html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/countries.pl";
  37
  38 # enable only the following on debugging purpose
  39 #use warnings;
  40 #use CGI::Carp 'fatalsToBrowser';
  41 #workaround to suppress a warning when a variable is used only once
  42 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
  43 undef (@dummy);
  44
  45 my %color = ();
  46 my %mainsettings = ();
  47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  49
  50 ###
  51 ### Initialize variables
  52 ###
  53 my %ccdconfhash=();
  54 my %ccdroutehash=();
  55 my %ccdroute2hash=();
  56 my %netsettings=();
  57 my %cgiparams=();
  58 my %vpnsettings=();
  59 my %checked=();
  60 my %confighash=();
  61 my %cahash=();
  62 my %selected=();
  63 my $warnmessage = '';
  64 my $errormessage = '';
  65 my %settings=();
  66 my $routes_push_file = '';
  67 my $confighost="${General::swroot}/fwhosts/customhosts";
  68 my $configgrp="${General::swroot}/fwhosts/customgroups";
  69 my $customnet="${General::swroot}/fwhosts/customnetworks";
  70 my $name;
  71 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  72 $cgiparams{'ENABLED'} = 'off';
  73 $cgiparams{'ENABLED_BLUE'} = 'off';
  74 $cgiparams{'ENABLED_ORANGE'} = 'off';
  75 $cgiparams{'EDIT_ADVANCED'} = 'off';
  76 $cgiparams{'NAT'} = 'off';
  77 $cgiparams{'COMPRESSION'} = 'off';
  78 $cgiparams{'ONLY_PROPOSED'} = 'off';
  79 $cgiparams{'ACTION'} = '';
  80 $cgiparams{'CA_NAME'} = '';
  81 $cgiparams{'DHCP_DOMAIN'} = '';
  82 $cgiparams{'DHCP_DNS'} = '';
  83 $cgiparams{'DHCP_WINS'} = '';
  84 $cgiparams{'ROUTES_PUSH'} = '';
  85 $cgiparams{'DCOMPLZO'} = 'off';
  86 $cgiparams{'MSSFIX'} = '';
  87 $cgiparams{'number'} = '';
  88 $cgiparams{'PMTU_DISCOVERY'} = '';
  89 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  90 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  91 unless (-e "${General::swroot}/ovpn/ccd.conf")    { system("touch ${General::swroot}/ovpn/ccd.conf"); }
  92 unless (-e "${General::swroot}/ovpn/ccdroute")    { system("touch ${General::swroot}/ovpn/ccdroute"); }
  93 unless (-e "${General::swroot}/ovpn/ccdroute2")    { system("touch ${General::swroot}/ovpn/ccdroute2"); }
  94
  95 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  96
  97 # prepare openvpn config file
  98 ###
  99 ### Useful functions
 100 ###
 101 sub haveOrangeNet
 102 {
 103         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
 104         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 105         return 0;
 106 }
 107
 108 sub haveBlueNet
 109 {
 110         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
 111         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 112         return 0;
 113 }
 114
 115 sub sizeformat{
 116     my $bytesize = shift;
 117     my $i = 0;
 118
 119     while(abs($bytesize) >= 1024){
 120         $bytesize=$bytesize/1024;
 121         $i++;
 122         last if($i==6);
 123     }
 124
 125     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 126     my $newsize=(int($bytesize*100 +0.5))/100;
 127     return("$newsize $units[$i]");
 128 }
 129
 130 sub valid_dns_host {
 131         my $hostname = $_[0];
 132         unless ($hostname) { return "No hostname"};
 133         my $res = new Net::DNS::Resolver;
 134         my $query = $res->search("$hostname");
 135         if ($query) {
 136                 foreach my $rr ($query->answer) {
 137                         ## Potential bug - we are only looking at A records:
 138                         return 0 if $rr->type eq "A";
 139                 }
 140         } else {
 141                 return $res->errorstring;
 142         }
 143 }
 144
 145 sub cleanssldatabase
 146 {
 147     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 148         print FILE "01";
 149         close FILE;
 150     }
 151     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 152         print FILE "";
 153         close FILE;
 154     }
 155     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 156     unlink ("${General::swroot}/ovpn/certs/serial.old");
 157     unlink ("${General::swroot}/ovpn/certs/01.pem");
 158 }
 159
 160 sub newcleanssldatabase
 161 {
 162     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 163         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 164         print FILE "01";
 165         close FILE;
 166     }
 167     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 168         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 169     }
 170     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 171     unlink ("${General::swroot}/ovpn/certs/serial.old");
 172 }
 173
 174 sub deletebackupcert
 175 {
 176         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 177                 my $hexvalue = <FILE>;
 178                 chomp $hexvalue;
 179                 close FILE;
 180                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 181         }
 182 }
 183
 184 sub checkportfw {
 185     my $KEY2 = $_[0]; # key2
 186     my $SRC_PORT = $_[1]; # src_port
 187     my $PROTOCOL = $_[2]; # protocol
 188     my $SRC_IP = $_[3]; # sourceip
 189
 190     my $pfwfilename = "${General::swroot}/portfw/config";
 191     open(FILE, $pfwfilename) or die 'Unable to open config file.';
 192     my @pfwcurrent = <FILE>;
 193     close(FILE);
 194     my $pfwkey1 = 0; # used for finding last sequence number used
 195     foreach my $pfwline (@pfwcurrent)
 196     {
 197         my @pfwtemp = split(/\,/,$pfwline);
 198
 199         chomp ($pfwtemp[8]);
 200         if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
 201                 if ( $SRC_PORT eq $pfwtemp[3] &&
 202                         $PROTOCOL eq $pfwtemp[2] &&
 203                         $SRC_IP eq $pfwtemp[7])
 204                 {
 205                          $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
 206                 }
 207                 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
 208                 if ( $pfwtemp[1] eq "0") {
 209                         $pfwkey1=$pfwtemp[0];
 210                 }
 211                 # Darren Critchley - Duplicate or overlapping Port range check
 212                 if ($pfwtemp[1] eq "0" &&
 213                         $PROTOCOL eq $pfwtemp[2] &&
 214                         $SRC_IP eq $pfwtemp[7] &&
 215                         $errormessage eq '')
 216                 {
 217                         &portchecks($SRC_PORT, $pfwtemp[5]);
 218 #                       &portchecks($pfwtemp[3], $pfwtemp[5]);
 219 #                       &portchecks($pfwtemp[3], $SRC_IP);
 220                 }
 221         }
 222     }
 223 #    $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
 224
 225     return;
 226 }
 227
 228 sub checkportoverlap
 229 {
 230         my $portrange1 = $_[0]; # New port range
 231         my $portrange2 = $_[1]; # existing port range
 232         my @tempr1 = split(/\:/,$portrange1);
 233         my @tempr2 = split(/\:/,$portrange2);
 234
 235         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 236         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 237
 238         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 239         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 240
 241         return 1; # Everything checks out!
 242 }
 243
 244 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 245 sub checkportinc
 246 {
 247         my $port1 = $_[0]; # Port
 248         my $portrange2 = $_[1]; # Port range
 249         my @tempr1 = split(/\:/,$portrange2);
 250
 251         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 252                 return 1;
 253         } else {
 254                 return 0;
 255         }
 256 }
 257 # Darren Critchley - Duplicate or overlapping Port range check
 258 sub portchecks
 259 {
 260         my $p1 = $_[0]; # New port range
 261         my $p2 = $_[1]; # existing port range
 262 #       $_ = $_[0];
 263         our ($prtrange1, $prtrange2);
 264         $prtrange1 = 0;
 265 #       if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
 266 #               unless (&checkportoverlap($p1,$p2)) {
 267 #                       $errormessage = "$Lang::tr{'source port overlaps'} $p1";
 268 #               }
 269 #       }
 270         if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
 271                 unless (&checkportinc($p2,$p1)) {
 272                         $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
 273                 }
 274         }
 275         $prtrange1 = 1;
 276         if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
 277                 unless (&checkportinc($p1,$p2)) {
 278                         $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
 279                 }
 280         }
 281         return;
 282 }
 283
 284 # Darren Critchley - certain ports are reserved for IPFire
 285 # TCP 67,68,81,222,445
 286 # UDP 67,68
 287 # Params passed in -> port, rangeyn, protocol
 288 sub disallowreserved
 289 {
 290         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 291         my $msg = "";
 292         my @tcp_reserved = (81,222,445);
 293         my $prt = $_[0]; # the port or range
 294         my $ryn = $_[1]; # tells us whether or not it is a port range
 295         my $prot = $_[2]; # protocol
 296         my $srcdst = $_[3]; # source or destination
 297         if ($ryn) { # disect port range
 298                 if ($srcdst eq "src") {
 299                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 300                 } else {
 301                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 302                 }
 303                 my @tmprng = split(/\:/,$prt);
 304                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 305                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 306                 if ($prot eq "tcp") {
 307                         foreach my $prange (@tcp_reserved) {
 308                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 309                         }
 310                 }
 311         } else {
 312                 if ($srcdst eq "src") {
 313                         $msg = "$Lang::tr{'reserved src port'}";
 314                 } else {
 315                         $msg = "$Lang::tr{'reserved dst port'}";
 316                 }
 317                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 318                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 319                 if ($prot eq "tcp") {
 320                         foreach my $prange (@tcp_reserved) {
 321                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 322                         }
 323                 }
 324         }
 325         return;
 326 }
 327
 328 sub writeserverconf {
 329     my %sovpnsettings = ();
 330     my @temp = ();
 331     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 332     &read_routepushfile;
 333
 334     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 335     flock CONF, 2;
 336     print CONF "#OpenVPN Server conf\n";
 337     print CONF "\n";
 338     print CONF "daemon openvpnserver\n";
 339     print CONF "writepid /var/run/openvpn.pid\n";
 340     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 341     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 342     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 343     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 344     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 345     print CONF "script-security 3 system\n";
 346     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 347     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 348     print CONF "tls-server\n";
 349     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 350     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 351     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 352     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 353     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 354     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 355     #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 356
 357     # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
 358     # If we doesn't use one of them, we can use the configured mtu value.
 359     if ($sovpnsettings{'MSSFIX'} eq 'on')
 360         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 361     elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
 362         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 363     elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
 364            ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
 365            ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
 366         { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
 367     else
 368         { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
 369
 370     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 371                 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 372                 foreach (@temp)
 373                 {
 374                         @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 375                         print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 376                 }
 377         }
 378 # a.marx ccd
 379         my %ccdconfhash=();
 380         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 381         foreach my $key (keys %ccdconfhash) {
 382                 my $a=$ccdconfhash{$key}[1];
 383                 my ($b,$c) = split (/\//, $a);
 384                 print CONF "route $b ".&General::cidrtosub($c)."\n";
 385         }
 386         my %ccdroutehash=();
 387         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 388         foreach my $key (keys %ccdroutehash) {
 389                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
 390                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
 391                         print CONF "route $a $b\n";
 392                 }
 393         }
 394 # ccd end
 395
 396         if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 397         print CONF "client-to-client\n";
 398     }
 399     if ($sovpnsettings{MSSFIX} eq 'on') {
 400         print CONF "mssfix\n";
 401     }
 402     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 403         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 404     }
 405
 406     # Check if a valid operating mode has been choosen and use it.
 407     if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
 408         ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
 409         ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
 410                 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
 411     }
 412
 413     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 414         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 415     }
 416     print CONF "status-version 1\n";
 417     print CONF "status /var/log/ovpnserver.log 30\n";
 418     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 419     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 420         print CONF "comp-lzo\n";
 421     }
 422     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 423         print CONF "push \"redirect-gateway def1\"\n";
 424     }
 425     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 426         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 427     }
 428
 429     if ($sovpnsettings{DHCP_DNS} ne '') {
 430         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 431     }
 432
 433     if ($sovpnsettings{DHCP_WINS} ne '') {
 434         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 435     }
 436
 437     if ($sovpnsettings{DHCP_WINS} eq '') {
 438         print CONF "max-clients 100\n";
 439     }
 440     if ($sovpnsettings{DHCP_WINS} ne '') {
 441         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 442     }
 443     print CONF "tls-verify /var/ipfire/ovpn/verify\n";
 444     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 445     print CONF "user nobody\n";
 446     print CONF "group nobody\n";
 447     print CONF "persist-key\n";
 448     print CONF "persist-tun\n";
 449         if ($sovpnsettings{LOG_VERB} ne '') {
 450                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 451         } else {
 452                 print CONF "verb 3\n";
 453         }
 454     print CONF "\n";
 455
 456     close(CONF);
 457 }
 458
 459 sub emptyserverlog{
 460     if (open(FILE, ">/var/log/ovpnserver.log")) {
 461         flock FILE, 2;
 462         print FILE "";
 463         close FILE;
 464     }
 465
 466 }
 467
 468 sub delccdnet
 469 {
 470         my %ccdconfhash = ();
 471         my %ccdhash = ();
 472         my $ccdnetname=$_[0];
 473         if (-f "${General::swroot}/ovpn/ovpnconfig"){
 474                 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 475                 foreach my $key (keys %ccdhash) {
 476                         if ($ccdhash{$key}[32] eq $ccdnetname) {
 477                                 $errormessage=$Lang::tr{'ccd err hostinnet'};
 478                                 return;
 479                         }
 480                 }
 481         }
 482         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 483         foreach my $key (keys %ccdconfhash) {
 484                         if ($ccdconfhash{$key}[0] eq $ccdnetname){
 485                                 delete $ccdconfhash{$key};
 486                         }
 487         }
 488         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 489
 490         &writeserverconf;
 491         return 0;
 492 }
 493
 494 sub addccdnet
 495 {
 496         my %ccdconfhash=();
 497         my @ccdconf=();
 498         my $ccdname=$_[0];
 499         my $ccdnet=$_[1];
 500         my $subcidr;
 501         my @ip2=();
 502         my $checkup;
 503         my $ccdip;
 504         my $baseaddress;
 505
 506
 507         #check name
 508         if ($ccdname eq '')
 509         {
 510                 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
 511                 return
 512         }
 513
 514         if(!&General::validhostname($ccdname))
 515         {
 516                 $errormessage=$Lang::tr{'ccd err invalidname'};
 517                 return;
 518         }
 519
 520         ($ccdip,$subcidr) = split (/\//,$ccdnet);
 521         $subcidr=&General::iporsubtocidr($subcidr);
 522         #check subnet
 523         if ($subcidr > 30)
 524         {
 525                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 526                 return;
 527         }
 528         #check ip
 529         if (!&General::validipandmask($ccdnet)){
 530                 $errormessage=$Lang::tr{'ccd err invalidnet'};
 531                 return;
 532         }
 533
 534         $errormessage=&General::checksubnets($ccdname,$ccdnet);
 535
 536
 537         if (!$errormessage) {
 538                 my %ccdconfhash=();
 539                 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
 540                 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 541                 my $key = &General::findhasharraykey (\%ccdconfhash);
 542                 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
 543                 $ccdconfhash{$key}[0] = $ccdname;
 544                 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
 545                 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 546                 &writeserverconf;
 547                 $cgiparams{'ccdname'}='';
 548                 $cgiparams{'ccdsubnet'}='';
 549                 return 1;
 550         }
 551 }
 552
 553 sub modccdnet
 554 {
 555
 556         my $newname=$_[0];
 557         my $oldname=$_[1];
 558         my %ccdconfhash=();
 559         my %ccdhash=();
 560         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 561         foreach my $key (keys %ccdconfhash) {
 562                 if ($ccdconfhash{$key}[0] eq $oldname) {
 563                         foreach my $key1 (keys %ccdconfhash) {
 564                                 if ($ccdconfhash{$key1}[0] eq $newname){
 565                                         $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
 566                                         return;
 567                                 }else{
 568                                         $ccdconfhash{$key}[0]= $newname;
 569                                         &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 570                                         last;
 571                                 }
 572                         }
 573                 }
 574         }
 575
 576         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 577                 foreach my $key (keys %ccdhash) {
 578                         if ($ccdhash{$key}[32] eq $oldname) {
 579                                 $ccdhash{$key}[32]=$newname;
 580                                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 581                                 last;
 582                         }
 583                 }
 584
 585         return 0;
 586 }
 587 sub ccdmaxclients
 588 {
 589         my $ccdnetwork=$_[0];
 590         my @octets=();
 591         my @subnet=();
 592         @octets=split("\/",$ccdnetwork);
 593         @subnet= split /\./, &General::cidrtosub($octets[1]);
 594         my ($a,$b,$c,$d,$e);
 595         $a=256-$subnet[0];
 596         $b=256-$subnet[1];
 597         $c=256-$subnet[2];
 598         $d=256-$subnet[3];
 599         $e=($a*$b*$c*$d)/4;
 600         return $e-1;
 601 }
 602
 603 sub getccdadresses
 604 {
 605         my $ipin=$_[0];
 606         my ($ip1,$ip2,$ip3,$ip4)=split  /\./, $ipin;
 607         my $cidr=$_[1];
 608         chomp($cidr);
 609         my $count=$_[2];
 610         my $hasip=$_[3];
 611         chomp($hasip);
 612         my @iprange=();
 613         my %ccdhash=();
 614         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 615         $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
 616         for (my $i=1;$i<=$count;$i++) {
 617                 my $tmpip=$iprange[$i-1];
 618                 my $stepper=$i*4;
 619                 $iprange[$i]= &General::getnextip($tmpip,4);
 620         }
 621         my $r=0;
 622         foreach my $key (keys %ccdhash) {
 623                 $r=0;
 624                 foreach  my $tmp (@iprange){
 625                         my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
 626                         if ($net eq $tmp) {
 627                                 if ( $hasip ne  $ccdhash{$key}[33] ){
 628                                         splice (@iprange,$r,1);
 629                                 }
 630                         }
 631                         $r++;
 632                 }
 633         }
 634         return @iprange;
 635 }
 636
 637 sub fillselectbox
 638 {
 639         my $boxname=$_[1];
 640         my ($ccdip,$subcidr) = split("/",$_[0]);
 641         my $tz=$_[2];
 642         my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
 643         print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
 644         foreach (@allccdips) {
 645                 my $ip=$_."/30";
 646                 chomp($ip);
 647                 print "<option value='$ip' ";
 648                 if ( $ip eq $cgiparams{$boxname} ){
 649                         print"selected";
 650                 }
 651                 print ">$ip</option>";
 652         }
 653         print "</select>";
 654 }
 655
 656 sub hostsinnet
 657 {
 658         my $name=$_[0];
 659         my %ccdhash=();
 660         my $i=0;
 661         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
 662         foreach my $key (keys %ccdhash) {
 663                 if ($ccdhash{$key}[32] eq $name){ $i++;}
 664         }
 665         return $i;
 666 }
 667
 668 sub check_routes_push
 669 {
 670                         my $val=$_[0];
 671                         my ($ip,$cidr) = split (/\//, $val);
 672                         ##check for existing routes in routes_push
 673                         if (-e "${General::swroot}/ovpn/routes_push") {
 674                                 open(FILE,"${General::swroot}/ovpn/routes_push");
 675                                 while (<FILE>) {
 676                                         $_=~s/\s*$//g;
 677
 678                                         my ($ip2,$cidr2) = split (/\//,"$_");
 679                                         my $val2=$ip2."/".&General::iporsubtodec($cidr2);
 680
 681                                         if($val eq $val2){
 682                                                 return 0;
 683                                         }
 684                                         #subnetcheck
 685                                         if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
 686                                                 return 0;
 687                                         }
 688                                 };
 689                                 close(FILE);
 690                         }
 691         return 1;
 692 }
 693
 694 sub check_ccdroute
 695 {
 696         my %ccdroutehash=();
 697         my $val=$_[0];
 698         my ($ip,$cidr) = split (/\//, $val);
 699         #check for existing routes in ccdroute
 700         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 701         foreach my $key (keys %ccdroutehash) {
 702                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 703                         if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
 704                                 return 0;
 705                         }
 706                         my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
 707                         #subnetcheck
 708                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
 709                                 return 0;
 710                         }
 711                 }
 712         }
 713         return 1;
 714 }
 715 sub check_ccdconf
 716 {
 717         my %ccdconfhash=();
 718         my $val=$_[0];
 719         my ($ip,$cidr) = split (/\//, $val);
 720         #check for existing routes in ccdroute
 721         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
 722         foreach my $key (keys %ccdconfhash) {
 723                 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
 724                                 return 0;
 725                         }
 726                         my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
 727                         #subnetcheck
 728                         if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
 729                                 return 0;
 730                         }
 731
 732         }
 733         return 1;
 734 }
 735
 736 ###
 737 # m.a.d net2net
 738 ###
 739
 740 sub validdotmask
 741 {
 742         my $ipdotmask = $_[0];
 743         if (&General::validip($ipdotmask)) { return 0; }
 744         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 745         my $mask = $2;
 746         if (($mask =~ /\./ )) { return 0; }
 747   return 1;
 748 }
 749
 750 # -------------------------------------------------------------------
 751
 752 sub write_routepushfile
 753 {
 754         open(FILE, ">$routes_push_file");
 755         flock(FILE, 2);
 756         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 757                 print FILE $vpnsettings{'ROUTES_PUSH'};
 758         }
 759         close(FILE);
 760 }
 761
 762 sub read_routepushfile
 763 {
 764         if (-e "$routes_push_file") {
 765                 open(FILE,"$routes_push_file");
 766                 delete $vpnsettings{'ROUTES_PUSH'};
 767                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 768                 close(FILE);
 769                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 770
 771         }
 772 }
 773
 774
 775 #hier die refresh page
 776 if ( -e "${General::swroot}/ovpn/gencanow") {
 777     my $refresh = '';
 778     $refresh = "<meta http-equiv='refresh' content='15;' />";
 779     &Header::showhttpheaders();
 780     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 781     &Header::openbigbox('100%', 'center');
 782     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 783     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 784     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 785     &Header::closebox();
 786     &Header::closebigbox();
 787     &Header::closepage();
 788     exit (0);
 789 }
 790 ##hier die refresh page
 791
 792
 793 ###
 794 ### OpenVPN Server Control
 795 ###
 796 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 797     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 798     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 799     #start openvpn server
 800     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 801         &emptyserverlog();
 802         system('/usr/local/bin/openvpnctrl', '-s');
 803     }
 804     #stop openvpn server
 805     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 806         system('/usr/local/bin/openvpnctrl', '-k');
 807         &emptyserverlog();
 808     }
 809 #    #restart openvpn server
 810 #    if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 811 #workarund, till SIGHUP also works when running as nobody
 812 #       system('/usr/local/bin/openvpnctrl', '-r');
 813 #       &emptyserverlog();
 814 #    }
 815 }
 816
 817 ###
 818 ### Save Advanced options
 819 ###
 820
 821 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 822     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 823     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 824     #DAN this value has to leave.
 825 #new settings for daemon
 826     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 827     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 828     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 829     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 830     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 831     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 832     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 833     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 834     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 835     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 836     $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
 837     my @temp=();
 838
 839     if ($cgiparams{'FRAGMENT'} eq '') {
 840         delete $vpnsettings{'FRAGMENT'};
 841     } else {
 842         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 843             $errormessage = "Incorrect value, please insert only numbers.";
 844         goto ADV_ERROR;
 845                 } else {
 846                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 847         }
 848     }
 849     if ($cgiparams{'MSSFIX'} ne 'on') {
 850         delete $vpnsettings{'MSSFIX'};
 851     } else {
 852         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 853     }
 854
 855     if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
 856         ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
 857         ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
 858
 859         if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
 860                 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
 861                 goto ADV_ERROR;
 862         }
 863     }
 864
 865     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 866         unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 867                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 868         goto ADV_ERROR;
 869         }
 870     }
 871     if ($cgiparams{'DHCP_DNS'} ne ''){
 872         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 873                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 874         goto ADV_ERROR;
 875         }
 876     }
 877     if ($cgiparams{'DHCP_WINS'} ne ''){
 878         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 879                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 880                 goto ADV_ERROR;
 881         }
 882     }
 883     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 884         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 885         undef $vpnsettings{'ROUTES_PUSH'};
 886
 887         foreach my $tmpip (@temp)
 888         {
 889                 s/^\s+//g; s/\s+$//g;
 890
 891                 if ($tmpip)
 892                 {
 893                         $tmpip=~s/\s*$//g;
 894                         unless (&General::validipandmask($tmpip)) {
 895                                 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
 896                                 goto ADV_ERROR;
 897                         }
 898                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
 899
 900                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 901                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 902                                 goto ADV_ERROR;
 903                         }
 904 # a.marx ccd
 905                         my %ccdroutehash=();
 906                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
 907                         foreach my $key (keys %ccdroutehash) {
 908                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
 909                                         if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
 910                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 911                                                 goto ADV_ERROR;
 912                                         }
 913                                         my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
 914                                         if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
 915                                                 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
 916                                                 goto ADV_ERROR;
 917                                         }
 918                                 }
 919                         }
 920
 921 # ccd end
 922
 923                         $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
 924                 }
 925         }
 926     &write_routepushfile;
 927         undef $vpnsettings{'ROUTES_PUSH'};
 928     }
 929         else {
 930         undef $vpnsettings{'ROUTES_PUSH'};
 931         &write_routepushfile;
 932     }
 933     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 934         $errormessage = $Lang::tr{'invalid input for max clients'};
 935         goto ADV_ERROR;
 936     }
 937     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 938         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 939             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 940         goto ADV_ERROR;
 941         }
 942     }
 943     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 944         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 945             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 946         goto ADV_ERROR;
 947         }
 948     }
 949     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 950         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 951         goto ADV_ERROR;
 952     }
 953
 954     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 955     &writeserverconf();#hier ok
 956 }
 957
 958 ###
 959 # m.a.d net2net
 960 ###
 961
 962 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 963 {
 964
 965 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 966 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 967 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 968 my $tunmtu =  '';
 969
 970 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 971 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 972
 973   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 974
 975   flock SERVERCONF, 2;
 976   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 977   print SERVERCONF "\n";
 978   print SERVERCONF "# User Security\n";
 979   print SERVERCONF "user nobody\n";
 980   print SERVERCONF "group nobody\n";
 981   print SERVERCONF "persist-tun\n";
 982   print SERVERCONF "persist-key\n";
 983   print SERVERCONF "script-security 2\n";
 984   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 985   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 986   print SERVERCONF "float\n";
 987   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 988   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 989   print SERVERCONF "# Client Gateway Network\n";
 990   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 991   print SERVERCONF "# tun Device\n";
 992   print SERVERCONF "dev tun\n";
 993   print SERVERCONF "# Port and Protokol\n";
 994   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 995
 996   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 997   print SERVERCONF "proto tcp-server\n";
 998   print SERVERCONF "# Packet size\n";
 999   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1000   print SERVERCONF "tun-mtu $tunmtu\n";
1001   }
1002
1003   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1004   print SERVERCONF "proto udp\n";
1005   print SERVERCONF "# Paketsize\n";
1006   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1007   print SERVERCONF "tun-mtu $tunmtu\n";
1008   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1009   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
1010   }
1011
1012   # Check if a valid operating mode has been choosen and use it.
1013   if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1014       ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1015       ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
1016         if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1017                 if($cgiparams{'MTU'} eq '1500') {
1018                         print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1019                 }
1020         }
1021   }
1022   print SERVERCONF "# Auth. Server\n";
1023   print SERVERCONF "tls-server\n";
1024   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
1025   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
1026   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
1027   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
1028   print SERVERCONF "# Cipher\n";
1029   print SERVERCONF "cipher AES-256-CBC\n";
1030   if ($cgiparams{'COMPLZO'} eq 'on') {
1031    print SERVERCONF "# Enable Compression\n";
1032    print SERVERCONF "comp-lzo\r\n";
1033      }
1034   print SERVERCONF "# Debug Level\n";
1035   print SERVERCONF "verb 3\n";
1036   print SERVERCONF "# Tunnel check\n";
1037   print SERVERCONF "keepalive 10 60\n";
1038   print SERVERCONF "# Start as daemon\n";
1039   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1040   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1041   print SERVERCONF "# Activate Management Interface and Port\n";
1042   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1043   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1044   close(SERVERCONF);
1045
1046 }
1047
1048 ###
1049 # m.a.d net2net
1050 ###
1051
1052 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1053 {
1054         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
1055         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1056         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
1057         my $tunmtu =  '';
1058
1059 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1060 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1061
1062   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1063
1064   flock CLIENTCONF, 2;
1065   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1066   print CLIENTCONF "#\n";
1067   print CLIENTCONF "# User Security\n";
1068   print CLIENTCONF "user nobody\n";
1069   print CLIENTCONF "group nobody\n";
1070   print CLIENTCONF "persist-tun\n";
1071   print CLIENTCONF "persist-key\n";
1072   print CLIENTCONF "script-security 2\n";
1073   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1074   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1075   print CLIENTCONF "float\n";
1076   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1077   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1078   print CLIENTCONF "# Server Gateway Network\n";
1079   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1080   print CLIENTCONF "# tun Device\n";
1081   print CLIENTCONF "dev tun\n";
1082   print CLIENTCONF "# Port and Protokol\n";
1083   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1084
1085   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1086   print CLIENTCONF "proto tcp-client\n";
1087   print CLIENTCONF "# Packet size\n";
1088   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1089   print CLIENTCONF "tun-mtu $tunmtu\n";
1090   }
1091
1092   if ($cgiparams{'PROTOCOL'} eq 'udp') {
1093   print CLIENTCONF "proto udp\n";
1094   print CLIENTCONF "# Paketsize\n";
1095   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1096   print CLIENTCONF "tun-mtu $tunmtu\n";
1097   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1098   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1099   }
1100
1101   # Check if a valid operating mode has been choosen and use it.
1102   if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1103       ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1104       ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
1105         if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1106                 if ($cgiparams{'MTU'} eq '1500') {
1107                         print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1108                 }
1109         }
1110   }
1111
1112   print CLIENTCONF "ns-cert-type server\n";
1113   print CLIENTCONF "# Auth. Client\n";
1114   print CLIENTCONF "tls-client\n";
1115   print CLIENTCONF "# Cipher\n";
1116   print CLIENTCONF "cipher AES-256-CBC\n";
1117   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1118   if ($cgiparams{'COMPLZO'} eq 'on') {
1119    print CLIENTCONF "# Enable Compression\n";
1120    print CLIENTCONF "comp-lzo\r\n";
1121      }
1122   print CLIENTCONF "# Debug Level\n";
1123   print CLIENTCONF "verb 3\n";
1124   print CLIENTCONF "# Tunnel check\n";
1125   print CLIENTCONF "keepalive 10 60\n";
1126   print CLIENTCONF "# Start as daemon\n";
1127   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1128   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1129   print CLIENTCONF "# Activate Management Interface and Port\n";
1130   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1131   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1132   close(CLIENTCONF);
1133
1134 }
1135
1136 ###
1137 ### Save main settings
1138 ###
1139
1140
1141 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1142     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1143     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1144     #DAN this value has to leave.
1145     if ($cgiparams{'ENABLED'} eq 'on'){
1146         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1147                 $errormessage = $Lang::tr{'invalid input for hostname'};
1148         goto SETTINGS_ERROR;
1149         }
1150     }
1151     if ($cgiparams{'ENABLED'} eq 'on'){
1152         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
1153     }
1154     if ($errormessage) { goto SETTINGS_ERROR; }
1155
1156
1157     if ($cgiparams{'ENABLED'} eq 'on'){
1158         &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
1159     }
1160
1161     if ($errormessage) { goto SETTINGS_ERROR; }
1162
1163     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1164             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1165         goto SETTINGS_ERROR;
1166     }
1167     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1168
1169     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1170         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1171         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1172         goto SETTINGS_ERROR;
1173     }
1174
1175     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1176         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1177         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1178         goto SETTINGS_ERROR;
1179     }
1180
1181     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1182         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1183         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1184         goto SETTINGS_ERROR;
1185     }
1186
1187     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1188         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1189         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1190         goto SETTINGS_ERROR;
1191     }
1192     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1193     while (<ALIASES>)
1194     {
1195         chomp($_);
1196         my @tempalias = split(/\,/,$_);
1197         if ($tempalias[1] eq 'on') {
1198             if (&General::IpInSubnet ($tempalias[0] ,
1199                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1200                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1201             }
1202         }
1203     }
1204     close(ALIASES);
1205     if ($errormessage ne ''){
1206         goto SETTINGS_ERROR;
1207     }
1208     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1209         $errormessage = $Lang::tr{'invalid input'};
1210         goto SETTINGS_ERROR;
1211     }
1212     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1213         $errormessage = $Lang::tr{'invalid mtu input'};
1214         goto SETTINGS_ERROR;
1215     }
1216
1217     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1218         $errormessage = $Lang::tr{'invalid port'};
1219         goto SETTINGS_ERROR;
1220     }
1221     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1222     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1223     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1224     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1225 #new settings for daemon
1226     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1227     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1228     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1229     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1230     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1231     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1232     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1233 #wrtie enable
1234
1235   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1236   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1237   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1238 #new settings for daemon
1239     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1240     &writeserverconf();#hier ok
1241 SETTINGS_ERROR:
1242 ###
1243 ### Reset all step 2
1244 ###
1245 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
1246     my $file = '';
1247     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1248
1249     foreach my $key (keys %confighash) {
1250         if ($confighash{$key}[4] eq 'cert') {
1251             delete $confighash{$cgiparams{'$key'}};
1252         }
1253     }
1254     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1255         unlink $file
1256     }
1257     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1258         unlink $file
1259     }
1260     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1261         unlink $file
1262     }
1263     &cleanssldatabase();
1264     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1265         print FILE "";
1266         close FILE;
1267     }
1268     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1269     #&writeserverconf();
1270 ###
1271 ### Reset all step 1
1272 ###
1273 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
1274     &Header::showhttpheaders();
1275     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1276     &Header::openbigbox('100%', 'LEFT', '', '');
1277     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1278     print <<END
1279         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1280             <tr><td align='center'>
1281                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1282                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
1283             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
1284                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1285         </form></table>
1286 END
1287     ;
1288     &Header::closebox();
1289     &Header::closebigbox();
1290     &Header::closepage();
1291     exit (0);
1292
1293 ###
1294 ### Upload CA Certificate
1295 ###
1296 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1297     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1298
1299     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1300         $errormessage = $Lang::tr{'name must only contain characters'};
1301         goto UPLOADCA_ERROR;
1302     }
1303
1304     if (length($cgiparams{'CA_NAME'}) >60) {
1305         $errormessage = $Lang::tr{'name too long'};
1306         goto VPNCONF_ERROR;
1307     }
1308
1309     if ($cgiparams{'CA_NAME'} eq 'ca') {
1310         $errormessage = $Lang::tr{'name is invalid'};
1311         goto UPLOAD_CA_ERROR;
1312     }
1313
1314     # Check if there is no other entry with this name
1315     foreach my $key (keys %cahash) {
1316         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1317             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1318             goto UPLOADCA_ERROR;
1319         }
1320     }
1321
1322     if (ref ($cgiparams{'FH'}) ne 'Fh') {
1323         $errormessage = $Lang::tr{'there was no file upload'};
1324         goto UPLOADCA_ERROR;
1325     }
1326     # Move uploaded ca to a temporary file
1327     (my $fh, my $filename) = tempfile( );
1328     if (copy ($cgiparams{'FH'}, $fh) != 1) {
1329         $errormessage = $!;
1330         goto UPLOADCA_ERROR;
1331     }
1332     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1333     if ($temp !~ /CA:TRUE/i) {
1334         $errormessage = $Lang::tr{'not a valid ca certificate'};
1335         unlink ($filename);
1336         goto UPLOADCA_ERROR;
1337     } else {
1338         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1339         if ($? ne 0) {
1340             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1341             unlink ($filename);
1342             goto UPLOADCA_ERROR;
1343         }
1344     }
1345
1346     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1347     $casubject    =~ /Subject: (.*)[\n]/;
1348     $casubject    = $1;
1349     $casubject    =~ s+/Email+, E+;
1350     $casubject    =~ s/ ST=/ S=/;
1351     $casubject    = &Header::cleanhtml($casubject);
1352
1353     my $key = &General::findhasharraykey (\%cahash);
1354     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1355     $cahash{$key}[1] = $casubject;
1356     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1357 #    system('/usr/local/bin/ipsecctrl', 'R');
1358
1359     UPLOADCA_ERROR:
1360
1361 ###
1362 ### Display ca certificate
1363 ###
1364 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1365     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1366
1367     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1368         &Header::showhttpheaders();
1369         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1370         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1371         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1372         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1373         $output = &Header::cleanhtml($output,"y");
1374         print "<pre>$output</pre>\n";
1375         &Header::closebox();
1376         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1377         &Header::closebigbox();
1378         &Header::closepage();
1379         exit(0);
1380     } else {
1381         $errormessage = $Lang::tr{'invalid key'};
1382     }
1383
1384 ###
1385 ### Download ca certificate
1386 ###
1387 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1388     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1389
1390     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1391         print "Content-Type: application/octet-stream\r\n";
1392         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1393         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1394         exit(0);
1395     } else {
1396         $errormessage = $Lang::tr{'invalid key'};
1397     }
1398
1399 ###
1400 ### Remove ca certificate (step 2)
1401 ###
1402 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1403     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1404     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1405
1406     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1407         foreach my $key (keys %confighash) {
1408             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1409             if ($test =~ /: OK/) {
1410                 # Delete connection
1411 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1412 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1413 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1414 #               }
1415                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1416                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1417                 delete $confighash{$key};
1418                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1419 #               &writeipsecfiles();
1420             }
1421         }
1422         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1423         delete $cahash{$cgiparams{'KEY'}};
1424         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1425 #       system('/usr/local/bin/ipsecctrl', 'R');
1426     } else {
1427         $errormessage = $Lang::tr{'invalid key'};
1428     }
1429 ###
1430 ### Remove ca certificate (step 1)
1431 ###
1432 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1433     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1434     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1435
1436     my $assignedcerts = 0;
1437     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1438         foreach my $key (keys %confighash) {
1439             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1440             if ($test =~ /: OK/) {
1441                 $assignedcerts++;
1442             }
1443         }
1444         if ($assignedcerts) {
1445             &Header::showhttpheaders();
1446             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1447             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1448             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1449             print <<END
1450                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1451                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1452                     <tr><td align='center'>
1453                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1454                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1455                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1456                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1457                 </form></table>
1458 END
1459             ;
1460             &Header::closebox();
1461             &Header::closebigbox();
1462             &Header::closepage();
1463             exit (0);
1464         } else {
1465             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1466             delete $cahash{$cgiparams{'KEY'}};
1467             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1468 #           system('/usr/local/bin/ipsecctrl', 'R');
1469         }
1470     } else {
1471         $errormessage = $Lang::tr{'invalid key'};
1472     }
1473
1474 ###
1475 ### Display root certificate
1476 ###
1477 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1478     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1479     my $output;
1480     &Header::showhttpheaders();
1481     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1482     &Header::openbigbox('100%', 'LEFT', '', '');
1483     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1484         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1485         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1486     } else {
1487         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1488         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1489     }
1490     $output = &Header::cleanhtml($output,"y");
1491     print "<pre>$output</pre>\n";
1492     &Header::closebox();
1493     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1494     &Header::closebigbox();
1495     &Header::closepage();
1496     exit(0);
1497
1498 ###
1499 ### Download root certificate
1500 ###
1501 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1502     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1503         print "Content-Type: application/octet-stream\r\n";
1504         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1505         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1506         exit(0);
1507     }
1508
1509 ###
1510 ### Download host certificate
1511 ###
1512 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1513     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1514         print "Content-Type: application/octet-stream\r\n";
1515         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1516         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1517         exit(0);
1518     }
1519 ###
1520 ### Form for generating a root certificate
1521 ###
1522 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1523          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1524
1525     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1526     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1527         $errormessage = $Lang::tr{'valid root certificate already exists'};
1528         $cgiparams{'ACTION'} = '';
1529         goto ROOTCERT_ERROR;
1530     }
1531
1532     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1533         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1534             my $ipaddr = <IPADDR>;
1535             close IPADDR;
1536             chomp ($ipaddr);
1537             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1538             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1539                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1540             }
1541         }
1542     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1543
1544         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1545             $errormessage = $Lang::tr{'there was no file upload'};
1546             goto ROOTCERT_ERROR;
1547         }
1548
1549         # Move uploaded certificate request to a temporary file
1550         (my $fh, my $filename) = tempfile( );
1551         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1552             $errormessage = $!;
1553             goto ROOTCERT_ERROR;
1554         }
1555
1556         # Create a temporary dirctory
1557         my $tempdir = tempdir( CLEANUP => 1 );
1558
1559         # Extract the CA certificate from the file
1560         my $pid = open(OPENSSL, "|-");
1561         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1562         if ($pid) {     # parent
1563             if ($cgiparams{'P12_PASS'} ne '') {
1564                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1565             }
1566             close (OPENSSL);
1567             if ($?) {
1568                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1569                 unlink ($filename);
1570                 goto ROOTCERT_ERROR;
1571             }
1572         } else {        # child
1573             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1574                     '-in', $filename,
1575                     '-out', "$tempdir/cacert.pem")) {
1576                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1577                 unlink ($filename);
1578                 goto ROOTCERT_ERROR;
1579             }
1580         }
1581
1582         # Extract the Host certificate from the file
1583         $pid = open(OPENSSL, "|-");
1584         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1585         if ($pid) {     # parent
1586             if ($cgiparams{'P12_PASS'} ne '') {
1587                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1588             }
1589             close (OPENSSL);
1590             if ($?) {
1591                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1592                 unlink ($filename);
1593                 goto ROOTCERT_ERROR;
1594             }
1595         } else {        # child
1596             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1597                     '-in', $filename,
1598                     '-out', "$tempdir/hostcert.pem")) {
1599                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1600                 unlink ($filename);
1601                 goto ROOTCERT_ERROR;
1602             }
1603         }
1604
1605         # Extract the Host key from the file
1606         $pid = open(OPENSSL, "|-");
1607         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1608         if ($pid) {     # parent
1609             if ($cgiparams{'P12_PASS'} ne '') {
1610                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1611             }
1612             close (OPENSSL);
1613             if ($?) {
1614                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1615                 unlink ($filename);
1616                 goto ROOTCERT_ERROR;
1617             }
1618         } else {        # child
1619             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1620                     '-nodes',
1621                     '-in', $filename,
1622                     '-out', "$tempdir/serverkey.pem")) {
1623                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1624                 unlink ($filename);
1625                 goto ROOTCERT_ERROR;
1626             }
1627         }
1628
1629         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1630         if ($? ne 0) {
1631             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1632             unlink ($filename);
1633             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1634             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1635             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1636             goto ROOTCERT_ERROR;
1637         }
1638
1639         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1640         if ($? ne 0) {
1641             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1642             unlink ($filename);
1643             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1644             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1645             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1646             goto ROOTCERT_ERROR;
1647         }
1648
1649         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1650         if ($? ne 0) {
1651             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1652             unlink ($filename);
1653             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1654             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1655             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1656             goto ROOTCERT_ERROR;
1657         }
1658
1659         goto ROOTCERT_SUCCESS;
1660
1661     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1662
1663         # Validate input since the form was submitted
1664         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1665             $errormessage = $Lang::tr{'organization cant be empty'};
1666             goto ROOTCERT_ERROR;
1667         }
1668         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1669             $errormessage = $Lang::tr{'organization too long'};
1670             goto ROOTCERT_ERROR;
1671         }
1672         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1673             $errormessage = $Lang::tr{'invalid input for organization'};
1674             goto ROOTCERT_ERROR;
1675         }
1676         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1677             $errormessage = $Lang::tr{'hostname cant be empty'};
1678             goto ROOTCERT_ERROR;
1679         }
1680         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1681             $errormessage = $Lang::tr{'invalid input for hostname'};
1682             goto ROOTCERT_ERROR;
1683         }
1684         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1685             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1686             goto ROOTCERT_ERROR;
1687         }
1688         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1689             $errormessage = $Lang::tr{'e-mail address too long'};
1690             goto ROOTCERT_ERROR;
1691         }
1692         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1693             $errormessage = $Lang::tr{'invalid input for department'};
1694             goto ROOTCERT_ERROR;
1695         }
1696         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1697             $errormessage = $Lang::tr{'invalid input for city'};
1698             goto ROOTCERT_ERROR;
1699         }
1700         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1701             $errormessage = $Lang::tr{'invalid input for state or province'};
1702             goto ROOTCERT_ERROR;
1703         }
1704         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1705             $errormessage = $Lang::tr{'invalid input for country'};
1706             goto ROOTCERT_ERROR;
1707         }
1708
1709         # Copy the cgisettings to vpnsettings and save the configfile
1710         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1711         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1712         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1713         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1714         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1715         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1716         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1717         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1718
1719         # Replace empty strings with a .
1720         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1721         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1722         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1723
1724         # refresh
1725         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1726
1727         # Create the CA certificate
1728         my $pid = open(OPENSSL, "|-");
1729         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1730         if ($pid) {     # parent
1731             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1732             print OPENSSL "$state\n";
1733             print OPENSSL "$city\n";
1734             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1735             print OPENSSL "$ou\n";
1736             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1737             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1738             close (OPENSSL);
1739             if ($?) {
1740                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1741                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1742                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1743                 goto ROOTCERT_ERROR;
1744             }
1745         } else {        # child
1746             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1747                         '-days', '999999', '-newkey', 'rsa:2048',
1748                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1749                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1750                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1751                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1752                 goto ROOTCERT_ERROR;
1753             }
1754         }
1755
1756         # Create the Host certificate request
1757         $pid = open(OPENSSL, "|-");
1758         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1759         if ($pid) {     # parent
1760             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1761             print OPENSSL "$state\n";
1762             print OPENSSL "$city\n";
1763             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1764             print OPENSSL "$ou\n";
1765             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1766             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1767             print OPENSSL ".\n";
1768             print OPENSSL ".\n";
1769             close (OPENSSL);
1770             if ($?) {
1771                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1772                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1773                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1774                 goto ROOTCERT_ERROR;
1775             }
1776         } else {        # child
1777             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1778                         '-newkey', 'rsa:1024',
1779                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1780                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1781                         '-extensions', 'server',
1782                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1783                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1784                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1785                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1786                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1787                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1788                 goto ROOTCERT_ERROR;
1789             }
1790         }
1791
1792         # Sign the host certificate request
1793         system('/usr/bin/openssl', 'ca', '-days', '999999',
1794                 '-batch', '-notext',
1795                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1796                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1797                 '-extensions', 'server',
1798                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1799         if ($?) {
1800             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1801             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1802             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1803             unlink ("${General::swroot}/ovpn/serverkey.pem");
1804             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1805             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1806             &newcleanssldatabase();
1807             goto ROOTCERT_ERROR;
1808         } else {
1809             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1810             &deletebackupcert();
1811         }
1812
1813         # Create an empty CRL
1814         system('/usr/bin/openssl', 'ca', '-gencrl',
1815                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1816                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1817         if ($?) {
1818             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1819             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1820             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1821             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1822             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1823             &cleanssldatabase();
1824             goto ROOTCERT_ERROR;
1825 #       } else {
1826 #           &cleanssldatabase();
1827         }
1828         # Create Diffie Hellmann Parameter
1829         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1830                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1831                '1024' );
1832         if ($?) {
1833             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1834             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1835             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1836             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1837             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1838             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1839             &cleanssldatabase();
1840             goto ROOTCERT_ERROR;
1841 #       } else {
1842 #           &cleanssldatabase();
1843         }
1844         goto ROOTCERT_SUCCESS;
1845     }
1846     ROOTCERT_ERROR:
1847     if ($cgiparams{'ACTION'} ne '') {
1848         &Header::showhttpheaders();
1849         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1850         &Header::openbigbox('100%', 'LEFT', '', '');
1851         if ($errormessage) {
1852             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1853             print "<class name='base'>$errormessage";
1854             print "&nbsp;</class>";
1855             &Header::closebox();
1856         }
1857         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1858         print <<END
1859         <form method='post' enctype='multipart/form-data'>
1860         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1861         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1862             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1863             <td width='35%' colspan='2'>&nbsp;</td></tr>
1864         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1865             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1866             <td colspan='2'>&nbsp;</td></tr>
1867         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1868             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1869             <td colspan='2'>&nbsp;</td></tr>
1870         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1871             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1872             <td colspan='2'>&nbsp;</td></tr>
1873         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1874             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1875             <td colspan='2'>&nbsp;</td></tr>
1876         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1877             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1878             <td colspan='2'>&nbsp;</td></tr>
1879         <tr><td class='base'>$Lang::tr{'country'}:</td>
1880             <td class='base'><select name='ROOTCERT_COUNTRY'>
1881
1882 END
1883         ;
1884         foreach my $country (sort keys %{Countries::countries}) {
1885             print "<option value='$Countries::countries{$country}'";
1886             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1887                 print " selected='selected'";
1888             }
1889             print ">$country</option>";
1890         }
1891         print <<END
1892             </select></td>
1893             <td colspan='2'>&nbsp;</td></tr>
1894         <tr><td>&nbsp;</td>
1895             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1896             <td>&nbsp;</td><td>&nbsp;</td></tr>
1897         <tr><td class='base' colspan='4' align='left'>
1898             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1899         <tr><td class='base' colspan='4' align='left'>
1900             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1901             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1902         </td></tr>
1903         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1904         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1905             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1906             <td colspan='2'>&nbsp;</td></tr>
1907         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1908             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1909             <td colspan='2'>&nbsp;</td></tr>
1910         <tr><td>&nbsp;</td>
1911             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1912             <td colspan='2'>&nbsp;</td></tr>
1913         <tr><td class='base' colspan='4' align='left'>
1914             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1915         </form></table>
1916 END
1917         ;
1918         &Header::closebox();
1919
1920         &Header::closebigbox();
1921         &Header::closepage();
1922         exit(0)
1923     }
1924
1925     ROOTCERT_SUCCESS:
1926     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1927 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1928 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1929 #       system('/usr/local/bin/ipsecctrl', 'S');
1930 #    }
1931
1932 ###
1933 ### Enable/Disable connection
1934 ###
1935
1936 ###
1937 # m.a.d net2net
1938 ###
1939
1940 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1941
1942     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1943     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1944 #    my $n2nactive = '';
1945     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1946
1947     if ($confighash{$cgiparams{'KEY'}}) {
1948                 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1949                         $confighash{$cgiparams{'KEY'}}[0] = 'on';
1950                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1951
1952                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1953                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1954                         }
1955                 } else {
1956
1957                         $confighash{$cgiparams{'KEY'}}[0] = 'off';
1958                         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1959
1960                         if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1961                     if ($n2nactive ne ''){
1962                                                 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1963                                         }
1964
1965                         } else {
1966                   $errormessage = $Lang::tr{'invalid key'};
1967                         }
1968       }
1969   }
1970
1971 ###
1972 ### Download OpenVPN client package
1973 ###
1974
1975
1976 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1977     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1978     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1979     my $file = '';
1980     my $clientovpn = '';
1981     my @fileholder;
1982     my $tempdir = tempdir( CLEANUP => 1 );
1983     my $zippath = "$tempdir/";
1984
1985 ###
1986 # m.a.d net2net
1987 ###
1988
1989 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1990
1991         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1992         my $zippathname = "$zippath$zipname";
1993         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1994         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1995         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1996         my $tunmtu = '';
1997         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1998         my $n2nfragment = '';
1999
2000     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2001     flock CLIENTCONF, 2;
2002
2003     my $zip = Archive::Zip->new();
2004    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2005    print CLIENTCONF "# \n";
2006    print CLIENTCONF "# User Security\n";
2007    print CLIENTCONF "user nobody\n";
2008    print CLIENTCONF "group nobody\n";
2009    print CLIENTCONF "persist-tun\n";
2010    print CLIENTCONF "persist-key\n";
2011    print CLIENTCONF "script-security 2\n";
2012    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2013    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2014    print CLIENTCONF "float\n";
2015    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2016    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2017    print CLIENTCONF "# Server Gateway Network\n";
2018    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2019    print CLIENTCONF "# tun Device\n";
2020    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
2021    print CLIENTCONF "# Port and Protokoll\n";
2022    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2023
2024    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2025    print CLIENTCONF "proto tcp-client\n";
2026    print CLIENTCONF "# Packet size\n";
2027    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2028    print CLIENTCONF "tun-mtu $tunmtu\n";
2029    }
2030
2031    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2032    print CLIENTCONF "proto udp\n";
2033    print CLIENTCONF "# Paketsize\n";
2034    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2035    print CLIENTCONF "tun-mtu $tunmtu\n";
2036    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2037    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
2038    }
2039    if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2040        ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2041        ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2042         if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2043                 if ($tunmtu eq '1500' ) {
2044                         print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2045                 }
2046         }
2047    }
2048    print CLIENTCONF "ns-cert-type server\n";
2049    print CLIENTCONF "# Auth. Client\n";
2050    print CLIENTCONF "tls-client\n";
2051    print CLIENTCONF "# Cipher\n";
2052    print CLIENTCONF "cipher AES-256-CBC\n";
2053     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2054          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2055      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2056    }
2057     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2058    print CLIENTCONF "# Enable Compression\n";
2059    print CLIENTCONF "comp-lzo\r\n";
2060      }
2061    print CLIENTCONF "# Debug Level\n";
2062    print CLIENTCONF "verb 3\n";
2063    print CLIENTCONF "# Tunnel check\n";
2064    print CLIENTCONF "keepalive 10 60\n";
2065    print CLIENTCONF "# Start as daemon\n";
2066    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2067    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2068    print CLIENTCONF "# Activate Management Interface and Port\n";
2069    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2070     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2071    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2072
2073
2074     close(CLIENTCONF);
2075
2076     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2077     my $status = $zip->writeToFileNamed($zippathname);
2078
2079     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2080     @fileholder = <DLFILE>;
2081     print "Content-Type:application/x-download\n";
2082     print "Content-Disposition:attachment;filename=$zipname\n\n";
2083     print @fileholder;
2084     exit (0);
2085 }
2086 else
2087 {
2088         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2089         my $zippathname = "$zippath$zipname";
2090         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2091
2092 ###
2093 # m.a.d net2net
2094 ###
2095
2096     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2097     flock CLIENTCONF, 2;
2098
2099     my $zip = Archive::Zip->new();
2100
2101     print CLIENTCONF "#OpenVPN Client conf\r\n";
2102     print CLIENTCONF "tls-client\r\n";
2103     print CLIENTCONF "client\r\n";
2104     print CLIENTCONF "nobind\n";
2105     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2106     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2107
2108     # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2109     # or use configured value.
2110     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2111         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2112     elsif ($vpnsettings{MSSFIX} eq 'on')
2113         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2114     elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2115            ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2116            ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2117         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\n"; }
2118     else
2119         { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2120
2121     if ( $vpnsettings{'ENABLED'} eq 'on'){
2122         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2123         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2124             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2125             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2126         }
2127         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2128             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2129             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2130         }
2131     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2132         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2133         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2134             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2135             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2136         }
2137     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2138         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2139     }
2140
2141     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2142         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2143         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2144     } else {
2145         print CLIENTCONF "ca cacert.pem\r\n";
2146         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2147         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2148         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
2149         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2150     }
2151     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2152     if ($vpnsettings{DCOMPLZO} eq 'on') {
2153         print CLIENTCONF "comp-lzo\r\n";
2154     }
2155     print CLIENTCONF "verb 3\r\n";
2156     print CLIENTCONF "ns-cert-type server\r\n";
2157     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2158     if ($vpnsettings{MSSFIX} eq 'on') {
2159         print CLIENTCONF "mssfix\r\n";
2160     }
2161     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2162         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2163     }
2164
2165     # Check if a valid operating mode has been choosen and use it.
2166     if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2167         ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2168         ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2169         if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2170                 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\n";
2171         }
2172     }
2173     close(CLIENTCONF);
2174
2175     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2176     my $status = $zip->writeToFileNamed($zippathname);
2177
2178     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2179     @fileholder = <DLFILE>;
2180     print "Content-Type:application/x-download\n";
2181     print "Content-Disposition:attachment;filename=$zipname\n\n";
2182     print @fileholder;
2183     exit (0);
2184    }
2185
2186
2187
2188 ###
2189 ### Remove connection
2190 ###
2191
2192
2193 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2194     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2195     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2196
2197     if ($confighash{$cgiparams{'KEY'}}) {
2198 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2199 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2200 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2201 #       }
2202 #
2203         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2204
2205 ###
2206 # m.a.d net2net
2207 ###
2208
2209  if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2210
2211         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2212   my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2213   unlink ($certfile) or die "Removing $certfile fail: $!";
2214   unlink ($conffile) or die "Removing $conffile fail: $!";
2215   rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2216
2217 }
2218
2219   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2220   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2221
2222 # A.Marx CCD delete ccd files and routes
2223
2224
2225         if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2226         {
2227                 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2228         }
2229
2230         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2231         foreach my $key (keys %ccdroutehash) {
2232                 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2233                         delete $ccdroutehash{$key};
2234                 }
2235         }
2236         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2237
2238         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2239         foreach my $key (keys %ccdroute2hash) {
2240                 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2241                         delete $ccdroute2hash{$key};
2242                 }
2243         }
2244         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2245         &writeserverconf;
2246
2247
2248 # CCD end
2249
2250
2251         delete $confighash{$cgiparams{'KEY'}};
2252         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2253         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2254
2255         #&writeserverconf();
2256     } else {
2257         $errormessage = $Lang::tr{'invalid key'};
2258     }
2259
2260
2261 ###
2262 ### Download PKCS12 file
2263 ###
2264 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2265     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2266
2267     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2268     print "Content-Type: application/octet-stream\r\n\r\n";
2269     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2270     exit (0);
2271
2272 ###
2273 ### Display certificate
2274 ###
2275 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2276     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2277
2278     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2279         &Header::showhttpheaders();
2280         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2281         &Header::openbigbox('100%', 'LEFT', '', '');
2282         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2283         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2284         $output = &Header::cleanhtml($output,"y");
2285         print "<pre>$output</pre>\n";
2286         &Header::closebox();
2287         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2288         &Header::closebigbox();
2289         &Header::closepage();
2290         exit(0);
2291     }
2292 ###
2293 ### Display Certificate Revoke List
2294 ###
2295 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2296 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2297
2298     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
2299         &Header::showhttpheaders();
2300         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2301         &Header::openbigbox('100%', 'LEFT', '', '');
2302         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2303         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2304         $output = &Header::cleanhtml($output,"y");
2305         print "<pre>$output</pre>\n";
2306         &Header::closebox();
2307         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2308         &Header::closebigbox();
2309         &Header::closepage();
2310         exit(0);
2311     }
2312
2313 ###
2314 ### Advanced Server Settings
2315 ###
2316
2317 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2318     %cgiparams = ();
2319     %cahash = ();
2320     %confighash = ();
2321     my $disabled;
2322     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2323     read_routepushfile;
2324
2325
2326 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2327 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
2328 #    }
2329 ADV_ERROR:
2330     if ($cgiparams{'MAX_CLIENTS'} eq '') {
2331         $cgiparams{'MAX_CLIENTS'} =  '100';
2332     }
2333     if ($cgiparams{'KEEPALIVE_1'} eq '') {
2334         $cgiparams{'KEEPALIVE_1'} =  '10';
2335     }
2336     if ($cgiparams{'KEEPALIVE_2'} eq '') {
2337         $cgiparams{'KEEPALIVE_2'} =  '60';
2338     }
2339     if ($cgiparams{'LOG_VERB'} eq '') {
2340         $cgiparams{'LOG_VERB'} =  '3';
2341     }
2342     $checked{'CLIENT2CLIENT'}{'off'} = '';
2343     $checked{'CLIENT2CLIENT'}{'on'} = '';
2344     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
2345     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
2346     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
2347     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
2348     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
2349     $checked{'MSSFIX'}{'off'} = '';
2350     $checked{'MSSFIX'}{'on'} = '';
2351     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
2352     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
2353     $selected{'LOG_VERB'}{'1'} = '';
2354     $selected{'LOG_VERB'}{'2'} = '';
2355     $selected{'LOG_VERB'}{'3'} = '';
2356     $selected{'LOG_VERB'}{'4'} = '';
2357     $selected{'LOG_VERB'}{'5'} = '';
2358     $selected{'LOG_VERB'}{'6'} = '';
2359     $selected{'LOG_VERB'}{'7'} = '';
2360     $selected{'LOG_VERB'}{'8'} = '';
2361     $selected{'LOG_VERB'}{'9'} = '';
2362     $selected{'LOG_VERB'}{'10'} = '';
2363     $selected{'LOG_VERB'}{'11'} = '';
2364     $selected{'LOG_VERB'}{'0'} = '';
2365     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
2366
2367     &Header::showhttpheaders();
2368     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
2369     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2370     if ($errormessage) {
2371         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2372         print "<class name='base'>$errormessage\n";
2373         print "&nbsp;</class>\n";
2374         &Header::closebox();
2375     }
2376     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
2377     print <<END
2378     <form method='post' enctype='multipart/form-data' disabled>
2379     <table width='100%' border=0>
2380     <tr>
2381         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
2382     </tr>
2383     <tr>
2384         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
2385     </tr>
2386     <tr>
2387         <td class='base'>Domain</td>
2388         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30'  /></td>
2389     </tr>
2390     <tr>
2391         <td class='base'>DNS</td>
2392         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
2393     </tr>
2394     <tr>
2395         <td class='base'>WINS</td>
2396         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
2397        </tr>
2398     <tr>
2399         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
2400     </tr>
2401     <tr>
2402         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
2403   <td colspan='2'>
2404        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
2405 END
2406 ;
2407
2408 if ($cgiparams{'ROUTES_PUSH'} ne '')
2409 {
2410         print $cgiparams{'ROUTES_PUSH'};
2411 }
2412
2413 print <<END;
2414 </textarea></td>
2415 </tr>
2416     </tr>
2417 </table>
2418 <hr size='1'>
2419     <table width='100%'>
2420     <tr>
2421         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
2422     </tr>
2423     <tr>
2424         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='15%'></td><td width='35%'></td>
2425     </tr>
2426     <tr>
2427         <td class='base'>Client-To-Client</td>
2428         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2429     </tr>
2430     <tr>
2431         <td class='base'>Redirect-Gateway def1</td>
2432         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2433     </tr>
2434     <tr>
2435         <td class='base'>Max-Clients</td>
2436         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2437     </tr>
2438         <tr>
2439           <td class='base'>Keppalive <br />
2440             (ping/ping-restart)</td>
2441           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2442           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2443     </tr>
2444         <tr>
2445           <td class='base'>fragment <br></td>
2446           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2447         <td>Default: <span class="base">1300</span></td>
2448       </tr>
2449         <tr>
2450           <td class='base'>mssfix</td>
2451           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2452           <td>Default: on</td>
2453           </tr>
2454
2455         <tr>
2456                 <td class='base'>$Lang::tr{'ovpn mtu-disc'}</td>
2457                 <td><input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}</td>
2458                 <td><input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}</td>
2459                 <td><input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}</td>
2460                 <td><input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}</td>
2461         </tr>
2462 </table>
2463
2464 <!--
2465 <hr size='1'>
2466     <table width='100%'>
2467     <tr>
2468  <td class'base'><b>Crypto-Engines</b></td>
2469     </tr>
2470     <tr>
2471         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2472     </tr>
2473     <tr><td class='base'>Engines:</td>
2474         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2475                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2476                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2477                         </select>
2478                 </td>
2479 </table>
2480 -->
2481 <hr size='1'>
2482     <table width='100%'>
2483     <tr>
2484         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2485     </tr>
2486     <tr>
2487         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2488     </tr>
2489
2490     <tr><td class='base'>VERB</td>
2491         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2492                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2493                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2494                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2495                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2496                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2497                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2498                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2499                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2500                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2501                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2502                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2503 </table><hr>
2504 END
2505
2506 if ( -e "/var/run/openvpn.pid"){
2507 print"  <br><b><font color='#990000'>$Lang::tr{'attention'}:</b></font><br>
2508                 $Lang::tr{'server restart'}<br><br>
2509                 <hr>";
2510                 print<<END
2511 <table width='100%'>
2512 <tr>
2513     <td>&nbsp;</td>
2514     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' disabled='disabled' /></td>
2515     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2516     <td>&nbsp;</td>
2517 </tr>
2518 </table>
2519 </form>
2520 END
2521 ;
2522
2523
2524 }else{
2525
2526 print<<END
2527 <table width='100%'>
2528 <tr>
2529     <td>&nbsp;</td>
2530     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2531     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2532     <td>&nbsp;</td>
2533 </tr>
2534 </table>
2535 </form>
2536 END
2537 ;
2538 }
2539     &Header::closebox();
2540 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2541     &Header::closebigbox();
2542     &Header::closepage();
2543     exit(0);
2544
2545
2546 # A.Marx CCD   Add,delete or edit CCD net
2547
2548 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} ||
2549                 $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} ||
2550                 $cgiparams{'ACTION'} eq "kill" ||
2551                 $cgiparams{'ACTION'} eq "edit" ||
2552                 $cgiparams{'ACTION'} eq 'editsave'){
2553         &Header::showhttpheaders();
2554         &Header::openpage($Lang::tr{'ccd net'}, 1, '');
2555         &Header::openbigbox('100%', 'LEFT', '', '');
2556
2557         if ($cgiparams{'ACTION'} eq "kill"){
2558                 &delccdnet($cgiparams{'net'});
2559         }
2560
2561         if ($cgiparams{'ACTION'} eq 'editsave'){
2562                 my ($a,$b) =split (/\|/,$cgiparams{'ccdname'});
2563                 if ( $a ne $b){ &modccdnet($a,$b);}
2564                 $cgiparams{'ccdname'}='';
2565                 $cgiparams{'ccdsubnet'}='';
2566         }
2567
2568         if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) {
2569                 &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'});
2570         }
2571         if ($errormessage) {
2572             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2573             print "<class name='base'>$errormessage";
2574             print "&nbsp;</class>";
2575             &Header::closebox();
2576         }
2577 if ($cgiparams{'ACTION'} eq "edit"){
2578
2579         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'});
2580
2581         print <<END
2582     <table width='100%' border=0>
2583     <tr><form method='post'>
2584         <td width='10%' nowrap='nowrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2585         <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' readonly /></td></tr>
2586         <tr><td colspan='4' align='right'><hr><input type='submit' value='$Lang::tr{'save'}' /><input type='hidden' name='ACTION' value='editsave'/>
2587         <input type='hidden' name='ccdname' value='$cgiparams{'ccdname'}'/><input type='submit' value='$Lang::tr{'cancel'}' />
2588         </td></tr>
2589         </table></form>
2590 END
2591 ;
2592         &Header::closebox();
2593
2594         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2595         print <<END
2596     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2597     <tr>
2598         <td class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' width='15%' align='center'><b>$Lang::tr{'ccd used'}</td><td width='3%'></td><td width='3%'></td></tr>
2599 END
2600 ;
2601 }
2602 else{
2603         if (! -e "/var/run/openvpn.pid"){
2604         &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'});
2605                 print <<END;
2606             <table width='100%' border='0'>
2607             <tr><form method='post'>
2608                 <td colspan='4'>$Lang::tr{'ccd hint'}<br><br></td></tr>
2609                 <tr>
2610                 <td width='10%' nowrap='nwrap'>$Lang::tr{'ccd name'}:</td><td><input type='TEXT' name='ccdname' value='$cgiparams{'ccdname'}' /></td>
2611                 <td width='8%'>$Lang::tr{'ccd subnet'}:</td><td><input type='TEXT' name='ccdsubnet' value='$cgiparams{'ccdsubnet'}' /></td></tr>
2612                 <tr><td colspan=4><hr /></td></tr><tr>
2613                 <td colspan='4' align='right'><input type='hidden' name='ACTION' value='$Lang::tr{'ccd add'}' /><input type='submit' value='$Lang::tr{'add'}' /><input type='hidden' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}'/></td></tr>
2614                 </table></form>
2615 END
2616
2617         &Header::closebox();
2618 }
2619         &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} );
2620         if ( -e "/var/run/openvpn.pid"){
2621                 print "<b>$Lang::tr{'attention'}:</b><br>";
2622                 print "$Lang::tr{'ccd noaddnet'}<br><hr>";
2623         }
2624
2625         print <<END
2626     <table width='100%' border='0'  cellpadding='0' cellspacing='1'>
2627     <tr>
2628         <td class='boldbase' align='center' nowrap='nowrap' width='20%'><b>$Lang::tr{'ccd name'}</td><td class='boldbase' align='center' width='8%'><b>$Lang::tr{'network'}</td><td class='boldbase' width='8%' align='center' nowrap='nowrap'><b>$Lang::tr{'ccd used'}</td><td width='1%' align='center'></td><td width='1%' align='center'></td></tr>
2629 END
2630 ;
2631 }
2632         my %ccdconfhash=();
2633         &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
2634         my @ccdconf=();
2635         my $count=0;
2636         foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
2637                 @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
2638                 $count++;
2639                 my $ccdhosts = &hostsinnet($ccdconf[0]);
2640                 if ($count % 2){ print" <tr bgcolor='$color{'color22'}'>";}
2641                 else{            print" <tr bgcolor='$color{'color20'}'>";}
2642                 print"<td>$ccdconf[0]</td><td align='center'>$ccdconf[1]</td><td align='center'>$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1)."</td><td>";
2643 print <<END
2644                 <form method='post' />
2645                 <input type='image' src='/images/edit.gif' align='middle' alt=$Lang::tr{'edit'} title=$Lang::tr{'edit'} />
2646                 <input type='hidden' name='ACTION' value='edit'/>
2647                 <input type='hidden' name='ccdname' value='$ccdconf[0]' />
2648                 <input type='hidden' name='ccdsubnet' value='$ccdconf[1]' />
2649                 </form></td>
2650                 <form method='post' />
2651                 <td><input type='hidden' name='ACTION' value='kill'/>
2652                 <input type='hidden' name='number' value='$count' />
2653                 <input type='hidden' name='net' value='$ccdconf[0]' />
2654                 <input type='image' src='/images/delete.gif' align='middle' alt=$Lang::tr{'remove'} title=$Lang::tr{'remove'} /></form></td></tr>
2655 END
2656 ;
2657         }
2658         print "</table></form>";
2659         &Header::closebox();
2660         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2661         &Header::closebigbox();
2662         &Header::closepage();
2663         exit(0);
2664
2665 #END CCD
2666
2667 ###
2668 ### Openvpn Connections Statistics
2669 ###
2670 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2671         &Header::showhttpheaders();
2672         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2673         &Header::openbigbox('100%', 'LEFT', '', '');
2674     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2675
2676 #
2677 #       <td><b>$Lang::tr{'protocol'}</b></td>
2678 # protocol temp removed
2679     print <<END
2680     <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2681     <tr>
2682         <td><b>$Lang::tr{'common name'}</b></td>
2683         <td><b>$Lang::tr{'real address'}</b></td>
2684         <td><b>$Lang::tr{'virtual address'}</b></td>
2685         <td><b>$Lang::tr{'loged in at'}</b></td>
2686         <td><b>$Lang::tr{'bytes sent'}</b></td>
2687         <td><b>$Lang::tr{'bytes received'}</b></td>
2688         <td><b>$Lang::tr{'last activity'}</b></td>
2689     </tr>
2690 END
2691 ;
2692         my $filename = "/var/log/ovpnserver.log";
2693         open(FILE, $filename) or die 'Unable to open config file.';
2694         my @current = <FILE>;
2695         close(FILE);
2696         my @users =();
2697         my $status;
2698         my $uid = 0;
2699         my $cn;
2700         my @match = ();
2701         my $proto = "udp";
2702         my $address;
2703         my %userlookup = ();
2704         foreach my $line (@current)
2705         {
2706             chomp($line);
2707             if ( $line =~ /^Updated,(.+)/){
2708                 @match = split( /^Updated,(.+)/, $line);
2709                 $status = $match[1];
2710             }
2711 #gian
2712             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2713                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2714                 if ($match[1] ne "Common Name") {
2715                     $cn = $match[1];
2716                     $userlookup{$match[2]} = $uid;
2717                     $users[$uid]{'CommonName'} = $match[1];
2718                     $users[$uid]{'RealAddress'} = $match[2];
2719                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2720                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2721                     $users[$uid]{'Since'} = $match[5];
2722                     $users[$uid]{'Proto'} = $proto;
2723                     $uid++;
2724                 }
2725             }
2726             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2727                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2728                 if ($match[1] ne "Virtual Address") {
2729                     $address = $match[3];
2730                     #find the uid in the lookup table
2731                     $uid = $userlookup{$address};
2732                     $users[$uid]{'VirtualAddress'} = $match[1];
2733                     $users[$uid]{'LastRef'} = $match[4];
2734                 }
2735             }
2736         }
2737         my $user2 = @users;
2738         if ($user2 >= 1){
2739             for (my $idx = 1; $idx <= $user2; $idx++){
2740                                                 if ($idx % 2) {
2741                                         print "<tr bgcolor='$color{'color20'}'>\n";
2742                                 } else {
2743                                         print "<tr bgcolor='$color{'color22'}'>\n";
2744                                                 }
2745                                                 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2746                                                 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2747                                                 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2748                                                 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2749                                                 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2750                                                 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2751                                                 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2752 #                       print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2753             }
2754         }
2755
2756         print "</table>";
2757         print <<END
2758         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2759         <tr><td></td></tr>
2760         <tr><td></td></tr>
2761         <tr><td></td></tr>
2762         <tr><td></td></tr>
2763         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2764         </table>
2765 END
2766 ;
2767         &Header::closebox();
2768         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2769         &Header::closebigbox();
2770         &Header::closepage();
2771         exit(0);
2772
2773 ###
2774 ### Download Certificate
2775 ###
2776 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2777     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2778
2779     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2780         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2781         print "Content-Type: application/octet-stream\r\n\r\n";
2782         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2783         exit (0);
2784     }
2785
2786 ###
2787 ### Enable/Disable connection
2788 ###
2789
2790 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2791
2792     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2793     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2794
2795     if ($confighash{$cgiparams{'KEY'}}) {
2796            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2797             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2798             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2799             #&writeserverconf();
2800 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2801 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2802 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2803 #           }
2804         } else {
2805             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2806 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2807 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2808 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2809 #           }
2810             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2811             #&writeserverconf();
2812         }
2813     } else {
2814         $errormessage = $Lang::tr{'invalid key'};
2815     }
2816
2817 ###
2818 ### Restart connection
2819 ###
2820 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2821     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2822     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2823
2824     if ($confighash{$cgiparams{'KEY'}}) {
2825 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2826 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2827 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2828 #       }
2829     } else {
2830         $errormessage = $Lang::tr{'invalid key'};
2831     }
2832
2833 ###
2834 ### Remove connection
2835 ###
2836 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2837     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2838     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2839
2840     if ($confighash{$cgiparams{'KEY'}}) {
2841 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2842 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2843 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2844 #       }
2845         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2846         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2847         delete $confighash{$cgiparams{'KEY'}};
2848         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2849         #&writeserverconf();
2850     } else {
2851         $errormessage = $Lang::tr{'invalid key'};
2852     }
2853 #test33
2854
2855 ###
2856 ### Choose between adding a host-net or net-net connection
2857 ###
2858
2859 ###
2860 # m.a.d net2net
2861 ###
2862
2863 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2864         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2865         &Header::showhttpheaders();
2866         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2867         &Header::openbigbox('100%', 'LEFT', '', '');
2868         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2869
2870 if ( -s "${General::swroot}/ovpn/settings") {
2871
2872         print <<END
2873             <b>$Lang::tr{'connection type'}:</b><br />
2874             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2875             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2876                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2877             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2878                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2879                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2880                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2881           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2882           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2883     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'>Default : Client Packagename</td></tr>
2884           <tr><td colspan='3'><hr /></td></tr>
2885     <tr><td align='right' colspan='3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2886           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2887             </form></table>
2888 END
2889         ;
2890
2891
2892 } else {
2893         print <<END
2894                     <b>$Lang::tr{'connection type'}:</b><br />
2895             <table border='0' width='100%'><form method='post' ENCTYPE="multipart/form-data">
2896             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2897             <tr><td align='right' colspan'3'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2898             </form></table>
2899 END
2900         ;
2901
2902 }
2903
2904         &Header::closebox();
2905         &Header::closebigbox();
2906         &Header::closepage();
2907         exit (0);
2908
2909 ###
2910 # m.a.d net2net
2911 ###
2912
2913 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2914
2915         my @firen2nconf;
2916         my @confdetails;
2917         my $uplconffilename ='';
2918         my $uplconffilename2 ='';
2919         my $uplp12name = '';
2920         my $uplp12name2 = '';
2921         my @rem_subnet;
2922         my @rem_subnet2;
2923         my @tmposupnet3;
2924         my $key;
2925         my @n2nname;
2926
2927         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2928
2929 # Check if a file is uploaded
2930
2931         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2932                 $errormessage = $Lang::tr{'there was no file upload'};
2933                 goto N2N_ERROR;
2934     }
2935
2936 # Move uploaded IPfire n2n package to temporary file
2937
2938     (my $fh, my $filename) = tempfile( );
2939     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2940                 $errormessage = $!;
2941                 goto N2N_ERROR;
2942     }
2943
2944         my $zip = Archive::Zip->new();
2945         my $zipName = $filename;
2946         my $status = $zip->read( $zipName );
2947         if ($status != AZ_OK) {
2948                 $errormessage = "Read of $zipName failed\n";
2949                 goto N2N_ERROR;
2950         }
2951
2952         my $tempdir = tempdir( CLEANUP => 1 );
2953         my @files = $zip->memberNames();
2954         for(@files) {
2955         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2956         }
2957         my $countfiles = @files;
2958
2959 # Check if we have not more then 2 files
2960
2961         if ( $countfiles == 2){
2962                 foreach (@files){
2963                         if ( $_ =~ /.conf$/){
2964                                 $uplconffilename = $_;
2965                         }
2966                         if ( $_ =~ /.p12$/){
2967                                 $uplp12name = $_;
2968                         }
2969                 }
2970                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2971                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2972                         goto N2N_ERROR;
2973                 }
2974
2975                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2976                 @firen2nconf = <FILE>;
2977                 close (FILE);
2978                 chomp(@firen2nconf);
2979
2980         } else {
2981
2982                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2983                 goto N2N_ERROR;
2984         }
2985
2986 ###
2987 # m.a.d net2net
2988 ###
2989
2990  if ($cgiparams{'n2nname'} ne ''){
2991
2992   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2993   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2994   $n2nname[0] = $cgiparams{'n2nname'};
2995   my @n2nname2 = split(/\./,$uplconffilename);
2996   $n2nname2[0] =~ s/\n|\r//g;
2997   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2998         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2999         my $input2 = "$n2nname2[0]n2n";
3000   my $output2 = "$n2nname[0]n2n";
3001   my $filename = "$tempdir/$uplconffilename";
3002   open(FILE, "< $filename") or die 'Unable to open config file.';
3003         my @current = <FILE>;
3004         close(FILE);
3005         foreach (@current) {s/$input1/$output1/g;}
3006         foreach (@current) {s/$input2/$output2/g;}
3007   open (OUT, "> $filename") || die 'Unable to open config file.';
3008   print OUT @current;
3009   close OUT;
3010
3011     }else{
3012     $uplconffilename2 =  $uplconffilename;
3013     $uplp12name2 = $uplp12name;
3014     @n2nname = split(/\./,$uplconffilename);
3015     $n2nname[0] =~ s/\n|\r//g;
3016    }
3017     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
3018     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
3019
3020         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
3021
3022         if ($? ne 0) {
3023             $errormessage = "*.conf move failed: $!";
3024             unlink ($filename);
3025             goto N2N_ERROR;
3026         }
3027
3028         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
3029         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
3030
3031         if ($? ne 0) {
3032             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3033             unlink ($filename);
3034             goto N2N_ERROR;
3035         }
3036
3037 my $complzoactive;
3038 my $mssfixactive;
3039 my $n2nfragment;
3040 my @n2nmtudisc = split(/ /, (grep { /^mtu-disc/ } @firen2nconf)[0]);;
3041 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
3042 my @n2nproto = split(/-/, $n2nproto2[1]);
3043 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
3044 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
3045 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
3046 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
3047 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
3048 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
3049 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
3050 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
3051 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
3052 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
3053 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
3054 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
3055 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
3056 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
3057
3058
3059 ###
3060 # m.a.d delete CR and LF from arrays for this chomp doesnt work
3061 ###
3062
3063 $n2nremote[1] =~ s/\n|\r//g;
3064 $n2novpnsub[0] =~ s/\n|\r//g;
3065 $n2novpnsub[1] =~ s/\n|\r//g;
3066 $n2novpnsub[2] =~ s/\n|\r//g;
3067 $n2nproto[0] =~ s/\n|\r//g;
3068 $n2nport[1] =~ s/\n|\r//g;
3069 $n2ntunmtu[1] =~ s/\n|\r//g;
3070 $n2nremsub[1] =~ s/\n|\r//g;
3071 $n2nremsub[2] =~ s/\n|\r//g;
3072 $n2nlocalsub[2] =~ s/\n|\r//g;
3073 $n2nfragment[1] =~ s/\n|\r//g;
3074 $n2nmgmt[2] =~ s/\n|\r//g;
3075 $n2nmtudisc[1] =~ s/\n|\r//g;
3076 chomp ($complzoactive);
3077 chomp ($mssfixactive);
3078
3079 ###
3080 # m.a.d net2net
3081 ###
3082
3083 ###
3084 # Check if there is no other entry with this name
3085 ###
3086
3087         foreach my $dkey (keys %confighash) {
3088                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
3089                         $errormessage = $Lang::tr{'a connection with this name already exists'};
3090                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3091             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3092       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3093                         goto N2N_ERROR;
3094                 }
3095         }
3096
3097 ###
3098 # Check if OpenVPN Subnet is valid
3099 ###
3100
3101 foreach my $dkey (keys %confighash) {
3102                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
3103                         $errormessage = 'The OpenVPN Subnet is already in use';
3104                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3105             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3106       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3107                         goto N2N_ERROR;
3108                 }
3109         }
3110
3111 ###
3112 # Check im Dest Port is vaild
3113 ###
3114
3115 foreach my $dkey (keys %confighash) {
3116                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
3117                         $errormessage = 'The OpenVPN Port is already in use';
3118                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
3119             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
3120       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
3121                         goto N2N_ERROR;
3122                 }
3123         }
3124
3125
3126
3127   $key = &General::findhasharraykey (\%confighash);
3128
3129         foreach my $i (0 .. 39) { $confighash{$key}[$i] = "";}
3130
3131         $confighash{$key}[0] = 'off';
3132         $confighash{$key}[1] = $n2nname[0];
3133         $confighash{$key}[2] = $n2nname[0];
3134         $confighash{$key}[3] = 'net';
3135         $confighash{$key}[4] = 'cert';
3136         $confighash{$key}[6] = 'client';
3137         $confighash{$key}[8] =  $n2nlocalsub[2];
3138         $confighash{$key}[10] = $n2nremote[1];
3139         $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
3140         $confighash{$key}[22] = $n2nmgmt[2];
3141         $confighash{$key}[23] = $mssfixactive;
3142         $confighash{$key}[24] = $n2nfragment[1];
3143         $confighash{$key}[25] = 'IPFire n2n Client';
3144         $confighash{$key}[26] = 'red';
3145         $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
3146         $confighash{$key}[28] = $n2nproto[0];
3147         $confighash{$key}[29] = $n2nport[1];
3148         $confighash{$key}[30] = $complzoactive;
3149         $confighash{$key}[31] = $n2ntunmtu[1];
3150         $confighash{$key}[38] = $n2nmtudisc[1];
3151
3152
3153   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3154
3155   N2N_ERROR:
3156
3157         &Header::showhttpheaders();
3158         &Header::openpage('Validate imported configuration', 1, '');
3159         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3160         if ($errormessage) {
3161             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3162             print "<class name='base'>$errormessage";
3163             print "&nbsp;</class>";
3164             &Header::closebox();
3165
3166         } else
3167   {
3168                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
3169         }
3170         if ($errormessage eq ''){
3171                 print <<END
3172                 <!-- ipfire net2net config gui -->
3173                 <table width='100%'>
3174                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
3175     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
3176     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3177                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
3178                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
3179                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
3180                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
3181                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
3182                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
3183                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
3184                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
3185                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
3186                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
3187                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
3188                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td><td><b>$confighash{$key}[38]</b></td></tr>
3189                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
3190                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
3191     </table>
3192 END
3193 ;
3194                 &Header::closebox();
3195         }
3196
3197         if ($errormessage) {
3198                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
3199         } else {
3200                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
3201                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
3202                 print "<input type='hidden' name='KEY' value='$key' />";
3203                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3204         }
3205         &Header::closebigbox();
3206         &Header::closepage();
3207         exit(0);
3208
3209
3210 ##
3211 ### Accept IPFire n2n Package Settings
3212 ###
3213
3214   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3215
3216 ###
3217 ### Discard and Rollback IPFire n2n Package Settings
3218 ###
3219
3220   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
3221
3222      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3223
3224 if ($confighash{$cgiparams{'KEY'}}) {
3225
3226      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
3227      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
3228      unlink ($certfile) or die "Removing $certfile fail: $!";
3229      unlink ($conffile) or die "Removing $conffile fail: $!";
3230      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
3231      delete $confighash{$cgiparams{'KEY'}};
3232     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3233
3234      } else {
3235                 $errormessage = $Lang::tr{'invalid key'};
3236    }
3237
3238
3239 ###
3240 # m.a.d net2net
3241 ###
3242
3243
3244 ###
3245 ### Adding a new connection
3246 ###
3247 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
3248          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
3249          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
3250
3251     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
3252     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3253     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3254
3255     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
3256                 if (! $confighash{$cgiparams{'KEY'}}[0]) {
3257                     $errormessage = $Lang::tr{'invalid key'};
3258                     goto VPNCONF_END;
3259                 }
3260                 $cgiparams{'ENABLED'}                   = $confighash{$cgiparams{'KEY'}}[0];
3261                 $cgiparams{'NAME'}                              = $confighash{$cgiparams{'KEY'}}[1];
3262                 $cgiparams{'TYPE'}                              = $confighash{$cgiparams{'KEY'}}[3];
3263                 $cgiparams{'AUTH'}                              = $confighash{$cgiparams{'KEY'}}[4];
3264                 $cgiparams{'PSK'}                               = $confighash{$cgiparams{'KEY'}}[5];
3265                 $cgiparams{'SIDE'}                              = $confighash{$cgiparams{'KEY'}}[6];
3266                 $cgiparams{'LOCAL_SUBNET'}              = $confighash{$cgiparams{'KEY'}}[8];
3267                 $cgiparams{'REMOTE'}                    = $confighash{$cgiparams{'KEY'}}[10];
3268                 $cgiparams{'REMOTE_SUBNET'}     = $confighash{$cgiparams{'KEY'}}[11];
3269                 $cgiparams{'OVPN_MGMT'}                 = $confighash{$cgiparams{'KEY'}}[22];
3270                 $cgiparams{'MSSFIX'}                    = $confighash{$cgiparams{'KEY'}}[23];
3271                 $cgiparams{'FRAGMENT'}                  = $confighash{$cgiparams{'KEY'}}[24];
3272                 $cgiparams{'REMARK'}                    = $confighash{$cgiparams{'KEY'}}[25];
3273                 $cgiparams{'INTERFACE'}                 = $confighash{$cgiparams{'KEY'}}[26];
3274                 $cgiparams{'OVPN_SUBNET'}               = $confighash{$cgiparams{'KEY'}}[27];
3275                 $cgiparams{'PROTOCOL'}                  = $confighash{$cgiparams{'KEY'}}[28];
3276                 $cgiparams{'DEST_PORT'}                 = $confighash{$cgiparams{'KEY'}}[29];
3277                 $cgiparams{'COMPLZO'}                   = $confighash{$cgiparams{'KEY'}}[30];
3278                 $cgiparams{'MTU'}                               = $confighash{$cgiparams{'KEY'}}[31];
3279                 $cgiparams{'CHECK1'}                    = $confighash{$cgiparams{'KEY'}}[32];
3280                 $name=$cgiparams{'CHECK1'}      ;
3281                 $cgiparams{$name}                               = $confighash{$cgiparams{'KEY'}}[33];
3282                 $cgiparams{'RG'}                                = $confighash{$cgiparams{'KEY'}}[34];
3283                 $cgiparams{'CCD_DNS1'}                  = $confighash{$cgiparams{'KEY'}}[35];
3284                 $cgiparams{'CCD_DNS2'}                  = $confighash{$cgiparams{'KEY'}}[36];
3285                 $cgiparams{'CCD_WINS'}                  = $confighash{$cgiparams{'KEY'}}[37];
3286                 $cgiparams{'PMTU_DISCOVERY'}    = $confighash{$cgiparams{'KEY'}}[38];
3287         } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
3288         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
3289
3290 #A.Marx CCD check iroute field and convert it to decimal
3291 if ($cgiparams{'TYPE'} eq 'host') {
3292         my @temp=();
3293         my %ccdroutehash=();
3294         my $keypoint=0;
3295         my $ip;
3296         my $cidr;
3297         if ($cgiparams{'IR'} ne ''){
3298                 @temp = split("\n",$cgiparams{'IR'});
3299                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3300                 #find key to use
3301                 foreach my $key (keys %ccdroutehash) {
3302                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3303                                 $keypoint=$key;
3304                                 delete $ccdroutehash{$key};
3305                         }else{
3306                                 $keypoint = &General::findhasharraykey (\%ccdroutehash);
3307                         }
3308                 }
3309                 $ccdroutehash{$keypoint}[0]=$cgiparams{'NAME'};
3310                 my $i=1;
3311                 my $val=0;
3312                 foreach $val (@temp){
3313                         chomp($val);
3314                         $val=~s/\s*$//g;
3315                         #check if iroute exists in ccdroute or if new iroute is part of an existing one
3316                         foreach my $key (keys %ccdroutehash) {
3317                                 foreach my $oldiroute ( 1 .. $#{$ccdroutehash{$key}}){
3318                                                 if ($ccdroutehash{$key}[$oldiroute] eq "$val") {
3319                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3320                                                         goto VPNCONF_ERROR;
3321                                                 }
3322                                                 my ($ip1,$cidr1) = split (/\//, $val);
3323                                                 my ($ip2,$cidr2) = split (/\//, $ccdroutehash{$key}[$oldiroute]);
3324                                                 if (&General::IpInSubnet ($ip1,$ip2,$cidr2)){
3325                                                         $errormessage=$errormessage.$Lang::tr{'ccd err irouteexist'};
3326                                                         goto VPNCONF_ERROR;
3327                                                 }
3328
3329                                 }
3330                         }
3331                         if (!&General::validipandmask($val)){
3332                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3333                                 goto VPNCONF_ERROR;
3334                         }else{
3335                                 ($ip,$cidr) = split(/\//,$val);
3336                                 $ip=&General::getnetworkip($ip,&General::iporsubtocidr($cidr));
3337                                 $cidr=&General::iporsubtodec($cidr);
3338                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3339
3340                         }
3341
3342                         #check for existing network IP's
3343                         if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0')
3344                         {
3345                                 $errormessage=$Lang::tr{'ccd err green'};
3346                                 goto VPNCONF_ERROR;
3347                         }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0')
3348                         {
3349                                 $errormessage=$Lang::tr{'ccd err red'};
3350                                 goto VPNCONF_ERROR;
3351                         }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '')
3352                         {
3353                                 $errormessage=$Lang::tr{'ccd err blue'};
3354                                 goto VPNCONF_ERROR;
3355                         }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' )
3356                         {
3357                                 $errormessage=$Lang::tr{'ccd err orange'};
3358                                 goto VPNCONF_ERROR;
3359                         }
3360
3361                         if (&General::validipandmask($val)){
3362                                 $ccdroutehash{$keypoint}[$i] = $ip."/".$cidr;
3363                         }else{
3364                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($ip/$cidr)";
3365                                 goto VPNCONF_ERROR;
3366                         }
3367                         $i++;
3368                 }
3369                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3370                 &writeserverconf;
3371         }else{
3372                 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3373                 foreach my $key (keys %ccdroutehash) {
3374                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}) {
3375                                 delete $ccdroutehash{$key};
3376                                 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3377                                 &writeserverconf;
3378                         }
3379                 }
3380         }
3381         undef @temp;
3382         #check route field and convert it to decimal
3383         my $val=0;
3384         my $i=1;
3385         &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3386         #find key to use
3387         foreach my $key (keys %ccdroute2hash) {
3388                 if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
3389                         $keypoint=$key;
3390                         delete $ccdroute2hash{$key};
3391                 }else{
3392                         $keypoint = &General::findhasharraykey (\%ccdroute2hash);
3393                         &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3394                         &writeserverconf;
3395                 }
3396         }
3397         $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'};
3398         if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};}
3399         @temp = split(/\|/,$cgiparams{'IFROUTE'});
3400         my %ownnet=();
3401         &General::readhash("${General::swroot}/ethernet/settings", \%ownnet);
3402         foreach $val (@temp){
3403                 chomp($val);
3404                 $val=~s/\s*$//g;
3405                 if ($val eq $Lang::tr{'green'})
3406                 {
3407                         $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK};
3408                 }
3409                 if ($val eq $Lang::tr{'blue'})
3410                 {
3411                         $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK};
3412                 }
3413                 if ($val eq $Lang::tr{'orange'})
3414                 {
3415                         $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK};
3416                 }
3417                 my ($ip,$cidr) = split (/\//, $val);
3418
3419                 if ($val ne $Lang::tr{'ccd none'})
3420                 {
3421                         if (! &check_routes_push($val)){$errormessage=$errormessage."Route $val ".$Lang::tr{'ccd err routeovpn2'}." ($val)";goto VPNCONF_ERROR;}
3422                         if (! &check_ccdroute($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err inuse'}." ($val)" ;goto VPNCONF_ERROR;}
3423                         if (! &check_ccdconf($val)){$errormessage=$errormessage."<br>Route $val ".$Lang::tr{'ccd err routeovpn'}." ($val)";goto VPNCONF_ERROR;}
3424                         if (&General::validipandmask($val)){
3425                                 $val=$ip."/".&General::iporsubtodec($cidr);
3426                                 $ccdroute2hash{$keypoint}[$i] = $val;
3427                         }else{
3428                                 $errormessage=$errormessage."Route ".$Lang::tr{'ccd invalid'}." ($val)";
3429                                 goto VPNCONF_ERROR;
3430                         }
3431                 }else{
3432                         $ccdroute2hash{$keypoint}[$i]='';
3433                 }
3434                 $i++;
3435         }
3436         &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
3437
3438         #check dns1 ip
3439         if ($cgiparams{'CCD_DNS1'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS1'})) {
3440                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 1";
3441                         goto VPNCONF_ERROR;
3442         }
3443         #check dns2 ip
3444         if ($cgiparams{'CCD_DNS2'} ne '' &&  ! &General::validip($cgiparams{'CCD_DNS2'})) {
3445                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp dns'}." 2";
3446                         goto VPNCONF_ERROR;
3447         }
3448         #check wins ip
3449         if ($cgiparams{'CCD_WINS'} ne '' &&  ! &General::validip($cgiparams{'CCD_WINS'})) {
3450                         $errormessage=$errormessage."<br>".$Lang::tr{'invalid input for dhcp wins'};
3451                         goto VPNCONF_ERROR;
3452         }
3453 }
3454
3455 #CCD End
3456
3457
3458  if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
3459             $errormessage = $Lang::tr{'connection type is invalid'};
3460             if ($cgiparams{'TYPE'} eq 'net') {
3461       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3462             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3463       }
3464             goto VPNCONF_ERROR;
3465         }
3466
3467
3468         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
3469             $errormessage = $Lang::tr{'name must only contain characters'};
3470       if ($cgiparams{'TYPE'} eq 'net') {
3471       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3472             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3473       }
3474       goto VPNCONF_ERROR;
3475   }
3476
3477         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
3478             $errormessage = $Lang::tr{'name is invalid'};
3479             if ($cgiparams{'TYPE'} eq 'net') {
3480       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3481             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3482       }
3483             goto VPNCONF_ERROR;
3484         }
3485
3486         if (length($cgiparams{'NAME'}) >60) {
3487             $errormessage = $Lang::tr{'name too long'};
3488             if ($cgiparams{'TYPE'} eq 'net') {
3489       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3490             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3491       }
3492             goto VPNCONF_ERROR;
3493         }
3494
3495 ###
3496 # m.a.d net2net
3497 ###
3498
3499 if ($cgiparams{'TYPE'} eq 'net') {
3500
3501     if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
3502                         $errormessage = $Lang::tr{'openvpn destination port used'};
3503                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3504             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3505       goto VPNCONF_ERROR;
3506                 }
3507
3508     if ($cgiparams{'DEST_PORT'} eq  '') {
3509                         $errormessage = $Lang::tr{'openvpn destination port used'};
3510                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3511             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3512       goto VPNCONF_ERROR;
3513                 }
3514
3515     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
3516                         $errormessage = $Lang::tr{'openvpn subnet is used'};
3517                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3518             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3519                         goto VPNCONF_ERROR;
3520                 }
3521
3522           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
3523             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
3524             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3525             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3526             goto VPNCONF_ERROR;
3527     }
3528
3529     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
3530             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
3531             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3532             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3533             goto VPNCONF_ERROR;
3534     }
3535
3536     if (($cgiparams{'PMTU_DISCOVERY'} ne 'off') && ($cgiparams{'MTU'} ne '1500')) {
3537         $errormessage = $Lang::tr{'ovpn mtu-disc and mtu not 1500'};
3538         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3539         rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3540         goto VPNCONF_ERROR;
3541     }
3542
3543     if ($cgiparams{'PMTU_DISCOVERY'} ne 'off') {
3544         if (($cgiparams{'FRAGMENT'} ne '') || ($cgiparams{'MSSFIX'} eq 'on')) {
3545                 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
3546                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3547                 rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3548                 goto VPNCONF_ERROR;
3549         }
3550     }
3551
3552     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
3553                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
3554                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3555             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3556                   goto VPNCONF_ERROR;
3557                 }
3558
3559     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
3560                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
3561                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3562             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3563                   goto VPNCONF_ERROR;
3564                 }
3565
3566     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
3567                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
3568                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3569             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3570                   goto VPNCONF_ERROR;
3571                 }
3572
3573     if ($cgiparams{'OVPN_MGMT'} eq  '') {
3574                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
3575                 }
3576
3577 }
3578
3579 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
3580 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
3581 #           goto VPNCONF_ERROR;
3582 #       }
3583
3584         # Check if there is no other entry with this name
3585         if (! $cgiparams{'KEY'}) {
3586             foreach my $key (keys %confighash) {
3587                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
3588                     $errormessage = $Lang::tr{'a connection with this name already exists'};
3589                     if ($cgiparams{'TYPE'} eq 'net') {
3590         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3591               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3592         }
3593                     goto VPNCONF_ERROR;
3594                 }
3595             }
3596         }
3597
3598         if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
3599             $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3600             if ($cgiparams{'TYPE'} eq 'net') {
3601       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3602             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3603       }
3604             goto VPNCONF_ERROR;
3605         }
3606
3607         if ($cgiparams{'REMOTE'}) {
3608             if (! &General::validip($cgiparams{'REMOTE'})) {
3609                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
3610                     $errormessage = $Lang::tr{'invalid input for remote host/ip'};
3611                     if ($cgiparams{'TYPE'} eq 'net') {
3612         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3613               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3614         }
3615                     goto VPNCONF_ERROR;
3616                 } else {
3617                     if (&valid_dns_host($cgiparams{'REMOTE'})) {
3618                         $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
3619                         if ($cgiparams{'TYPE'} eq 'net') {
3620
3621       }
3622                     }
3623                 }
3624             }
3625         }
3626         if ($cgiparams{'TYPE'} ne 'host') {
3627             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
3628                     $errormessage = $Lang::tr{'local subnet is invalid'};
3629                     if ($cgiparams{'TYPE'} eq 'net') {
3630               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3631                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3632               }
3633                         goto VPNCONF_ERROR;}
3634         }
3635         # Check if there is no other entry without IP-address and PSK
3636         if ($cgiparams{'REMOTE'} eq '') {
3637             foreach my $key (keys %confighash) {
3638                 if(($cgiparams{'KEY'} ne $key) &&
3639                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
3640                     $confighash{$key}[10] eq '') {
3641                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
3642                         goto VPNCONF_ERROR;
3643                 }
3644             }
3645         }
3646         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
3647                 $errormessage = $Lang::tr{'remote subnet is invalid'};
3648                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
3649                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
3650                 goto VPNCONF_ERROR;
3651         }
3652
3653         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
3654             $errormessage = $Lang::tr{'invalid input'};
3655             goto VPNCONF_ERROR;
3656         }
3657         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
3658             $errormessage = $Lang::tr{'invalid input'};
3659             goto VPNCONF_ERROR;
3660         }
3661
3662 #fixplausi
3663         if ($cgiparams{'AUTH'} eq 'psk')  {
3664 #           if (! length($cgiparams{'PSK'}) ) {
3665 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
3666 #               goto VPNCONF_ERROR;
3667 #           }
3668 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
3669 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
3670 #               goto VPNCONF_ERROR;
3671 #           }
3672         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
3673             if ($cgiparams{'KEY'}) {
3674                 $errormessage = $Lang::tr{'cant change certificates'};
3675                 goto VPNCONF_ERROR;
3676             }
3677             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3678                 $errormessage = $Lang::tr{'there was no file upload'};
3679                 goto VPNCONF_ERROR;
3680             }
3681
3682             # Move uploaded certificate request to a temporary file
3683             (my $fh, my $filename) = tempfile( );
3684             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3685                 $errormessage = $!;
3686                 goto VPNCONF_ERROR;
3687             }
3688
3689             # Sign the certificate request and move it
3690             # Sign the host certificate request
3691             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3692                 '-batch', '-notext',
3693                 '-in', $filename,
3694                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3695                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3696             if ($?) {
3697                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3698                 unlink ($filename);
3699                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3700                 &newcleanssldatabase();
3701                 goto VPNCONF_ERROR;
3702             } else {
3703                 unlink ($filename);
3704                 &deletebackupcert();
3705             }
3706
3707             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3708             $temp =~ /Subject:.*CN=(.*)[\n]/;
3709             $temp = $1;
3710             $temp =~ s+/Email+, E+;
3711             $temp =~ s/ ST=/ S=/;
3712             $cgiparams{'CERT_NAME'} = $temp;
3713             $cgiparams{'CERT_NAME'} =~ s/,//g;
3714             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3715             if ($cgiparams{'CERT_NAME'} eq '') {
3716                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3717                 goto VPNCONF_ERROR;
3718             }
3719         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
3720             if ($cgiparams{'KEY'}) {
3721                 $errormessage = $Lang::tr{'cant change certificates'};
3722                 goto VPNCONF_ERROR;
3723             }
3724             if (ref ($cgiparams{'FH'}) ne 'Fh') {
3725                 $errormessage = $Lang::tr{'there was no file upload'};
3726                 goto VPNCONF_ERROR;
3727             }
3728             # Move uploaded certificate to a temporary file
3729             (my $fh, my $filename) = tempfile( );
3730             if (copy ($cgiparams{'FH'}, $fh) != 1) {
3731                 $errormessage = $!;
3732                 goto VPNCONF_ERROR;
3733             }
3734
3735             # Verify the certificate has a valid CA and move it
3736             my $validca = 0;
3737             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
3738             if ($test =~ /: OK/) {
3739                 $validca = 1;
3740             } else {
3741                 foreach my $key (keys %cahash) {
3742                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
3743                     if ($test =~ /: OK/) {
3744                         $validca = 1;
3745                     }
3746                 }
3747             }
3748             if (! $validca) {
3749                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
3750                 unlink ($filename);
3751                 goto VPNCONF_ERROR;
3752             } else {
3753                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3754                 if ($? ne 0) {
3755                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
3756                     unlink ($filename);
3757                     goto VPNCONF_ERROR;
3758                 }
3759             }
3760
3761             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
3762             $temp =~ /Subject:.*CN=(.*)[\n]/;
3763             $temp = $1;
3764             $temp =~ s+/Email+, E+;
3765             $temp =~ s/ ST=/ S=/;
3766             $cgiparams{'CERT_NAME'} = $temp;
3767             $cgiparams{'CERT_NAME'} =~ s/,//g;
3768             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3769             if ($cgiparams{'CERT_NAME'} eq '') {
3770                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3771                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3772                 goto VPNCONF_ERROR;
3773             }
3774         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
3775             if ($cgiparams{'KEY'}) {
3776                 $errormessage = $Lang::tr{'cant change certificates'};
3777                 goto VPNCONF_ERROR;
3778             }
3779             # Validate input since the form was submitted
3780             if (length($cgiparams{'CERT_NAME'}) >60) {
3781                 $errormessage = $Lang::tr{'name too long'};
3782                 goto VPNCONF_ERROR;
3783             }
3784             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3785                 $errormessage = $Lang::tr{'invalid input for name'};
3786                 goto VPNCONF_ERROR;
3787             }
3788             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3789                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3790                 goto VPNCONF_ERROR;
3791             }
3792             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3793                 $errormessage = $Lang::tr{'e-mail address too long'};
3794                 goto VPNCONF_ERROR;
3795             }
3796             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3797                 $errormessage = $Lang::tr{'invalid input for department'};
3798                 goto VPNCONF_ERROR;
3799             }
3800             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3801                 $errormessage = $Lang::tr{'organization too long'};
3802                 goto VPNCONF_ERROR;
3803             }
3804             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3805                 $errormessage = $Lang::tr{'invalid input for organization'};
3806                 goto VPNCONF_ERROR;
3807             }
3808             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3809                 $errormessage = $Lang::tr{'invalid input for city'};
3810                 goto VPNCONF_ERROR;
3811             }
3812             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3813                 $errormessage = $Lang::tr{'invalid input for state or province'};
3814                 goto VPNCONF_ERROR;
3815             }
3816             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3817                 $errormessage = $Lang::tr{'invalid input for country'};
3818                 goto VPNCONF_ERROR;
3819             }
3820             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3821                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3822                     $errormessage = $Lang::tr{'password too short'};
3823                     goto VPNCONF_ERROR;
3824                 }
3825             }
3826             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3827                 $errormessage = $Lang::tr{'passwords do not match'};
3828                 goto VPNCONF_ERROR;
3829             }
3830
3831             # Replace empty strings with a .
3832             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3833             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3834             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3835
3836             # Create the Host certificate request client
3837             my $pid = open(OPENSSL, "|-");
3838             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3839             if ($pid) { # parent
3840                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3841                 print OPENSSL "$state\n";
3842                 print OPENSSL "$city\n";
3843                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3844                 print OPENSSL "$ou\n";
3845                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3846                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3847                 print OPENSSL ".\n";
3848                 print OPENSSL ".\n";
3849                 close (OPENSSL);
3850                 if ($?) {
3851                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3852                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3853                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3854                     goto VPNCONF_ERROR;
3855                 }
3856             } else {    # child
3857                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3858                         '-newkey', 'rsa:1024',
3859                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3860                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3861                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3862                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3863                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3864                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3865                     goto VPNCONF_ERROR;
3866                 }
3867             }
3868
3869             # Sign the host certificate request
3870             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3871                 '-batch', '-notext',
3872                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3873                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3874                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3875             if ($?) {
3876                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3877                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3878                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3879                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3880                 &newcleanssldatabase();
3881                 goto VPNCONF_ERROR;
3882             } else {
3883                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3884                 &deletebackupcert();
3885             }
3886
3887             # Create the pkcs12 file
3888             system('/usr/bin/openssl', 'pkcs12', '-export',
3889                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3890                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3891                 '-name', $cgiparams{'NAME'},
3892                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3893                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3894                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3895                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3896             if ($?) {
3897                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3898                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3899                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3900                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3901                 goto VPNCONF_ERROR;
3902             } else {
3903                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3904             }
3905         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3906             ;# Nothing, just editing
3907         } else {
3908             $errormessage = $Lang::tr{'invalid input for authentication method'};
3909             goto VPNCONF_ERROR;
3910         }
3911
3912         # Check if there is no other entry with this common name
3913         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3914             foreach my $key (keys %confighash) {
3915                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3916                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3917                     goto VPNCONF_ERROR;
3918                 }
3919             }
3920         }
3921
3922         # Save the config
3923         my $key = $cgiparams{'KEY'};
3924
3925         if (! $key) {
3926             $key = &General::findhasharraykey (\%confighash);
3927             foreach my $i (0 .. 38) { $confighash{$key}[$i] = "";}
3928         }
3929         $confighash{$key}[0]            = $cgiparams{'ENABLED'};
3930         $confighash{$key}[1]            = $cgiparams{'NAME'};
3931         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3932             $confighash{$key}[2]        = $cgiparams{'CERT_NAME'};
3933         }
3934
3935         $confighash{$key}[3]            = $cgiparams{'TYPE'};
3936         if ($cgiparams{'AUTH'} eq 'psk') {
3937             $confighash{$key}[4]        = 'psk';
3938             $confighash{$key}[5]        = $cgiparams{'PSK'};
3939         } else {
3940             $confighash{$key}[4]        = 'cert';
3941         }
3942         if ($cgiparams{'TYPE'} eq 'net') {
3943             $confighash{$key}[6]        = $cgiparams{'SIDE'};
3944             $confighash{$key}[11]       = $cgiparams{'REMOTE_SUBNET'};
3945         }
3946         $confighash{$key}[8]                    = $cgiparams{'LOCAL_SUBNET'};
3947         $confighash{$key}[10]           = $cgiparams{'REMOTE'};
3948   if ($cgiparams{'OVPN_MGMT'} eq '') {
3949         $confighash{$key}[22]           = $confighash{$key}[29];
3950   } else {
3951         $confighash{$key}[22]           = $cgiparams{'OVPN_MGMT'};
3952   }
3953         $confighash{$key}[23]           = $cgiparams{'MSSFIX'};
3954         $confighash{$key}[24]           = $cgiparams{'FRAGMENT'};
3955         $confighash{$key}[25]           = $cgiparams{'REMARK'};
3956         $confighash{$key}[26]           = $cgiparams{'INTERFACE'};
3957 # new fields
3958         $confighash{$key}[27]           = $cgiparams{'OVPN_SUBNET'};
3959         $confighash{$key}[28]           = $cgiparams{'PROTOCOL'};
3960         $confighash{$key}[29]           = $cgiparams{'DEST_PORT'};
3961         $confighash{$key}[30]           = $cgiparams{'COMPLZO'};
3962         $confighash{$key}[31]           = $cgiparams{'MTU'};
3963         $confighash{$key}[32]           = $cgiparams{'CHECK1'};
3964         $name=$cgiparams{'CHECK1'};
3965         $confighash{$key}[33]           = $cgiparams{$name};
3966         $confighash{$key}[34]           = $cgiparams{'RG'};
3967         $confighash{$key}[35]           = $cgiparams{'CCD_DNS1'};
3968         $confighash{$key}[36]           = $cgiparams{'CCD_DNS2'};
3969         $confighash{$key}[37]           = $cgiparams{'CCD_WINS'};
3970         $confighash{$key}[38]                   = $cgiparams{'PMTU_DISCOVERY'};
3971
3972
3973         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3974
3975         if ($cgiparams{'CHECK1'} ){
3976
3977                 my ($ccdip,$ccdsub)=split "/",$cgiparams{$name};
3978                 my ($a,$b,$c,$d) = split (/\./,$ccdip);
3979                         if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){
3980                                 unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}";
3981                         }
3982                         open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!";
3983                         print CCDRWCONF "# OpenVPN Clientconfig from CCD extension by Copymaster#\n\n";
3984                         if($cgiparams{'CHECK1'} eq 'dynamic'){
3985                                 print CCDRWCONF "#This client uses the dynamic pool\n";
3986                         }else{
3987                                 print CCDRWCONF "#Ip address client and Server\n";
3988                                 print CCDRWCONF "ifconfig-push $ccdip ".&General::getlastip($ccdip,1)."\n";
3989                         }
3990                         if ($confighash{$key}[34] eq 'on'){
3991                                 print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n";
3992                                 print CCDRWCONF "push redirect-gateway\n";
3993                         }
3994                         &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
3995                         if ($cgiparams{'IR'} ne ''){
3996                                 print CCDRWCONF "\n#Client routes these Networks (behind Client)\n";
3997                                 foreach my $key (keys %ccdroutehash){
3998                                         if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){
3999                                                 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
4000                                                         my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
4001                                                         print CCDRWCONF "iroute $a $b\n";
4002                                                 }
4003                                         }
4004                                 }
4005                         }
4006                         if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';}
4007                         if ($cgiparams{'IFROUTE'} ne ''){
4008                                 print CCDRWCONF "\n#Client gets routes to these Networks (behind IPFIRE)\n";
4009                                 foreach my $key (keys %ccdroute2hash){
4010                                         if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4011                                                 foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){
4012                                                         if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){
4013                                                                 my %blue=();
4014                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%blue);
4015                                                                 print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n";
4016                                                         }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){
4017                                                                 my %orange=();
4018                                                                 &General::readhash("${General::swroot}/ethernet/settings", \%orange);
4019                                                                 print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS}  $orange{ORANGE_NETMASK}\n";
4020                                                         }else{
4021                                                                 my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]);
4022                                                                 print CCDRWCONF "push \"route $a $b\"\n";
4023                                                         }
4024                                                 }
4025                                         }
4026                                 }
4027                         }
4028                         if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';}
4029                         if($cgiparams{'CCD_DNS1'} ne ''){
4030                                 print CCDRWCONF "\n#Client gets these Nameservers\n";
4031                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n";
4032                         }
4033                         if($cgiparams{'CCD_DNS2'} ne ''){
4034                                 print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n";
4035                         }
4036                         if($cgiparams{'CCD_WINS'} ne ''){
4037                                 print CCDRWCONF "\n#Client gets this WINS server\n";
4038                                 print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n";
4039                         }
4040                         close CCDRWCONF;
4041         }
4042
4043 ###
4044 # m.a.d n2n begin
4045 ###
4046
4047         if ($cgiparams{'TYPE'} eq 'net') {
4048
4049         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4050   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
4051
4052   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4053         my $key = $cgiparams{'KEY'};
4054         if (! $key) {
4055             $key = &General::findhasharraykey (\%confighash);
4056             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
4057             }
4058   $confighash{$key}[0] = 'on';
4059   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4060
4061   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
4062          }
4063   }
4064
4065 ###
4066 # m.a.d n2n end
4067 ###
4068
4069         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
4070             $cgiparams{'KEY'} = $key;
4071             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
4072         }
4073         goto VPNCONF_END;
4074     } else {
4075         $cgiparams{'ENABLED'} = 'on';
4076 ###
4077 # m.a.d n2n begin
4078 ###
4079         $cgiparams{'MSSFIX'} = 'on';
4080         $cgiparams{'FRAGMENT'} = '1300';
4081         $cgiparams{'PMTU_DISCOVERY'} = 'off';
4082 ###
4083 # m.a.d n2n end
4084 ###
4085         $cgiparams{'SIDE'} = 'left';
4086         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
4087             $cgiparams{'AUTH'} = 'psk';
4088         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4089             $cgiparams{'AUTH'} = 'certfile';
4090         } else {
4091             $cgiparams{'AUTH'} = 'certgen';
4092         }
4093         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
4094         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
4095         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
4096         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
4097         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
4098     }
4099
4100     VPNCONF_ERROR:
4101     $checked{'ENABLED'}{'off'} = '';
4102     $checked{'ENABLED'}{'on'} = '';
4103     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4104     $checked{'ENABLED_BLUE'}{'off'} = '';
4105     $checked{'ENABLED_BLUE'}{'on'} = '';
4106     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4107     $checked{'ENABLED_ORANGE'}{'off'} = '';
4108     $checked{'ENABLED_ORANGE'}{'on'} = '';
4109     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4110
4111
4112     $checked{'EDIT_ADVANCED'}{'off'} = '';
4113     $checked{'EDIT_ADVANCED'}{'on'} = '';
4114     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
4115
4116     $selected{'SIDE'}{'server'} = '';
4117     $selected{'SIDE'}{'client'} = '';
4118     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
4119
4120     $selected{'PROTOCOL'}{'udp'} = '';
4121     $selected{'PROTOCOL'}{'tcp'} = '';
4122     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
4123
4124
4125     $checked{'AUTH'}{'psk'} = '';
4126     $checked{'AUTH'}{'certreq'} = '';
4127     $checked{'AUTH'}{'certgen'} = '';
4128     $checked{'AUTH'}{'certfile'} = '';
4129     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
4130
4131     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
4132
4133     $checked{'COMPLZO'}{'off'} = '';
4134     $checked{'COMPLZO'}{'on'} = '';
4135     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
4136
4137     $checked{'MSSFIX'}{'off'} = '';
4138     $checked{'MSSFIX'}{'on'} = '';
4139     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4140
4141     $checked{'PMTU_DISCOVERY'}{$cgiparams{'PMTU_DISCOVERY'}} = 'checked=\'checked\'';
4142
4143
4144     if (1) {
4145         &Header::showhttpheaders();
4146         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
4147         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4148         if ($errormessage) {
4149             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4150             print "<class name='base'>$errormessage";
4151             print "&nbsp;</class>";
4152             &Header::closebox();
4153         }
4154
4155         if ($warnmessage) {
4156             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
4157             print "<class name='base'>$warnmessage";
4158             print "&nbsp;</class>";
4159             &Header::closebox();
4160         }
4161
4162         print "<form method='post' enctype='multipart/form-data'>";
4163         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
4164
4165         if ($cgiparams{'KEY'}) {
4166             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
4167             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
4168         }
4169
4170         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
4171         print "<table width='100%'  border='0'>\n";
4172
4173
4174
4175         print "<tr><td width='14%' class='boldbase'>$Lang::tr{'name'}: </td>";
4176
4177         if ($cgiparams{'TYPE'} eq 'host') {
4178             if ($cgiparams{'KEY'}) {
4179                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4180             } else {
4181
4182                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
4183             }
4184 #           print "<tr><td>$Lang::tr{'interface'}</td>";
4185 #           print "<td><select name='INTERFACE'>";
4186 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
4187 #           if ($netsettings{'BLUE_DEV'} ne '') {
4188 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
4189 #           }
4190 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
4191 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
4192 #           print "</select></td></tr>";
4193 #           print <<END
4194         } else {
4195             print "<input type='hidden' name='INTERFACE' value='red' />";
4196             if ($cgiparams{'KEY'}) {
4197                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
4198             } else {
4199                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
4200             }
4201
4202
4203
4204             print <<END
4205                     <td width='25%'>&nbsp;</td>
4206                     <td width='25%'>&nbsp;</td></tr>
4207                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
4208                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
4209                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
4210                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
4211                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
4212                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
4213                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
4214                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
4215                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
4216                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
4217                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
4218                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4219
4220      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
4221                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
4222
4223         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4224                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
4225                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
4226                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
4227
4228                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
4229                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
4230         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
4231
4232           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
4233                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
4234                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
4235
4236                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
4237                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
4238         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
4239
4240         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
4241                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
4242         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
4243
4244         <tr>
4245                 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn mtu-disc'}</td>
4246                 <td colspan='2'>
4247                         <input type='radio' name='PMTU_DISCOVERY' value='yes' $checked{'PMTU_DISCOVERY'}{'yes'} /> $Lang::tr{'ovpn mtu-disc yes'}
4248                         <input type='radio' name='PMTU_DISCOVERY' value='maybe' $checked{'PMTU_DISCOVERY'}{'maybe'} /> $Lang::tr{'ovpn mtu-disc maybe'}
4249                         <input type='radio' name='PMTU_DISCOVERY' value='no' $checked{'PMTU_DISCOVERY'}{'no'} /> $Lang::tr{'ovpn mtu-disc no'}
4250                         <input type='radio' name='PMTU_DISCOVERY' value='off' $checked{'PMTU_DISCOVERY'}{'off'} /> $Lang::tr{'ovpn mtu-disc off'}
4251                 </td>
4252         </tr>
4253
4254 END
4255 ;
4256         }
4257 #jumper
4258         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
4259         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr></table>";
4260
4261         if ($cgiparams{'TYPE'} eq 'host') {
4262       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>";
4263     }
4264
4265                 print"</tr></table><br><br>";
4266 #A.Marx CCD new client
4267 if ($cgiparams{'TYPE'} eq 'host') {
4268             print "<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td colspan='3'><hr><br><b>$Lang::tr{'ccd choose net'}</td></tr><tr><td height='20' colspan='3'></td></tr>";
4269             my %vpnnet=();
4270             my $vpnip;
4271             &General::readhash("${General::swroot}/ovpn/settings", \%vpnnet);
4272             $vpnip=$vpnnet{'DOVPN_SUBNET'};
4273             &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
4274             my @ccdconf=();
4275                 my $count=0;
4276                 my $checked;
4277                 $checked{'check1'}{'off'} = '';
4278             $checked{'check1'}{'on'} = '';
4279             $checked{'check1'}{$cgiparams{'CHECK1'}} = 'CHECKED';
4280             print"<tr><td align='center' width='1%' valign='top'><input type='radio' name='CHECK1' value='dynamic' checked /></td><td align='left' valign='top' width='35%'>$Lang::tr{'ccd dynrange'} ($vpnip)</td><td width='30%'>";
4281             print"</td></tr></table><br><br>";
4282                 my $name=$cgiparams{'CHECK1'};
4283                 $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED';
4284
4285         if (! -z "${General::swroot}/ovpn/ccd.conf"){
4286                 print"<table border='0' width='100%' cellspacing='1' cellpadding='0'><tr><td width='1%'></td><td width='30%' class='boldbase' align='center'><b>$Lang::tr{'ccd name'}</td><td width='15%' class='boldbase' align='center'><b>$Lang::tr{'network'}</td><td class='boldbase' align='center' width='18%'><b>$Lang::tr{'ccd clientip'}</td></tr>";
4287                 foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) {
4288                         $count++;
4289                         @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]);
4290                         if ($count % 2){print"<tr bgcolor='$color{'color22'}'>";}else{print"<tr bgcolor='$color{'color20'}'>";}
4291                         print"<td align='center' width='1%'><input type='radio' name='CHECK1' value='$ccdconf[0]' $checked{'check1'}{$ccdconf[0]}/></td><td>$ccdconf[0]</td><td width='40%' align='center'>$ccdconf[1]</td><td align='left' width='10%'>";
4292                         &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name});
4293                         print"</td></tr>";
4294                 }
4295                 print "</table><br><br><hr><br><br>";
4296         }
4297 }
4298 # ccd end
4299         &Header::closebox();
4300         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
4301
4302                 } elsif (! $cgiparams{'KEY'}) {
4303
4304
4305             my $disabled='';
4306             my $cakeydisabled='';
4307             my $cacrtdisabled='';
4308             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
4309             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
4310
4311             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
4312
4313
4314  if ($cgiparams{'TYPE'} eq 'host') {
4315
4316 print <<END
4317             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4318
4319             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
4320             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
4321             <tr><td colspan='3'>&nbsp;</td></tr>
4322       <tr><td colspan='3'><hr /></td></tr>
4323       <tr><td colspan='3'>&nbsp;</td></tr>
4324             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4325             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4326             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4327             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4328             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4329             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4330             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4331             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4332 END
4333 ;
4334
4335 ###
4336 # m.a.d net2net
4337 ###
4338
4339 } else {
4340
4341 print <<END
4342             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
4343
4344             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
4345             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
4346             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
4347             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
4348             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
4349             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
4350             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
4351             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
4352
4353
4354 END
4355 ;
4356
4357 }
4358
4359 ###
4360 # m.a.d net2net
4361 ###
4362
4363             foreach my $country (sort keys %{Countries::countries}) {
4364                 print "<option value='$Countries::countries{$country}'";
4365                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
4366                     print " selected='selected'";
4367                 }
4368                 print ">$country</option>";
4369             }
4370 ###
4371 # m.a.d net2net
4372 ###
4373
4374 if ($cgiparams{'TYPE'} eq 'host') {
4375             print <<END
4376             </select></td></tr>
4377
4378         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
4379         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
4380    <tr><td>&nbsp;</td>
4381                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
4382                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
4383             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
4384                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
4385      <tr><td colspan='3'>&nbsp;</td></tr>
4386      <tr><td colspan='3'><hr /></td></tr>
4387      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4388      </table>
4389 END
4390 }else{
4391             print <<END
4392             </select></td></tr>
4393    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4394          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
4395          <tr><td colspan='3'><hr /></td></tr>
4396          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
4397        </table>
4398
4399 END
4400 }
4401
4402 ###
4403 # m.a.d net2net
4404 ###
4405             ;
4406             &Header::closebox();
4407
4408         }
4409
4410 #A.Marx CCD new client
4411 if ($cgiparams{'TYPE'} eq 'host') {
4412             print"<br><br>";
4413             &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:");
4414
4415
4416         print <<END;
4417         <table border='0' width='100%'>
4418         <tr><td width='20%'>Redirect Gateway:</td><td colspan='3'><input type='checkbox' name='RG' $checked{'RG'}{'on'} /></td></tr>
4419         <tr><td colspan='4'><b><br>$Lang::tr{'ccd routes'}</b></td></tr>
4420         <tr><td colspan='4'>&nbsp</td></tr>
4421         <tr><td valign='top'>$Lang::tr{'ccd iroute'}</td><td align='left' width='30%'><textarea name='IR' cols='26' rows='6' wrap='off'>
4422 END
4423
4424         if ($cgiparams{'IR'} ne ''){
4425                 print $cgiparams{'IR'};
4426         }else{
4427                 &General::readhasharray ("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
4428                 foreach my $key (keys %ccdroutehash) {
4429                         if( $cgiparams{'NAME'} eq $ccdroutehash{$key}[0]){
4430                                 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
4431                                                 if ($ccdroutehash{$key}[$i] ne ''){
4432                                                         print $ccdroutehash{$key}[$i]."\n";
4433                                                 }
4434                                                 $cgiparams{'IR'} .= $ccdroutehash{$key}[$i];
4435                                 }
4436                         }
4437                 }
4438         }
4439
4440         print <<END;
4441 </textarea></td><td valign='top' colspan='2'>$Lang::tr{'ccd iroutehint'}</td></tr>
4442         <tr><td colspan='4'><br></td></tr>
4443         <tr><td valign='top' rowspan='3'>$Lang::tr{'ccd iroute2'}</td><td align='left' valign='top' rowspan='3'><select name='IFROUTE' style="width: 205px"; size='6' multiple>
4444 END
4445
4446         my $set=0;
4447         my $selorange=0;
4448         my $selblue=0;
4449         my $selgreen=0;
4450         my $helpblue=0;
4451         my $helporange=0;
4452         my $other=0;
4453         my $none=0;
4454         my @temp=();
4455
4456         our @current = ();
4457         open(FILE, "${General::swroot}/main/routing") ;
4458         @current = <FILE>;
4459         close (FILE);
4460         &General::readhasharray ("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
4461         #check for "none"
4462         foreach my $key (keys %ccdroute2hash) {
4463                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4464                         if ($ccdroute2hash{$key}[1] eq ''){
4465                                 $none=1;
4466                                 last;
4467                         }
4468                 }
4469         }
4470         if ($none ne '1'){
4471                 print"<option>$Lang::tr{'ccd none'}</option>";
4472         }else{
4473                 print"<option selected>$Lang::tr{'ccd none'}</option>";
4474         }
4475         #check if static routes are defined for client
4476         foreach my $line (@current) {
4477                 chomp($line);
4478                 $line=~s/\s*$//g;                       # remove newline
4479                 @temp=split(/\,/,$line);
4480                 $temp[1] = '' unless defined $temp[1]; # not always populated
4481                 my ($a,$b) = split(/\//,$temp[1]);
4482                 $temp[1] = $a."/".&General::iporsubtocidr($b);
4483                 foreach my $key (keys %ccdroute2hash) {
4484                         if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4485                                 foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4486                                         if($ccdroute2hash{$key}[$i] eq $a."/".&General::iporsubtodec($b)){
4487                                                 $set=1;
4488                                         }
4489                                 }
4490                         }
4491                 }
4492                 if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
4493         }
4494         #check if green,blue,orange are defined for client
4495         foreach my $key (keys %ccdroute2hash) {
4496                 if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){
4497                         $other=1;
4498                         foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
4499                                 if ($ccdroute2hash{$key}[$i] eq $netsettings{'GREEN_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'GREEN_NETMASK'})){
4500                                         $selgreen=1;
4501                                 }
4502                                 if (&haveBlueNet()){
4503                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'BLUE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'BLUE_NETMASK'})) {
4504                                                 $selblue=1;
4505                                         }
4506                                 }
4507                                 if (&haveOrangeNet()){
4508                                         if( $ccdroute2hash{$key}[$i] eq $netsettings{'ORANGE_NETADDRESS'}."/".&General::iporsubtodec($netsettings{'ORANGE_NETMASK'}) ) {
4509                                                 $selorange=1;
4510                                         }
4511                                 }
4512                         }
4513                 }
4514         }
4515         if (&haveBlueNet() && $selblue == '1'){ print"<option selected>$Lang::tr{'blue'}</option>";$selblue=0;}elsif(&haveBlueNet() && $selblue == '0'){print"<option>$Lang::tr{'blue'}</option>";}
4516         if (&haveOrangeNet() && $selorange == '1'){ print"<option selected>$Lang::tr{'orange'}</option>";$selorange=0;}elsif(&haveOrangeNet() && $selorange == '0'){print"<option>$Lang::tr{'orange'}</option>";}
4517         if ($selgreen == '1' || $other == '0'){ print"<option selected>$Lang::tr{'green'}</option>";$set=0;}else{print"<option>$Lang::tr{'green'}</option>";};
4518
4519         print<<END
4520         </select></td><td valign='top'>DNS1:</td><td valign='top'><input type='TEXT' name='CCD_DNS1' value='$cgiparams{'CCD_DNS1'}' size='30' /></td></tr>
4521         <tr valign='top'><td>DNS2:</td><td><input type='TEXT' name='CCD_DNS2' value='$cgiparams{'CCD_DNS2'}' size='30' /></td></tr>
4522         <tr valign='top'><td valign='top'>WINS:</td><td><input type='TEXT' name='CCD_WINS' value='$cgiparams{'CCD_WINS'}' size='30' /></td></tr></table><br><hr>
4523
4524 END
4525 ;
4526      &Header::closebox();
4527 }
4528         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4529         if ($cgiparams{'KEY'}) {
4530 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
4531         }
4532         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
4533         &Header::closebigbox();
4534         &Header::closepage();
4535         exit (0);
4536     }
4537     VPNCONF_END:
4538 }
4539
4540 #    SETTINGS_ERROR:
4541 ###
4542 ### Default status page
4543 ###
4544     %cgiparams = ();
4545     %cahash = ();
4546     %confighash = ();
4547     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
4548     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
4549     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
4550
4551     my @status = `/bin/cat /var/log/ovpnserver.log`;
4552
4553     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
4554                 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
4555                     my $ipaddr = <IPADDR>;
4556                     close IPADDR;
4557                     chomp ($ipaddr);
4558                     $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
4559                     if ($cgiparams{'VPN_IP'} eq '') {
4560                                 $cgiparams{'VPN_IP'} = $ipaddr;
4561                     }
4562                 }
4563     }
4564
4565 #default setzen
4566     if ($cgiparams{'DCIPHER'} eq '') {
4567         $cgiparams{'DCIPHER'} =  'BF-CBC';
4568     }
4569     if ($cgiparams{'DDEST_PORT'} eq '') {
4570         $cgiparams{'DDEST_PORT'} =  '1194';
4571     }
4572     if ($cgiparams{'DMTU'} eq '') {
4573         $cgiparams{'DMTU'} =  '1400';
4574     }
4575     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
4576         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
4577     }
4578         $checked{'ENABLED'}{'off'} = '';
4579     $checked{'ENABLED'}{'on'} = '';
4580     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
4581     $checked{'ENABLED_BLUE'}{'off'} = '';
4582     $checked{'ENABLED_BLUE'}{'on'} = '';
4583     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
4584     $checked{'ENABLED_ORANGE'}{'off'} = '';
4585     $checked{'ENABLED_ORANGE'}{'on'} = '';
4586     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
4587     $selected{'DDEVICE'}{'tun'} = '';
4588     $selected{'DDEVICE'}{'tap'} = '';
4589     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
4590
4591     $selected{'DPROTOCOL'}{'udp'} = '';
4592     $selected{'DPROTOCOL'}{'tcp'} = '';
4593     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
4594
4595     $selected{'DCIPHER'}{'DES-CBC'} = '';
4596     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
4597     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
4598     $selected{'DCIPHER'}{'DESX-CBC'} = '';
4599     $selected{'DCIPHER'}{'RC2-CBC'} = '';
4600     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
4601     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
4602     $selected{'DCIPHER'}{'BF-CBC'} = '';
4603     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
4604     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
4605     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
4606     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
4607     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
4608     $checked{'DCOMPLZO'}{'off'} = '';
4609     $checked{'DCOMPLZO'}{'on'} = '';
4610     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
4611 # m.a.d
4612     $checked{'MSSFIX'}{'off'} = '';
4613     $checked{'MSSFIX'}{'on'} = '';
4614     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
4615 #new settings
4616     &Header::showhttpheaders();
4617     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
4618     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
4619
4620     if ($errormessage) {
4621         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
4622         print "<class name='base'>$errormessage\n";
4623         print "&nbsp;</class>\n";
4624         &Header::closebox();
4625     }
4626
4627     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
4628     my $srunning = "no";
4629     my $activeonrun = "";
4630     if ( -e "/var/run/openvpn.pid"){
4631         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
4632         $srunning ="yes";
4633         $activeonrun = "";
4634     } else {
4635         $activeonrun = "disabled='disabled'";
4636     }
4637     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
4638         print <<END
4639     <table width='100%' border=0>
4640     <form method='post'>
4641     <td width='25%'>&nbsp;</td>
4642     <td width='25%'>&nbsp;</td>
4643     <td width='25%'>&nbsp;</td></tr>
4644     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
4645     <td align='left'>$sactive</td>
4646     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
4647     <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
4648 END
4649 ;
4650     if (&haveBlueNet()) {
4651         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
4652         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
4653     }
4654     if (&haveOrangeNet()) {
4655         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
4656         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
4657     }
4658     print <<END
4659     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
4660         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
4661     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
4662         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
4663                                 <!-- this is still not working
4664                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
4665     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
4666         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
4667                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
4668         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
4669         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
4670     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
4671         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
4672     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
4673         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
4674         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
4675         <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
4676                                    <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
4677                                    <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
4678                                    <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
4679                                    <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
4680                                    <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
4681                                    <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
4682                                    <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
4683                                    <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
4684                                    <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
4685                                    <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
4686                                    <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td></tr>
4687                                    <tr><td colspan='4'><hr /></td></tr>
4688 END
4689 ;
4690
4691     if ( $srunning eq "yes" ) {
4692         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' />";
4693         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4694         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4695         print "<input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td></tr>";
4696     } else{
4697         print "<tr><td align='right' colspan='4'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
4698         print "<input type='submit' name='ACTION' value='$Lang::tr{'ccd net'}' />";
4699         print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' />";
4700         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
4701              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
4702              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
4703              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
4704             (( $cgiparams{'ENABLED'} eq 'on') ||
4705             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4706             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
4707             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td></tr>";
4708         } else {
4709             print "<input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td></tr>";
4710         }
4711     }
4712     print "</form></table>";
4713     &Header::closebox();
4714     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
4715     print <<EOF#'
4716     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
4717     <tr>
4718         <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
4719         <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
4720         <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
4721     </tr>
4722 EOF
4723     ;
4724     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
4725         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
4726         $casubject    =~ /Subject: (.*)[\n]/;
4727         $casubject    = $1;
4728         $casubject    =~ s+/Email+, E+;
4729         $casubject    =~ s/ ST=/ S=/;
4730
4731         print <<END
4732         <tr bgcolor='$color{'color22'}'>
4733         <td class='base'>$Lang::tr{'root certificate'}</td>
4734         <td class='base'>$casubject</td>
4735         <form method='post' name='frmrootcrta'><td width='3%' align='center'>
4736             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
4737             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
4738         </td></form>
4739         <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
4740             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
4741             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
4742         </td></form>
4743         <td width='4%'>&nbsp;</td></tr>
4744 END
4745         ;
4746     } else {
4747         # display rootcert generation buttons
4748         print <<END
4749         <tr bgcolor='$color{'color22'}'>
4750         <td class='base'>$Lang::tr{'root certificate'}:</td>
4751         <td class='base'>$Lang::tr{'not present'}</td>
4752         <td colspan='3'>&nbsp;</td></tr>
4753 END
4754         ;
4755     }
4756
4757     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
4758         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
4759         $hostsubject    =~ /Subject: (.*)[\n]/;
4760         $hostsubject    = $1;
4761         $hostsubject    =~ s+/Email+, E+;
4762         $hostsubject    =~ s/ ST=/ S=/;
4763
4764         print <<END
4765         <tr bgcolor='$color{'color20'}'>
4766         <td class='base'>$Lang::tr{'host certificate'}</td>
4767         <td class='base'>$hostsubject</td>
4768         <form method='post' name='frmhostcrta'><td width='3%' align='center'>
4769             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
4770             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
4771         </td></form>
4772         <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
4773             <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
4774             <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
4775         </td></form>
4776         <td width='4%'>&nbsp;</td></tr>
4777 END
4778         ;
4779     } else {
4780         # Nothing
4781         print <<END
4782         <tr bgcolor='$color{'color20'}'>
4783         <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
4784         <td class='base'>$Lang::tr{'not present'}</td>
4785         </td><td colspan='3'>&nbsp;</td></tr>
4786 END
4787         ;
4788     }
4789
4790     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
4791         print "<tr><td colspan='5' align='center'><form method='post'>";
4792         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
4793         print "</form></td></tr>\n";
4794     }
4795
4796     if (keys %cahash > 0) {
4797         foreach my $key (keys %cahash) {
4798             if (($key + 1) % 2) {
4799                 print "<tr bgcolor='$color{'color20'}'>\n";
4800             } else {
4801                 print "<tr bgcolor='$color{'color22'}'>\n";
4802             }
4803             print "<td class='base'>$cahash{$key}[0]</td>\n";
4804             print "<td class='base'>$cahash{$key}[1]</td>\n";
4805             print <<END
4806             <form method='post' name='cafrm${key}a'><td align='center'>
4807                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
4808                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
4809                 <input type='hidden' name='KEY' value='$key' />
4810             </td></form>
4811             <form method='post' name='cafrm${key}b'><td align='center'>
4812                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
4813                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
4814                 <input type='hidden' name='KEY' value='$key' />
4815             </td></form>
4816             <form method='post' name='cafrm${key}c'><td align='center'>
4817                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
4818                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
4819                 <input type='hidden' name='KEY' value='$key' />
4820             </td></form></tr>
4821 END
4822             ;
4823         }
4824     }
4825
4826     print "</table>";
4827
4828     # If the file contains entries, print Key to action icons
4829     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
4830     print <<END
4831     <table>
4832     <tr>
4833         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4834         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4835         <td class='base'>$Lang::tr{'show certificate'}</td>
4836         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
4837         <td class='base'>$Lang::tr{'download certificate'}</td>
4838     </tr>
4839     </table>
4840 END
4841 ;
4842     }
4843
4844 print <<END
4845 <form method='post' enctype='multipart/form-data'>
4846 <table width='100%' border='0'>
4847 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td><td nowrap='nowrap' width='8%'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' align='left'/></td><td nowrap='nowrap' align='right'><input type='file' name='FH' size='25' /><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /></td></tr>
4848 <tr><td colspan='4'><hr /></td></tr>
4849 <tr align='right'><td colspan='4' align='right' width='80%'><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td></tr>
4850 </table>
4851 END
4852 ;
4853
4854
4855     &Header::closebox();
4856     if ( $srunning eq "yes" ) {
4857         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
4858     }else{
4859         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
4860     }
4861     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
4862
4863 ###
4864 # m.a.d net2net
4865 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
4866 ###
4867
4868     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
4869     print <<END
4870
4871
4872     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
4873 <tr>
4874     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
4875     <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
4876     <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'network'}</b></td>
4877     <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
4878     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
4879     <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
4880 </tr>
4881 END
4882         ;
4883         my $id = 0;
4884         my $gif;
4885          foreach my $key (sort { uc($confighash{$a}[1]) cmp uc($confighash{$b}[1]) } keys %confighash) {
4886         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
4887
4888         if ($id % 2) {
4889             print "<tr bgcolor='$color{'color20'}'>\n";
4890         } else {
4891             print "<tr bgcolor='$color{'color22'}'>\n";
4892         }
4893         print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
4894         print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
4895         #if ($confighash{$key}[4] eq 'cert') {
4896             #print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
4897         #} else {
4898             #print "<td align='left'>&nbsp;</td>";
4899         #}
4900         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
4901         $cavalid    =~ /Not After : (.*)[\n]/;
4902         $cavalid    = $1;
4903         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]="net-2-net";}
4904         if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'host' ){$confighash{$key}[32]="dynamic";}
4905         print "<td align='center'>$confighash{$key}[32]</td>";
4906         print "<td align='center'>$confighash{$key}[25]</td>";
4907
4908         my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
4909
4910         if ($confighash{$key}[0] eq 'off') {
4911          $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
4912         } else {
4913
4914 ###
4915 # m.a.d net2net
4916 ###
4917
4918        if ($confighash{$key}[3] eq 'net') {
4919
4920         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
4921           my @output = "";
4922           my @tustate = "";
4923           my $tport = $confighash{$key}[22];
4924           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
4925           if ($tport ne '') {
4926           $tnet->open('127.0.0.1');
4927           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
4928           @tustate = split(/\,/, $output[1]);
4929 ###
4930 #CONNECTING    -- OpenVPN's initial state.
4931 #WAIT          -- (Client only) Waiting for initial response from server.
4932 #AUTH          -- (Client only) Authenticating with server.
4933 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
4934 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
4935 #ADD_ROUTES    -- Adding routes to system.
4936 #CONNECTED     -- Initialization Sequence Completed.
4937 #RECONNECTING  -- A restart has occurred.
4938 #EXITING       -- A graceful exit is in progress.
4939 ####
4940
4941         if ( $tustate[1] eq 'CONNECTED') {
4942           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></tr></td></table>";
4943                           } else {
4944           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$tustate[1]</font></b></td></tr></table>";
4945            }
4946            }
4947            }
4948         }       else {
4949
4950                 my $cn;
4951             my @match = ();
4952           foreach my $line (@status) {
4953                 chomp($line);
4954                 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
4955                     @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
4956                     if ($match[1] ne "Common Name") {
4957                         $cn = $match[1];
4958                     }
4959                 $cn =~ s/[_]/ /g;
4960                     if ($cn eq "$confighash{$key}[2]") {
4961                         $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
4962                     }
4963    }
4964
4965         }
4966 }
4967 }
4968
4969
4970         my $disable_clientdl = "disabled='disabled'";
4971         if (( $cgiparams{'ENABLED'} eq 'on') ||
4972             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
4973             ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
4974             $disable_clientdl = "";
4975         }
4976         print <<END
4977         <td align='center'>$active</td>
4978
4979         <form method='post' name='frm${key}a'><td align='center'>
4980             <input type='image'  name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
4981             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
4982             <input type='hidden' name='KEY' value='$key' $disable_clientdl />
4983         </td></form>
4984 END
4985         ;
4986         if ($confighash{$key}[4] eq 'cert') {
4987             print <<END
4988             <form method='post' name='frm${key}b'><td align='center'>
4989                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
4990                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
4991                 <input type='hidden' name='KEY' value='$key' />
4992             </td></form>
4993 END
4994         ; } else {
4995             print "<td>&nbsp;</td>";
4996         }
4997         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
4998             print <<END
4999             <form method='post' name='frm${key}c'><td align='center'>
5000                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
5001                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
5002                 <input type='hidden' name='KEY' value='$key' />
5003             </td></form>
5004 END
5005         ; } elsif ($confighash{$key}[4] eq 'cert') {
5006             print <<END
5007             <form method='post' name='frm${key}c'><td align='center'>
5008                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
5009                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
5010                 <input type='hidden' name='KEY' value='$key' />
5011             </td></form>
5012 END
5013         ; } else {
5014             print "<td>&nbsp;</td>";
5015         }
5016         print <<END
5017         <form method='post' name='frm${key}d'><td align='center'>
5018             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
5019             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
5020             <input type='hidden' name='KEY' value='$key' />
5021         </td></form>
5022
5023         <form method='post' name='frm${key}e'><td align='center'>
5024             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
5025             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
5026             <input type='hidden' name='KEY' value='$key' />
5027         </td></form>
5028         <form method='post' name='frm${key}f'><td align='center'>
5029             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
5030             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
5031             <input type='hidden' name='KEY' value='$key' />
5032         </td></form>
5033         </tr>
5034 END
5035         ;
5036         $id++;
5037     }
5038     ;
5039
5040     # If the config file contains entries, print Key to action icons
5041     if ( $id ) {
5042     print <<END
5043     <table border='0'>
5044     <tr>
5045         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
5046         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
5047         <td class='base'>$Lang::tr{'click to disable'}</td>
5048         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
5049         <td class='base'>$Lang::tr{'show certificate'}</td>
5050         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
5051         <td class='base'>$Lang::tr{'edit'}</td>
5052         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
5053         <td class='base'>$Lang::tr{'remove'}</td>
5054     </tr>
5055     <tr>
5056         <td>&nbsp; </td>
5057         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
5058         <td class='base'>$Lang::tr{'click to enable'}</td>
5059         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
5060         <td class='base'>$Lang::tr{'download certificate'}</td>
5061         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
5062         <td class='base'>$Lang::tr{'dl client arch'}</td>
5063     </tr>
5064     </table><hr>
5065 END
5066     ;
5067     }
5068
5069     print <<END
5070     <table width='100%'>
5071     <form method='post'>
5072     <tr><td align='right'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
5073     <input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
5074     </form>
5075     </table>
5076 END
5077     ;
5078     &Header::closebox();
5079 }
5080 &Header::closepage();
5081
5082
5083