td class='base'>Engines:</td>
2467         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2468                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2469                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2470                         </select>
2471                 </td>
2472 </table>
2473 -->
2474 <hr size='1'>
2475     <table width='100%'>
2476     <tr>
2477         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2478     </tr>
2479     <tr>
2480         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2481     </tr>
2482
2483     <tr><td class='base'>VERB</td>
2484         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2485                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2486                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2487                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2488                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2489                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2490                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2491                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2492                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2493                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2494                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2495                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2496 </table><hr>
2497 END
2498
2499 if ( -e "/var/run/openvpn.pid"){
2500 print"  <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2501                 $Lang::tr{'server restart'}<br><br>
2502                 <hr>";
2503                 print<<END
2504 <table width='100%'>
2505 <tr>
2506     <td>&nbsp;</td>
2507     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2508     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2509     <td>&nbsp;</td>
2510 </tr>
2511 </table>
2512 </form>
2513 END
2514 ;
2515
2516
2517 }else{
2518
2519 print<<END
2520 <table width='100%'>
2521 <tr>
2522     <td>&nbsp;</td>
2523     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2524     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2525     <td>&nbsp;</td>
2526 </tr>
2527 </table>
2528 </form>
2529 END
2530 ;
2531 }
2532     &Header::closebox();
2533 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2534     &Header::closebigbox();
2535     &Header::closepage();
2536     exit(0);
2537
2538
2539 # A.Marx CCD   Add,delete or edit CCD net
2540
2541 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2542                 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2543                 $cgiparams{'ACTION'} eq "kill" ||
2544                 $cgiparams{'ACTION'} eq "edit" ||
2545                 $cgiparams{'ACTION'} eq 'editsave'){
2546         &Header::showhttpheaders();
2547         &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2548         &Header::openbigbox('100%', 'LEFT', '', '');
2549
2550         if ($cgiparams{'ACTION'} eq "kill"){
2551                 &delccdnet($cgiparams{'net'});
2552         }
2553
2554         if ($cgiparams{'ACTION'} eq 'editsave'){
2555                 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2556                 if ( $a ne $b){ &modccdnet($a,$b);}
2557         }
2558
2559         if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
2560                 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'},$cgiparams{'DOVPN_SUBNET'});
2561         }
2562         if ($errormessage) {
2563             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2564             print "<class name='base'>$errormessage";
2565             print "&nbsp;</class>";
2566             &Header::closebox();
2567         }
2568 if ($cgiparams{'ACTION'} eq "edit"){
2569
2570         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2571
2572         print <<END
2573     <table width='100%' border=0>
2574     <tr><form method='post'>
2575         <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2576         <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
2577         <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2578         <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2579         </td></tr>
2580         </table></form>
2581 END
2582 ;
2583         &Header::closebox();
2584
2585         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2586         print <<END
2587     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2588     <tr>
2589         <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2590 END
2591 ;
2592 }
2593 else{
2594         if (! -e "/var/run/openvpn.pid"){
2595         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2596                 print <<END;
2597             <table width='100%' border='0'>
2598             <tr><form method='post'>
2599                 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2600                 <tr>
2601                 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2602                 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2603                 <tr><td colspan=4><hr /></td></tr><tr>
2604                 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2605                 </table></form>
2606 END
2607
2608         &Header::closebox();
2609 }
2610         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2611         print <<END
2612     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2613     <tr>
2614         <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2615 END
2616 ;
2617 }
2618         my %ccdconfhash=();
2619         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2620         my @ccdconf=();
2621         my $count=0;
2622         foreach my $key (keys %ccdconfhash) {
2623                 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2624                 $count++;
2625                 my $ccdhosts = &hostsinnet($ccdconf[0]);
2626                 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2627                 else{            print" <tr bgcolor='$color{'color20'}'>";}
2628                 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
2629 print <<END
2630                 <form method='post' />
2631                 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
2632                 <input type='hidden' name='ACTION' value='edit'/>
2633                 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2634                 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2635                 </form></td>
2636                 <form method='post' />
2637                 <td><input type='hidden' name='ACTION' value='kill'/>
2638                 <input type='hidden' name='number' value='$count' />
2639                 <input type='hidden' name='net' value='$ccdconf[0]' />
2640                 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
2641 END
2642 ;
2643         }
2644         print "</table></form>";
2645         &Header::closebox();
2646         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2647         &Header::closebigbox();
2648         &Header::closepage();
2649         exit(0);
2650
2651 #END CCD
2652
2653 ###
2654 ### Openvpn Connections Statistics
2655 ###
2656 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2657         &Header::showhttpheaders();
2658         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2659         &Header::openbigbox('100%', 'LEFT', '', '');
2660     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2661
2662 #
2663 #       <td><b>$Lang::tr{'protocol'}</b></td>
2664 # protocol temp removed
2665     print <<END
2666     <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2667     <tr>
2668         <td><b>$Lang::tr{'common name'}</b></td>
2669         <td><b>$Lang::tr{'real address'}</b></td>
2670         <td><b>$Lang::tr{'virtual address'}</b></td>
2671         <td><b>$Lang::tr{'loged in at'}</b></td>
2672         <td><b>$Lang::tr{'bytes sent'}</b></td>
2673         <td><b>$Lang::tr{'bytes received'}</b></td>
2674         <td><b>$Lang::tr{'last activity'}</b></td>
2675     </tr>
2676 END
2677 ;
2678         my $filename = "/var/log/ovpnserver.log";
2679         open(FILE, $filename) or die 'Unable to open config file.';
2680         my @current = <FILE>;
2681         close(FILE);
2682         my @users =();
2683         my $status;
2684         my $uid = 0;
2685         my $cn;
2686         my @match = ();
2687         my $proto = "udp";
2688         my $address;
2689         my %userlookup = ();
2690         foreach my $line (@current)
2691         {
2692             chomp($line);
2693             if ( $line =~ /^Updated,(.+)/){
2694                 @match = split( /^Updated,(.+)/, $line);
2695                 $status = $match[1];
2696             }
2697 #gian
2698             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2699                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2700                 if ($match[1] ne "Common Name") {
2701                     $cn = $match[1];
2702                     $userlookup{$match[2]} = $uid;
2703                     $users[$uid]{'CommonName'} = $match[1];
2704                     $users[$uid]{'RealAddress'} = $match[2];
2705                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2706                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2707                     $users[$uid]{'Since'} = $match[5];
2708                     $users[$uid]{'Proto'} = $proto;
2709                     $uid++;
2710                 }
2711             }
2712             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2713                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2714                 if ($match[1] ne "Virtual Address") {
2715                     $address = $match[3];
2716                     #find the uid in the lookup table
2717                     $uid = $userlookup{$address};
2718                     $users[$uid]{'VirtualAddress'} = $match[1];
2719                     $users[$uid]{'LastRef'} = $match[4];
2720                 }
2721             }
2722         }
2723         my $user2 = @users;
2724         if ($user2 >= 1){
2725             for (my $idx = 1; $idx <= $user2; $idx++){
2726                                                 if ($idx % 2) {
2727                                         print "<tr bgcolor='$color{'color20'}'>\n";
2728                                 } else {
2729                                         print "<tr bgcolor='$color{'color22'}'>\n";
2730                                                 }
2731                                                 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2732                                                 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2733                                                 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2734                                                 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2735                                                 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2736                                                 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2737                                                 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2738 #                       print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2739             }
2740         }
2741
2742         print "</table>";
2743         print <<END
2744         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2745         <tr><td></td></tr>
2746         <tr><td></td></tr>
2747         <tr><td></td></tr>
2748         <tr><td></td></tr>
2749         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2750         </table>
2751 END
2752 ;
2753         &Header::closebox();
2754         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2755         &Header::closebigbox();
2756         &Header::closepage();
2757         exit(0);
2758
2759 ###
2760 ### Download Certificate
2761 ###
2762 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2763     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2764
2765     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2766         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2767         print "Content-Type: application/octet-stream\r\n\r\n";
2768         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2769         exit (0);
2770     }
2771
2772 ###
2773 ### Enable/Disable connection
2774 ###
2775
2776 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2777
2778     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2779     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2780
2781     if ($confighash{$cgiparams{'KEY'}}) {
2782            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2783             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2784             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2785             #&writeserverconf();
2786 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2787 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2788 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2789 #           }
2790         } else {
2791             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2792 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2793 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2794 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2795 #           }
2796             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2797             #&writeserverconf();
2798         }
2799     } else {
2800         $errormessage = $Lang::tr{'invalid key'};
2801     }
2802
2803 ###
2804 ### Restart connection
2805 ###
2806 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2807     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2808     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2809
2810     if ($confighash{$cgiparams{'KEY'}}) {
2811 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2812 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2813 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2814 #       }
2815     } else {
2816         $errormessage = $Lang::tr{'invalid key'};
2817     }
2818
2819 ###
2820 ### Remove connection
2821 ###
2822 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2823     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2824     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2825
2826     if ($confighash{$cgiparams{'KEY'}}) {
2827 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2828 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2829 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2830 #       }
2831         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2832         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2833         delete $confighash{$cgiparams{'KEY'}};
2834         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2835         #&writeserverconf();
2836     } else {
2837         $errormessage = $Lang::tr{'invalid key'};
2838     }
2839 #test33
2840
2841 ###
2842 ### Choose between adding a host-net or net-net connection
2843 ###
2844
2845 ###
2846 # m.a.d net2net
2847 ###
2848
2849 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2850         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2851         &Header::showhttpheaders();
2852         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2853         &Header::openbigbox('100%', 'LEFT', '', '');
2854         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2855
2856 if ( -s "${General::swroot}/ovpn/settings") {
2857
2858         print <<END
2859             <b>$Lang::tr{'connection type'}:</b><br />
2860             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2861             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2862                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2863             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2864                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2865                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2866                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2867           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2868           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2869     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr>
2870           <tr><td colspan='3'><hr /></td></tr>
2871     <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2872           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2873             </form></table>
2874 END
2875         ;
2876
2877
2878 } else {
2879         print <<END
2880                     <b>$Lang::tr{'connection type'}:</b><br />
2881             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2882             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2883             <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2884             </form></table>
2885 END
2886         ;
2887
2888 }
2889
2890         &Header::closebox();
2891         &Header::closebigbox();
2892         &Header::closepage();
2893         exit (0);
2894
2895 ###
2896 # m.a.d net2net
2897 ###
2898
2899 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2900
2901         my @firen2nconf;
2902         my @confdetails;
2903         my $uplconffilename ='';
2904         my $uplconffilename2 ='';
2905         my $uplp12name = '';
2906         my $uplp12name2 = '';
2907         my @rem_subnet;
2908         my @rem_subnet2;
2909         my @tmposupnet3;
2910         my $key;
2911         my @n2nname;
2912
2913         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2914
2915 # Check if a file is uploaded
2916
2917         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2918                 $errormessage = $Lang::tr{'there was no file upload'};
2919                 goto N2N_ERROR;
2920     }
2921
2922 # Move uploaded IPfire n2n package to temporary file
2923
2924     (my $fh, my $filename) = tempfile( );
2925     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2926                 $errormessage = $!;
2927                 goto N2N_ERROR;
2928     }
2929
2930         my $zip = Archive::Zip->new();
2931         my $zipName = $filename;
2932         my $status = $zip->read( $zipName );
2933         if ($status != AZ_OK) {
2934                 $errormessage = "Read of $zipName failed\n";
2935                 goto N2N_ERROR;
2936         }
2937
2938         my $tempdir = tempdir( CLEANUP => 1 );
2939         my @files = $zip->memberNames();
2940         for(@files) {
2941         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2942         }
2943         my $countfiles = @files;
2944
2945 # Check if we have not more then 2 files
2946
2947         if ( $countfiles == 2){
2948                 foreach (@files){
2949                         if ( $_ =~ /.conf$/){
2950                                 $uplconffilename = $_;
2951                         }
2952                         if ( $_ =~ /.p12$/){
2953                                 $uplp12name = $_;
2954                         }
2955                 }
2956                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2957                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2958                         goto N2N_ERROR;
2959                 }
2960
2961                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2962                 @firen2nconf = <FILE>;
2963                 close (FILE);
2964                 chomp(@firen2nconf);
2965
2966         } else {
2967
2968                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2969                 goto N2N_ERROR;
2970         }
2971
2972 ###
2973 # m.a.d net2net
2974 ###
2975
2976  if ($cgiparams{'n2nname'} ne ''){
2977
2978   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2979   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2980   $n2nname[0] = $cgiparams{'n2nname'};
2981   my @n2nname2 = split(/\./,$uplconffilename);
2982   $n2nname2[0] =~ s/\n|\r//g;
2983   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2984         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2985         my $input2 = "$n2nname2[0]n2n";
2986   my $output2 = "$n2nname[0]n2n";
2987   my $filename = "$tempdir/$uplconffilename";
2988   open(FILE, "< $filename") or die 'Unable to open config file.';
2989         my @current = <FILE>;
2990         close(FILE);
2991         foreach (@current) {s/$input1/$output1/g;}
2992         foreach (@current) {s/$input2/$output2/g;}
2993   open (OUT, "> $filename") || die 'Unable to open config file.';
2994   print OUT @current;
2995   close OUT;
2996
2997     }else{
2998     $uplconffilename2 =  $uplconffilename;
2999     $uplp12name2 = $uplp12name;
3000     @n2nname = split(/\./,$uplconffilename);
3001     $n2nname[0] =~ s/\n|\r//g;
3002    }
3003     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3004     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
3005
3006         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
3007
3008         if ($? ne 0) {
3009             $errormessage = "*.conf move failed: $!";
3010             unlink ($filename);
3011             goto N2N_ERROR;
3012         }
3013
3014         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
3015         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3016
3017         if ($? ne 0) {
3018             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3019             unlink ($filename);
3020             goto N2N_ERROR;
3021         }
3022
3023 my $complzoactive;
3024 my $mssfixactive;
3025 my $n2nfragment;
3026 my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);;
3027 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
3028 my @n2nproto = split(/-/, $n2nproto2[1]);
3029 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3030 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3031 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3032 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
3033 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
3034 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
3035 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
3036 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
3037 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3038 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3039 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
3040 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
3041 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
3042 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3043
3044
3045 ###
3046 # m.a.d delete CR and LF from arrays for this chomp doesnt work
3047 ###
3048
3049 $n2nremote[1] =~ s/\n|\r//g;
3050 $n2novpnsub[0] =~ s/\n|\r//g;
3051 $n2novpnsub[1] =~ s/\n|\r//g;
3052 $n2novpnsub[2] =~ s/\n|\r//g;
3053 $n2nproto[0] =~ s/\n|\r//g;
3054 $n2nport[1] =~ s/\n|\r//g;
3055 $n2ntunmtu[1] =~ s/\n|\r//g;
3056 $n2nremsub[1] =~ s/\n|\r//g;
3057 $n2nremsub[2] =~ s/\n|\r//g;
3058 $n2nlocalsub[2] =~ s/\n|\r//g;
3059 $n2nfragment[1] =~ s/\n|\r//g;
3060 $n2nmgmt[2] =~ s/\n|\r//g;
3061 $n2nmtudisc[1] =~ s/\n|\r//g;
3062 chomp ($complzoactive);
3063 chomp ($mssfixactive);
3064
3065 ###
3066 # m.a.d net2net
3067 ###
3068
3069 ###
3070 # Check if there is no other entry with this name
3071 ###
3072
3073         foreach my $dkey (keys %confighash) {
3074                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3075                         $errormessage = $Lang::tr{'a connection with this name already exists'};
3076                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3077             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3078       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3079                         goto N2N_ERROR;
3080                 }
3081         }
3082
3083 ###
3084 # Check if OpenVPN Subnet is valid
3085 ###
3086
3087 foreach my $dkey (keys %confighash) {
3088                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3089                         $errormessage = 'The OpenVPN Subnet is already in use';
3090                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3091             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3092       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3093                         goto N2N_ERROR;
3094                 }
3095         }
3096
3097 ###
3098 # Check im Dest Port is vaild
3099 ###
3100
3101 foreach my $dkey (keys %confighash) {
3102                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3103                         $errormessage = 'The OpenVPN Port is already in use';
3104                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3105             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3106       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3107                         goto N2N_ERROR;
3108                 }
3109         }
3110
3111
3112
3113   $key = &General::findhasharraykey (\%confighash);
3114
3115         foreach my $i (0 .. 39) { $confighash{$key}[$i] = "";}
3116
3117         $confighash{$key}[0] = 'off';
3118         $confighash{$key}[1] = $n2nname[0];
3119         $confighash{$key}[2] = $n2nname[0];
3120         $confighash{$key}[3] = 'net';
3121         $confighash{$key}[4] = 'cert';
3122         $confighash{$key}[6] = 'client';
3123         $confighash{$key}[8] =  $n2nlocalsub[2];
3124         $confighash{$key}[10] = $n2nremote[1];
3125         $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3126         $confighash{$key}[22] = $n2nmgmt[2];
3127         $confighash{$key}[23] = $mssfixactive;
3128         $confighash{$key}[24] = $n2nfragment[1];
3129         $confighash{$key}[25] = 'IPFire n2n Client';
3130         $confighash{$key}[26] = 'red';
3131         $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3132         $confighash{$key}[28] = $n2nproto[0];
3133         $confighash{$key}[29] = $n2nport[1];
3134         $confighash{$key}[30] = $complzoactive;
3135         $confighash{$key}[31] = $n2ntunmtu[1];
3136         $confighash{$key}[38] = $n2nmtudisc[1];
3137
3138
3139   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3140
3141   N2N_ERROR:
3142
3143         &Header::showhttpheaders();
3144         &Header::openpage('Validate imported configuration', 1, '');
3145         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3146         if ($errormessage) {
3147             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3148             print "<class name='base'>$errormessage";
3149             print "&nbsp;</class>";
3150             &Header::closebox();
3151
3152         } else
3153   {
3154                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3155         }
3156         if ($errormessage eq ''){
3157                 print <<END
3158                 <!-- ipfire net2net config gui -->
3159                 <table width='100%'>
3160                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3161     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3162     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3163                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3164                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3165                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3166                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
3167                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3168                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3169                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3170                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3171                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
3172                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
3173                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3174                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td><b>$confighash{$key}[38]</b></td></tr>
3175                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3176                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3177     </table>
3178 END
3179 ;
3180                 &Header::closebox();
3181         }
3182
3183         if ($errormessage) {
3184                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3185         } else {
3186                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3187                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3188                 print "<input type='hidden' name='KEY' value='$key' />";
3189                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3190         }
3191         &Header::closebigbox();
3192         &Header::closepage();
3193         exit(0);
3194
3195
3196 ##
3197 ### Accept IPFire n2n Package Settings
3198 ###
3199
3200   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3201
3202 ###
3203 ### Discard and Rollback IPFire n2n Package Settings
3204 ###
3205
3206   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3207
3208      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3209
3210 if ($confighash{$cgiparams{'KEY'}}) {
3211
3212      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3213      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3214      unlink ($certfile) or die "Removing $certfile fail: $!";
3215      unlink ($conffile) or die "Removing $conffile fail: $!";
3216      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3217      delete $confighash{$cgiparams{'KEY'}};
3218     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3219
3220      } else {
3221                 $errormessage = $Lang::tr{'invalid key'};
3222    }
3223
3224
3225 ###
3226 # m.a.d net2net
3227 ###
3228
3229
3230 ###
3231 ### Adding a new connection
3232 ###
3233 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3234          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3235          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3236
3237     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3238     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3239     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3240
3241     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3242                 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3243                     $errormessage = $Lang::tr{'invalid key'};
3244                     goto VPNCONF_END;
3245                 }
3246                 $cgiparams{'ENABLED'}                   = $confighash{$cgiparams{'KEY'}}[0];
3247                 $cgiparams{'NAME'}                              = $confighash{$cgiparams{'KEY'}}[1];
3248                 $cgiparams{'TYPE'}                              = $confighash{$cgiparams{'KEY'}}[3];
3249                 $cgiparams{'AUTH'}                              = $confighash{$cgiparams{'KEY'}}[4];
3250                 $cgiparams{'PSK'}                               = $confighash{$cgiparams{'KEY'}}[5];
3251                 $cgiparams{'SIDE'}                              = $confighash{$cgiparams{'KEY'}}[6];
3252                 $cgiparams{'LOCAL_SUBNET'}              = $confighash{$cgiparams{'KEY'}}[8];
3253                 $cgiparams{'REMOTE'}                    = $confighash{$cgiparams{'KEY'}}[10];
3254                 $cgiparams{'REMOTE_SUBNET'}     = $confighash{$cgiparams{'KEY'}}[11];
3255                 $cgiparams{'OVPN_MGMT'}                 = $confighash{$cgiparams{'KEY'}}[22];
3256                 $cgiparams{'MSSFIX'}                    = $confighash{$cgiparams{'KEY'}}[23];
3257                 $cgiparams{'FRAGMENT'}                  = $confighash{$cgiparams{'KEY'}}[24];
3258                 $cgiparams{'REMARK'}                    = $confighash{$cgiparams{'KEY'}}[25];
3259                 $cgiparams{'INTERFACE'}                 = $confighash{$cgiparams{'KEY'}}[26];
3260                 $cgiparams{'OVPN_SUBNET'}               = $confighash{$cgiparams{'KEY'}}[27];
3261                 $cgiparams{'PROTOCOL'}                  = $confighash{$cgiparams{'KEY'}}[28];
3262                 $cgiparams{'DEST_PORT'}                 = $confighash{$cgiparams{'KEY'}}[29];
3263                 $cgiparams{'COMPLZO'}                   = $confighash{$cgiparams{'KEY'}}[30];
3264                 $cgiparams{'MTU'}                               = $confighash{$cgiparams{'KEY'}}[31];
3265                 $cgiparams{'CHECK1'}                    = $confighash{$cgiparams{'KEY'}}[32];
3266                 my $name=$cgiparams{'CHECK1'}   ;
3267                 $cgiparams{$name}                               = $confighash{$cgiparams{'KEY'}}[33];
3268                 $cgiparams{'RG'}                                = $confighash{$cgiparams{'KEY'}}[34];
3269                 $cgiparams{'CCD_DNS1'}                  = $confighash{$cgiparams{'KEY'}}[35];
3270                 $cgiparams{'CCD_DNS2'}                  = $confighash{$cgiparams{'KEY'}}[36];
3271                 $cgiparams{'CCD_WINS'}                  = $confighash{$cgiparams{'KEY'}}[37];
3272                 $cgiparams{'PMTU_DISCOVERY'}    = $confighash{$cgiparams{'KEY'}}[38];
3273         } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3274         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3275
3276 #A.Marx CCD check iroute field and convert it to decimal
3277 if ($cgiparams{'TYPE'} eq 'host') {
3278         my @temp=();
3279         my %ccdroutehash=();
3280         my $keypoint=0;
3281         if ($cgiparams{'IR'} ne ''){
3282                 @temp = split("\n",$cgiparams{'IR'});
3283                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3284                 #find key to use
3285                 foreach my $key (keys %ccdroutehash) {
3286                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3287                                 $keypoint=$key;
3288                                 delete $ccdroutehash{$key};
3289                         }else{
3290                                 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3291                         }
3292                 }
3293                 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3294                 my $i=1;
3295                 my $val=0;
3296                 foreach $val (@temp){
3297                         chomp($val);
3298                         $val=~s/\s*$//g;
3299                         my($ip,$cidr) = split(/\//,$val);
3300                         $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3301                         $cidr=&General::iporsubtodec($cidr);
3302
3303                         #check if iroute exists in ccdroute
3304                         foreach my $key (keys %ccdroutehash) {
3305                                 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3306                                         if ($ccdroutehash{$key}[$oldiroute] eq "$ip/$cidr") {
3307                                                 $errormessage=$Lang::tr{'ccd err irouteexist'};
3308                                                 goto VPNCONF_ERROR;
3309                                         }
3310                                 }
3311                         }
3312
3313                         #check for existing network IP's
3314                         if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3315                         {
3316                                 $errormessage=$Lang::tr{'ccd err green'};
3317                                 goto VPNCONF_ERROR;
3318                         }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3319                         {
3320                                 $errormessage=$Lang::tr{'ccd err red'};
3321                                 goto VPNCONF_ERROR;
3322                         }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3323                         {
3324                                 $errormessage=$Lang::tr{'ccd err blue'};
3325                                 goto VPNCONF_ERROR;
3326                         }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3327                         {
3328                                 $errormessage=$Lang::tr{'ccd err orange'};
3329                                 goto VPNCONF_ERROR;
3330                         }
3331
3332                         if (&General::validipandmask($val)){
3333                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3334                         }else{
3335                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3336                                 goto VPNCONF_ERROR;
3337                         }
3338                         $i++;
3339                 }
3340                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3341                 &writeserverconf;
3342         }else{
3343                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3344                 foreach my $key (keys %ccdroutehash) {
3345                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3346                                 delete $ccdroutehash{$key};
3347                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3348                                 &writeserverconf;
3349                         }
3350                 }
3351         }
3352         undef @temp;
3353         #check route field and convert it to decimal
3354         my $val=0;
3355         my $i=1;
3356         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3357         #find key to use
3358         foreach my $key (keys %ccdroute2hash) {
3359                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3360                         $keypoint=$key;
3361                         delete $ccdroute2hash{$key};
3362                 }else{
3363                         $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3364                         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3365                         &writeserverconf;
3366                 }
3367         }
3368         $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3369         if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3370         @temp = split(/\|/,$cgiparams{'IFROUTE'});
3371         my %ownnet=();
3372         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3373         foreach $val (@temp){
3374                 chomp($val);
3375                 $val=~s/\s*$//g;
3376                 if ($val eq $Lang::tr{'green'})
3377                 {
3378                         $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3379                 }
3380                 if ($val eq $Lang::tr{'blue'})
3381                 {
3382                         $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3383                 }
3384                 if ($val eq $Lang::tr{'orange'})
3385                 {
3386                         $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3387                 }
3388                 my ($ip,$cidr) = split (/\//, $val);
3389
3390                 if ($val ne $Lang::tr{'ccd none'})
3391                 {
3392                         if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3393                         if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3394                         if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3395                         if (&General::validipandmask($val)){
3396                                 $val=$ip."/".&General::iporsubtodec($cidr);
3397                                 $ccdroute2hash{$keypoint}[$i] = $val;
3398                         }else{
3399                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3400                                 goto VPNCONF_ERROR;
3401                         }
3402                 }else{
3403                         $ccdroute2hash{$keypoint}[$i]='';
3404                 }
3405                 $i++;
3406         }
3407         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3408
3409         #check dns1 ip
3410         if ($cgiparams{'CCD_DNS1'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS1'})) {
3411                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3412                         goto VPNCONF_ERROR;
3413         }
3414         #check dns2 ip
3415         if ($cgiparams{'CCD_DNS2'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS2'})) {
3416                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3417                         goto VPNCONF_ERROR;
3418         }
3419         #check wins ip
3420         if ($cgiparams{'CCD_WINS'} ne '' &&  ! &General::validip($cgiparams{'CCD_WINS'})) {
3421                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3422                         goto VPNCONF_ERROR;
3423         }
3424 }
3425
3426 #CCD End
3427
3428
3429  if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3430             $errormessage = $Lang::tr{'connection type is invalid'};
3431             if ($cgiparams{'TYPE'} eq 'net') {
3432       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3433             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3434       }
3435             goto VPNCONF_ERROR;
3436         }
3437
3438
3439         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3440             $errormessage = $Lang::tr{'name must only contain characters'};
3441       if ($cgiparams{'TYPE'} eq 'net') {
3442       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3443             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3444       }
3445       goto VPNCONF_ERROR;
3446   }
3447
3448         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3449             $errormessage = $Lang::tr{'name is invalid'};
3450             if ($cgiparams{'TYPE'} eq 'net') {
3451       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3452             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3453       }
3454             goto VPNCONF_ERROR;
3455         }
3456
3457         if (length($cgiparams{'NAME'}) >60) {
3458             $errormessage = $Lang::tr{'name too long'};
3459             if ($cgiparams{'TYPE'} eq 'net') {
3460       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3461             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3462       }
3463             goto VPNCONF_ERROR;
3464         }
3465
3466 ###
3467 # m.a.d net2net
3468 ###
3469
3470 if ($cgiparams{'TYPE'} eq 'net') {
3471
3472     if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
3473                         $errormessage = $Lang::tr{'openvpn destination port used'};
3474                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3475             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3476       goto VPNCONF_ERROR;
3477                 }
3478
3479     if ($cgiparams{'DEST_PORT'} eq  '') {
3480                         $errormessage = $Lang::tr{'openvpn destination port used'};
3481                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3482             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3483       goto VPNCONF_ERROR;
3484                 }
3485
3486     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
3487                         $errormessage = $Lang::tr{'openvpn subnet is used'};
3488                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3489             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3490                         goto VPNCONF_ERROR;
3491                 }
3492
3493           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3494             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3495             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3496             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3497             goto VPNCONF_ERROR;
3498     }
3499
3500     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3501             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3502             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3503             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3504             goto VPNCONF_ERROR;
3505     }
3506
3507     if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') && ($cgiparams{'MTU'} ne '1500')) {
3508         $errormessage = $Lang::tr{'ovpn mtu-disc and mtu not 1500'};
3509         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3510         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3511         goto VPNCONF_ERROR;
3512     }
3513
3514     if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') {
3515         if (($cgiparams{'FRAGMENT'} ne '') || ($cgiparams{'MSSFIX'} eq 'on')) {
3516                 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
3517                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3518                 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3519                 goto VPNCONF_ERROR;
3520         }
3521     }
3522
3523     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
3524                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3525                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3526             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3527                   goto VPNCONF_ERROR;
3528                 }
3529
3530     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
3531                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3532                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3533             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3534                   goto VPNCONF_ERROR;
3535                 }
3536
3537     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
3538                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
3539                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3540             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3541                   goto VPNCONF_ERROR;
3542                 }
3543
3544     if ($cgiparams{'OVPN_MGMT'} eq  '') {
3545                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
3546                 }
3547
3548 }
3549
3550 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
3551 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
3552 #           goto VPNCONF_ERROR;
3553 #       }
3554
3555         # Check if there is no other entry with this name
3556         if (! $cgiparams{'KEY'}) {
3557             foreach my $key (keys %confighash) {
3558                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
3559                     $errormessage = $Lang::tr{'a connection with this name already exists'};
3560                     if ($cgiparams{'TYPE'} eq 'net') {
3561         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3562               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3563         }
3564                     goto VPNCONF_ERROR;
3565                 }
3566             }
3567         }
3568
3569         if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
3570             $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3571             if ($cgiparams{'TYPE'} eq 'net') {
3572       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3573             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3574       }
3575             goto VPNCONF_ERROR;
3576         }
3577
3578         if ($cgiparams{'REMOTE'}) {
3579             if (! &General::validip($cgiparams{'REMOTE'})) {
3580                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
3581                     $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3582                     if ($cgiparams{'TYPE'} eq 'net') {
3583         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3584               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3585         }
3586                     goto VPNCONF_ERROR;
3587                 } else {
3588                     if (&valid_dns_host($cgiparams{'REMOTE'})) {
3589                         $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
3590                         if ($cgiparams{'TYPE'} eq 'net') {
3591
3592       }
3593                     }
3594                 }
3595             }
3596         }
3597         if ($cgiparams{'TYPE'} ne 'host') {
3598             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
3599                     $errormessage = $Lang::tr{'local subnet is invalid'};
3600                     if ($cgiparams{'TYPE'} eq 'net') {
3601               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3602                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3603               }
3604                         goto VPNCONF_ERROR;}
3605         }
3606         # Check if there is no other entry without IP-address and PSK
3607         if ($cgiparams{'REMOTE'} eq '') {
3608             foreach my $key (keys %confighash) {
3609                 if(($cgiparams{'KEY'} ne $key) &&
3610                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
3611                     $confighash{$key}[10] eq '') {
3612                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
3613                         goto VPNCONF_ERROR;
3614                 }
3615             }
3616         }
3617         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
3618                 $errormessage = $Lang::tr{'remote subnet is invalid'};
3619                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3620                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3621                 goto VPNCONF_ERROR;
3622         }
3623
3624         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
3625             $errormessage = $Lang::tr{'invalid input'};
3626             goto VPNCONF_ERROR;
3627         }
3628         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
3629             $errormessage = $Lang::tr{'invalid input'};
3630             goto VPNCONF_ERROR;
3631         }
3632
3633 #fixplausi
3634         if ($cgiparams{'AUTH'} eq 'psk')  {
3635 #           if (! length($cgiparams{'PSK'}) ) {
3636 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
3637 #               goto VPNCONF_ERROR;
3638 #           }
3639 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
3640 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
3641 #               goto VPNCONF_ERROR;
3642 #           }
3643         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
3644             if ($cgiparams{'KEY'}) {
3645                 $errormessage = $Lang::tr{'cant change certificates'};
3646                 goto VPNCONF_ERROR;
3647             }
3648             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3649                 $errormessage = $Lang::tr{'there was no file upload'};
3650                 goto VPNCONF_ERROR;
3651             }
3652
3653             # Move uploaded certificate request to a temporary file
3654             (my $fh, my $filename) = tempfile( );
3655             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3656                 $errormessage = $!;
3657                 goto VPNCONF_ERROR;
3658             }
3659
3660             # Sign the certificate request and move it
3661             # Sign the host certificate request
3662             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3663                 '-batch', '-notext',
3664                 '-in', $filename,
3665                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3666                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3667             if ($?) {
3668                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3669                 unlink ($filename);
3670                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3671                 &newcleanssldatabase();
3672                 goto VPNCONF_ERROR;
3673             } else {
3674                 unlink ($filename);
3675                 &deletebackupcert();
3676             }
3677
3678             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3679             $temp =~ /Subject:.*CN=(.*)[\n]/;
3680             $temp = $1;
3681             $temp =~ s+/Email+, E+;
3682             $temp =~ s/ ST=/ S=/;
3683             $cgiparams{'CERT_NAME'} = $temp;
3684             $cgiparams{'CERT_NAME'} =~ s/,//g;
3685             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3686             if ($cgiparams{'CERT_NAME'} eq '') {
3687                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3688                 goto VPNCONF_ERROR;
3689             }
3690         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
3691             if ($cgiparams{'KEY'}) {
3692                 $errormessage = $Lang::tr{'cant change certificates'};
3693                 goto VPNCONF_ERROR;
3694             }
3695             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3696                 $errormessage = $Lang::tr{'there was no file upload'};
3697                 goto VPNCONF_ERROR;
3698             }
3699             # Move uploaded certificate to a temporary file
3700             (my $fh, my $filename) = tempfile( );
3701             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3702                 $errormessage = $!;
3703                 goto VPNCONF_ERROR;
3704             }
3705
3706             # Verify the certificate has a valid CA and move it
3707             my $validca = 0;
3708             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
3709             if ($test =~ /: OK/) {
3710                 $validca = 1;
3711             } else {
3712                 foreach my $key (keys %cahash) {
3713                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
3714                     if ($test =~ /: OK/) {
3715                         $validca = 1;
3716                     }
3717                 }
3718             }
3719             if (! $validca) {
3720                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
3721                 unlink ($filename);
3722                 goto VPNCONF_ERROR;
3723             } else {
3724                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3725                 if ($? ne 0) {
3726                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3727                     unlink ($filename);
3728                     goto VPNCONF_ERROR;
3729                 }
3730             }
3731
3732             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3733             $temp =~ /Subject:.*CN=(.*)[\n]/;
3734             $temp = $1;
3735             $temp =~ s+/Email+, E+;
3736             $temp =~ s/ ST=/ S=/;
3737             $cgiparams{'CERT_NAME'} = $temp;
3738             $cgiparams{'CERT_NAME'} =~ s/,//g;
3739             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3740             if ($cgiparams{'CERT_NAME'} eq '') {
3741                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3742                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3743                 goto VPNCONF_ERROR;
3744             }
3745         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
3746             if ($cgiparams{'KEY'}) {
3747                 $errormessage = $Lang::tr{'cant change certificates'};
3748                 goto VPNCONF_ERROR;
3749             }
3750             # Validate input since the form was submitted
3751             if (length($cgiparams{'CERT_NAME'}) >60) {
3752                 $errormessage = $Lang::tr{'name too long'};
3753                 goto VPNCONF_ERROR;
3754             }
3755             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3756                 $errormessage = $Lang::tr{'invalid input for name'};
3757                 goto VPNCONF_ERROR;
3758             }
3759             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3760                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3761                 goto VPNCONF_ERROR;
3762             }
3763             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3764                 $errormessage = $Lang::tr{'e-mail address too long'};
3765                 goto VPNCONF_ERROR;
3766             }
3767             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3768                 $errormessage = $Lang::tr{'invalid input for department'};
3769                 goto VPNCONF_ERROR;
3770             }
3771             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3772                 $errormessage = $Lang::tr{'organization too long'};
3773                 goto VPNCONF_ERROR;
3774             }
3775             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3776                 $errormessage = $Lang::tr{'invalid input for organization'};
3777                 goto VPNCONF_ERROR;
3778             }
3779             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3780                 $errormessage = $Lang::tr{'invalid input for city'};
3781                 goto VPNCONF_ERROR;
3782             }
3783             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3784                 $errormessage = $Lang::tr{'invalid input for state or province'};
3785                 goto VPNCONF_ERROR;
3786             }
3787             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3788                 $errormessage = $Lang::tr{'invalid input for country'};
3789                 goto VPNCONF_ERROR;
3790             }
3791             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3792                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3793                     $errormessage = $Lang::tr{'password too short'};
3794                     goto VPNCONF_ERROR;
3795                 }
3796             }
3797             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3798                 $errormessage = $Lang::tr{'passwords do not match'};
3799                 goto VPNCONF_ERROR;
3800             }
3801
3802             # Replace empty strings with a .
3803             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3804             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3805             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3806
3807             # Create the Host certificate request client
3808             my $pid = open(OPENSSL, "|-");
3809             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3810             if ($pid) { # parent
3811                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3812                 print OPENSSL "$state\n";
3813                 print OPENSSL "$city\n";
3814                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3815                 print OPENSSL "$ou\n";
3816                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3817                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3818                 print OPENSSL ".\n";
3819                 print OPENSSL ".\n";
3820                 close (OPENSSL);
3821                 if ($?) {
3822                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3823                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3824                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3825                     goto VPNCONF_ERROR;
3826                 }
3827             } else {    # child
3828                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3829                         '-newkey', 'rsa:1024',
3830                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3831                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3832                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3833                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3834                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3835                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3836                     goto VPNCONF_ERROR;
3837                 }
3838             }
3839
3840             # Sign the host certificate request
3841             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3842                 '-batch', '-notext',
3843                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3844                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3845                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3846             if ($?) {
3847                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3848                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3849                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3850                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3851                 &newcleanssldatabase();
3852                 goto VPNCONF_ERROR;
3853             } else {
3854                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3855                 &deletebackupcert();
3856             }
3857
3858             # Create the pkcs12 file
3859             system('/usr/bin/openssl', 'pkcs12', '-export',
3860                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3861                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3862                 '-name', $cgiparams{'NAME'},
3863                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3864                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3865                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3866                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3867             if ($?) {
3868                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3869                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3870                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3871                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3872                 goto VPNCONF_ERROR;
3873             } else {
3874                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3875             }
3876         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3877             ;# Nothing, just editing
3878         } else {
3879             $errormessage = $Lang::tr{'invalid input for authentication method'};
3880             goto VPNCONF_ERROR;
3881         }
3882
3883         # Check if there is no other entry with this common name
3884         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3885             foreach my $key (keys %confighash) {
3886                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3887                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3888                     goto VPNCONF_ERROR;
3889                 }
3890             }
3891         }
3892
3893         # Save the config
3894         my $key = $cgiparams{'KEY'};
3895
3896         if (! $key) {
3897             $key = &General::findhasharraykey (\%confighash);
3898             foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";}
3899         }
3900         $confighash{$key}[0]            = $cgiparams{'ENABLED'};
3901         $confighash{$key}[1]            = $cgiparams{'NAME'};
3902         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3903             $confighash{$key}[2]        = $cgiparams{'CERT_NAME'};
3904         }
3905
3906         $confighash{$key}[3]            = $cgiparams{'TYPE'};
3907         if ($cgiparams{'AUTH'} eq 'psk') {
3908             $confighash{$key}[4]        = 'psk';
3909             $confighash{$key}[5]        = $cgiparams{'PSK'};
3910         } else {
3911             $confighash{$key}[4]        = 'cert';
3912         }
3913         if ($cgiparams{'TYPE'} eq 'net') {
3914             $confighash{$key}[6]        = $cgiparams{'SIDE'};
3915             $confighash{$key}[11]       = $cgiparams{'REMOTE_SUBNET'};
3916         }
3917         $confighash{$key}[8]                    = $cgiparams{'LOCAL_SUBNET'};
3918         $confighash{$key}[10]           = $cgiparams{'REMOTE'};
3919   if ($cgiparams{'OVPN_MGMT'} eq '') {
3920         $confighash{$key}[22]           = $confighash{$key}[29];
3921   } else {
3922         $confighash{$key}[22]           = $cgiparams{'OVPN_MGMT'};
3923   }
3924         $confighash{$key}[23]           = $cgiparams{'MSSFIX'};
3925         $confighash{$key}[24]           = $cgiparams{'FRAGMENT'};
3926         $confighash{$key}[25]           = $cgiparams{'REMARK'};
3927         $confighash{$key}[26]           = $cgiparams{'INTERFACE'};
3928 # new fields
3929         $confighash{$key}[27]           = $cgiparams{'OVPN_SUBNET'};
3930         $confighash{$key}[28]           = $cgiparams{'PROTOCOL'};
3931         $confighash{$key}[29]           = $cgiparams{'DEST_PORT'};
3932         $confighash{$key}[30]           = $cgiparams{'COMPLZO'};
3933         $confighash{$key}[31]           = $cgiparams{'MTU'};
3934         $confighash{$key}[32]           = $cgiparams{'CHECK1'};
3935         my $name=$cgiparams{'CHECK1'};
3936         $confighash{$key}[33]           = $cgiparams{$name};
3937         $confighash{$key}[34]           = $cgiparams{'RG'};
3938         $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
3939         $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
3940         $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
3941         $confighash{$key}[38]                   = $cgiparams{'PMTU_DISCOVERY'};
3942
3943
3944         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3945
3946         if ($cgiparams{'CHECK1'} ){
3947
3948                 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
3949                 my ($a,$b,$c,$d) = split (/\./,$ccdip);
3950                         if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";}
3951                         open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
3952                         print CCDRWCONF "# OpenVPN Clientconfig from CCD extension by Copymaster#\n\n";
3953                         if($cgiparams{'CHECK1'} eq 'dynamic'){
3954                                 print CCDRWCONF "#This client uses the dynamic pool\n";
3955                         }else{
3956                                 print CCDRWCONF "#Ip address client and Server\n";
3957                                 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
3958                         }
3959                         if ($confighash{$key}[34] eq 'on'){
3960                                 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
3961                                 print CCDRWCONF "push redirect-gateway\n";
3962                         }
3963                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3964                         if ($cgiparams{'IR'} ne ''){
3965                                 print CCDRWCONF "\n#Client routes these Networks (behind Client)\n";
3966                                 foreach my $key (keys %ccdroutehash){
3967                                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
3968                                                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
3969                                                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
3970                                                         print CCDRWCONF "iroute $a $b\n";
3971                                                 }
3972                                         }
3973                                 }
3974                         }
3975                         if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
3976                         if ($cgiparams{'IFROUTE'} ne ''){
3977                                 print CCDRWCONF "\n#Client gets routes to these Networks (behind IPFIRE)\n";
3978                                 foreach my $key (keys %ccdroute2hash){
3979                                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
3980                                                 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
3981                                                         if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
3982                                                                 my %blue=();
3983                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
3984                                                                 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
3985                                                         }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
3986                                                                 my %orange=();
3987                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
3988                                                                 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS}  $orange{ORANGE_NETMASK}\n";
3989                                                         }else{
3990                                                                 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
3991                                                                 print CCDRWCONF "push \"route $a $b\"\n";
3992                                                         }
3993                                                 }
3994                                         }
3995                                 }
3996                         }
3997                         if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
3998                         if($cgiparams{'CCD_DNS1'} ne ''){
3999                                 print CCDRWCONF "\n#Client gets these Nameservers\n";
4000                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4001                         }
4002                         if($cgiparams{'CCD_DNS2'} ne ''){
4003                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4004                         }
4005                         if($cgiparams{'CCD_WINS'} ne ''){
4006                                 print CCDRWCONF "\n#Client gets this WINS server\n";
4007                                 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4008                         }
4009                         close CCDRWCONF;
4010         }
4011
4012 ###
4013 # m.a.d n2n begin
4014 ###
4015
4016         if ($cgiparams{'TYPE'} eq 'net') {
4017
4018         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4019   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
4020
4021   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4022         my $key = $cgiparams{'KEY'};
4023         if (! $key) {
4024             $key = &General::findhasharraykey (\%confighash);
4025             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
4026             }
4027   $confighash{$key}[0] = 'on';
4028   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4029
4030   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
4031          }
4032   }
4033
4034 ###
4035 # m.a.d n2n end
4036 ###
4037
4038         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4039             $cgiparams{'KEY'} = $key;
4040             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4041         }
4042         goto VPNCONF_END;
4043     } else {
4044         $cgiparams{'ENABLED'} = 'on';
4045 ###
4046 # m.a.d n2n begin
4047 ###
4048         $cgiparams{'MSSFIX'} = 'on';
4049         $cgiparams{'FRAGMENT'} = '1300';
4050         $cgiparams{'PMTU_DISCOVERY'} = 'off';
4051 ###
4052 # m.a.d n2n end
4053 ###
4054         $cgiparams{'SIDE'} = 'left';
4055         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4056             $cgiparams{'AUTH'} = 'psk';
4057         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4058             $cgiparams{'AUTH'} = 'certfile';
4059         } else {
4060             $cgiparams{'AUTH'} = 'certgen';
4061         }
4062         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4063         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4064         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
4065         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
4066         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
4067     }
4068
4069     VPNCONF_ERROR:
4070     $checked{'ENABLED'}{'off'} = '';
4071     $checked{'ENABLED'}{'on'} = '';
4072     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4073     $checked{'ENABLED_BLUE'}{'off'} = '';
4074     $checked{'ENABLED_BLUE'}{'on'} = '';
4075     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4076     $checked{'ENABLED_ORANGE'}{'off'} = '';
4077     $checked{'ENABLED_ORANGE'}{'on'} = '';
4078     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4079
4080
4081     $checked{'EDIT_ADVANCED'}{'off'} = '';
4082     $checked{'EDIT_ADVANCED'}{'on'} = '';
4083     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
4084
4085     $selected{'SIDE'}{'server'} = '';
4086     $selected{'SIDE'}{'client'} = '';
4087     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
4088
4089     $selected{'PROTOCOL'}{'udp'} = '';
4090     $selected{'PROTOCOL'}{'tcp'} = '';
4091     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4092
4093
4094     $checked{'AUTH'}{'psk'} = '';
4095     $checked{'AUTH'}{'certreq'} = '';
4096     $checked{'AUTH'}{'certgen'} = '';
4097     $checked{'AUTH'}{'certfile'} = '';
4098     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
4099
4100     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
4101
4102     $checked{'COMPLZO'}{'off'} = '';
4103     $checked{'COMPLZO'}{'on'} = '';
4104     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
4105
4106     $checked{'MSSFIX'}{'off'} = '';
4107     $checked{'MSSFIX'}{'on'} = '';
4108     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4109
4110     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
4111
4112
4113     if (1) {
4114         &Header::showhttpheaders();
4115         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
4116         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4117         if ($errormessage) {
4118             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4119             print "<class name='base'>$errormessage";
4120             print "&nbsp;</class>";
4121             &Header::closebox();
4122         }
4123
4124         if ($warnmessage) {
4125             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4126             print "<class name='base'>$warnmessage";
4127             print "&nbsp;</class>";
4128             &Header::closebox();
4129         }
4130
4131         print "<form method='post' enctype='multipart/form-data'>";
4132         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
4133
4134         if ($cgiparams{'KEY'}) {
4135             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4136             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4137         }
4138
4139         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4140         print "<table width='100%'  border='0'>\n";
4141
4142
4143
4144         print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}: </td>";
4145
4146         if ($cgiparams{'TYPE'} eq 'host') {
4147             if ($cgiparams{'KEY'}) {
4148                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4149             } else {
4150
4151                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4152             }
4153 #           print "<tr><td>$Lang::tr{'interface'}</td>";
4154 #           print "<td><select name='INTERFACE'>";
4155 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4156 #           if ($netsettings{'BLUE_DEV'} ne '') {
4157 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4158 #           }
4159 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4160 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4161 #           print "</select></td></tr>";
4162 #           print <<END
4163         } else {
4164             print "<input type='hidden' name='INTERFACE' value='red' />";
4165             if ($cgiparams{'KEY'}) {
4166                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4167             } else {
4168                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4169             }
4170
4171
4172
4173             print <<END
4174                     <td width='25%'>&nbsp;</td>
4175                     <td width='25%'>&nbsp;</td></tr>
4176                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4177                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4178                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
4179                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4180                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
4181                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
4182                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4183                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
4184                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
4185                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
4186                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
4187                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4188
4189      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4190                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4191
4192         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4193                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
4194                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
4195                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4196
4197                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
4198                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4199         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4200
4201           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
4202                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4203                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4204
4205                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
4206                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4207         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4208
4209         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
4210                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4211         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
4212
4213         <tr>
4214                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td>
4215                 <td colspan='2'>
4216                         <input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}
4217                         <input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}
4218                         <input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}
4219                         <input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}
4220                 </td>
4221         </tr>
4222
4223 END
4224 ;
4225         }
4226 #jumper
4227         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
4228         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4229
4230         if ($cgiparams{'TYPE'} eq 'host') {
4231       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4232     }
4233
4234                 print"</tr></table><br><br>";
4235 #A.Marx CCD new client
4236 if ($cgiparams{'TYPE'} eq 'host') {
4237             print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4238             my %vpnnet=();
4239             my $vpnip;
4240             &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4241             $vpnip=$vpnnet{'DOVPN_SUBNET'};
4242             &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4243             my @ccdconf=();
4244                 my $count=0;
4245                 my $checked;
4246                 $checked{'check1'}{'off'} = '';
4247             $checked{'check1'}{'on'} = '';
4248             $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4249             print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4250             print"</td></tr></table><br><br>";
4251                 my $name=$cgiparams{'CHECK1'};
4252                 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4253
4254         if (! -z "${General::swroot}/ovpn/ccd.conf"){
4255                 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4256                 foreach my $key (keys %ccdconfhash) {
4257                         $count++;
4258                         @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4259                         if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4260                         print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4261                         &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4262                         print"</td></tr>";
4263                 }
4264                 print "</table><br><br><hr><br><br>";
4265         }
4266 }
4267 # ccd end
4268         &Header::closebox();
4269         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4270
4271                 } elsif (! $cgiparams{'KEY'}) {
4272
4273
4274             my $disabled='';
4275             my $cakeydisabled='';
4276             my $cacrtdisabled='';
4277             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4278             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4279
4280             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4281
4282
4283  if ($cgiparams{'TYPE'} eq 'host') {
4284
4285 print <<END
4286             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4287
4288             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4289             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4290             <tr><td colspan='3'>&nbsp;</td></tr>
4291       <tr><td colspan='3'><hr /></td></tr>
4292       <tr><td colspan='3'>&nbsp;</td></tr>
4293             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4294             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4295             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4296             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4297             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4298             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4299             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4300             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4301 END
4302 ;
4303
4304 ###
4305 # m.a.d net2net
4306 ###
4307
4308 } else {
4309
4310 print <<END
4311             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4312
4313             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4314             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4315             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4316             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4317             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4318             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4319             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4320             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4321
4322
4323 END
4324 ;
4325
4326 }
4327
4328 ###
4329 # m.a.d net2net
4330 ###
4331
4332             foreach my $country (sort keys %{Countries::countries}) {
4333                 print "<option value='$Countries::countries{$country}'";
4334                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4335                     print " selected='selected'";
4336                 }
4337                 print ">$country</option>";
4338             }
4339 ###
4340 # m.a.d net2net
4341 ###
4342
4343 if ($cgiparams{'TYPE'} eq 'host') {
4344             print <<END
4345             </select></td></tr>
4346
4347         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
4348         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4349    <tr><td>&nbsp;</td>
4350                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
4351                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
4352             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
4353                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
4354      <tr><td colspan='3'>&nbsp;</td></tr>
4355      <tr><td colspan='3'><hr /></td></tr>
4356      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4357      </table>
4358 END
4359 }else{
4360             print <<END
4361             </select></td></tr>
4362    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4363          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4364          <tr><td colspan='3'><hr /></td></tr>
4365          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4366        </table>
4367
4368 END
4369 }
4370
4371 ###
4372 # m.a.d net2net
4373 ###
4374             ;
4375             &Header::closebox();
4376
4377         }
4378
4379 #A.Marx CCD new client
4380 if ($cgiparams{'TYPE'} eq 'host') {
4381             print"<br><br>";
4382             &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
4383
4384
4385         print <<END;
4386         <table border='0' width='100%'>
4387         <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
4388         <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
4389         <tr><td colspan='4'>&nbsp</td></tr>
4390         <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
4391 END
4392
4393         if ($cgiparams{'IR'} ne ''){
4394                 print $cgiparams{'IR'};
4395         }else{
4396                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4397                 foreach my $key (keys %ccdroutehash) {
4398                         if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
4399                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
4400                                                 if ($ccdroutehash{$key}[$i] ne ''){
4401                                                         print $ccdroutehash{$key}[$i]."\n";
4402                                                 }
4403                                                 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
4404                                 }
4405                         }
4406                 }
4407         }
4408
4409         print <<END;
4410 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
4411         <tr><td colspan='4'><br></td></tr>
4412         <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
4413 END
4414
4415         my $set=0;
4416         my $selorange=0;
4417         my $selblue=0;
4418         my $selgreen=0;
4419         my $helpblue=0;
4420         my $helporange=0;
4421         my $other=0;
4422         my @temp=();
4423
4424         our @current = ();
4425         open(FILE, "${General::swroot}/main/routing") ;
4426         @current = <FILE>;
4427         close (FILE);
4428         &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
4429         print"<option>$Lang::tr{'ccd none'}</option>";
4430         #check if static routes are defined for client
4431         foreach my $line (@current) {
4432                 chomp($line);
4433                 $line=~s/\s*$//g;                       # remove newline
4434                 @temp=split(/\,/,$line);
4435                 $temp[1] = '' unless defined $temp[1]; # not always populated
4436                 my ($a,$b) = split(/\//,$temp[1]);
4437                 $temp[1] = $a."/".&General::iporsubtocidr($b);
4438                 foreach my $key (keys %ccdroute2hash) {
4439                         if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4440                                 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4441                                         if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
4442                                                 $set=1;
4443                                         }
4444                                 }
4445                         }
4446                 }
4447                 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
4448         }
4449         #check if green,blue,orange are defined for client
4450         foreach my $key (keys %ccdroute2hash) {
4451                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4452                         $other=1;
4453                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4454                                 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
4455                                         $selgreen=1;
4456                                 }
4457                                 if (&haveBlueNet()){
4458                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
4459                                                 $selblue=1;
4460                                         }
4461                                 }
4462                                 if (&haveOrangeNet()){
4463                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
4464                                                 $selorange=1;
4465                                         }
4466                                 }
4467                         }
4468                 }
4469         }
4470         if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
4471         if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
4472         if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
4473
4474         print<<END
4475         </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
4476         <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
4477         <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
4478
4479 END
4480 ;
4481      &Header::closebox();
4482 }
4483         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4484         if ($cgiparams{'KEY'}) {
4485 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
4486         }
4487         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
4488         &Header::closebigbox();
4489         &Header::closepage();
4490         exit (0);
4491     }
4492     VPNCONF_END:
4493 }
4494
4495 #    SETTINGS_ERROR:
4496 ###
4497 ### Default status page
4498 ###
4499     %cgiparams = ();
4500     %cahash = ();
4501     %confighash = ();
4502     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
4503     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
4504     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4505
4506     my @status = `/bin/cat /var/log/ovpnserver.log`;
4507
4508     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
4509                 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
4510                     my $ipaddr = <IPADDR>;
4511                     close IPADDR;
4512                     chomp ($ipaddr);
4513                     $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
4514                     if ($cgiparams{'VPN_IP'} eq '') {
4515                                 $cgiparams{'VPN_IP'} = $ipaddr;
4516                     }
4517                 }
4518     }
4519
4520 #default setzen
4521     if ($cgiparams{'DCIPHER'} eq '') {
4522         $cgiparams{'DCIPHER'} =  'BF-CBC';
4523     }
4524     if ($cgiparams{'DDEST_PORT'} eq '') {
4525         $cgiparams{'DDEST_PORT'} =  '1194';
4526     }
4527     if ($cgiparams{'DMTU'} eq '') {
4528         $cgiparams{'DMTU'} =  '1400';
4529     }
4530     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
4531         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
4532     }
4533         $checked{'ENABLED'}{'off'} = '';
4534     $checked{'ENABLED'}{'on'} = '';
4535     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4536     $checked{'ENABLED_BLUE'}{'off'} = '';
4537     $checked{'ENABLED_BLUE'}{'on'} = '';
4538     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4539     $checked{'ENABLED_ORANGE'}{'off'} = '';
4540     $checked{'ENABLED_ORANGE'}{'on'} = '';
4541     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4542     $selected{'DDEVICE'}{'tun'} = '';
4543     $selected{'DDEVICE'}{'tap'} = '';
4544     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
4545
4546     $selected{'DPROTOCOL'}{'udp'} = '';
4547     $selected{'DPROTOCOL'}{'tcp'} = '';
4548     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
4549
4550     $selected{'DCIPHER'}{'DES-CBC'} = '';
4551     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4552     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4553     $selected{'DCIPHER'}{'DESX-CBC'} = '';
4554     $selected{'DCIPHER'}{'RC2-CBC'} = '';
4555     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
4556     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
4557     $selected{'DCIPHER'}{'BF-CBC'} = '';
4558     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4559     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4560     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4561     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4562     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4563     $checked{'DCOMPLZO'}{'off'} = '';
4564     $checked{'DCOMPLZO'}{'on'} = '';
4565     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
4566 # m.a.d
4567     $checked{'MSSFIX'}{'off'} = '';
4568     $checked{'MSSFIX'}{'on'} = '';
4569     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4570 #new settings
4571     &Header::showhttpheaders();
4572     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
4573     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4574
4575     if ($errormessage) {
4576         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4577         print "<class name='base'>$errormessage\n";
4578         print "&nbsp;</class>\n";
4579         &Header::closebox();
4580     }
4581
4582     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
4583     my $srunning = "no";
4584     my $activeonrun = "";
4585     if ( -e "/var/run/openvpn.pid"){
4586         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
4587         $srunning ="yes";
4588         $activeonrun = "";
4589     } else {
4590         $activeonrun = "disabled='disabled'";
4591     }
4592     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
4593         print <<END
4594     <table width='100%' border=0>
4595     <form method='post'>
4596     <td width='25%'>&nbsp;</td>
4597     <td width='25%'>&nbsp;</td>
4598     <td width='25%'>&nbsp;</td></tr>
4599     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
4600     <td align='left'>$sactive</td>
4601     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
4602     <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
4603 END
4604 ;
4605     if (&haveBlueNet()) {
4606         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
4607         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
4608     }
4609     if (&haveOrangeNet()) {
4610         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
4611         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
4612     }
4613     print <<END
4614     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
4615         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
4616     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
4617         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
4618                                 <!-- this is still not working
4619                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
4620     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4621         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
4622                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
4623         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4624         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
4625     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
4626         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
4627     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4628         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
4629         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
4630         <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
4631                                    <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
4632                                    <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
4633                                    <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
4634                                    <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
4635                                    <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
4636                                    <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
4637                                    <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
4638                                    <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
4639                                    <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
4640                                    <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
4641                                    <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td></tr>
4642                                    <tr><td colspan='4'><hr /></td></tr>
4643 END
4644 ;
4645
4646     if ( $srunning eq "yes" ) {
4647         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
4648         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4649         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4650         print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
4651     } else{
4652         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4653         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4654         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4655         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
4656              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
4657              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
4658              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
4659             (( $cgiparams{'ENABLED'} eq 'on') ||
4660             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4661             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
4662             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
4663         } else {
4664             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
4665         }
4666     }
4667     print "</form></table>";
4668     &Header::closebox();
4669     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
4670     print <<EOF#'
4671     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
4672     <tr>
4673         <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
4674         <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
4675         <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
4676     </tr>
4677 EOF
4678     ;
4679     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
4680         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
4681         $casubject    =~ /Subject: (.*)[\n]/;
4682         $casubject    = $1;
4683         $casubject    =~ s+/Email+, E+;
4684         $casubject    =~ s/ ST=/ S=/;
4685
4686         print <<END
4687         <tr bgcolor='$color{'color22'}'>
4688         <td class='base'>$Lang::tr{'root certificate'}</td>
4689         <td class='base'>$casubject</td>
4690         <form method='post' name='frmrootcrta'><td width='3%' align='center'>
4691             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
4692             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
4693         </td></form>
4694         <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
4695             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
4696             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
4697         </td></form>
4698         <td width='4%'>&nbsp;</td></tr>
4699 END
4700         ;
4701     } else {
4702         # display rootcert generation buttons
4703         print <<END
4704         <tr bgcolor='$color{'color22'}'>
4705         <td class='base'>$Lang::tr{'root certificate'}:</td>
4706         <td class='base'>$Lang::tr{'not present'}</td>
4707         <td colspan='3'>&nbsp;</td></tr>
4708 END
4709         ;
4710     }
4711
4712     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
4713         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
4714         $hostsubject    =~ /Subject: (.*)[\n]/;
4715         $hostsubject    = $1;
4716         $hostsubject    =~ s+/Email+, E+;
4717         $hostsubject    =~ s/ ST=/ S=/;
4718
4719         print <<END
4720         <tr bgcolor='$color{'color20'}'>
4721         <td class='base'>$Lang::tr{'host certificate'}</td>
4722         <td class='base'>$hostsubject</td>
4723         <form method='post' name='frmhostcrta'><td width='3%' align='center'>
4724             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
4725             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
4726         </td></form>
4727         <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
4728             <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
4729             <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
4730         </td></form>
4731         <td width='4%'>&nbsp;</td></tr>
4732 END
4733         ;
4734     } else {
4735         # Nothing
4736         print <<END
4737         <tr bgcolor='$color{'color20'}'>
4738         <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
4739         <td class='base'>$Lang::tr{'not present'}</td>
4740         </td><td colspan='3'>&nbsp;</td></tr>
4741 END
4742         ;
4743     }
4744
4745     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4746         print "<tr><td colspan='5' align='center'><form method='post'>";
4747         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
4748         print "</form></td></tr>\n";
4749     }
4750
4751     if (keys %cahash > 0) {
4752         foreach my $key (keys %cahash) {
4753             if (($key + 1) % 2) {
4754                 print "<tr bgcolor='$color{'color20'}'>\n";
4755             } else {
4756                 print "<tr bgcolor='$color{'color22'}'>\n";
4757             }
4758             print "<td class='base'>$cahash{$key}[0]</td>\n";
4759             print "<td class='base'>$cahash{$key}[1]</td>\n";
4760             print <<END
4761             <form method='post' name='cafrm${key}a'><td align='center'>
4762                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
4763                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
4764                 <input type='hidden' name='KEY' value='$key' />
4765             </td></form>
4766             <form method='post' name='cafrm${key}b'><td align='center'>
4767                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
4768                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
4769                 <input type='hidden' name='KEY' value='$key' />
4770             </td></form>
4771             <form method='post' name='cafrm${key}c'><td align='center'>
4772                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
4773                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
4774                 <input type='hidden' name='KEY' value='$key' />
4775             </td></form></tr>
4776 END
4777             ;
4778         }
4779     }
4780
4781     print "</table>";
4782
4783     # If the file contains entries, print Key to action icons
4784     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
4785     print <<END
4786     <table>
4787     <tr>
4788         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4789         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4790         <td class='base'>$Lang::tr{'show certificate'}</td>
4791         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
4792         <td class='base'>$Lang::tr{'download certificate'}</td>
4793     </tr>
4794     </table>
4795 END
4796 ;
4797     }
4798
4799 print <<END
4800 <form method='post' enctype='multipart/form-data'>
4801 <table width='100%' border='0'>
4802 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td><td nowrap='nowrap' width='8%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'/></td><td nowrap='nowrap' align='right'><input type='file' name='FH' size='25' /><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td></tr>
4803 <tr><td colspan='4'><hr /></td></tr>
4804 <tr align='right'><td colspan='4' align='right' width='80%'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td></tr>
4805 </table>
4806 END
4807 ;
4808
4809
4810     &Header::closebox();
4811     if ( $srunning eq "yes" ) {
4812         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
4813     }else{
4814         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
4815     }
4816     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
4817
4818 ###
4819 # m.a.d net2net
4820 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
4821 ###
4822
4823     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
4824     print <<END
4825
4826
4827     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
4828 <tr>
4829     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
4830     <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
4831     <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'network'}</b></td>
4832     <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
4833     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
4834     <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
4835 </tr>
4836 END
4837         ;
4838         my $id = 0;
4839         my $gif;
4840          foreach my $key (sort { uc($confighash{$a}[1]) cmp uc($confighash{$b}[1]) } keys %confighash) {
4841         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
4842
4843         if ($id % 2) {
4844             print "<tr bgcolor='$color{'color20'}'>\n";
4845         } else {
4846             print "<tr bgcolor='$color{'color22'}'>\n";
4847         }
4848         print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
4849         print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
4850         #if ($confighash{$key}[4] eq 'cert') {
4851             #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
4852         #} else {
4853             #print "<td align='left'>&nbsp;</td>";
4854         #}
4855         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
4856         $cavalid    =~ /Not After : (.*)[\n]/;
4857         $cavalid    = $1;
4858         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]="net-2-net";}
4859         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'host' ){$confighash{$key}[32]="dynamic";}
4860         print "<td align='center'>$confighash{$key}[32]</td>";
4861         print "<td align='center'>$confighash{$key}[25]</td>";
4862
4863         my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
4864
4865         if ($confighash{$key}[0] eq 'off') {
4866          $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
4867         } else {
4868
4869 ###
4870 # m.a.d net2net
4871 ###
4872
4873        if ($confighash{$key}[3] eq 'net') {
4874
4875         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4876           my @output = "";
4877           my @tustate = "";
4878           my $tport = $confighash{$key}[22];
4879           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
4880           if ($tport ne '') {
4881           $tnet->open('127.0.0.1');
4882           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
4883           @tustate = split(/\,/, $output[1]);
4884 ###
4885 #CONNECTING    -- OpenVPN's initial state.
4886 #WAIT          -- (Client only) Waiting for initial response from server.
4887 #AUTH          -- (Client only) Authenticating with server.
4888 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
4889 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
4890 #ADD_ROUTES    -- Adding routes to system.
4891 #CONNECTED     -- Initialization Sequence Completed.
4892 #RECONNECTING  -- A restart has occurred.
4893 #EXITING       -- A graceful exit is in progress.
4894 ####
4895
4896         if ( $tustate[1] eq 'CONNECTED') {
4897           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></tr></td></table>";
4898                           } else {
4899           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$tustate[1]</font></b></td></tr></table>";
4900            }
4901            }
4902            }
4903         }       else {
4904
4905                 my $cn;
4906             my @match = ();
4907           foreach my $line (@status) {
4908                 chomp($line);
4909                 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
4910                     @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
4911                     if ($match[1] ne "Common Name") {
4912                         $cn = $match[1];
4913                     }
4914                 $cn =~ s/[_]/ /g;
4915                     if ($cn eq "$confighash{$key}[2]") {
4916                         $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
4917                     }
4918    }
4919
4920         }
4921 }
4922 }
4923
4924
4925         my $disable_clientdl = "disabled='disabled'";
4926         if (( $cgiparams{'ENABLED'} eq 'on') ||
4927             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4928             ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
4929             $disable_clientdl = "";
4930         }
4931         print <<END
4932         <td align='center'>$active</td>
4933
4934         <form method='post' name='frm${key}a'><td align='center'>
4935             <input type='image'  name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
4936             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
4937             <input type='hidden' name='KEY' value='$key' $disable_clientdl />
4938         </td></form>
4939 END
4940         ;
4941         if ($confighash{$key}[4] eq 'cert') {
4942             print <<END
4943             <form method='post' name='frm${key}b'><td align='center'>
4944                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
4945                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
4946                 <input type='hidden' name='KEY' value='$key' />
4947             </td></form>
4948 END
4949         ; } else {
4950             print "<td>&nbsp;</td>";
4951         }
4952         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
4953             print <<END
4954             <form method='post' name='frm${key}c'><td align='center'>
4955                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
4956                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
4957                 <input type='hidden' name='KEY' value='$key' />
4958             </td></form>
4959 END
4960         ; } elsif ($confighash{$key}[4] eq 'cert') {
4961             print <<END
4962             <form method='post' name='frm${key}c'><td align='center'>
4963                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
4964                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
4965                 <input type='hidden' name='KEY' value='$key' />
4966             </td></form>
4967 END
4968         ; } else {
4969             print "<td>&nbsp;</td>";
4970         }
4971         print <<END
4972         <form method='post' name='frm${key}d'><td align='center'>
4973             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
4974             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
4975             <input type='hidden' name='KEY' value='$key' />
4976         </td></form>
4977
4978         <form method='post' name='frm${key}e'><td align='center'>
4979             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
4980             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
4981             <input type='hidden' name='KEY' value='$key' />
4982         </td></form>
4983         <form method='post' name='frm${key}f'><td align='center'>
4984             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
4985             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
4986             <input type='hidden' name='KEY' value='$key' />
4987         </td></form>
4988         </tr>
4989 END
4990         ;
4991         $id++;
4992     }
4993     ;
4994
4995     # If the config file contains entries, print Key to action icons
4996     if ( $id ) {
4997     print <<END
4998     <table border='0'>
4999     <tr>
5000         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5001         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5002         <td class='base'>$Lang::tr{'click to disable'}</td>
5003         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5004         <td class='base'>$Lang::tr{'show certificate'}</td>
5005         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5006         <td class='base'>$Lang::tr{'edit'}</td>
5007         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5008         <td class='base'>$Lang::tr{'remove'}</td>
5009     </tr>
5010     <tr>
5011         <td>&nbsp; </td>
5012         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5013         <td class='base'>$Lang::tr{'click to enable'}</td>
5014         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5015         <td class='base'>$Lang::tr{'download certificate'}</td>
5016         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5017         <td class='base'>$Lang::tr{'dl client arch'}</td>
5018     </tr>
5019     </table><hr>
5020 END
5021     ;
5022     }
5023
5024     print <<END
5025     <table width='100%'>
5026     <form method='post'>
5027     <tr><td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5028     <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
5029     </form>
5030     </table>
5031 END
5032     ;
5033     &Header::closebox();
5034 }
5035 &Header::closepage();
5036
5037
5038