Merge remote-tracking branch 'ummeegge/openvpn' into next
[people/teissler/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2014 IPFire Team <info@ipfire.org> #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21 ###
22 ###
23 use CGI;
24 use CGI qw/:standard/;
25 use Net::DNS;
26 use Net::Ping;
27 use Net::Telnet;
28 use File::Copy;
29 use File::Temp qw/ tempfile tempdir /;
30 use strict;
31 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
32 use Sort::Naturally;
33 require '/var/ipfire/general-functions.pl';
34 require "${General::swroot}/lang.pl";
35 require "${General::swroot}/header.pl";
36 require "${General::swroot}/countries.pl";
37
38 # enable only the following on debugging purpose
39 #use warnings;
40 #use CGI::Carp 'fatalsToBrowser';
41 #workaround to suppress a warning when a variable is used only once
42 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
43 undef (@dummy);
44
45 my %color = ();
46 my %mainsettings = ();
47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
49
50 ###
51 ### Initialize variables
52 ###
53 my %ccdconfhash=();
54 my %ccdroutehash=();
55 my %ccdroute2hash=();
56 my %netsettings=();
57 my %cgiparams=();
58 my %vpnsettings=();
59 my %checked=();
60 my %confighash=();
61 my %cahash=();
62 my %selected=();
63 my $warnmessage = '';
64 my $errormessage = '';
65 my %settings=();
66 my $routes_push_file = '';
67 my $confighost="${General::swroot}/fwhosts/customhosts";
68 my $configgrp="${General::swroot}/fwhosts/customgroups";
69 my $customnet="${General::swroot}/fwhosts/customnetworks";
70 my $name;
71 my $col="";
72 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
73 $cgiparams{'ENABLED'} = 'off';
74 $cgiparams{'ENABLED_BLUE'} = 'off';
75 $cgiparams{'ENABLED_ORANGE'} = 'off';
76 $cgiparams{'EDIT_ADVANCED'} = 'off';
77 $cgiparams{'NAT'} = 'off';
78 $cgiparams{'COMPRESSION'} = 'off';
79 $cgiparams{'ONLY_PROPOSED'} = 'off';
80 $cgiparams{'ACTION'} = '';
81 $cgiparams{'CA_NAME'} = '';
82 $cgiparams{'DH_NAME'} = 'dh1024.pem';
83 $cgiparams{'DHLENGHT'} = '';
84 $cgiparams{'DHCP_DOMAIN'} = '';
85 $cgiparams{'DHCP_DNS'} = '';
86 $cgiparams{'DHCP_WINS'} = '';
87 $cgiparams{'ROUTES_PUSH'} = '';
88 $cgiparams{'DCOMPLZO'} = 'off';
89 $cgiparams{'MSSFIX'} = '';
90 $cgiparams{'number'} = '';
91 $cgiparams{'PMTU_DISCOVERY'} = '';
92 $cgiparams{'DCIPHER'} = '';
93 $cgiparams{'DAUTH'} = '';
94 $cgiparams{'TLSAUTH'} = '';
95 $cgiparams{'ENGINES'} = '';
96 $routes_push_file = "${General::swroot}/ovpn/routes_push";
97 unless (-e $routes_push_file) { system("touch $routes_push_file"); }
98 unless (-e "${General::swroot}/ovpn/ccd.conf") { system("touch ${General::swroot}/ovpn/ccd.conf"); }
99 unless (-e "${General::swroot}/ovpn/ccdroute") { system("touch ${General::swroot}/ovpn/ccdroute"); }
100 unless (-e "${General::swroot}/ovpn/ccdroute2") { system("touch ${General::swroot}/ovpn/ccdroute2"); }
101
102 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
103
104 # prepare openvpn config file
105 ###
106 ### Useful functions
107 ###
108 sub haveOrangeNet
109 {
110 if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
111 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
112 return 0;
113 }
114
115 sub haveBlueNet
116 {
117 if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
118 if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
119 return 0;
120 }
121
122 sub sizeformat{
123 my $bytesize = shift;
124 my $i = 0;
125
126 while(abs($bytesize) >= 1024){
127 $bytesize=$bytesize/1024;
128 $i++;
129 last if($i==6);
130 }
131
132 my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
133 my $newsize=(int($bytesize*100 +0.5))/100;
134 return("$newsize $units[$i]");
135 }
136
137 sub cleanssldatabase
138 {
139 if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
140 print FILE "01";
141 close FILE;
142 }
143 if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
144 print FILE "";
145 close FILE;
146 }
147 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
148 unlink ("${General::swroot}/ovpn/certs/serial.old");
149 unlink ("${General::swroot}/ovpn/certs/01.pem");
150 }
151
152 sub newcleanssldatabase
153 {
154 if (! -s "${General::swroot}/ovpn/certs/serial" ) {
155 open(FILE, ">${General::swroot}(ovpn/certs/serial");
156 print FILE "01";
157 close FILE;
158 }
159 if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
160 system ("touch ${General::swroot}/ovpn/certs/index.txt");
161 }
162 unlink ("${General::swroot}/ovpn/certs/index.txt.old");
163 unlink ("${General::swroot}/ovpn/certs/serial.old");
164 }
165
166 sub deletebackupcert
167 {
168 if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
169 my $hexvalue = <FILE>;
170 chomp $hexvalue;
171 close FILE;
172 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
173 }
174 }
175 sub checkportfw {
176 my $DPORT = shift;
177 my $DPROT = shift;
178 my %natconfig =();
179 my $confignat = "${General::swroot}/firewall/config";
180 $DPROT= uc ($DPROT);
181 &General::readhasharray($confignat, \%natconfig);
182 foreach my $key (sort keys %natconfig){
183 my @portarray = split (/\|/,$natconfig{$key}[30]);
184 foreach my $value (@portarray){
185 if ($value =~ /:/i){
186 my ($a,$b) = split (":",$value);
187 if ($DPROT eq $natconfig{$key}[12] && $DPORT gt $a && $DPORT lt $b){
188 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
189 }
190 }else{
191 if ($DPROT eq $natconfig{$key}[12] && $DPORT eq $value){
192 $errormessage= "$Lang::tr{'source port in use'} $DPORT";
193 }
194 }
195 }
196 }
197 return;
198 }
199
200 sub checkportoverlap
201 {
202 my $portrange1 = $_[0]; # New port range
203 my $portrange2 = $_[1]; # existing port range
204 my @tempr1 = split(/\:/,$portrange1);
205 my @tempr2 = split(/\:/,$portrange2);
206
207 unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
208 unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
209
210 unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
211 unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
212
213 return 1; # Everything checks out!
214 }
215
216 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
217 sub checkportinc
218 {
219 my $port1 = $_[0]; # Port
220 my $portrange2 = $_[1]; # Port range
221 my @tempr1 = split(/\:/,$portrange2);
222
223 if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
224 return 1;
225 } else {
226 return 0;
227 }
228 }
229
230 # Darren Critchley - certain ports are reserved for IPFire
231 # TCP 67,68,81,222,444
232 # UDP 67,68
233 # Params passed in -> port, rangeyn, protocol
234 sub disallowreserved
235 {
236 # port 67 and 68 same for tcp and udp, don't bother putting in an array
237 my $msg = "";
238 my @tcp_reserved = (81,222,444);
239 my $prt = $_[0]; # the port or range
240 my $ryn = $_[1]; # tells us whether or not it is a port range
241 my $prot = $_[2]; # protocol
242 my $srcdst = $_[3]; # source or destination
243 if ($ryn) { # disect port range
244 if ($srcdst eq "src") {
245 $msg = "$Lang::tr{'rsvd src port overlap'}";
246 } else {
247 $msg = "$Lang::tr{'rsvd dst port overlap'}";
248 }
249 my @tmprng = split(/\:/,$prt);
250 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
251 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
252 if ($prot eq "tcp") {
253 foreach my $prange (@tcp_reserved) {
254 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
255 }
256 }
257 } else {
258 if ($srcdst eq "src") {
259 $msg = "$Lang::tr{'reserved src port'}";
260 } else {
261 $msg = "$Lang::tr{'reserved dst port'}";
262 }
263 if ($prt == 67) { $errormessage="$msg 67"; return; }
264 if ($prt == 68) { $errormessage="$msg 68"; return; }
265 if ($prot eq "tcp") {
266 foreach my $prange (@tcp_reserved) {
267 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
268 }
269 }
270 }
271 return;
272 }
273
274
275 sub writeserverconf {
276 my %sovpnsettings = ();
277 my @temp = ();
278 &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
279 &read_routepushfile;
280
281 open(CONF, ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
282 flock CONF, 2;
283 print CONF "#OpenVPN Server conf\n";
284 print CONF "\n";
285 print CONF "daemon openvpnserver\n";
286 print CONF "writepid /var/run/openvpn.pid\n";
287 print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
288 print CONF ";local $sovpnsettings{'VPN_IP'}\n";
289 print CONF "dev $sovpnsettings{'DDEVICE'}\n";
290 print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
291 print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
292 print CONF "script-security 3 system\n";
293 print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
294 print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
295 print CONF "tls-server\n";
296 print CONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
297 print CONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
298 print CONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
299 print CONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
300 my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
301 print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
302 #print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
303
304 # Check if we are using mssfix, fragment or mtu-disc and set the corretct mtu of 1500.
305 # If we doesn't use one of them, we can use the configured mtu value.
306 if ($sovpnsettings{'MSSFIX'} eq 'on')
307 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
308 elsif ($sovpnsettings{'FRAGMENT'} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp')
309 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
310 elsif (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
311 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
312 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
313 { print CONF "$sovpnsettings{'DDEVICE'}-mtu 1500\n"; }
314 else
315 { print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n"; }
316
317 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
318 @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
319 foreach (@temp)
320 {
321 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
322 print CONF "push \"route " . $tempovpnsubnet[0]. " " . $tempovpnsubnet[1] . "\"\n";
323 }
324 }
325 # a.marx ccd
326 my %ccdconfhash=();
327 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
328 foreach my $key (keys %ccdconfhash) {
329 my $a=$ccdconfhash{$key}[1];
330 my ($b,$c) = split (/\//, $a);
331 print CONF "route $b ".&General::cidrtosub($c)."\n";
332 }
333 my %ccdroutehash=();
334 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
335 foreach my $key (keys %ccdroutehash) {
336 foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){
337 my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]);
338 print CONF "route $a $b\n";
339 }
340 }
341 # ccd end
342
343 if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
344 print CONF "client-to-client\n";
345 }
346 if ($sovpnsettings{MSSFIX} eq 'on') {
347 print CONF "mssfix\n";
348 }
349 if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
350 print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
351 }
352
353 # Check if a valid operating mode has been choosen and use it.
354 if (($sovpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
355 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
356 ($sovpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
357 print CONF "mtu-disc $sovpnsettings{'PMTU_DISCOVERY'}\n";
358 }
359
360 if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
361 print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
362 }
363 print CONF "status-version 1\n";
364 print CONF "status /var/log/ovpnserver.log 30\n";
365 print CONF "cipher $sovpnsettings{DCIPHER}\n";
366 if ($sovpnsettings{'DAUTH'} eq '') {
367 print CONF "";
368 } else {
369 print CONF "auth $sovpnsettings{'DAUTH'}\n";
370 }
371 if ($sovpnsettings{'TLSAUTH'} eq 'on') {
372 print CONF "tls-auth ${General::swroot}/ovpn/ca/ta.key 0\n";
373 }
374 if ($sovpnsettings{ENGINES} eq 'disabled') {
375 print CONF "";
376 } else {
377 print CONF "engine $sovpnsettings{ENGINES}\n";
378 }
379 if ($sovpnsettings{DCOMPLZO} eq 'on') {
380 print CONF "comp-lzo\n";
381 }
382 if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
383 print CONF "push \"redirect-gateway def1\"\n";
384 }
385 if ($sovpnsettings{DHCP_DOMAIN} ne '') {
386 print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
387 }
388
389 if ($sovpnsettings{DHCP_DNS} ne '') {
390 print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
391 }
392
393 if ($sovpnsettings{DHCP_WINS} ne '') {
394 print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
395 }
396
397 if ($sovpnsettings{DHCP_WINS} eq '') {
398 print CONF "max-clients 100\n";
399 }
400 if ($sovpnsettings{DHCP_WINS} ne '') {
401 print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
402 }
403 print CONF "tls-verify /usr/lib/openvpn/verify\n";
404 print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
405 print CONF "user nobody\n";
406 print CONF "group nobody\n";
407 print CONF "persist-key\n";
408 print CONF "persist-tun\n";
409 if ($sovpnsettings{LOG_VERB} ne '') {
410 print CONF "verb $sovpnsettings{LOG_VERB}\n";
411 } else {
412 print CONF "verb 3\n";
413 }
414 print CONF "\n";
415
416 close(CONF);
417 }
418
419 sub emptyserverlog{
420 if (open(FILE, ">/var/log/ovpnserver.log")) {
421 flock FILE, 2;
422 print FILE "";
423 close FILE;
424 }
425
426 }
427
428 sub delccdnet
429 {
430 my %ccdconfhash = ();
431 my %ccdhash = ();
432 my $ccdnetname=$_[0];
433 if (-f "${General::swroot}/ovpn/ovpnconfig"){
434 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
435 foreach my $key (keys %ccdhash) {
436 if ($ccdhash{$key}[32] eq $ccdnetname) {
437 $errormessage=$Lang::tr{'ccd err hostinnet'};
438 return;
439 }
440 }
441 }
442 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
443 foreach my $key (keys %ccdconfhash) {
444 if ($ccdconfhash{$key}[0] eq $ccdnetname){
445 delete $ccdconfhash{$key};
446 }
447 }
448 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
449
450 &writeserverconf;
451 return 0;
452 }
453
454 sub addccdnet
455 {
456 my %ccdconfhash=();
457 my @ccdconf=();
458 my $ccdname=$_[0];
459 my $ccdnet=$_[1];
460 my $subcidr;
461 my @ip2=();
462 my $checkup;
463 my $ccdip;
464 my $baseaddress;
465
466
467 #check name
468 if ($ccdname eq '')
469 {
470 $errormessage=$errormessage.$Lang::tr{'ccd err name'}."<br>";
471 return
472 }
473
474 if(!&General::validhostname($ccdname))
475 {
476 $errormessage=$Lang::tr{'ccd err invalidname'};
477 return;
478 }
479
480 ($ccdip,$subcidr) = split (/\//,$ccdnet);
481 $subcidr=&General::iporsubtocidr($subcidr);
482 #check subnet
483 if ($subcidr > 30)
484 {
485 $errormessage=$Lang::tr{'ccd err invalidnet'};
486 return;
487 }
488 #check ip
489 if (!&General::validipandmask($ccdnet)){
490 $errormessage=$Lang::tr{'ccd err invalidnet'};
491 return;
492 }
493
494 $errormessage=&General::checksubnets($ccdname,$ccdnet);
495
496
497 if (!$errormessage) {
498 my %ccdconfhash=();
499 $baseaddress=&General::getnetworkip($ccdip,$subcidr);
500 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
501 my $key = &General::findhasharraykey (\%ccdconfhash);
502 foreach my $i (0 .. 1) { $ccdconfhash{$key}[$i] = "";}
503 $ccdconfhash{$key}[0] = $ccdname;
504 $ccdconfhash{$key}[1] = $baseaddress."/".$subcidr;
505 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
506 &writeserverconf;
507 $cgiparams{'ccdname'}='';
508 $cgiparams{'ccdsubnet'}='';
509 return 1;
510 }
511 }
512
513 sub modccdnet
514 {
515
516 my $newname=$_[0];
517 my $oldname=$_[1];
518 my %ccdconfhash=();
519 my %ccdhash=();
520 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
521 foreach my $key (keys %ccdconfhash) {
522 if ($ccdconfhash{$key}[0] eq $oldname) {
523 foreach my $key1 (keys %ccdconfhash) {
524 if ($ccdconfhash{$key1}[0] eq $newname){
525 $errormessage=$errormessage.$Lang::tr{'ccd err netadrexist'};
526 return;
527 }else{
528 $ccdconfhash{$key}[0]= $newname;
529 &General::writehasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
530 last;
531 }
532 }
533 }
534 }
535
536 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
537 foreach my $key (keys %ccdhash) {
538 if ($ccdhash{$key}[32] eq $oldname) {
539 $ccdhash{$key}[32]=$newname;
540 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
541 last;
542 }
543 }
544
545 return 0;
546 }
547 sub ccdmaxclients
548 {
549 my $ccdnetwork=$_[0];
550 my @octets=();
551 my @subnet=();
552 @octets=split("\/",$ccdnetwork);
553 @subnet= split /\./, &General::cidrtosub($octets[1]);
554 my ($a,$b,$c,$d,$e);
555 $a=256-$subnet[0];
556 $b=256-$subnet[1];
557 $c=256-$subnet[2];
558 $d=256-$subnet[3];
559 $e=($a*$b*$c*$d)/4;
560 return $e-1;
561 }
562
563 sub getccdadresses
564 {
565 my $ipin=$_[0];
566 my ($ip1,$ip2,$ip3,$ip4)=split /\./, $ipin;
567 my $cidr=$_[1];
568 chomp($cidr);
569 my $count=$_[2];
570 my $hasip=$_[3];
571 chomp($hasip);
572 my @iprange=();
573 my %ccdhash=();
574 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
575 $iprange[0]=$ip1.".".$ip2.".".$ip3.".".2;
576 for (my $i=1;$i<=$count;$i++) {
577 my $tmpip=$iprange[$i-1];
578 my $stepper=$i*4;
579 $iprange[$i]= &General::getnextip($tmpip,4);
580 }
581 my $r=0;
582 foreach my $key (keys %ccdhash) {
583 $r=0;
584 foreach my $tmp (@iprange){
585 my ($net,$sub) = split (/\//,$ccdhash{$key}[33]);
586 if ($net eq $tmp) {
587 if ( $hasip ne $ccdhash{$key}[33] ){
588 splice (@iprange,$r,1);
589 }
590 }
591 $r++;
592 }
593 }
594 return @iprange;
595 }
596
597 sub fillselectbox
598 {
599 my $boxname=$_[1];
600 my ($ccdip,$subcidr) = split("/",$_[0]);
601 my $tz=$_[2];
602 my @allccdips=&getccdadresses($ccdip,$subcidr,&ccdmaxclients($ccdip."/".$subcidr),$tz);
603 print"<select name='$boxname' STYLE='font-family : arial; font-size : 9pt; width:130px;' >";
604 foreach (@allccdips) {
605 my $ip=$_."/30";
606 chomp($ip);
607 print "<option value='$ip' ";
608 if ( $ip eq $cgiparams{$boxname} ){
609 print"selected";
610 }
611 print ">$ip</option>";
612 }
613 print "</select>";
614 }
615
616 sub hostsinnet
617 {
618 my $name=$_[0];
619 my %ccdhash=();
620 my $i=0;
621 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%ccdhash);
622 foreach my $key (keys %ccdhash) {
623 if ($ccdhash{$key}[32] eq $name){ $i++;}
624 }
625 return $i;
626 }
627
628 sub check_routes_push
629 {
630 my $val=$_[0];
631 my ($ip,$cidr) = split (/\//, $val);
632 ##check for existing routes in routes_push
633 if (-e "${General::swroot}/ovpn/routes_push") {
634 open(FILE,"${General::swroot}/ovpn/routes_push");
635 while (<FILE>) {
636 $_=~s/\s*$//g;
637
638 my ($ip2,$cidr2) = split (/\//,"$_");
639 my $val2=$ip2."/".&General::iporsubtodec($cidr2);
640
641 if($val eq $val2){
642 return 0;
643 }
644 #subnetcheck
645 if (&General::IpInSubnet ($ip,$ip2,&General::iporsubtodec($cidr2))){
646 return 0;
647 }
648 };
649 close(FILE);
650 }
651 return 1;
652 }
653
654 sub check_ccdroute
655 {
656 my %ccdroutehash=();
657 my $val=$_[0];
658 my ($ip,$cidr) = split (/\//, $val);
659 #check for existing routes in ccdroute
660 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
661 foreach my $key (keys %ccdroutehash) {
662 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
663 if (&General::iporsubtodec($val) eq $ccdroutehash{$key}[$i] && $ccdroutehash{$key}[0] ne $cgiparams{'NAME'}){
664 return 0;
665 }
666 my ($ip2,$cidr2) = split (/\//,$ccdroutehash{$key}[$i]);
667 #subnetcheck
668 if (&General::IpInSubnet ($ip,$ip2,$cidr2)&& $ccdroutehash{$key}[0] ne $cgiparams{'NAME'} ){
669 return 0;
670 }
671 }
672 }
673 return 1;
674 }
675 sub check_ccdconf
676 {
677 my %ccdconfhash=();
678 my $val=$_[0];
679 my ($ip,$cidr) = split (/\//, $val);
680 #check for existing routes in ccdroute
681 &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash);
682 foreach my $key (keys %ccdconfhash) {
683 if (&General::iporsubtocidr($val) eq $ccdconfhash{$key}[1]){
684 return 0;
685 }
686 my ($ip2,$cidr2) = split (/\//,$ccdconfhash{$key}[1]);
687 #subnetcheck
688 if (&General::IpInSubnet ($ip,$ip2,&General::cidrtosub($cidr2))){
689 return 0;
690 }
691
692 }
693 return 1;
694 }
695
696 ###
697 # m.a.d net2net
698 ###
699
700 sub validdotmask
701 {
702 my $ipdotmask = $_[0];
703 if (&General::validip($ipdotmask)) { return 0; }
704 if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) { }
705 my $mask = $2;
706 if (($mask =~ /\./ )) { return 0; }
707 return 1;
708 }
709
710 # -------------------------------------------------------------------
711
712 sub write_routepushfile
713 {
714 open(FILE, ">$routes_push_file");
715 flock(FILE, 2);
716 if ($vpnsettings{'ROUTES_PUSH'} ne '') {
717 print FILE $vpnsettings{'ROUTES_PUSH'};
718 }
719 close(FILE);
720 }
721
722 sub read_routepushfile
723 {
724 if (-e "$routes_push_file") {
725 open(FILE,"$routes_push_file");
726 delete $vpnsettings{'ROUTES_PUSH'};
727 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
728 close(FILE);
729 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
730
731 }
732 }
733
734
735 #hier die refresh page
736 if ( -e "${General::swroot}/ovpn/gencanow") {
737 my $refresh = '';
738 $refresh = "<meta http-equiv='refresh' content='15;' />";
739 &Header::showhttpheaders();
740 &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
741 &Header::openbigbox('100%', 'center');
742 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
743 print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
744 print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
745 &Header::closebox();
746 &Header::closebigbox();
747 &Header::closepage();
748 exit (0);
749 }
750 ##hier die refresh page
751
752
753 ###
754 ### OpenVPN Server Control
755 ###
756 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
757 $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
758 $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
759 #start openvpn server
760 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
761 &emptyserverlog();
762 system('/usr/local/bin/openvpnctrl', '-s');
763 }
764 #stop openvpn server
765 if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
766 system('/usr/local/bin/openvpnctrl', '-k');
767 &emptyserverlog();
768 }
769 # #restart openvpn server
770 # if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
771 #workarund, till SIGHUP also works when running as nobody
772 # system('/usr/local/bin/openvpnctrl', '-r');
773 # &emptyserverlog();
774 # }
775 }
776
777 ###
778 ### Save Advanced options
779 ###
780
781 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
782 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
783 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
784 #DAN this value has to leave.
785 #new settings for daemon
786 $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
787 $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
788 $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
789 $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
790 $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
791 $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
792 $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
793 $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
794 $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
795 $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
796 $vpnsettings{'PMTU_DISCOVERY'} = $cgiparams{'PMTU_DISCOVERY'};
797 $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
798 $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
799 $vpnsettings{'ENGINES'} = $cgiparams{'ENGINES'};
800 my @temp=();
801
802 if ($cgiparams{'FRAGMENT'} eq '') {
803 delete $vpnsettings{'FRAGMENT'};
804 } else {
805 if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
806 $errormessage = "Incorrect value, please insert only numbers.";
807 goto ADV_ERROR;
808 } else {
809 $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
810 }
811 }
812
813 if ($cgiparams{'MSSFIX'} ne 'on') {
814 delete $vpnsettings{'MSSFIX'};
815 } else {
816 $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
817 }
818
819 # Create ta.key for tls-auth if not presant
820 if ($cgiparams{'TLSAUTH'} eq 'on') {
821 if ( ! -e "${General::swroot}/ovpn/ca/ta.key") {
822 system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/ca/ta.key")
823 }
824 }
825
826 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
827 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
828 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
829
830 if (($cgiparams{'MSSFIX'} eq 'on') || ($cgiparams{'FRAGMENT'} ne '')) {
831 $errormessage = $Lang::tr{'ovpn mtu-disc with mssfix or fragment'};
832 goto ADV_ERROR;
833 }
834 }
835
836 if ($cgiparams{'DHCP_DOMAIN'} ne ''){
837 unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
838 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
839 goto ADV_ERROR;
840 }
841 }
842 if ($cgiparams{'DHCP_DNS'} ne ''){
843 unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
844 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
845 goto ADV_ERROR;
846 }
847 }
848 if ($cgiparams{'DHCP_WINS'} ne ''){
849 unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
850 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
851 goto ADV_ERROR;
852 }
853 }
854 if ($cgiparams{'ROUTES_PUSH'} ne ''){
855 @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
856 undef $vpnsettings{'ROUTES_PUSH'};
857
858 foreach my $tmpip (@temp)
859 {
860 s/^\s+//g; s/\s+$//g;
861
862 if ($tmpip)
863 {
864 $tmpip=~s/\s*$//g;
865 unless (&General::validipandmask($tmpip)) {
866 $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
867 goto ADV_ERROR;
868 }
869 my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
870
871 if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
872 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
873 goto ADV_ERROR;
874 }
875 # a.marx ccd
876 my %ccdroutehash=();
877 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
878 foreach my $key (keys %ccdroutehash) {
879 foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
880 if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
881 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
882 goto ADV_ERROR;
883 }
884 my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
885 if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
886 $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
887 goto ADV_ERROR;
888 }
889 }
890 }
891
892 # ccd end
893
894 $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
895 }
896 }
897 &write_routepushfile;
898 undef $vpnsettings{'ROUTES_PUSH'};
899 }
900 else {
901 undef $vpnsettings{'ROUTES_PUSH'};
902 &write_routepushfile;
903 }
904 if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
905 $errormessage = $Lang::tr{'invalid input for max clients'};
906 goto ADV_ERROR;
907 }
908 if ($cgiparams{'KEEPALIVE_1'} ne '') {
909 if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
910 $errormessage = $Lang::tr{'invalid input for keepalive 1'};
911 goto ADV_ERROR;
912 }
913 }
914 if ($cgiparams{'KEEPALIVE_2'} ne ''){
915 if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
916 $errormessage = $Lang::tr{'invalid input for keepalive 2'};
917 goto ADV_ERROR;
918 }
919 }
920 if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
921 $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
922 goto ADV_ERROR;
923 }
924
925 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
926 &writeserverconf();#hier ok
927 }
928
929 ###
930 # m.a.d net2net
931 ###
932
933 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
934 {
935
936 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
937 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
938 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
939 my $tunmtu = '';
940
941 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
942 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
943
944 open(SERVERCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
945
946 flock SERVERCONF, 2;
947 print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
948 print SERVERCONF "\n";
949 print SERVERCONF "# User Security\n";
950 print SERVERCONF "user nobody\n";
951 print SERVERCONF "group nobody\n";
952 print SERVERCONF "persist-tun\n";
953 print SERVERCONF "persist-key\n";
954 print SERVERCONF "script-security 2\n";
955 print SERVERCONF "# IP/DNS for remote Server Gateway\n";
956
957 if ($cgiparams{'REMOTE'} ne '') {
958 print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
959 }
960
961 print SERVERCONF "float\n";
962 print SERVERCONF "# IP adresses of the VPN Subnet\n";
963 print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
964 print SERVERCONF "# Client Gateway Network\n";
965 print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
966 print SERVERCONF "# tun Device\n";
967 print SERVERCONF "dev tun\n";
968 print SERVERCONF "# Port and Protokol\n";
969 print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
970
971 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
972 print SERVERCONF "proto tcp-server\n";
973 print SERVERCONF "# Packet size\n";
974 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
975 print SERVERCONF "tun-mtu $tunmtu\n";
976 }
977
978 if ($cgiparams{'PROTOCOL'} eq 'udp') {
979 print SERVERCONF "proto udp\n";
980 print SERVERCONF "# Paketsize\n";
981 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
982 print SERVERCONF "tun-mtu $tunmtu\n";
983 if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
984 if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
985 }
986
987 # Check if a valid operating mode has been choosen and use it.
988 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
989 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
990 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
991 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
992 if($cgiparams{'MTU'} eq '1500') {
993 print SERVERCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
994 }
995 }
996 }
997 print SERVERCONF "# Auth. Server\n";
998 print SERVERCONF "tls-server\n";
999 print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
1000 print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
1001 print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
1002 print SERVERCONF "dh ${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}\n";
1003 print SERVERCONF "# Cipher\n";
1004 print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n";
1005 if ($cgiparams{'DAUTH'} eq '') {
1006 print SERVERCONF "auth SHA1\n";
1007 } else {
1008 print SERVERCONF "# HMAC algorithm\n";
1009 print SERVERCONF "auth $cgiparams{'DAUTH'}\n";
1010 }
1011 if ($cgiparams{'ENGINES'} eq 'disabled') {
1012 print SERVERCONF "";
1013 } else {
1014 print SERVERCONF "# Crypto engine\n";
1015 print SERVERCONF "engine $cgiparams{'ENGINES'}\n";
1016 }
1017 if ($cgiparams{'COMPLZO'} eq 'on') {
1018 print SERVERCONF "# Enable Compression\n";
1019 print SERVERCONF "comp-lzo\r\n";
1020 }
1021 print SERVERCONF "# Debug Level\n";
1022 print SERVERCONF "verb 3\n";
1023 print SERVERCONF "# Tunnel check\n";
1024 print SERVERCONF "keepalive 10 60\n";
1025 print SERVERCONF "# Start as daemon\n";
1026 print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
1027 print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1028 print SERVERCONF "# Activate Management Interface and Port\n";
1029 if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1030 else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1031 close(SERVERCONF);
1032
1033 }
1034
1035 ###
1036 # m.a.d net2net
1037 ###
1038
1039 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
1040 {
1041
1042 my @ovsubnettemp = split(/\./,$cgiparams{'OVPN_SUBNET'});
1043 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1044 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
1045 my $tunmtu = '';
1046
1047 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
1048 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
1049
1050 open(CLIENTCONF, ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
1051
1052 flock CLIENTCONF, 2;
1053 print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
1054 print CLIENTCONF "#\n";
1055 print CLIENTCONF "# User Security\n";
1056 print CLIENTCONF "user nobody\n";
1057 print CLIENTCONF "group nobody\n";
1058 print CLIENTCONF "persist-tun\n";
1059 print CLIENTCONF "persist-key\n";
1060 print CLIENTCONF "script-security 2\n";
1061 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1062 print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
1063 print CLIENTCONF "float\n";
1064 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1065 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1066 print CLIENTCONF "# Server Gateway Network\n";
1067 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1068 print CLIENTCONF "# tun Device\n";
1069 print CLIENTCONF "dev tun\n";
1070 print CLIENTCONF "# Port and Protokol\n";
1071 print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
1072
1073 if ($cgiparams{'PROTOCOL'} eq 'tcp') {
1074 print CLIENTCONF "proto tcp-client\n";
1075 print CLIENTCONF "# Packet size\n";
1076 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
1077 print CLIENTCONF "tun-mtu $tunmtu\n";
1078 }
1079
1080 if ($cgiparams{'PROTOCOL'} eq 'udp') {
1081 print CLIENTCONF "proto udp\n";
1082 print CLIENTCONF "# Paketsize\n";
1083 if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
1084 print CLIENTCONF "tun-mtu $tunmtu\n";
1085 if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
1086 if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
1087 }
1088
1089 # Check if a valid operating mode has been choosen and use it.
1090 if (($cgiparams{'PMTU_DISCOVERY'} eq 'yes') ||
1091 ($cgiparams{'PMTU_DISCOVERY'} eq 'maybe') ||
1092 ($cgiparams{'PMTU_DISCOVERY'} eq 'no' )) {
1093 if(($cgiparams{'MSSFIX'} ne 'on') || ($cgiparams{'FRAGMENT'} eq '')) {
1094 if ($cgiparams{'MTU'} eq '1500') {
1095 print CLIENTCONF "mtu-disc $cgiparams{'PMTU_DISCOVERY'}\n";
1096 }
1097 }
1098 }
1099
1100 print CLIENTCONF "ns-cert-type server\n";
1101 print CLIENTCONF "# Auth. Client\n";
1102 print CLIENTCONF "tls-client\n";
1103 print CLIENTCONF "# Cipher\n";
1104 print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n";
1105 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
1106 if ($cgiparams{'DAUTH'} eq '') {
1107 print CLIENTCONF "auth SHA1\n";
1108 } else {
1109 print CLIENTCONF "# HMAC algorithm\n";
1110 print CLIENTCONF "auth $cgiparams{'DAUTH'}\n";
1111 }
1112 if ($cgiparams{'ENGINES'} eq 'disabled') {
1113 print CLIENTCONF "";
1114 } else {
1115 print CLIENTCONF "# Crypto engine\n";
1116 print CLIENTCONF "engine $cgiparams{'ENGINES'}\n";
1117 }
1118 if ($cgiparams{'COMPLZO'} eq 'on') {
1119 print CLIENTCONF "# Enable Compression\n";
1120 print CLIENTCONF "comp-lzo\r\n";
1121 }
1122 print CLIENTCONF "# Debug Level\n";
1123 print CLIENTCONF "verb 3\n";
1124 print CLIENTCONF "# Tunnel check\n";
1125 print CLIENTCONF "keepalive 10 60\n";
1126 print CLIENTCONF "# Start as daemon\n";
1127 print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
1128 print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
1129 print CLIENTCONF "# Activate Management Interface and Port\n";
1130 if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
1131 else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
1132 close(CLIENTCONF);
1133
1134 }
1135
1136 ###
1137 ### Save main settings
1138 ###
1139
1140
1141 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
1142 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1143 #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
1144 #DAN this value has to leave.
1145 if ($cgiparams{'ENABLED'} eq 'on'){
1146 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
1147 $errormessage = $Lang::tr{'invalid input for hostname'};
1148 goto SETTINGS_ERROR;
1149 }
1150 }
1151 if ($errormessage) { goto SETTINGS_ERROR; }
1152
1153 if ($cgiparams{'ENABLED'} eq 'on'){
1154 &checkportfw($cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'});
1155 }
1156 if ($errormessage) { goto SETTINGS_ERROR; }
1157
1158 if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
1159 $errormessage = $Lang::tr{'ovpn subnet is invalid'};
1160 goto SETTINGS_ERROR;
1161 }
1162 my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
1163
1164 if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
1165 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1166 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
1167 goto SETTINGS_ERROR;
1168 }
1169
1170 if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
1171 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1172 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
1173 goto SETTINGS_ERROR;
1174 }
1175
1176 if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
1177 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1178 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
1179 goto SETTINGS_ERROR;
1180 }
1181
1182 if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
1183 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1184 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
1185 goto SETTINGS_ERROR;
1186 }
1187 open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
1188 while (<ALIASES>)
1189 {
1190 chomp($_);
1191 my @tempalias = split(/\,/,$_);
1192 if ($tempalias[1] eq 'on') {
1193 if (&General::IpInSubnet ($tempalias[0] ,
1194 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
1195 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
1196 }
1197 }
1198 }
1199 close(ALIASES);
1200 if ($errormessage ne ''){
1201 goto SETTINGS_ERROR;
1202 }
1203 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1204 $errormessage = $Lang::tr{'invalid input'};
1205 goto SETTINGS_ERROR;
1206 }
1207 if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
1208 $errormessage = $Lang::tr{'invalid mtu input'};
1209 goto SETTINGS_ERROR;
1210 }
1211
1212 unless (&General::validport($cgiparams{'DDEST_PORT'})) {
1213 $errormessage = $Lang::tr{'invalid port'};
1214 goto SETTINGS_ERROR;
1215 }
1216
1217 $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
1218 $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
1219 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
1220 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
1221 #new settings for daemon
1222 $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
1223 $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
1224 $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
1225 $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
1226 $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
1227 $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
1228 $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
1229 #wrtie enable
1230
1231 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
1232 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
1233 if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
1234 #new settings for daemon
1235 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1236 &writeserverconf();#hier ok
1237 SETTINGS_ERROR:
1238 ###
1239 ### Reset all step 2
1240 ###
1241 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
1242 my $file = '';
1243 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1244
1245 foreach my $key (keys %confighash) {
1246 if ($confighash{$key}[4] eq 'cert') {
1247 delete $confighash{$cgiparams{'$key'}};
1248 }
1249 }
1250 while ($file = glob("${General::swroot}/ovpn/ca/*")) {
1251 unlink $file;
1252 }
1253 while ($file = glob("${General::swroot}/ovpn/certs/*")) {
1254 unlink $file;
1255 }
1256 while ($file = glob("${General::swroot}/ovpn/crls/*")) {
1257 unlink $file;
1258 }
1259 &cleanssldatabase();
1260 if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
1261 print FILE "";
1262 close FILE;
1263 }
1264 if (open(FILE, ">${General::swroot}/ovpn/ccdroute")) {
1265 print FILE "";
1266 close FILE;
1267 }
1268 if (open(FILE, ">${General::swroot}/ovpn/ccdroute2")) {
1269 print FILE "";
1270 close FILE;
1271 }
1272 while ($file = glob("${General::swroot}/ovpn/ccd/*")) {
1273 unlink $file
1274 }
1275 if (open(FILE, ">${General::swroot}/ovpn/ovpn-leases.db")) {
1276 print FILE "";
1277 close FILE;
1278 }
1279 if (open(FILE, ">${General::swroot}/ovpn/ovpnconfig")) {
1280 print FILE "";
1281 close FILE;
1282 }
1283 while ($file = glob("${General::swroot}/ovpn/n2nconf/*")) {
1284 system ("rm -rf $file");
1285 }
1286
1287 #&writeserverconf();
1288 ###
1289 ### Reset all step 1
1290 ###
1291 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
1292 &Header::showhttpheaders();
1293 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1294 &Header::openbigbox('100%', 'left', '', '');
1295 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
1296 print <<END;
1297 <form method='post'>
1298 <table width='100%'>
1299 <tr>
1300 <td align='center'>
1301 <input type='hidden' name='AREUSURE' value='yes' />
1302 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1303 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1304 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
1305 </tr>
1306 <tr>
1307 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
1308 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
1309 </tr>
1310 </table>
1311 </form>
1312 END
1313 ;
1314 &Header::closebox();
1315 &Header::closebigbox();
1316 &Header::closepage();
1317 exit (0);
1318
1319 ###
1320 ### Generate DH key step 2
1321 ###
1322 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'} && $cgiparams{'AREUSURE'} eq 'yes') {
1323 # Delete if old key exists
1324 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1325 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1326 }
1327 # Create Diffie Hellmann Parameter
1328 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1329 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1330 if ($?) {
1331 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1332 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1333 }
1334
1335 ###
1336 ### Generate DH key step 1
1337 ###
1338 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate dh key'}) {
1339 &Header::showhttpheaders();
1340 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1341 &Header::openbigbox('100%', 'LEFT', '', '');
1342 &Header::openbox('100%', 'LEFT', "$Lang::tr{'gen dh'}:");
1343 print <<END;
1344 <table width='100%'>
1345 <tr>
1346 <td width='15%'> </td> <td width='15%'></td> <td width='65%'></td>
1347 </tr>
1348 <tr>
1349 <td class='base'>$Lang::tr{'ovpn dh'}:</td>
1350 <td align='center'>
1351 <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1352 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1353 <select name='DHLENGHT'>
1354 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
1355 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
1356 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
1357 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
1358 </select>
1359 </td>
1360 </tr>
1361 <tr><td colspan='4'><br></td></tr>
1362 </table>
1363 <table width='100%'>
1364 <tr>
1365 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'dh key warn'}
1366 </tr>
1367 <tr>
1368 <td class='base'>$Lang::tr{'dh key warn1'}</td>
1369 </tr>
1370 <tr><td colspan='2'><br></td></tr>
1371 <tr>
1372 <td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'generate dh key'}' /></td>
1373 </form>
1374 </tr>
1375 </table>
1376
1377 END
1378 ;
1379 &Header::closebox();
1380 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1381 &Header::closebigbox();
1382 &Header::closepage();
1383 exit (0);
1384
1385 ###
1386 ### Upload DH key
1387 ###
1388 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload dh key'}) {
1389 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1390 $errormessage = $Lang::tr{'there was no file upload'};
1391 goto UPLOADCA_ERROR;
1392 }
1393 # Move uploaded dh key to a temporary file
1394 (my $fh, my $filename) = tempfile( );
1395 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1396 $errormessage = $!;
1397 goto UPLOADCA_ERROR;
1398 }
1399 my $temp = `/usr/bin/openssl dhparam -text -in $filename`;
1400 if ($temp !~ /DH Parameters: \((1024|2048|3072|4096) bit\)/) {
1401 $errormessage = $Lang::tr{'not a valid dh key'};
1402 unlink ($filename);
1403 goto UPLOADCA_ERROR;
1404 } else {
1405 # Delete if old key exists
1406 if (-f "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}") {
1407 unlink "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}";
1408 }
1409 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'DH_NAME'}");
1410 if ($? ne 0) {
1411 $errormessage = "$Lang::tr{'dh key move failed'}: $!";
1412 unlink ($filename);
1413 goto UPLOADCA_ERROR;
1414 }
1415 }
1416
1417 ###
1418 ### Upload CA Certificate
1419 ###
1420 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
1421 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1422
1423 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
1424 $errormessage = $Lang::tr{'name must only contain characters'};
1425 goto UPLOADCA_ERROR;
1426 }
1427
1428 if (length($cgiparams{'CA_NAME'}) >60) {
1429 $errormessage = $Lang::tr{'name too long'};
1430 goto VPNCONF_ERROR;
1431 }
1432
1433 if ($cgiparams{'CA_NAME'} eq 'ca') {
1434 $errormessage = $Lang::tr{'name is invalid'};
1435 goto UPLOADCA_ERROR;
1436 }
1437
1438 # Check if there is no other entry with this name
1439 foreach my $key (keys %cahash) {
1440 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
1441 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
1442 goto UPLOADCA_ERROR;
1443 }
1444 }
1445
1446 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1447 $errormessage = $Lang::tr{'there was no file upload'};
1448 goto UPLOADCA_ERROR;
1449 }
1450 # Move uploaded ca to a temporary file
1451 (my $fh, my $filename) = tempfile( );
1452 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1453 $errormessage = $!;
1454 goto UPLOADCA_ERROR;
1455 }
1456 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
1457 if ($temp !~ /CA:TRUE/i) {
1458 $errormessage = $Lang::tr{'not a valid ca certificate'};
1459 unlink ($filename);
1460 goto UPLOADCA_ERROR;
1461 } else {
1462 move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
1463 if ($? ne 0) {
1464 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1465 unlink ($filename);
1466 goto UPLOADCA_ERROR;
1467 }
1468 }
1469
1470 my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
1471 $casubject =~ /Subject: (.*)[\n]/;
1472 $casubject = $1;
1473 $casubject =~ s+/Email+, E+;
1474 $casubject =~ s/ ST=/ S=/;
1475 $casubject = &Header::cleanhtml($casubject);
1476
1477 my $key = &General::findhasharraykey (\%cahash);
1478 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1479 $cahash{$key}[1] = $casubject;
1480 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1481 # system('/usr/local/bin/ipsecctrl', 'R');
1482
1483 UPLOADCA_ERROR:
1484
1485 ###
1486 ### Display ca certificate
1487 ###
1488 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
1489 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1490
1491 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
1492 &Header::showhttpheaders();
1493 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1494 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1495 &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1496 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1497 $output = &Header::cleanhtml($output,"y");
1498 print "<pre>$output</pre>\n";
1499 &Header::closebox();
1500 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1501 &Header::closebigbox();
1502 &Header::closepage();
1503 exit(0);
1504 } else {
1505 $errormessage = $Lang::tr{'invalid key'};
1506 }
1507
1508 ###
1509 ### Download ca certificate
1510 ###
1511 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1512 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1513
1514 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1515 print "Content-Type: application/octet-stream\r\n";
1516 print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1517 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1518 exit(0);
1519 } else {
1520 $errormessage = $Lang::tr{'invalid key'};
1521 }
1522
1523 ###
1524 ### Remove ca certificate (step 2)
1525 ###
1526 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1527 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1528 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1529
1530 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1531 foreach my $key (keys %confighash) {
1532 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1533 if ($test =~ /: OK/) {
1534 # Delete connection
1535 # if ($vpnsettings{'ENABLED'} eq 'on' ||
1536 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1537 # system('/usr/local/bin/ipsecctrl', 'D', $key);
1538 # }
1539 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1540 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1541 delete $confighash{$key};
1542 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1543 # &writeipsecfiles();
1544 }
1545 }
1546 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1547 delete $cahash{$cgiparams{'KEY'}};
1548 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1549 # system('/usr/local/bin/ipsecctrl', 'R');
1550 } else {
1551 $errormessage = $Lang::tr{'invalid key'};
1552 }
1553 ###
1554 ### Remove ca certificate (step 1)
1555 ###
1556 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1557 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1558 &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1559
1560 my $assignedcerts = 0;
1561 if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1562 foreach my $key (keys %confighash) {
1563 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1564 if ($test =~ /: OK/) {
1565 $assignedcerts++;
1566 }
1567 }
1568 if ($assignedcerts) {
1569 &Header::showhttpheaders();
1570 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1571 &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1572 &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1573 print <<END;
1574 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1575 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1576 <tr><td align='center'>
1577 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1578 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}
1579 <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1580 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1581 </form></table>
1582 END
1583 ;
1584 &Header::closebox();
1585 &Header::closebigbox();
1586 &Header::closepage();
1587 exit (0);
1588 } else {
1589 unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1590 delete $cahash{$cgiparams{'KEY'}};
1591 &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1592 # system('/usr/local/bin/ipsecctrl', 'R');
1593 }
1594 } else {
1595 $errormessage = $Lang::tr{'invalid key'};
1596 }
1597
1598 ###
1599 ### Display root certificate
1600 ###
1601 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1602 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1603 my $output;
1604 &Header::showhttpheaders();
1605 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1606 &Header::openbigbox('100%', 'LEFT', '', '');
1607 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1608 &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1609 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1610 } else {
1611 &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1612 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1613 }
1614 $output = &Header::cleanhtml($output,"y");
1615 print "<pre>$output</pre>\n";
1616 &Header::closebox();
1617 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1618 &Header::closebigbox();
1619 &Header::closepage();
1620 exit(0);
1621
1622 ###
1623 ### Download root certificate
1624 ###
1625 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1626 if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1627 print "Content-Type: application/octet-stream\r\n";
1628 print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1629 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1630 exit(0);
1631 }
1632
1633 ###
1634 ### Download host certificate
1635 ###
1636 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1637 if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1638 print "Content-Type: application/octet-stream\r\n";
1639 print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1640 print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1641 exit(0);
1642 }
1643 ###
1644 ### Form for generating a root certificate
1645 ###
1646 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1647 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1648
1649 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1650 if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1651 $errormessage = $Lang::tr{'valid root certificate already exists'};
1652 $cgiparams{'ACTION'} = '';
1653 goto ROOTCERT_ERROR;
1654 }
1655
1656 if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1657 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1658 my $ipaddr = <IPADDR>;
1659 close IPADDR;
1660 chomp ($ipaddr);
1661 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1662 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1663 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1664 }
1665 }
1666 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1667
1668 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1669 $errormessage = $Lang::tr{'there was no file upload'};
1670 goto ROOTCERT_ERROR;
1671 }
1672
1673 # Move uploaded certificate request to a temporary file
1674 (my $fh, my $filename) = tempfile( );
1675 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1676 $errormessage = $!;
1677 goto ROOTCERT_ERROR;
1678 }
1679
1680 # Create a temporary dirctory
1681 my $tempdir = tempdir( CLEANUP => 1 );
1682
1683 # Extract the CA certificate from the file
1684 my $pid = open(OPENSSL, "|-");
1685 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1686 if ($pid) { # parent
1687 if ($cgiparams{'P12_PASS'} ne '') {
1688 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1689 }
1690 close (OPENSSL);
1691 if ($?) {
1692 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1693 unlink ($filename);
1694 goto ROOTCERT_ERROR;
1695 }
1696 } else { # child
1697 unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1698 '-in', $filename,
1699 '-out', "$tempdir/cacert.pem")) {
1700 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1701 unlink ($filename);
1702 goto ROOTCERT_ERROR;
1703 }
1704 }
1705
1706 # Extract the Host certificate from the file
1707 $pid = open(OPENSSL, "|-");
1708 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1709 if ($pid) { # parent
1710 if ($cgiparams{'P12_PASS'} ne '') {
1711 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1712 }
1713 close (OPENSSL);
1714 if ($?) {
1715 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1716 unlink ($filename);
1717 goto ROOTCERT_ERROR;
1718 }
1719 } else { # child
1720 unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1721 '-in', $filename,
1722 '-out', "$tempdir/hostcert.pem")) {
1723 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1724 unlink ($filename);
1725 goto ROOTCERT_ERROR;
1726 }
1727 }
1728
1729 # Extract the Host key from the file
1730 $pid = open(OPENSSL, "|-");
1731 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1732 if ($pid) { # parent
1733 if ($cgiparams{'P12_PASS'} ne '') {
1734 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1735 }
1736 close (OPENSSL);
1737 if ($?) {
1738 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1739 unlink ($filename);
1740 goto ROOTCERT_ERROR;
1741 }
1742 } else { # child
1743 unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1744 '-nodes',
1745 '-in', $filename,
1746 '-out', "$tempdir/serverkey.pem")) {
1747 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1748 unlink ($filename);
1749 goto ROOTCERT_ERROR;
1750 }
1751 }
1752
1753 move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1754 if ($? ne 0) {
1755 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1756 unlink ($filename);
1757 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1758 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1759 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1760 goto ROOTCERT_ERROR;
1761 }
1762
1763 move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1764 if ($? ne 0) {
1765 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1766 unlink ($filename);
1767 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1768 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1769 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1770 goto ROOTCERT_ERROR;
1771 }
1772
1773 move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1774 if ($? ne 0) {
1775 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1776 unlink ($filename);
1777 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1778 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1779 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1780 goto ROOTCERT_ERROR;
1781 }
1782
1783 goto ROOTCERT_SUCCESS;
1784
1785 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1786
1787 # Validate input since the form was submitted
1788 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1789 $errormessage = $Lang::tr{'organization cant be empty'};
1790 goto ROOTCERT_ERROR;
1791 }
1792 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1793 $errormessage = $Lang::tr{'organization too long'};
1794 goto ROOTCERT_ERROR;
1795 }
1796 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1797 $errormessage = $Lang::tr{'invalid input for organization'};
1798 goto ROOTCERT_ERROR;
1799 }
1800 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1801 $errormessage = $Lang::tr{'hostname cant be empty'};
1802 goto ROOTCERT_ERROR;
1803 }
1804 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1805 $errormessage = $Lang::tr{'invalid input for hostname'};
1806 goto ROOTCERT_ERROR;
1807 }
1808 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1809 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1810 goto ROOTCERT_ERROR;
1811 }
1812 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1813 $errormessage = $Lang::tr{'e-mail address too long'};
1814 goto ROOTCERT_ERROR;
1815 }
1816 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1817 $errormessage = $Lang::tr{'invalid input for department'};
1818 goto ROOTCERT_ERROR;
1819 }
1820 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1821 $errormessage = $Lang::tr{'invalid input for city'};
1822 goto ROOTCERT_ERROR;
1823 }
1824 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1825 $errormessage = $Lang::tr{'invalid input for state or province'};
1826 goto ROOTCERT_ERROR;
1827 }
1828 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1829 $errormessage = $Lang::tr{'invalid input for country'};
1830 goto ROOTCERT_ERROR;
1831 }
1832
1833 # Copy the cgisettings to vpnsettings and save the configfile
1834 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
1835 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
1836 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
1837 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
1838 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
1839 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
1840 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
1841 &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1842
1843 # Replace empty strings with a .
1844 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1845 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1846 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1847
1848 # refresh
1849 #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1850
1851 # Create the CA certificate
1852 my $pid = open(OPENSSL, "|-");
1853 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1854 if ($pid) { # parent
1855 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1856 print OPENSSL "$state\n";
1857 print OPENSSL "$city\n";
1858 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1859 print OPENSSL "$ou\n";
1860 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1861 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1862 close (OPENSSL);
1863 if ($?) {
1864 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1865 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1866 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1867 goto ROOTCERT_ERROR;
1868 }
1869 } else { # child
1870 unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1871 '-days', '999999', '-newkey', 'rsa:4096', '-sha512',
1872 '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1873 '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1874 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1875 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1876 goto ROOTCERT_ERROR;
1877 }
1878 }
1879
1880 # Create the Host certificate request
1881 $pid = open(OPENSSL, "|-");
1882 $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1883 if ($pid) { # parent
1884 print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1885 print OPENSSL "$state\n";
1886 print OPENSSL "$city\n";
1887 print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1888 print OPENSSL "$ou\n";
1889 print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1890 print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1891 print OPENSSL ".\n";
1892 print OPENSSL ".\n";
1893 close (OPENSSL);
1894 if ($?) {
1895 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1896 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1897 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1898 goto ROOTCERT_ERROR;
1899 }
1900 } else { # child
1901 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1902 '-newkey', 'rsa:2048',
1903 '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1904 '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1905 '-extensions', 'server',
1906 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1907 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1908 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1909 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1910 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1911 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1912 goto ROOTCERT_ERROR;
1913 }
1914 }
1915
1916 # Sign the host certificate request
1917 system('/usr/bin/openssl', 'ca', '-days', '999999',
1918 '-batch', '-notext',
1919 '-in', "${General::swroot}/ovpn/certs/serverreq.pem",
1920 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1921 '-extensions', 'server',
1922 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1923 if ($?) {
1924 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1925 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1926 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1927 unlink ("${General::swroot}/ovpn/serverkey.pem");
1928 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1929 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1930 &newcleanssldatabase();
1931 goto ROOTCERT_ERROR;
1932 } else {
1933 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1934 &deletebackupcert();
1935 }
1936
1937 # Create an empty CRL
1938 system('/usr/bin/openssl', 'ca', '-gencrl',
1939 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1940 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1941 if ($?) {
1942 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1943 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1944 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1945 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1946 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1947 &cleanssldatabase();
1948 goto ROOTCERT_ERROR;
1949 # } else {
1950 # &cleanssldatabase();
1951 }
1952 # Create Diffie Hellmann Parameter
1953 system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1954 '-out', "${General::swroot}/ovpn/ca/dh1024.pem", "$cgiparams{'DHLENGHT'}");
1955 if ($?) {
1956 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1957 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1958 unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1959 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1960 unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1961 unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1962 &cleanssldatabase();
1963 goto ROOTCERT_ERROR;
1964 # } else {
1965 # &cleanssldatabase();
1966 }
1967 goto ROOTCERT_SUCCESS;
1968 }
1969 ROOTCERT_ERROR:
1970 if ($cgiparams{'ACTION'} ne '') {
1971 &Header::showhttpheaders();
1972 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
1973 &Header::openbigbox('100%', 'LEFT', '', '');
1974 if ($errormessage) {
1975 &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1976 print "<class name='base'>$errormessage";
1977 print "&nbsp;</class>";
1978 &Header::closebox();
1979 }
1980 &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1981 print <<END;
1982 <form method='post' enctype='multipart/form-data'>
1983 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1984 <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1985 <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1986 <td width='35%' colspan='2'>&nbsp;</td></tr>
1987 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1988 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1989 <td colspan='2'>&nbsp;</td></tr>
1990 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1991 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1992 <td colspan='2'>&nbsp;</td></tr>
1993 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1994 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1995 <td colspan='2'>&nbsp;</td></tr>
1996 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1997 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1998 <td colspan='2'>&nbsp;</td></tr>
1999 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
2000 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
2001 <td colspan='2'>&nbsp;</td></tr>
2002 <tr><td class='base'>$Lang::tr{'country'}:</td>
2003 <td class='base'><select name='ROOTCERT_COUNTRY'>
2004
2005 END
2006 ;
2007 foreach my $country (sort keys %{Countries::countries}) {
2008 print "<option value='$Countries::countries{$country}'";
2009 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
2010 print " selected='selected'";
2011 }
2012 print ">$country</option>";
2013 }
2014 print <<END;
2015 </select></td>
2016 <tr><td class='base'>$Lang::tr{'ovpn dh'}:</td>
2017 <td class='base'><select name='DHLENGHT'>
2018 <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
2019 <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
2020 <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
2021 <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
2022 </select>
2023 </td>
2024 </tr>
2025
2026 <tr><td>&nbsp;</td>
2027 <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
2028 <td>&nbsp;</td><td>&nbsp;</td></tr>
2029 <tr><td class='base' colspan='4' align='left'>
2030 <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2031 <tr><td colspan='2'><br></td></tr>
2032 <table width='100%'>
2033 <tr>
2034 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}: </font></b>$Lang::tr{'ovpn generating the root and host certificates'}
2035 <td class='base'>$Lang::tr{'dh key warn'}</td>
2036 </tr>
2037 <tr>
2038 <td class='base'>$Lang::tr{'dh key warn1'}</td>
2039 </tr>
2040 <tr><td colspan='2'><br></td></tr>
2041 <tr>
2042 </table>
2043
2044 <table width='100%'>
2045 <tr><td colspan='4'><hr></td></tr>
2046 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
2047 <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
2048 <td colspan='2'>&nbsp;</td></tr>
2049 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
2050 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
2051 <td colspan='2'>&nbsp;</td></tr>
2052 <tr><td>&nbsp;</td>
2053 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
2054 <td colspan='2'>&nbsp;</td></tr>
2055 <tr><td class='base' colspan='4' align='left'>
2056 <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td>
2057 </tr>
2058 </form></table>
2059 END
2060 ;
2061 &Header::closebox();
2062 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2063 &Header::closebigbox();
2064 &Header::closepage();
2065 exit(0)
2066 }
2067
2068 ROOTCERT_SUCCESS:
2069 system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
2070 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2071 # $vpnsettings{'ENABLE_BLUE'} eq 'on') {
2072 # system('/usr/local/bin/ipsecctrl', 'S');
2073 # }
2074
2075 ###
2076 ### Enable/Disable connection
2077 ###
2078
2079 ###
2080 # m.a.d net2net
2081 ###
2082
2083 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2084
2085 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2086 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2087 # my $n2nactive = '';
2088 my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
2089
2090 if ($confighash{$cgiparams{'KEY'}}) {
2091 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2092 $confighash{$cgiparams{'KEY'}}[0] = 'on';
2093 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2094
2095 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2096 system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
2097 }
2098 } else {
2099
2100 $confighash{$cgiparams{'KEY'}}[0] = 'off';
2101 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2102
2103 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2104 if ($n2nactive ne ''){
2105 system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
2106 }
2107
2108 } else {
2109 $errormessage = $Lang::tr{'invalid key'};
2110 }
2111 }
2112 }
2113
2114 ###
2115 ### Download OpenVPN client package
2116 ###
2117
2118
2119 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
2120 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2121 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2122 my $file = '';
2123 my $clientovpn = '';
2124 my @fileholder;
2125 my $tempdir = tempdir( CLEANUP => 1 );
2126 my $zippath = "$tempdir/";
2127
2128 ###
2129 # m.a.d net2net
2130 ###
2131
2132 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
2133
2134 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
2135 my $zippathname = "$zippath$zipname";
2136 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
2137 my @ovsubnettemp = split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
2138 my $ovsubnet = "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
2139 my $tunmtu = '';
2140 my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
2141 my $n2nfragment = '';
2142
2143 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2144 flock CLIENTCONF, 2;
2145
2146 my $zip = Archive::Zip->new();
2147 print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
2148 print CLIENTCONF "# \n";
2149 print CLIENTCONF "# User Security\n";
2150 print CLIENTCONF "user nobody\n";
2151 print CLIENTCONF "group nobody\n";
2152 print CLIENTCONF "persist-tun\n";
2153 print CLIENTCONF "persist-key\n";
2154 print CLIENTCONF "script-security 2\n";
2155 print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
2156 print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
2157 print CLIENTCONF "float\n";
2158 print CLIENTCONF "# IP adresses of the VPN Subnet\n";
2159 print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
2160 print CLIENTCONF "# Server Gateway Network\n";
2161 print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
2162 print CLIENTCONF "# tun Device\n";
2163 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
2164 print CLIENTCONF "# Port and Protokoll\n";
2165 print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
2166
2167 if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
2168 print CLIENTCONF "proto tcp-client\n";
2169 print CLIENTCONF "# Packet size\n";
2170 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2171 print CLIENTCONF "tun-mtu $tunmtu\n";
2172 }
2173
2174 if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
2175 print CLIENTCONF "proto udp\n";
2176 print CLIENTCONF "# Paketsize\n";
2177 if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
2178 print CLIENTCONF "tun-mtu $tunmtu\n";
2179 if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
2180 if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
2181 }
2182 if (($confighash{$cgiparams{'KEY'}}[38] eq 'yes') ||
2183 ($confighash{$cgiparams{'KEY'}}[38] eq 'maybe') ||
2184 ($confighash{$cgiparams{'KEY'}}[38] eq 'no' )) {
2185 if (($confighash{$cgiparams{'KEY'}}[23] ne 'on') || ($confighash{$cgiparams{'KEY'}}[24] eq '')) {
2186 if ($tunmtu eq '1500' ) {
2187 print CLIENTCONF "mtu-disc $confighash{$cgiparams{'KEY'}}[38]\n";
2188 }
2189 }
2190 }
2191 print CLIENTCONF "ns-cert-type server\n";
2192 print CLIENTCONF "# Auth. Client\n";
2193 print CLIENTCONF "tls-client\n";
2194 print CLIENTCONF "# Cipher\n";
2195 print CLIENTCONF "cipher $confighash{$cgiparams{'KEY'}}[40]\n";
2196 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2197 print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2198 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2199 }
2200 if ($confighash{$cgiparams{'KEY'}}[39] eq '') {
2201 print CLIENTCONF "# HMAC algorithm\n";
2202 print CLIENTCONF "auth SHA1\n";
2203 } else {
2204 print CLIENTCONF "# HMAC algorithm\n";
2205 print CLIENTCONF "auth $confighash{$cgiparams{'KEY'}}[39]\n";
2206 }
2207 if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
2208 print CLIENTCONF "# Enable Compression\n";
2209 print CLIENTCONF "comp-lzo\r\n";
2210 }
2211 print CLIENTCONF "# Debug Level\n";
2212 print CLIENTCONF "verb 3\n";
2213 print CLIENTCONF "# Tunnel check\n";
2214 print CLIENTCONF "keepalive 10 60\n";
2215 print CLIENTCONF "# Start as daemon\n";
2216 print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
2217 print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
2218 print CLIENTCONF "# Activate Management Interface and Port\n";
2219 if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
2220 else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
2221 print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
2222
2223
2224 close(CLIENTCONF);
2225
2226 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2227 my $status = $zip->writeToFileNamed($zippathname);
2228
2229 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2230 @fileholder = <DLFILE>;
2231 print "Content-Type:application/x-download\n";
2232 print "Content-Disposition:attachment;filename=$zipname\n\n";
2233 print @fileholder;
2234 exit (0);
2235 }
2236 else
2237 {
2238 my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
2239 my $zippathname = "$zippath$zipname";
2240 $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
2241
2242 ###
2243 # m.a.d net2net
2244 ###
2245
2246 open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
2247 flock CLIENTCONF, 2;
2248
2249 my $zip = Archive::Zip->new();
2250
2251 print CLIENTCONF "#OpenVPN Client conf\r\n";
2252 print CLIENTCONF "tls-client\r\n";
2253 print CLIENTCONF "client\r\n";
2254 print CLIENTCONF "nobind\r\n";
2255 print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
2256 print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
2257
2258 # Check if we are using fragment, mssfix or mtu-disc and set MTU to 1500
2259 # or use configured value.
2260 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' )
2261 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2262 elsif ($vpnsettings{MSSFIX} eq 'on')
2263 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2264 elsif (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2265 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2266 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' ))
2267 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu 1500\r\n"; }
2268 else
2269 { print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n"; }
2270
2271 if ( $vpnsettings{'ENABLED'} eq 'on'){
2272 print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
2273 if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2274 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
2275 print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2276 }
2277 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2278 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2279 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2280 }
2281 } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
2282 print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2283 if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2284 print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
2285 print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2286 }
2287 } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
2288 print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
2289 }
2290
2291 if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
2292 print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
2293 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
2294 } else {
2295 print CLIENTCONF "ca cacert.pem\r\n";
2296 print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
2297 print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
2298 $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n";
2299 $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
2300 }
2301 print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
2302 if ($vpnsettings{'DAUTH'} eq '') {
2303 print CLIENTCONF "";
2304 } else {
2305 print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
2306 }
2307 if ($vpnsettings{'TLSAUTH'} eq 'on') {
2308 print CLIENTCONF "tls-auth ta.key 1\r\n";
2309 $zip->addFile( "${General::swroot}/ovpn/ca/ta.key", "ta.key") or die "Can't add file ta.key\n";
2310 }
2311 if ($vpnsettings{DCOMPLZO} eq 'on') {
2312 print CLIENTCONF "comp-lzo\r\n";
2313 }
2314 print CLIENTCONF "verb 3\r\n";
2315 print CLIENTCONF "ns-cert-type server\r\n";
2316 print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
2317 if ($vpnsettings{MSSFIX} eq 'on') {
2318 print CLIENTCONF "mssfix\r\n";
2319 }
2320 if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
2321 print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
2322 }
2323
2324 # Check if a valid operating mode has been choosen and use it.
2325 if (($vpnsettings{'PMTU_DISCOVERY'} eq 'yes') ||
2326 ($vpnsettings{'PMTU_DISCOVERY'} eq 'maybe') ||
2327 ($vpnsettings{'PMTU_DISCOVERY'} eq 'no' )) {
2328 if(($vpnsettings{MSSFIX} ne 'on') || ($vpnsettings{FRAGMENT} eq '')) {
2329 print CLIENTCONF "mtu-disc $vpnsettings{'PMTU_DISCOVERY'}\r\n";
2330 }
2331 }
2332 close(CLIENTCONF);
2333
2334 $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
2335 my $status = $zip->writeToFileNamed($zippathname);
2336
2337 open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
2338 @fileholder = <DLFILE>;
2339 print "Content-Type:application/x-download\n";
2340 print "Content-Disposition:attachment;filename=$zipname\n\n";
2341 print @fileholder;
2342 exit (0);
2343 }
2344
2345
2346
2347 ###
2348 ### Remove connection
2349 ###
2350
2351
2352 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2353 &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2354 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2355
2356 if ($confighash{$cgiparams{'KEY'}}) {
2357 # if ($vpnsettings{'ENABLED'} eq 'on' ||
2358 # $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2359 # system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2360 # }
2361 #
2362 my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2363
2364 ###
2365 # m.a.d net2net
2366 ###
2367
2368 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2369 my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2370 my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2371 unlink ($certfile);
2372 unlink ($conffile);
2373
2374 if (-e "${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") {
2375 rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2376 }
2377 }
2378
2379 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2380 unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2381
2382 # A.Marx CCD delete ccd files and routes
2383
2384
2385 if (-f "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]")
2386 {
2387 unlink "${General::swroot}/ovpn/ccd/$confighash{$cgiparams{'KEY'}}[2]";
2388 }
2389
2390 &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2391 foreach my $key (keys %ccdroutehash) {
2392 if ($ccdroutehash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2393 delete $ccdroutehash{$key};
2394 }
2395 }
2396 &General::writehasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
2397
2398 &General::readhasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2399 foreach my $key (keys %ccdroute2hash) {
2400 if ($ccdroute2hash{$key}[0] eq $confighash{$cgiparams{'KEY'}}[1]){
2401 delete $ccdroute2hash{$key};
2402 }
2403 }
2404 &General::writehasharray("${General::swroot}/ovpn/ccdroute2", \%ccdroute2hash);
2405 &writeserverconf;
2406
2407
2408 # CCD end
2409
2410
2411 delete $confighash{$cgiparams{'KEY'}};
2412 my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
2413 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2414
2415 #&writeserverconf();
2416 } else {
2417 $errormessage = $Lang::tr{'invalid key'};
2418 }
2419 &General::firewall_reload();
2420
2421 ###
2422 ### Download PKCS12 file
2423 ###
2424 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
2425 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2426
2427 print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
2428 print "Content-Type: application/octet-stream\r\n\r\n";
2429 print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
2430 exit (0);
2431
2432 ###
2433 ### Display certificate
2434 ###
2435 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
2436 &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2437
2438 if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2439 &Header::showhttpheaders();
2440 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2441 &Header::openbigbox('100%', 'LEFT', '', '');
2442 &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
2443 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2444 $output = &Header::cleanhtml($output,"y");
2445 print "<pre>$output</pre>\n";
2446 &Header::closebox();
2447 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2448 &Header::closebigbox();
2449 &Header::closepage();
2450 exit(0);
2451 }
2452
2453 ###
2454 ### Display Diffie-Hellman key
2455 ###
2456 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show dh'}) {
2457
2458 if (! -e "${General::swroot}/ovpn/ca/dh1024.pem") {
2459 $errormessage = $Lang::tr{'not present'};
2460 } else {
2461 &Header::showhttpheaders();
2462 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2463 &Header::openbigbox('100%', 'LEFT', '', '');
2464 &Header::openbox('100%', 'LEFT', "$Lang::tr{'dh'}:");
2465 my $output = `/usr/bin/openssl dhparam -text -in ${General::swroot}/ovpn/ca/dh1024.pem`;
2466 $output = &Header::cleanhtml($output,"y");
2467 print "<pre>$output</pre>\n";
2468 &Header::closebox();
2469 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2470 &Header::closebigbox();
2471 &Header::closepage();
2472 exit(0);
2473 }
2474
2475 ###
2476 ### Display Certificate Revoke List
2477 ###
2478 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
2479 # &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2480
2481 if (! -e "${General::swroot}/ovpn/crls/cacrl.pem") {
2482 $errormessage = $Lang::tr{'not present'};
2483 } else {
2484 &Header::showhttpheaders();
2485 &Header::openpage($Lang::tr{'ovpn'}, 1, '');
2486 &Header::openbigbox('100%', 'LEFT', '', '');
2487 &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
2488 my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
2489 $output = &Header::cleanhtml($output,"y");
2490 print "<pre>$output</pre>\n";
2491 &Header::closebox();
2492 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2493 &Header::closebigbox();
2494 &Header::closepage();
2495 exit(0);
2496 }
2497
2498 ###
2499 ### Advanced Server Settings
2500 ###
2501
2502 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
2503 %cgiparams = ();
2504 %cahash = ();
2505 %confighash = ();
2506 my $disabled;
2507 &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
2508 read_routepushfile;
2509
2510
2511 # if ($cgiparams{'CLIENT2CLIENT'} eq '') {
2512 # $cgiparams{'CLIENT2CLIENT'} = 'on';
2513 # }
2514 ADV_ERROR:
2515 if ($cgiparams{'MAX_CLIENTS'} eq '') {
2516 $cgiparams{'MAX_CLIENTS'} = '100';
2517 }
2518 if ($cgiparams{'KEEPALIVE_1'} eq '') {
2519 $cgiparams{'KEEPALIVE_1'} = '10';
2520 }
2521 if ($cgiparams{'KEEPALIVE_2'} eq '') {
2522 $cgiparams{'KEEPALIVE_2'} = '60';
2523 }
2524 if ($cgiparams{'LOG_VERB'} eq '') {
2525 $cgiparams{'LOG_VERB'} = '3';
2526 }
2527 if ($cgiparams{'PMTU_DISCOVERY'} eq '') {
2528 $cgiparams{'PMTU_DISCOVERY'} = 'off';
2529 }
2530 if ($cgiparams{'DAUTH'} eq '') {
2531 $cgiparams{'DAUTH'} = 'SHA1';
2532 }
2533 if ($cgiparams{'DAUTH'} eq '') {
2534 $cgiparams{'DAUTH'} = 'SHA1';
2535 }
2536 if ($cgiparams{'ENGINES'} eq '') {
2537 $cgiparams{'ENGINES'} = 'disabled';
2538 }
2539 if ($cgiparams{'TLSAUTH'} eq '') {<