html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/countries.pl";
  37
  38 # enable only the following on debugging purpose
  39 use warnings;
  40 use CGI::Carp 'fatalsToBrowser';
  41 #workaround to suppress a warning when a variable is used only once
  42 my @dummy = ( ${Header::colourgreen} );
  43 undef (@dummy);
  44
  45 my %color = ();
  46 my %mainsettings = ();
  47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  49
  50 ###
  51 ### Initialize variables
  52 ###
  53 my %netsettings=();
  54 my %cgiparams=();
  55 my %vpnsettings=();
  56 my %checked=();
  57 my %confighash=();
  58 my %cahash=();
  59 my %selected=();
  60 my $warnmessage = '';
  61 my $errormessage = '';
  62 my %settings=();
  63 my $routes_push_file = '';
  64 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  65 $cgiparams{'ENABLED'} = 'off';
  66 $cgiparams{'ENABLED_BLUE'} = 'off';
  67 $cgiparams{'ENABLED_ORANGE'} = 'off';
  68 $cgiparams{'EDIT_ADVANCED'} = 'off';
  69 $cgiparams{'NAT'} = 'off';
  70 $cgiparams{'COMPRESSION'} = 'off';
  71 $cgiparams{'ONLY_PROPOSED'} = 'off';
  72 $cgiparams{'ACTION'} = '';
  73 $cgiparams{'CA_NAME'} = '';
  74 $cgiparams{'DHCP_DOMAIN'} = '';
  75 $cgiparams{'DHCP_DNS'} = '';
  76 $cgiparams{'DHCP_WINS'} = '';
  77 $cgiparams{'ROUTES_PUSH'} = '';
  78 $cgiparams{'DCOMPLZO'} = 'off';
  79 $cgiparams{'MSSFIX'} = '';
  80 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  81 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  82
  83 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  84
  85 # prepare openvpn config file
  86 ###
  87 ### Useful functions
  88 ###
  89 sub haveOrangeNet
  90 {
  91         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
  92         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
  93         return 0;
  94 }
  95
  96 sub haveBlueNet
  97 {
  98         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
  99         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 100         return 0;
 101 }
 102
 103 sub sizeformat{
 104     my $bytesize = shift;
 105     my $i = 0;
 106
 107     while(abs($bytesize) >= 1024){
 108         $bytesize=$bytesize/1024;
 109         $i++;
 110         last if($i==6);
 111     }
 112
 113     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 114     my $newsize=(int($bytesize*100 +0.5))/100;
 115     return("$newsize $units[$i]");
 116 }
 117
 118 sub valid_dns_host {
 119         my $hostname = $_[0];
 120         unless ($hostname) { return "No hostname"};
 121         my $res = new Net::DNS::Resolver;
 122         my $query = $res->search("$hostname");
 123         if ($query) {
 124                 foreach my $rr ($query->answer) {
 125                         ## Potential bug - we are only looking at A records:
 126                         return 0 if $rr->type eq "A";
 127                 }
 128         } else {
 129                 return $res->errorstring;
 130         }
 131 }
 132
 133 sub cleanssldatabase
 134 {
 135     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 136         print FILE "01";
 137         close FILE;
 138     }
 139     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 140         print FILE "";
 141         close FILE;
 142     }
 143     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 144     unlink ("${General::swroot}/ovpn/certs/serial.old");
 145     unlink ("${General::swroot}/ovpn/certs/01.pem");
 146 }
 147
 148 sub newcleanssldatabase
 149 {
 150     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 151         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 152         print FILE "01";
 153         close FILE;
 154     }
 155     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 156         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 157     }
 158     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 159     unlink ("${General::swroot}/ovpn/certs/serial.old");
 160 }
 161
 162 sub deletebackupcert
 163 {
 164         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 165                 my $hexvalue = <FILE>;
 166                 chomp $hexvalue;
 167                 close FILE;
 168                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 169         }
 170 }
 171
 172 sub checkportfw {
 173     my $KEY2 = $_[0]; # key2
 174     my $SRC_PORT = $_[1]; # src_port
 175     my $PROTOCOL = $_[2]; # protocol
 176     my $SRC_IP = $_[3]; # sourceip
 177
 178     my $pfwfilename = "${General::swroot}/portfw/config";
 179     open(FILE, $pfwfilename) or die 'Unable to open config file.';
 180     my @pfwcurrent = <FILE>;
 181     close(FILE);
 182     my $pfwkey1 = 0; # used for finding last sequence number used
 183     foreach my $pfwline (@pfwcurrent)
 184     {
 185         my @pfwtemp = split(/\,/,$pfwline);
 186
 187         chomp ($pfwtemp[8]);
 188         if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
 189                 if ( $SRC_PORT eq $pfwtemp[3] &&
 190                         $PROTOCOL eq $pfwtemp[2] &&
 191                         $SRC_IP eq $pfwtemp[7])
 192                 {
 193                          $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
 194                 }
 195                 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
 196                 if ( $pfwtemp[1] eq "0") {
 197                         $pfwkey1=$pfwtemp[0];
 198                 }
 199                 # Darren Critchley - Duplicate or overlapping Port range check
 200                 if ($pfwtemp[1] eq "0" &&
 201                         $PROTOCOL eq $pfwtemp[2] &&
 202                         $SRC_IP eq $pfwtemp[7] &&
 203                         $errormessage eq '')
 204                 {
 205                         &portchecks($SRC_PORT, $pfwtemp[5]);
 206 #                       &portchecks($pfwtemp[3], $pfwtemp[5]);
 207 #                       &portchecks($pfwtemp[3], $SRC_IP);
 208                 }
 209         }
 210     }
 211 #    $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
 212
 213     return;
 214 }
 215
 216 sub checkportoverlap
 217 {
 218         my $portrange1 = $_[0]; # New port range
 219         my $portrange2 = $_[1]; # existing port range
 220         my @tempr1 = split(/\:/,$portrange1);
 221         my @tempr2 = split(/\:/,$portrange2);
 222
 223         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 224         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 225
 226         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 227         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 228
 229         return 1; # Everything checks out!
 230 }
 231
 232 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 233 sub checkportinc
 234 {
 235         my $port1 = $_[0]; # Port
 236         my $portrange2 = $_[1]; # Port range
 237         my @tempr1 = split(/\:/,$portrange2);
 238
 239         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 240                 return 1;
 241         } else {
 242                 return 0;
 243         }
 244 }
 245 # Darren Critchley - Duplicate or overlapping Port range check
 246 sub portchecks
 247 {
 248         my $p1 = $_[0]; # New port range
 249         my $p2 = $_[1]; # existing port range
 250 #       $_ = $_[0];
 251         our ($prtrange1, $prtrange2);
 252         $prtrange1 = 0;
 253 #       if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
 254 #               unless (&checkportoverlap($p1,$p2)) {
 255 #                       $errormessage = "$Lang::tr{'source port overlaps'} $p1";
 256 #               }
 257 #       }
 258         if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
 259                 unless (&checkportinc($p2,$p1)) {
 260                         $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
 261                 }
 262         }
 263         $prtrange1 = 1;
 264         if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
 265                 unless (&checkportinc($p1,$p2)) {
 266                         $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
 267                 }
 268         }
 269         return;
 270 }
 271
 272 # Darren Critchley - certain ports are reserved for IPFire
 273 # TCP 67,68,81,222,445
 274 # UDP 67,68
 275 # Params passed in -> port, rangeyn, protocol
 276 sub disallowreserved
 277 {
 278         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 279         my $msg = "";
 280         my @tcp_reserved = (81,222,445);
 281         my $prt = $_[0]; # the port or range
 282         my $ryn = $_[1]; # tells us whether or not it is a port range
 283         my $prot = $_[2]; # protocol
 284         my $srcdst = $_[3]; # source or destination
 285         if ($ryn) { # disect port range
 286                 if ($srcdst eq "src") {
 287                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 288                 } else {
 289                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 290                 }
 291                 my @tmprng = split(/\:/,$prt);
 292                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 293                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 294                 if ($prot eq "tcp") {
 295                         foreach my $prange (@tcp_reserved) {
 296                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 297                         }
 298                 }
 299         } else {
 300                 if ($srcdst eq "src") {
 301                         $msg = "$Lang::tr{'reserved src port'}";
 302                 } else {
 303                         $msg = "$Lang::tr{'reserved dst port'}";
 304                 }
 305                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 306                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 307                 if ($prot eq "tcp") {
 308                         foreach my $prange (@tcp_reserved) {
 309                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 310                         }
 311                 }
 312         }
 313         return;
 314 }
 315
 316
 317 sub writeserverconf {
 318     my %sovpnsettings = ();
 319     my @temp = ();
 320     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 321     &read_routepushfile;
 322
 323     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 324     flock CONF, 2;
 325     print CONF "#OpenVPN Server conf\n";
 326     print CONF "\n";
 327     print CONF "daemon openvpnserver\n";
 328     print CONF "writepid /var/run/openvpn.pid\n";
 329     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 330     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 331     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 332     print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
 333     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 334     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 335     print CONF "script-security 3 system\n";
 336     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 337     print CONF "tls-server\n";
 338     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 339     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 340     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 341     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 342     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 343     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 344     print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 345
 346     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 347         @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 348         foreach (@temp)
 349         {
 350                 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 351                 print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 352         }
 353     }
 354
 355     if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 356         print CONF "client-to-client\n";
 357     }
 358     if ($sovpnsettings{MSSFIX} eq 'on') {
 359         print CONF "mssfix\n";
 360     }
 361     if ($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 362         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 363     }
 364     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 365         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 366     }
 367     print CONF "status-version 1\n";
 368     print CONF "status /var/log/ovpnserver.log 30\n";
 369     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 370     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 371         print CONF "comp-lzo\n";
 372     }
 373     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 374         print CONF "push \"redirect-gateway def1\"\n";
 375     }
 376     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 377         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 378     }
 379
 380     if ($sovpnsettings{DHCP_DNS} ne '') {
 381         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 382     }
 383
 384     if ($sovpnsettings{DHCP_WINS} ne '') {
 385         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 386     }
 387
 388     if ($sovpnsettings{DHCP_WINS} eq '') {
 389         print CONF "max-clients 100\n";
 390     }
 391     if ($sovpnsettings{DHCP_WINS} ne '') {
 392         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 393     }
 394     print CONF "tls-verify /var/ipfire/ovpn/verify\n";
 395     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 396     print CONF "user nobody\n";
 397     print CONF "group nobody\n";
 398     print CONF "persist-key\n";
 399     print CONF "persist-tun\n";
 400         if ($sovpnsettings{LOG_VERB} ne '') {
 401                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 402         } else {
 403                 print CONF "verb 3\n";
 404         }
 405     print CONF "\n";
 406
 407     close(CONF);
 408 }
 409 #
 410 sub emptyserverlog{
 411     if (open(FILE, ">/var/log/ovpnserver.log")) {
 412         flock FILE, 2;
 413         print FILE "";
 414         close FILE;
 415     }
 416
 417 }
 418
 419 ###
 420 # m.a.d net2net
 421 ###
 422
 423 sub validdotmask
 424 {
 425         my $ipdotmask = $_[0];
 426         if (&General::validip($ipdotmask)) { return 0; }
 427         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 428         my $mask = $2;
 429         if (($mask =~ /\./ )) { return 0; }
 430   return 1;
 431 }
 432
 433 # -------------------------------------------------------------------
 434
 435 sub write_routepushfile
 436 {
 437         open(FILE, ">$routes_push_file");
 438         flock(FILE, 2);
 439         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 440                 print FILE $vpnsettings{'ROUTES_PUSH'};
 441         }
 442         close(FILE);
 443 }
 444
 445 sub read_routepushfile
 446 {
 447         if (-e "$routes_push_file") {
 448                 open(FILE,"$routes_push_file");
 449                 delete $vpnsettings{'ROUTES_PUSH'};
 450                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 451                 close(FILE);
 452                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 453         }
 454 }
 455
 456
 457 #hier die refresh page
 458 if ( -e "${General::swroot}/ovpn/gencanow") {
 459     my $refresh = '';
 460     $refresh = "<meta http-equiv='refresh' content='15;' />";
 461     &Header::showhttpheaders();
 462     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 463     &Header::openbigbox('100%', 'center');
 464     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 465     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 466     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 467     &Header::closebox();
 468     &Header::closebigbox();
 469     &Header::closepage();
 470     exit (0);
 471 }
 472 ##hier die refresh page
 473
 474
 475 ###
 476 ### OpenVPN Server Control
 477 ###
 478 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 479     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 480     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 481     #start openvpn server
 482     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 483         &emptyserverlog();
 484         system('/usr/local/bin/openvpnctrl', '-s');
 485     }
 486     #stop openvpn server
 487     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 488         system('/usr/local/bin/openvpnctrl', '-k');
 489         &emptyserverlog();
 490     }
 491 #    #restart openvpn server
 492     if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 493 #workarund, till SIGHUP also works when running as nobody
 494         system('/usr/local/bin/openvpnctrl', '-r');
 495         &emptyserverlog();
 496     }
 497 }
 498
 499 ###
 500 ### Save Advanced options
 501 ###
 502
 503 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 504     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 505     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 506     #DAN this value has to leave.
 507 #new settings for daemon
 508     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 509     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 510     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 511     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 512     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 513     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 514     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 515     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 516     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 517     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 518     my @temp=();
 519
 520     if ($cgiparams{'FRAGMENT'} eq '') {
 521         delete $vpnsettings{'FRAGMENT'};
 522     } else {
 523         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 524             $errormessage = "Incorrect value, please insert only numbers.";
 525         goto ADV_ERROR;
 526                 } else {
 527                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 528         }
 529     }
 530     if ($cgiparams{'MSSFIX'} ne 'on') {
 531         delete $vpnsettings{'MSSFIX'};
 532     } else {
 533         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 534     }
 535     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 536         unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 537                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 538         goto ADV_ERROR;
 539         }
 540     }
 541     if ($cgiparams{'DHCP_DNS'} ne ''){
 542         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 543                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 544         goto ADV_ERROR;
 545         }
 546     }
 547     if ($cgiparams{'DHCP_WINS'} ne ''){
 548         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 549                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 550                 goto ADV_ERROR;
 551         }
 552     }
 553     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 554         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 555         undef $vpnsettings{'ROUTES_PUSH'};
 556         foreach (@temp)
 557         {
 558                 s/^\s+//g; s/\s+$//g;
 559                 if ($_)
 560                 {
 561                         unless (&General::validipandmask($_)) {
 562                                 $errormessage = $Lang::tr{'ovpn errmsg invalid ip or mask'};
 563                         goto ADV_ERROR;
 564                         }
 565                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($_));
 566                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 567                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 568   goto ADV_ERROR;
 569                         }
 570                         $vpnsettings{'ROUTES_PUSH'} .= $_."\n";
 571                 }
 572         }
 573         &write_routepushfile;
 574         undef $vpnsettings{'ROUTES_PUSH'};
 575     }
 576         else {
 577         undef $vpnsettings{'ROUTES_PUSH'};
 578         &write_routepushfile;
 579     }
 580     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 581         $errormessage = $Lang::tr{'invalid input for max clients'};
 582         goto ADV_ERROR;
 583     }
 584     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 585         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 586             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 587         goto ADV_ERROR;
 588         }
 589     }
 590     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 591         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 592             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 593         goto ADV_ERROR;
 594         }
 595     }
 596     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 597         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 598         goto ADV_ERROR;
 599     }
 600
 601     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 602     &writeserverconf();#hier ok
 603 }
 604
 605 ###
 606 # m.a.d net2net
 607 ###
 608
 609 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 610 {
 611
 612 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 613 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 614 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 615 my $tunmtu =  '';
 616
 617 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 618 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 619
 620   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 621
 622   flock SERVERCONF, 2;
 623   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 624   print SERVERCONF "\n";
 625   print SERVERCONF "# User Security\n";
 626   print SERVERCONF "user nobody\n";
 627   print SERVERCONF "group nobody\n";
 628   print SERVERCONF "persist-tun\n";
 629   print SERVERCONF "persist-key\n";
 630   print SERVERCONF "script-security 2\n";
 631   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 632   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 633   print SERVERCONF "float\n";
 634   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 635   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 636   print SERVERCONF "# Client Gateway Network\n";
 637   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 638   print SERVERCONF "# tun Device\n";
 639   print SERVERCONF "dev tun\n";
 640   print SERVERCONF "# Port and Protokol\n";
 641   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 642
 643   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 644   print SERVERCONF "proto tcp-server\n";
 645   print SERVERCONF "# Packet size\n";
 646   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 647   print SERVERCONF "tun-mtu $tunmtu\n";
 648   }
 649
 650   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 651   print SERVERCONF "proto udp\n";
 652   print SERVERCONF "# Paketsize\n";
 653   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 654   print SERVERCONF "tun-mtu $tunmtu\n";
 655   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 656   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
 657   }
 658   print SERVERCONF "# Auth. Server\n";
 659   print SERVERCONF "tls-server\n";
 660   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 661   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 662   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 663   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
 664   print SERVERCONF "# Cipher\n";
 665   print SERVERCONF "cipher AES-256-CBC\n";
 666   if ($cgiparams{'COMPLZO'} eq 'on') {
 667    print SERVERCONF "# Enable Compression\n";
 668    print SERVERCONF "comp-lzo\r\n";
 669      }
 670   print SERVERCONF "# Debug Level\n";
 671   print SERVERCONF "verb 3\n";
 672   print SERVERCONF "# Tunnel check\n";
 673   print SERVERCONF "keepalive 10 60\n";
 674   print SERVERCONF "# Start as daemon\n";
 675   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
 676   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 677   print SERVERCONF "# Activate Management Interface and Port\n";
 678   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 679   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 680   close(SERVERCONF);
 681
 682 }
 683
 684 ###
 685 # m.a.d net2net
 686 ###
 687
 688 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
 689 {
 690         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 691         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 692         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
 693         my $tunmtu =  '';
 694
 695 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 696 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 697
 698   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 699
 700   flock CLIENTCONF, 2;
 701   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
 702   print CLIENTCONF "#\n";
 703   print CLIENTCONF "# User Security\n";
 704   print CLIENTCONF "user nobody\n";
 705   print CLIENTCONF "group nobody\n";
 706   print CLIENTCONF "persist-tun\n";
 707   print CLIENTCONF "persist-key\n";
 708   print CLIENTCONF "script-security 2\n";
 709   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
 710   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
 711   print CLIENTCONF "float\n";
 712   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
 713   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
 714   print CLIENTCONF "# Server Gateway Network\n";
 715   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
 716   print CLIENTCONF "# tun Device\n";
 717   print CLIENTCONF "dev tun\n";
 718   print CLIENTCONF "# Port and Protokol\n";
 719   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
 720
 721   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 722   print CLIENTCONF "proto tcp-client\n";
 723   print CLIENTCONF "# Packet size\n";
 724   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 725   print CLIENTCONF "tun-mtu $tunmtu\n";
 726   }
 727
 728   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 729   print CLIENTCONF "proto udp\n";
 730   print CLIENTCONF "# Paketsize\n";
 731   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 732   print CLIENTCONF "tun-mtu $tunmtu\n";
 733   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 734   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
 735   }
 736
 737   print CLIENTCONF "ns-cert-type server\n";
 738   print CLIENTCONF "# Auth. Client\n";
 739   print CLIENTCONF "tls-client\n";
 740   print CLIENTCONF "# Cipher\n";
 741   print CLIENTCONF "cipher AES-256-CBC\n";
 742   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
 743   if ($cgiparams{'COMPLZO'} eq 'on') {
 744    print CLIENTCONF "# Enable Compression\n";
 745    print CLIENTCONF "comp-lzo\r\n";
 746      }
 747   print CLIENTCONF "# Debug Level\n";
 748   print CLIENTCONF "verb 3\n";
 749   print CLIENTCONF "# Tunnel check\n";
 750   print CLIENTCONF "keepalive 10 60\n";
 751   print CLIENTCONF "# Start as daemon\n";
 752   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
 753   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 754   print CLIENTCONF "# Activate Management Interface and Port\n";
 755   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 756   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 757   close(CLIENTCONF);
 758
 759 }
 760
 761 ###
 762 ### Save main settings
 763 ###
 764
 765
 766 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
 767     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 768     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 769     #DAN this value has to leave.
 770     if ($cgiparams{'ENABLED'} eq 'on'){
 771         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
 772                 $errormessage = $Lang::tr{'invalid input for hostname'};
 773         goto SETTINGS_ERROR;
 774         }
 775     }
 776     if ($cgiparams{'ENABLED'} eq 'on'){
 777         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
 778     }
 779     if ($errormessage) { goto SETTINGS_ERROR; }
 780
 781
 782     if ($cgiparams{'ENABLED'} eq 'on'){
 783         &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
 784     }
 785
 786     if ($errormessage) { goto SETTINGS_ERROR; }
 787
 788     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
 789             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
 790         goto SETTINGS_ERROR;
 791     }
 792     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
 793
 794     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
 795         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 796         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
 797         goto SETTINGS_ERROR;
 798     }
 799
 800     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
 801         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 802         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
 803         goto SETTINGS_ERROR;
 804     }
 805
 806     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
 807         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 808         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
 809         goto SETTINGS_ERROR;
 810     }
 811
 812     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
 813         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 814         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
 815         goto SETTINGS_ERROR;
 816     }
 817     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
 818     while (<ALIASES>)
 819     {
 820         chomp($_);
 821         my @tempalias = split(/\,/,$_);
 822         if ($tempalias[1] eq 'on') {
 823             if (&General::IpInSubnet ($tempalias[0] ,
 824                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 825                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
 826             }
 827         }
 828     }
 829     close(ALIASES);
 830     if ($errormessage ne ''){
 831         goto SETTINGS_ERROR;
 832     }
 833     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
 834         $errormessage = $Lang::tr{'invalid input'};
 835         goto SETTINGS_ERROR;
 836     }
 837     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
 838         $errormessage = $Lang::tr{'invalid mtu input'};
 839         goto SETTINGS_ERROR;
 840     }
 841
 842     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
 843         $errormessage = $Lang::tr{'invalid port'};
 844         goto SETTINGS_ERROR;
 845     }
 846     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
 847     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
 848     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
 849     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
 850 #new settings for daemon
 851     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
 852     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
 853     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
 854     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
 855     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
 856     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
 857     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
 858 #wrtie enable
 859
 860   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
 861   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
 862   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
 863 #new settings for daemon
 864     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 865     &writeserverconf();#hier ok
 866 SETTINGS_ERROR:
 867 ###
 868 ### Reset all step 2
 869 ###
 870 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
 871     my $file = '';
 872     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 873
 874     foreach my $key (keys %confighash) {
 875         if ($confighash{$key}[4] eq 'cert') {
 876             delete $confighash{$cgiparams{'$key'}};
 877         }
 878     }
 879     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
 880         unlink $file
 881     }
 882     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
 883         unlink $file
 884     }
 885     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
 886         unlink $file
 887     }
 888     &cleanssldatabase();
 889     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
 890         print FILE "";
 891         close FILE;
 892     }
 893     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 894     #&writeserverconf();
 895 ###
 896 ### Reset all step 1
 897 ###
 898 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
 899     &Header::showhttpheaders();
 900     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
 901     &Header::openbigbox('100%', 'LEFT', '', '');
 902     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
 903     print <<END
 904         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
 905             <tr><td align='center'>
 906                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
 907                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
 908             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
 909                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
 910         </form></table>
 911 END
 912     ;
 913     &Header::closebox();
 914     &Header::closebigbox();
 915     &Header::closepage();
 916     exit (0);
 917
 918 ###
 919 ### Upload CA Certificate
 920 ###
 921 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
 922     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 923
 924     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
 925         $errormessage = $Lang::tr{'name must only contain characters'};
 926         goto UPLOADCA_ERROR;
 927     }
 928
 929     if (length($cgiparams{'CA_NAME'}) >60) {
 930         $errormessage = $Lang::tr{'name too long'};
 931         goto VPNCONF_ERROR;
 932     }
 933
 934     if ($cgiparams{'CA_NAME'} eq 'ca') {
 935         $errormessage = $Lang::tr{'name is invalid'};
 936         goto UPLOAD_CA_ERROR;
 937     }
 938
 939     # Check if there is no other entry with this name
 940     foreach my $key (keys %cahash) {
 941         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
 942             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
 943             goto UPLOADCA_ERROR;
 944         }
 945     }
 946
 947     if (ref ($cgiparams{'FH'}) ne 'Fh') {
 948         $errormessage = $Lang::tr{'there was no file upload'};
 949         goto UPLOADCA_ERROR;
 950     }
 951     # Move uploaded ca to a temporary file
 952     (my $fh, my $filename) = tempfile( );
 953     if (copy ($cgiparams{'FH'}, $fh) != 1) {
 954         $errormessage = $!;
 955         goto UPLOADCA_ERROR;
 956     }
 957     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
 958     if ($temp !~ /CA:TRUE/i) {
 959         $errormessage = $Lang::tr{'not a valid ca certificate'};
 960         unlink ($filename);
 961         goto UPLOADCA_ERROR;
 962     } else {
 963         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
 964         if ($? ne 0) {
 965             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
 966             unlink ($filename);
 967             goto UPLOADCA_ERROR;
 968         }
 969     }
 970
 971     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
 972     $casubject    =~ /Subject: (.*)[\n]/;
 973     $casubject    = $1;
 974     $casubject    =~ s+/Email+, E+;
 975     $casubject    =~ s/ ST=/ S=/;
 976     $casubject    = &Header::cleanhtml($casubject);
 977
 978     my $key = &General::findhasharraykey (\%cahash);
 979     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
 980     $cahash{$key}[1] = $casubject;
 981     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 982 #    system('/usr/local/bin/ipsecctrl', 'R');
 983
 984     UPLOADCA_ERROR:
 985
 986 ###
 987 ### Display ca certificate
 988 ###
 989 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
 990     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 991
 992     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
 993         &Header::showhttpheaders();
 994         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
 995         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
 996         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
 997         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
 998         $output = &Header::cleanhtml($output,"y");
 999         print "<pre>$output</pre>\n";
1000         &Header::closebox();
1001         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1002         &Header::closebigbox();
1003         &Header::closepage();
1004         exit(0);
1005     } else {
1006         $errormessage = $Lang::tr{'invalid key'};
1007     }
1008
1009 ###
1010 ### Download ca certificate
1011 ###
1012 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1013     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1014
1015     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1016         print "Content-Type: application/octet-stream\r\n";
1017         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1018         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1019         exit(0);
1020     } else {
1021         $errormessage = $Lang::tr{'invalid key'};
1022     }
1023
1024 ###
1025 ### Remove ca certificate (step 2)
1026 ###
1027 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1028     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1029     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1030
1031     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1032         foreach my $key (keys %confighash) {
1033             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1034             if ($test =~ /: OK/) {
1035                 # Delete connection
1036 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1037 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1038 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1039 #               }
1040                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1041                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1042                 delete $confighash{$key};
1043                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1044 #               &writeipsecfiles();
1045             }
1046         }
1047         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1048         delete $cahash{$cgiparams{'KEY'}};
1049         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1050 #       system('/usr/local/bin/ipsecctrl', 'R');
1051     } else {
1052         $errormessage = $Lang::tr{'invalid key'};
1053     }
1054 ###
1055 ### Remove ca certificate (step 1)
1056 ###
1057 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1058     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1059     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1060
1061     my $assignedcerts = 0;
1062     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1063         foreach my $key (keys %confighash) {
1064             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1065             if ($test =~ /: OK/) {
1066                 $assignedcerts++;
1067             }
1068         }
1069         if ($assignedcerts) {
1070             &Header::showhttpheaders();
1071             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1072             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1073             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1074             print <<END
1075                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1076                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1077                     <tr><td align='center'>
1078                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1079                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1080                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1081                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1082                 </form></table>
1083 END
1084             ;
1085             &Header::closebox();
1086             &Header::closebigbox();
1087             &Header::closepage();
1088             exit (0);
1089         } else {
1090             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1091             delete $cahash{$cgiparams{'KEY'}};
1092             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1093 #           system('/usr/local/bin/ipsecctrl', 'R');
1094         }
1095     } else {
1096         $errormessage = $Lang::tr{'invalid key'};
1097     }
1098
1099 ###
1100 ### Display root certificate
1101 ###
1102 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1103     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1104     my $output;
1105     &Header::showhttpheaders();
1106     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1107     &Header::openbigbox('100%', 'LEFT', '', '');
1108     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1109         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1110         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1111     } else {
1112         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1113         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1114     }
1115     $output = &Header::cleanhtml($output,"y");
1116     print "<pre>$output</pre>\n";
1117     &Header::closebox();
1118     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1119     &Header::closebigbox();
1120     &Header::closepage();
1121     exit(0);
1122
1123 ###
1124 ### Download root certificate
1125 ###
1126 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1127     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1128         print "Content-Type: application/octet-stream\r\n";
1129         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1130         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1131         exit(0);
1132     }
1133
1134 ###
1135 ### Download host certificate
1136 ###
1137 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1138     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1139         print "Content-Type: application/octet-stream\r\n";
1140         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1141         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1142         exit(0);
1143     }
1144 ###
1145 ### Form for generating a root certificate
1146 ###
1147 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1148          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1149
1150     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1151     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1152         $errormessage = $Lang::tr{'valid root certificate already exists'};
1153         $cgiparams{'ACTION'} = '';
1154         goto ROOTCERT_ERROR;
1155     }
1156
1157     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1158         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1159             my $ipaddr = <IPADDR>;
1160             close IPADDR;
1161             chomp ($ipaddr);
1162             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1163             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1164                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1165             }
1166         }
1167     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1168
1169         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1170             $errormessage = $Lang::tr{'there was no file upload'};
1171             goto ROOTCERT_ERROR;
1172         }
1173
1174         # Move uploaded certificate request to a temporary file
1175         (my $fh, my $filename) = tempfile( );
1176         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1177             $errormessage = $!;
1178             goto ROOTCERT_ERROR;
1179         }
1180
1181         # Create a temporary dirctory
1182         my $tempdir = tempdir( CLEANUP => 1 );
1183
1184         # Extract the CA certificate from the file
1185         my $pid = open(OPENSSL, "|-");
1186         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1187         if ($pid) {     # parent
1188             if ($cgiparams{'P12_PASS'} ne '') {
1189                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1190             }
1191             close (OPENSSL);
1192             if ($?) {
1193                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1194                 unlink ($filename);
1195                 goto ROOTCERT_ERROR;
1196             }
1197         } else {        # child
1198             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1199                     '-in', $filename,
1200                     '-out', "$tempdir/cacert.pem")) {
1201                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1202                 unlink ($filename);
1203                 goto ROOTCERT_ERROR;
1204             }
1205         }
1206
1207         # Extract the Host certificate from the file
1208         $pid = open(OPENSSL, "|-");
1209         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1210         if ($pid) {     # parent
1211             if ($cgiparams{'P12_PASS'} ne '') {
1212                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1213             }
1214             close (OPENSSL);
1215             if ($?) {
1216                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1217                 unlink ($filename);
1218                 goto ROOTCERT_ERROR;
1219             }
1220         } else {        # child
1221             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1222                     '-in', $filename,
1223                     '-out', "$tempdir/hostcert.pem")) {
1224                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1225                 unlink ($filename);
1226                 goto ROOTCERT_ERROR;
1227             }
1228         }
1229
1230         # Extract the Host key from the file
1231         $pid = open(OPENSSL, "|-");
1232         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1233         if ($pid) {     # parent
1234             if ($cgiparams{'P12_PASS'} ne '') {
1235                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1236             }
1237             close (OPENSSL);
1238             if ($?) {
1239                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1240                 unlink ($filename);
1241                 goto ROOTCERT_ERROR;
1242             }
1243         } else {        # child
1244             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1245                     '-nodes',
1246                     '-in', $filename,
1247                     '-out', "$tempdir/serverkey.pem")) {
1248                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1249                 unlink ($filename);
1250                 goto ROOTCERT_ERROR;
1251             }
1252         }
1253
1254         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1255         if ($? ne 0) {
1256             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1257             unlink ($filename);
1258             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1259             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1260             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1261             goto ROOTCERT_ERROR;
1262         }
1263
1264         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1265         if ($? ne 0) {
1266             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1267             unlink ($filename);
1268             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1269             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1270             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1271             goto ROOTCERT_ERROR;
1272         }
1273
1274         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1275         if ($? ne 0) {
1276             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1277             unlink ($filename);
1278             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1279             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1280             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1281             goto ROOTCERT_ERROR;
1282         }
1283
1284         goto ROOTCERT_SUCCESS;
1285
1286     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1287
1288         # Validate input since the form was submitted
1289         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1290             $errormessage = $Lang::tr{'organization cant be empty'};
1291             goto ROOTCERT_ERROR;
1292         }
1293         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1294             $errormessage = $Lang::tr{'organization too long'};
1295             goto ROOTCERT_ERROR;
1296         }
1297         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1298             $errormessage = $Lang::tr{'invalid input for organization'};
1299             goto ROOTCERT_ERROR;
1300         }
1301         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1302             $errormessage = $Lang::tr{'hostname cant be empty'};
1303             goto ROOTCERT_ERROR;
1304         }
1305         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1306             $errormessage = $Lang::tr{'invalid input for hostname'};
1307             goto ROOTCERT_ERROR;
1308         }
1309         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1310             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1311             goto ROOTCERT_ERROR;
1312         }
1313         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1314             $errormessage = $Lang::tr{'e-mail address too long'};
1315             goto ROOTCERT_ERROR;
1316         }
1317         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1318             $errormessage = $Lang::tr{'invalid input for department'};
1319             goto ROOTCERT_ERROR;
1320         }
1321         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1322             $errormessage = $Lang::tr{'invalid input for city'};
1323             goto ROOTCERT_ERROR;
1324         }
1325         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1326             $errormessage = $Lang::tr{'invalid input for state or province'};
1327             goto ROOTCERT_ERROR;
1328         }
1329         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1330             $errormessage = $Lang::tr{'invalid input for country'};
1331             goto ROOTCERT_ERROR;
1332         }
1333
1334         # Copy the cgisettings to vpnsettings and save the configfile
1335         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1336         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1337         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1338         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1339         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1340         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1341         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1342         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1343
1344         # Replace empty strings with a .
1345         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1346         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1347         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1348
1349         # refresh
1350         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1351
1352         # Create the CA certificate
1353         my $pid = open(OPENSSL, "|-");
1354         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1355         if ($pid) {     # parent
1356             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1357             print OPENSSL "$state\n";
1358             print OPENSSL "$city\n";
1359             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1360             print OPENSSL "$ou\n";
1361             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1362             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1363             close (OPENSSL);
1364             if ($?) {
1365                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1366                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1367                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1368                 goto ROOTCERT_ERROR;
1369             }
1370         } else {        # child
1371             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1372                         '-days', '999999', '-newkey', 'rsa:2048',
1373                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1374                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1375                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1376                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1377                 goto ROOTCERT_ERROR;
1378             }
1379         }
1380
1381         # Create the Host certificate request
1382         $pid = open(OPENSSL, "|-");
1383         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1384         if ($pid) {     # parent
1385             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1386             print OPENSSL "$state\n";
1387             print OPENSSL "$city\n";
1388             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1389             print OPENSSL "$ou\n";
1390             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1391             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1392             print OPENSSL ".\n";
1393             print OPENSSL ".\n";
1394             close (OPENSSL);
1395             if ($?) {
1396                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1397                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1398                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1399                 goto ROOTCERT_ERROR;
1400             }
1401         } else {        # child
1402             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1403                         '-newkey', 'rsa:1024',
1404                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1405                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1406                         '-extensions', 'server',
1407                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1408                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1409                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1410                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1411                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1412                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1413                 goto ROOTCERT_ERROR;
1414             }
1415         }
1416
1417         # Sign the host certificate request
1418         system('/usr/bin/openssl', 'ca', '-days', '999999',
1419                 '-batch', '-notext',
1420                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1421                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1422                 '-extensions', 'server',
1423                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1424         if ($?) {
1425             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1426             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1427             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1428             unlink ("${General::swroot}/ovpn/serverkey.pem");
1429             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1430             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1431             &newcleanssldatabase();
1432             goto ROOTCERT_ERROR;
1433         } else {
1434             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1435             &deletebackupcert();
1436         }
1437
1438         # Create an empty CRL
1439         system('/usr/bin/openssl', 'ca', '-gencrl',
1440                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1441                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1442         if ($?) {
1443             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1444             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1445             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1446             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1447             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1448             &cleanssldatabase();
1449             goto ROOTCERT_ERROR;
1450 #       } else {
1451 #           &cleanssldatabase();
1452         }
1453         # Create Diffie Hellmann Parameter
1454         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1455                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1456                '1024' );
1457         if ($?) {
1458             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1459             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1460             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1461             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1462             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1463             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1464             &cleanssldatabase();
1465             goto ROOTCERT_ERROR;
1466 #       } else {
1467 #           &cleanssldatabase();
1468         }
1469         goto ROOTCERT_SUCCESS;
1470     }
1471     ROOTCERT_ERROR:
1472     if ($cgiparams{'ACTION'} ne '') {
1473         &Header::showhttpheaders();
1474         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1475         &Header::openbigbox('100%', 'LEFT', '', '');
1476         if ($errormessage) {
1477             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1478             print "<class name='base'>$errormessage";
1479             print "&nbsp;</class>";
1480             &Header::closebox();
1481         }
1482         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1483         print <<END
1484         <form method='post' enctype='multipart/form-data'>
1485         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1486         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1487             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1488             <td width='35%' colspan='2'>&nbsp;</td></tr>
1489         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1490             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1491             <td colspan='2'>&nbsp;</td></tr>
1492         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1493             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1494             <td colspan='2'>&nbsp;</td></tr>
1495         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1496             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1497             <td colspan='2'>&nbsp;</td></tr>
1498         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1499             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1500             <td colspan='2'>&nbsp;</td></tr>
1501         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1502             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1503             <td colspan='2'>&nbsp;</td></tr>
1504         <tr><td class='base'>$Lang::tr{'country'}:</td>
1505             <td class='base'><select name='ROOTCERT_COUNTRY'>
1506
1507 END
1508         ;
1509         foreach my $country (sort keys %{Countries::countries}) {
1510             print "<option value='$Countries::countries{$country}'";
1511             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1512                 print " selected='selected'";
1513             }
1514             print ">$country</option>";
1515         }
1516         print <<END
1517             </select></td>
1518             <td colspan='2'>&nbsp;</td></tr>
1519         <tr><td>&nbsp;</td>
1520             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1521             <td>&nbsp;</td><td>&nbsp;</td></tr>
1522         <tr><td class='base' colspan='4' align='left'>
1523             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1524         <tr><td class='base' colspan='4' align='left'>
1525             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1526             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1527         </td></tr>
1528         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1529         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1530             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1531             <td colspan='2'>&nbsp;</td></tr>
1532         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1533             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1534             <td colspan='2'>&nbsp;</td></tr>
1535         <tr><td>&nbsp;</td>
1536             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1537             <td colspan='2'>&nbsp;</td></tr>
1538         <tr><td class='base' colspan='4' align='left'>
1539             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1540         </form></table>
1541 END
1542         ;
1543         &Header::closebox();
1544
1545         &Header::closebigbox();
1546         &Header::closepage();
1547         exit(0)
1548     }
1549
1550     ROOTCERT_SUCCESS:
1551     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1552 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1553 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1554 #       system('/usr/local/bin/ipsecctrl', 'S');
1555 #    }
1556
1557 ###
1558 ### Enable/Disable connection
1559 ###
1560
1561 ###
1562 # m.a.d net2net
1563 ###
1564
1565 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1566
1567     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1568     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1569 #    my $n2nactive = '';
1570     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1571
1572     if ($confighash{$cgiparams{'KEY'}}) {
1573
1574
1575         if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1576             $confighash{$cgiparams{'KEY'}}[0] = 'on';
1577             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1578
1579      if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1580                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1581           }
1582
1583   } else {
1584
1585             $confighash{$cgiparams{'KEY'}}[0] = 'off';
1586       &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1587
1588           if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1589                     if ($n2nactive ne ''){
1590                     system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1591            }
1592
1593           } else {
1594                   $errormessage = $Lang::tr{'invalid key'};
1595           }
1596       }
1597   }
1598
1599 ###
1600 ### Download OpenVPN client package
1601 ###
1602
1603
1604 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1605     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1606     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1607     my $file = '';
1608     my $clientovpn = '';
1609     my @fileholder;
1610     my $tempdir = tempdir( CLEANUP => 1 );
1611     my $zippath = "$tempdir/";
1612
1613 ###
1614 # m.a.d net2net
1615 ###
1616
1617 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1618
1619         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1620         my $zippathname = "$zippath$zipname";
1621         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1622         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1623         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1624         my $tunmtu = '';
1625         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1626         my $n2nfragment = '';
1627
1628     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1629     flock CLIENTCONF, 2;
1630
1631     my $zip = Archive::Zip->new();
1632    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1633    print CLIENTCONF "# \n";
1634    print CLIENTCONF "# User Security\n";
1635    print CLIENTCONF "user nobody\n";
1636    print CLIENTCONF "group nobody\n";
1637    print CLIENTCONF "persist-tun\n";
1638    print CLIENTCONF "persist-key\n";
1639    print CLIENTCONF "script-security 2\n";
1640    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1641    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1642    print CLIENTCONF "float\n";
1643    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1644    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1645    print CLIENTCONF "# Server Gateway Network\n";
1646    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1647    print CLIENTCONF "# tun Device\n";
1648    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1649    print CLIENTCONF "# Port and Protokoll\n";
1650    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1651
1652    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1653    print CLIENTCONF "proto tcp-client\n";
1654    print CLIENTCONF "# Packet size\n";
1655    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1656    print CLIENTCONF "tun-mtu $tunmtu\n";
1657    }
1658
1659    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1660    print CLIENTCONF "proto udp\n";
1661    print CLIENTCONF "# Paketsize\n";
1662    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1663    print CLIENTCONF "tun-mtu $tunmtu\n";
1664    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1665    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1666    }
1667    print CLIENTCONF "ns-cert-type server\n";
1668    print CLIENTCONF "# Auth. Client\n";
1669    print CLIENTCONF "tls-client\n";
1670    print CLIENTCONF "# Cipher\n";
1671    print CLIENTCONF "cipher AES-256-CBC\n";
1672     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1673          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1674      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1675    }
1676     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1677    print CLIENTCONF "# Enable Compression\n";
1678    print CLIENTCONF "comp-lzo\r\n";
1679      }
1680    print CLIENTCONF "# Debug Level\n";
1681    print CLIENTCONF "verb 3\n";
1682    print CLIENTCONF "# Tunnel check\n";
1683    print CLIENTCONF "keepalive 10 60\n";
1684    print CLIENTCONF "# Start as daemon\n";
1685    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1686    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
1687    print CLIENTCONF "# Activate Management Interface and Port\n";
1688    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
1689     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
1690    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
1691
1692
1693     close(CLIENTCONF);
1694
1695     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1696     my $status = $zip->writeToFileNamed($zippathname);
1697
1698     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1699     @fileholder = <DLFILE>;
1700     print "Content-Type:application/x-download\n";
1701     print "Content-Disposition:attachment;filename=$zipname\n\n";
1702     print @fileholder;
1703     exit (0);
1704 }
1705 else
1706 {
1707         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1708         my $zippathname = "$zippath$zipname";
1709         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1710
1711 ###
1712 # m.a.d net2net
1713 ###
1714
1715     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1716     flock CLIENTCONF, 2;
1717
1718     my $zip = Archive::Zip->new();
1719
1720     print CLIENTCONF "#OpenVPN Server conf\r\n";
1721     print CLIENTCONF "tls-client\r\n";
1722     print CLIENTCONF "client\r\n";
1723     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
1724     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
1725     print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1726     if ( $vpnsettings{'ENABLED'} eq 'on'){
1727         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
1728         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1729             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1730             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1731         }
1732         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1733             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1734             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1735         }
1736     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1737         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1738         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1739             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1740             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1741         }
1742     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1743         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1744     }
1745
1746     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1747         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1748         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1749     } else {
1750         print CLIENTCONF "ca cacert.pem\r\n";
1751         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1752         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1753         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
1754         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
1755     }
1756     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1757     if ($vpnsettings{DCOMPLZO} eq 'on') {
1758         print CLIENTCONF "comp-lzo\r\n";
1759     }
1760     print CLIENTCONF "verb 3\r\n";
1761     print CLIENTCONF "ns-cert-type server\r\n";
1762     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1763     if ($vpnsettings{MSSFIX} eq 'on') {
1764         print CLIENTCONF "mssfix\r\n";
1765     }
1766     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
1767         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1768     }
1769     close(CLIENTCONF);
1770
1771     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1772     my $status = $zip->writeToFileNamed($zippathname);
1773
1774     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1775     @fileholder = <DLFILE>;
1776     print "Content-Type:application/x-download\n";
1777     print "Content-Disposition:attachment;filename=$zipname\n\n";
1778     print @fileholder;
1779     exit (0);
1780    }
1781
1782
1783
1784 ###
1785 ### Remove connection
1786 ###
1787
1788
1789 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1790     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1791     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1792
1793     if ($confighash{$cgiparams{'KEY'}}) {
1794 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
1795 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1796 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1797 #       }
1798 #
1799         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1800
1801 ###
1802 # m.a.d net2net
1803 ###
1804
1805  if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1806
1807         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1808   my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1809   unlink ($certfile) or die "Removing $certfile fail: $!";
1810   unlink ($conffile) or die "Removing $conffile fail: $!";
1811   rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1812
1813 }
1814
1815   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1816         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1817         delete $confighash{$cgiparams{'KEY'}};
1818         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1819         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1820         #&writeserverconf();
1821     } else {
1822         $errormessage = $Lang::tr{'invalid key'};
1823     }
1824
1825
1826 ###
1827 ### Download PKCS12 file
1828 ###
1829 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1830     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1831
1832     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1833     print "Content-Type: application/octet-stream\r\n\r\n";
1834     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1835     exit (0);
1836
1837 ###
1838 ### Display certificate
1839 ###
1840 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1841     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1842
1843     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1844         &Header::showhttpheaders();
1845         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1846         &Header::openbigbox('100%', 'LEFT', '', '');
1847         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1848         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1849         $output = &Header::cleanhtml($output,"y");
1850         print "<pre>$output</pre>\n";
1851         &Header::closebox();
1852         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1853         &Header::closebigbox();
1854         &Header::closepage();
1855         exit(0);
1856     }
1857 ###
1858 ### Display Certificate Revoke List
1859 ###
1860 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
1861 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1862
1863     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
1864         &Header::showhttpheaders();
1865         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1866         &Header::openbigbox('100%', 'LEFT', '', '');
1867         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1868         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1869         $output = &Header::cleanhtml($output,"y");
1870         print "<pre>$output</pre>\n";
1871         &Header::closebox();
1872         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1873         &Header::closebigbox();
1874         &Header::closepage();
1875         exit(0);
1876     }
1877
1878 ###
1879 ### Advanced Server Settings
1880 ###
1881
1882 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1883     %cgiparams = ();
1884     %cahash = ();
1885     %confighash = ();
1886     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
1887     read_routepushfile;
1888
1889 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1890 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
1891 #    }
1892 ADV_ERROR:
1893     if ($cgiparams{'MAX_CLIENTS'} eq '') {
1894         $cgiparams{'MAX_CLIENTS'} =  '100';
1895     }
1896
1897     if ($cgiparams{'KEEPALIVE_1'} eq '') {
1898         $cgiparams{'KEEPALIVE_1'} =  '10';
1899     }
1900     if ($cgiparams{'KEEPALIVE_2'} eq '') {
1901         $cgiparams{'KEEPALIVE_2'} =  '60';
1902     }
1903     if ($cgiparams{'LOG_VERB'} eq '') {
1904         $cgiparams{'LOG_VERB'} =  '3';
1905     }
1906     $checked{'CLIENT2CLIENT'}{'off'} = '';
1907     $checked{'CLIENT2CLIENT'}{'on'} = '';
1908     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1909     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1910     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1911     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
1912     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1913     $checked{'MSSFIX'}{'off'} = '';
1914     $checked{'MSSFIX'}{'on'} = '';
1915     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
1916     $selected{'LOG_VERB'}{'1'} = '';
1917     $selected{'LOG_VERB'}{'2'} = '';
1918     $selected{'LOG_VERB'}{'3'} = '';
1919     $selected{'LOG_VERB'}{'4'} = '';
1920     $selected{'LOG_VERB'}{'5'} = '';
1921     $selected{'LOG_VERB'}{'6'} = '';
1922     $selected{'LOG_VERB'}{'7'} = '';
1923     $selected{'LOG_VERB'}{'8'} = '';
1924     $selected{'LOG_VERB'}{'9'} = '';
1925     $selected{'LOG_VERB'}{'10'} = '';
1926     $selected{'LOG_VERB'}{'11'} = '';
1927     $selected{'LOG_VERB'}{'0'} = '';
1928     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
1929
1930
1931
1932     &Header::showhttpheaders();
1933     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1934     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1935     if ($errormessage) {
1936         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1937         print "<class name='base'>$errormessage\n";
1938         print "&nbsp;</class>\n";
1939         &Header::closebox();
1940     }
1941     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1942     print <<END
1943     <form method='post' enctype='multipart/form-data'>
1944     <table width='100%'>
1945     <tr>
1946         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1947     </tr>
1948     <tr>
1949         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1950     </tr>
1951     <tr>
1952         <td class='base'>Domain</td>
1953         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1954     </tr>
1955     <tr>
1956         <td class='base'>DNS</td>
1957         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1958     </tr>
1959     <tr>
1960         <td class='base'>WINS</td>
1961         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
1962        </tr>
1963     <tr>
1964         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
1965     </tr>
1966     <tr>
1967         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
1968   <td colspan='2'>
1969        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
1970 END
1971 ;
1972
1973 if ($cgiparams{'ROUTES_PUSH'} ne '')
1974 {
1975         print $cgiparams{'ROUTES_PUSH'};
1976 }
1977
1978 print <<END
1979 </textarea></td>
1980 </tr>
1981     </tr>
1982 </table>
1983 <hr size='1'>
1984     <table width='100%'>
1985     <tr>
1986         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1987     </tr>
1988     <tr>
1989         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
1990     </tr>
1991     <tr>
1992         <td class='base'>Client-To-Client</td>
1993         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
1994     </tr>
1995     <tr>
1996         <td class='base'>Redirect-Gateway def1</td>
1997         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
1998     </tr>
1999     <tr>
2000         <td class='base'>Max-Clients</td>
2001         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2002     </tr>
2003         <tr>
2004           <td class='base'>Keppalive <br />
2005             (ping/ping-restart)</td>
2006           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2007           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2008     </tr>
2009         <tr>
2010           <td class='base'>fragment <br></td>
2011           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2012         <td>Default: <span class="base">1300</span></td>
2013       </tr>
2014         <tr>
2015           <td class='base'>mssfix</td>
2016           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2017           <td>Default: on</td>
2018           </tr>
2019 </table>
2020
2021 <!--
2022 <hr size='1'>
2023     <table width='100%'>
2024     <tr>
2025  <td class'base'><b>Crypto-Engines</b></td>
2026     </tr>
2027     <tr>
2028         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2029     </tr>
2030     <tr><td class='base'>Engines:</td>
2031         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2032                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2033                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2034                         </select>
2035                 </td>
2036 </table>
2037 -->
2038 <hr size='1'>
2039     <table width='100%'>
2040     <tr>
2041         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2042     </tr>
2043     <tr>
2044         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2045     </tr>
2046
2047     <tr><td class='base'>VERB</td>
2048         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2049                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2050                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2051                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2052                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2053                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2054                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2055                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2056                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2057                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2058                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2059                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2060 </table>
2061 <hr size='1'>
2062 <table width='100%'>
2063 <tr>
2064     <td>&nbsp;</td>
2065     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2066     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2067     <td>&nbsp;</td>
2068 </tr>
2069 </table>
2070 </form>
2071 END
2072 ;
2073
2074     &Header::closebox();
2075 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2076     &Header::closebigbox();
2077     &Header::closepage();
2078     exit(0);
2079
2080 ###
2081 ### Openvpn Connections Statistics
2082 ###
2083 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2084         &Header::showhttpheaders();
2085         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2086         &Header::openbigbox('100%', 'LEFT', '', '');
2087     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2088
2089 #
2090 #       <td><b>$Lang::tr{'protocol'}</b></td>
2091 # protocol temp removed
2092     print <<END
2093     <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2094     <tr>
2095         <td><b>$Lang::tr{'common name'}</b></td>
2096         <td><b>$Lang::tr{'real address'}</b></td>
2097         <td><b>$Lang::tr{'virtual address'}</b></td>
2098         <td><b>$Lang::tr{'loged in at'}</b></td>
2099         <td><b>$Lang::tr{'bytes sent'}</b></td>
2100         <td><b>$Lang::tr{'bytes received'}</b></td>
2101         <td><b>$Lang::tr{'last activity'}</b></td>
2102     </tr>
2103 END
2104 ;
2105         my $filename = "/var/log/ovpnserver.log";
2106         open(FILE, $filename) or die 'Unable to open config file.';
2107         my @current = <FILE>;
2108         close(FILE);
2109         my @users =();
2110         my $status;
2111         my $uid = 0;
2112         my $cn;
2113         my @match = ();
2114         my $proto = "udp";
2115         my $address;
2116         my %userlookup = ();
2117         foreach my $line (@current)
2118         {
2119             chomp($line);
2120             if ( $line =~ /^Updated,(.+)/){
2121                 @match = split( /^Updated,(.+)/, $line);
2122                 $status = $match[1];
2123             }
2124 #gian
2125             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2126                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2127                 if ($match[1] ne "Common Name") {
2128                     $cn = $match[1];
2129                     $userlookup{$match[2]} = $uid;
2130                     $users[$uid]{'CommonName'} = $match[1];
2131                     $users[$uid]{'RealAddress'} = $match[2];
2132                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2133                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2134                     $users[$uid]{'Since'} = $match[5];
2135                     $users[$uid]{'Proto'} = $proto;
2136                     $uid++;
2137                 }
2138             }
2139             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2140                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2141                 if ($match[1] ne "Virtual Address") {
2142                     $address = $match[3];
2143                     #find the uid in the lookup table
2144                     $uid = $userlookup{$address};
2145                     $users[$uid]{'VirtualAddress'} = $match[1];
2146                     $users[$uid]{'LastRef'} = $match[4];
2147                 }
2148             }
2149         }
2150         my $user2 = @users;
2151         if ($user2 >= 1){
2152             for (my $idx = 1; $idx <= $user2; $idx++){
2153                                                 if ($idx % 2) {
2154                                         print "<tr bgcolor='$color{'color20'}'>\n";
2155                                 } else {
2156                                         print "<tr bgcolor='$color{'color22'}'>\n";
2157                                                 }
2158                                                 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2159                                                 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2160                                                 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2161                                                 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2162                                                 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2163                                                 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2164                                                 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2165 #                       print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2166             }
2167         }
2168
2169         print "</table>";
2170         print <<END
2171         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2172         <tr><td></td></tr>
2173         <tr><td></td></tr>
2174         <tr><td></td></tr>
2175         <tr><td></td></tr>
2176         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2177         </table>
2178 END
2179 ;
2180         &Header::closebox();
2181         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2182         &Header::closebigbox();
2183         &Header::closepage();
2184         exit(0);
2185
2186 ###
2187 ### Download Certificate
2188 ###
2189 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2190     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2191
2192     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2193         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2194         print "Content-Type: application/octet-stream\r\n\r\n";
2195         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2196         exit (0);
2197     }
2198
2199 ###
2200 ### Enable/Disable connection
2201 ###
2202
2203 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2204
2205     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2206     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2207
2208     if ($confighash{$cgiparams{'KEY'}}) {
2209            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2210             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2211             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2212             #&writeserverconf();
2213 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2214 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2215 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2216 #           }
2217         } else {
2218             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2219 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2220 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2221 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2222 #           }
2223             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2224             #&writeserverconf();
2225         }
2226     } else {
2227         $errormessage = $Lang::tr{'invalid key'};
2228     }
2229
2230 ###
2231 ### Restart connection
2232 ###
2233 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2234     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2235     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2236
2237     if ($confighash{$cgiparams{'KEY'}}) {
2238 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2239 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2240 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2241 #       }
2242     } else {
2243         $errormessage = $Lang::tr{'invalid key'};
2244     }
2245
2246 ###
2247 ### Remove connection
2248 ###
2249 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2250     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2251     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2252
2253     if ($confighash{$cgiparams{'KEY'}}) {
2254 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2255 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2256 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2257 #       }
2258         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2259         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2260         delete $confighash{$cgiparams{'KEY'}};
2261         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2262         #&writeserverconf();
2263     } else {
2264         $errormessage = $Lang::tr{'invalid key'};
2265     }
2266 #test33
2267
2268 ###
2269 ### Choose between adding a host-net or net-net connection
2270 ###
2271
2272 ###
2273 # m.a.d net2net
2274 ###
2275
2276 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2277         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2278         &Header::showhttpheaders();
2279         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2280         &Header::openbigbox('100%', 'LEFT', '', '');
2281         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2282
2283 if ( -s "${General::swroot}/ovpn/settings") {
2284
2285         print <<END
2286             <b>$Lang::tr{'connection type'}:</b><br />
2287             <table><form method='post' ENCTYPE="multipart/form-data">
2288             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2289                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2290             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2291                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2292                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2293                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2294           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2295           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2296     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'><td class='base'>Default : Client Packagename</td></td></tr>
2297           <tr><td colspan='3'><hr /></td></tr>
2298     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2299           <tr><td>&nbsp;</td></tr>
2300           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2301             </form></table>
2302 END
2303         ;
2304
2305 } else {
2306         print <<END
2307                     <b>$Lang::tr{'connection type'}:</b><br />
2308             <table><form method='post' ENCTYPE="multipart/form-data">
2309             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2310             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2311             </form></table>
2312 END
2313         ;
2314
2315 }
2316
2317         &Header::closebox();
2318         &Header::closebigbox();
2319         &Header::closepage();
2320         exit (0);
2321
2322 ###
2323 # m.a.d net2net
2324 ###
2325
2326 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2327
2328         my @firen2nconf;
2329         my @confdetails;
2330         my $uplconffilename ='';
2331         my $uplconffilename2 ='';
2332         my $uplp12name = '';
2333         my $uplp12name2 = '';
2334         my @rem_subnet;
2335         my @rem_subnet2;
2336         my @tmposupnet3;
2337         my $key;
2338         my @n2nname;
2339
2340         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2341
2342 # Check if a file is uploaded
2343
2344         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2345                 $errormessage = $Lang::tr{'there was no file upload'};
2346                 goto N2N_ERROR;
2347     }
2348
2349 # Move uploaded IPfire n2n package to temporary file
2350
2351     (my $fh, my $filename) = tempfile( );
2352     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2353                 $errormessage = $!;
2354                 goto N2N_ERROR;
2355     }
2356
2357         my $zip = Archive::Zip->new();
2358         my $zipName = $filename;
2359         my $status = $zip->read( $zipName );
2360         if ($status != AZ_OK) {
2361                 $errormessage = "Read of $zipName failed\n";
2362                 goto N2N_ERROR;
2363         }
2364
2365         my $tempdir = tempdir( CLEANUP => 1 );
2366         my @files = $zip->memberNames();
2367         for(@files) {
2368         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2369         }
2370         my $countfiles = @files;
2371
2372 # Check if we have not more then 2 files
2373
2374         if ( $countfiles == 2){
2375                 foreach (@files){
2376                         if ( $_ =~ /.conf$/){
2377                                 $uplconffilename = $_;
2378                         }
2379                         if ( $_ =~ /.p12$/){
2380                                 $uplp12name = $_;
2381                         }
2382                 }
2383                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2384                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2385                         goto N2N_ERROR;
2386                 }
2387
2388                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2389                 @firen2nconf = <FILE>;
2390                 close (FILE);
2391                 chomp(@firen2nconf);
2392
2393         } else {
2394
2395                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2396                 goto N2N_ERROR;
2397         }
2398
2399 ###
2400 # m.a.d net2net
2401 ###
2402
2403  if ($cgiparams{'n2nname'} ne ''){
2404
2405   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2406   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2407   $n2nname[0] = $cgiparams{'n2nname'};
2408   my @n2nname2 = split(/\./,$uplconffilename);
2409   $n2nname2[0] =~ s/\n|\r//g;
2410   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2411         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2412         my $input2 = "$n2nname2[0]n2n";
2413   my $output2 = "$n2nname[0]n2n";
2414   my $filename = "$tempdir/$uplconffilename";
2415   open(FILE, "< $filename") or die 'Unable to open config file.';
2416         my @current = <FILE>;
2417         close(FILE);
2418         foreach (@current) {s/$input1/$output1/g;}
2419         foreach (@current) {s/$input2/$output2/g;}
2420   open (OUT, "> $filename") || die 'Unable to open config file.';
2421   print OUT @current;
2422   close OUT;
2423
2424     }else{
2425     $uplconffilename2 =  $uplconffilename;
2426     $uplp12name2 = $uplp12name;
2427     @n2nname = split(/\./,$uplconffilename);
2428     $n2nname[0] =~ s/\n|\r//g;
2429    }
2430     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2431     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2432
2433         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
2434
2435         if ($? ne 0) {
2436             $errormessage = "*.conf move failed: $!";
2437             unlink ($filename);
2438             goto N2N_ERROR;
2439         }
2440
2441         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
2442         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2443
2444         if ($? ne 0) {
2445             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2446             unlink ($filename);
2447             goto N2N_ERROR;
2448         }
2449
2450 my $complzoactive;
2451 my $mssfixactive;
2452 my $n2nfragment;
2453 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2454 my @n2nproto = split(/-/, $n2nproto2[1]);
2455 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2456 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2457 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2458 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2459 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
2460 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2461 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
2462 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
2463 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2464 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2465 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
2466 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2467 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
2468 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2469
2470
2471 ###
2472 # m.a.d delete CR and LF from arrays for this chomp doesnt work
2473 ###
2474
2475 $n2nremote[1] =~ s/\n|\r//g;
2476 $n2novpnsub[0] =~ s/\n|\r//g;
2477 $n2novpnsub[1] =~ s/\n|\r//g;
2478 $n2novpnsub[2] =~ s/\n|\r//g;
2479 $n2nproto[0] =~ s/\n|\r//g;
2480 $n2nport[1] =~ s/\n|\r//g;
2481 $n2ntunmtu[1] =~ s/\n|\r//g;
2482 $n2nremsub[1] =~ s/\n|\r//g;
2483 $n2nremsub[2] =~ s/\n|\r//g;
2484 $n2nlocalsub[2] =~ s/\n|\r//g;
2485 $n2nfragment[1] =~ s/\n|\r//g;
2486 $n2nmgmt[2] =~ s/\n|\r//g;
2487 chomp ($complzoactive);
2488 chomp ($mssfixactive);
2489
2490 ###
2491 # m.a.d net2net
2492 ###
2493
2494 ###
2495 # Check if there is no other entry with this name
2496 ###
2497
2498         foreach my $dkey (keys %confighash) {
2499                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2500                         $errormessage = $Lang::tr{'a connection with this name already exists'};
2501                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2502             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2503       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2504                         goto N2N_ERROR;
2505                 }
2506         }
2507
2508 ###
2509 # Check if OpenVPN Subnet is valid
2510 ###
2511
2512 foreach my $dkey (keys %confighash) {
2513                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2514                         $errormessage = 'The OpenVPN Subnet is already in use';
2515                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2516             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2517       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2518                         goto N2N_ERROR;
2519                 }
2520         }
2521
2522 ###
2523 # Check im Dest Port is vaild
2524 ###
2525
2526 foreach my $dkey (keys %confighash) {
2527                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2528                         $errormessage = 'The OpenVPN Port is already in use';
2529                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2530             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2531       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2532                         goto N2N_ERROR;
2533                 }
2534         }
2535
2536
2537
2538   $key = &General::findhasharraykey (\%confighash);
2539
2540         foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2541         $confighash{$key}[0] = 'off';
2542         $confighash{$key}[1] = $n2nname[0];
2543   $confighash{$key}[2] = $n2nname[0];
2544         $confighash{$key}[3] = 'net';
2545         $confighash{$key}[4] = 'cert';
2546         $confighash{$key}[6] = 'client';
2547         $confighash{$key}[8] =  $n2nlocalsub[2];
2548   $confighash{$key}[10] = $n2nremote[1];
2549   $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
2550         $confighash{$key}[22] = $n2nmgmt[2];
2551   $confighash{$key}[23] = $mssfixactive;
2552         $confighash{$key}[24] = $n2nfragment[1];
2553   $confighash{$key}[25] = 'IPFire n2n Client';
2554         $confighash{$key}[26] = 'red';
2555   $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
2556   $confighash{$key}[28] = $n2nproto[0];
2557   $confighash{$key}[29] = $n2nport[1];
2558   $confighash{$key}[30] = $complzoactive;
2559   $confighash{$key}[31] = $n2ntunmtu[1];
2560
2561
2562   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2563
2564   N2N_ERROR:
2565
2566         &Header::showhttpheaders();
2567         &Header::openpage('Validate imported configuration', 1, '');
2568         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2569         if ($errormessage) {
2570             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2571             print "<class name='base'>$errormessage";
2572             print "&nbsp;</class>";
2573             &Header::closebox();
2574
2575         } else
2576   {
2577                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2578         }
2579         if ($errormessage eq ''){
2580                 print <<END
2581                 <!-- ipfire net2net config gui -->
2582                 <table width='100%'>
2583                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2584     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2585     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2586                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2587                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2588                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2589                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2590                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2591                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2592                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2593                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
2594                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
2595                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
2596                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
2597                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
2598                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2599     </table>
2600 END
2601 ;
2602                 &Header::closebox();
2603         }
2604
2605         if ($errormessage) {
2606                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2607         } else {
2608                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2609                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2610                 print "<input type='hidden' name='KEY' value='$key' />";
2611                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2612         }
2613         &Header::closebigbox();
2614         &Header::closepage();
2615         exit(0);
2616
2617
2618 ##
2619 ### Accept IPFire n2n Package Settings
2620 ###
2621
2622   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2623
2624 ###
2625 ### Discard and Rollback IPFire n2n Package Settings
2626 ###
2627
2628   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2629
2630      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2631
2632 if ($confighash{$cgiparams{'KEY'}}) {
2633
2634      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2635      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2636      unlink ($certfile) or die "Removing $certfile fail: $!";
2637      unlink ($conffile) or die "Removing $conffile fail: $!";
2638      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2639      delete $confighash{$cgiparams{'KEY'}};
2640     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2641
2642      } else {
2643                 $errormessage = $Lang::tr{'invalid key'};
2644    }
2645
2646
2647 ###
2648 # m.a.d net2net
2649 ###
2650
2651
2652 ###
2653 ### Adding a new connection
2654 ###
2655 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2656          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2657          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2658
2659     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2660     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2661     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2662
2663     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
2664         if (! $confighash{$cgiparams{'KEY'}}[0]) {
2665             $errormessage = $Lang::tr{'invalid key'};
2666             goto VPNCONF_END;
2667         }
2668         $cgiparams{'ENABLED'}   = $confighash{$cgiparams{'KEY'}}[0];
2669         $cgiparams{'NAME'}      = $confighash{$cgiparams{'KEY'}}[1];
2670         $cgiparams{'TYPE'}      = $confighash{$cgiparams{'KEY'}}[3];
2671         $cgiparams{'AUTH'}      = $confighash{$cgiparams{'KEY'}}[4];
2672         $cgiparams{'PSK'}       = $confighash{$cgiparams{'KEY'}}[5];
2673         $cgiparams{'SIDE'}      = $confighash{$cgiparams{'KEY'}}[6];
2674         $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
2675   $cgiparams{'REMOTE'}  = $confighash{$cgiparams{'KEY'}}[10];
2676   $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
2677 # n2n m.a.d new fields
2678   $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
2679   $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2680   $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
2681         $cgiparams{'REMARK'}    = $confighash{$cgiparams{'KEY'}}[25];
2682         $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
2683 #new fields
2684         $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
2685         $cgiparams{'PROTOCOL'}    = $confighash{$cgiparams{'KEY'}}[28];
2686         $cgiparams{'DEST_PORT'}   = $confighash{$cgiparams{'KEY'}}[29];
2687         $cgiparams{'COMPLZO'}     = $confighash{$cgiparams{'KEY'}}[30];
2688         $cgiparams{'MTU'}         = $confighash{$cgiparams{'KEY'}}[31];
2689
2690 #new fields
2691 #ab hiere error uebernehmen
2692
2693     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2694         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
2695
2696   if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
2697             $errormessage = $Lang::tr{'connection type is invalid'};
2698             if ($cgiparams{'TYPE'} eq 'net') {
2699       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2700             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2701       }
2702             goto VPNCONF_ERROR;
2703         }
2704
2705
2706         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
2707             $errormessage = $Lang::tr{'name must only contain characters'};
2708       if ($cgiparams{'TYPE'} eq 'net') {
2709       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2710             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2711       }
2712       goto VPNCONF_ERROR;
2713   }
2714
2715         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
2716             $errormessage = $Lang::tr{'name is invalid'};
2717             if ($cgiparams{'TYPE'} eq 'net') {
2718       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2719             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2720       }
2721             goto VPNCONF_ERROR;
2722         }
2723
2724         if (length($cgiparams{'NAME'}) >60) {
2725             $errormessage = $Lang::tr{'name too long'};
2726             if ($cgiparams{'TYPE'} eq 'net') {
2727       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2728             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2729       }
2730             goto VPNCONF_ERROR;
2731         }
2732
2733 ###
2734 # m.a.d net2net
2735 ###
2736
2737 if ($cgiparams{'TYPE'} eq 'net') {
2738
2739     if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
2740                         $errormessage = $Lang::tr{'openvpn destination port used'};
2741                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2742             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2743       goto VPNCONF_ERROR;
2744                 }
2745
2746     if ($cgiparams{'DEST_PORT'} eq  '') {
2747                         $errormessage = $Lang::tr{'openvpn destination port used'};
2748                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2749             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2750       goto VPNCONF_ERROR;
2751                 }
2752
2753     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
2754                         $errormessage = $Lang::tr{'openvpn subnet is used'};
2755                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2756             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2757                         goto VPNCONF_ERROR;
2758                 }
2759
2760           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
2761             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
2762             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2763             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2764             goto VPNCONF_ERROR;
2765     }
2766
2767     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
2768             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
2769             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2770             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2771             goto VPNCONF_ERROR;
2772     }
2773
2774     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
2775                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
2776                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2777             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2778                   goto VPNCONF_ERROR;
2779                 }
2780
2781     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
2782                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
2783                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2784             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2785                   goto VPNCONF_ERROR;
2786                 }
2787
2788     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
2789                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
2790                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2791             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2792                   goto VPNCONF_ERROR;
2793                 }
2794
2795     if ($cgiparams{'OVPN_MGMT'} eq  '') {
2796                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
2797                 }
2798
2799 }
2800
2801 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
2802 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
2803 #           goto VPNCONF_ERROR;
2804 #       }
2805
2806         # Check if there is no other entry with this name
2807         if (! $cgiparams{'KEY'}) {
2808             foreach my $key (keys %confighash) {
2809                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
2810                     $errormessage = $Lang::tr{'a connection with this name already exists'};
2811                     if ($cgiparams{'TYPE'} eq 'net') {
2812         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2813               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2814         }
2815                     goto VPNCONF_ERROR;
2816                 }
2817             }
2818         }
2819
2820         if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
2821             $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2822             if ($cgiparams{'TYPE'} eq 'net') {
2823       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2824             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2825       }
2826             goto VPNCONF_ERROR;
2827         }
2828
2829         if ($cgiparams{'REMOTE'}) {
2830             if (! &General::validip($cgiparams{'REMOTE'})) {
2831                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
2832                     $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2833                     if ($cgiparams{'TYPE'} eq 'net') {
2834         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2835               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2836         }
2837                     goto VPNCONF_ERROR;
2838                 } else {
2839                     if (&valid_dns_host($cgiparams{'REMOTE'})) {
2840                         $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
2841                         if ($cgiparams{'TYPE'} eq 'net') {
2842
2843       }
2844                     }
2845                 }
2846             }
2847         }
2848         if ($cgiparams{'TYPE'} ne 'host') {
2849             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
2850                     $errormessage = $Lang::tr{'local subnet is invalid'};
2851                     if ($cgiparams{'TYPE'} eq 'net') {
2852               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2853                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2854               }
2855                         goto VPNCONF_ERROR;}
2856         }
2857         # Check if there is no other entry without IP-address and PSK
2858         if ($cgiparams{'REMOTE'} eq '') {
2859             foreach my $key (keys %confighash) {
2860                 if(($cgiparams{'KEY'} ne $key) &&
2861                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
2862                     $confighash{$key}[10] eq '') {
2863                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
2864                         goto VPNCONF_ERROR;
2865                 }
2866             }
2867         }
2868         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
2869                 $errormessage = $Lang::tr{'remote subnet is invalid'};
2870                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2871                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2872                 goto VPNCONF_ERROR;
2873         }
2874
2875         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
2876             $errormessage = $Lang::tr{'invalid input'};
2877             goto VPNCONF_ERROR;
2878         }
2879         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
2880             $errormessage = $Lang::tr{'invalid input'};
2881             goto VPNCONF_ERROR;
2882         }
2883
2884 #fixplausi
2885         if ($cgiparams{'AUTH'} eq 'psk')  {
2886 #           if (! length($cgiparams{'PSK'}) ) {
2887 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
2888 #               goto VPNCONF_ERROR;
2889 #           }
2890 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
2891 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
2892 #               goto VPNCONF_ERROR;
2893 #           }
2894         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
2895             if ($cgiparams{'KEY'}) {
2896                 $errormessage = $Lang::tr{'cant change certificates'};
2897                 goto VPNCONF_ERROR;
2898             }
2899             if (ref ($cgiparams{'FH'}) ne 'Fh') {
2900                 $errormessage = $Lang::tr{'there was no file upload'};
2901                 goto VPNCONF_ERROR;
2902             }
2903
2904             # Move uploaded certificate request to a temporary file
2905             (my $fh, my $filename) = tempfile( );
2906             if (copy ($cgiparams{'FH'}, $fh) != 1) {
2907                 $errormessage = $!;
2908                 goto VPNCONF_ERROR;
2909             }
2910
2911             # Sign the certificate request and move it
2912             # Sign the host certificate request
2913             system('/usr/bin/openssl', 'ca', '-days', '999999',
2914                 '-batch', '-notext',
2915                 '-in', $filename,
2916                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2917                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
2918             if ($?) {
2919                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2920                 unlink ($filename);
2921                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2922                 &newcleanssldatabase();
2923                 goto VPNCONF_ERROR;
2924             } else {
2925                 unlink ($filename);
2926                 &deletebackupcert();
2927             }
2928
2929             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2930             $temp =~ /Subject:.*CN=(.*)[\n]/;
2931             $temp = $1;
2932             $temp =~ s+/Email+, E+;
2933             $temp =~ s/ ST=/ S=/;
2934             $cgiparams{'CERT_NAME'} = $temp;
2935             $cgiparams{'CERT_NAME'} =~ s/,//g;
2936             $cgiparams{'CERT_NAME'} =~ s/\'//g;
2937             if ($cgiparams{'CERT_NAME'} eq '') {
2938                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2939                 goto VPNCONF_ERROR;
2940             }
2941         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
2942             if ($cgiparams{'KEY'}) {
2943                 $errormessage = $Lang::tr{'cant change certificates'};
2944                 goto VPNCONF_ERROR;
2945             }
2946             if (ref ($cgiparams{'FH'}) ne 'Fh') {
2947                 $errormessage = $Lang::tr{'there was no file upload'};
2948                 goto VPNCONF_ERROR;
2949             }
2950             # Move uploaded certificate to a temporary file
2951             (my $fh, my $filename) = tempfile( );
2952             if (copy ($cgiparams{'FH'}, $fh) != 1) {
2953                 $errormessage = $!;
2954                 goto VPNCONF_ERROR;
2955             }
2956
2957             # Verify the certificate has a valid CA and move it
2958             my $validca = 0;
2959             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
2960             if ($test =~ /: OK/) {
2961                 $validca = 1;
2962             } else {
2963                 foreach my $key (keys %cahash) {
2964                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
2965                     if ($test =~ /: OK/) {
2966                         $validca = 1;
2967                     }
2968                 }
2969             }
2970             if (! $validca) {
2971                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
2972                 unlink ($filename);
2973                 goto VPNCONF_ERROR;
2974             } else {
2975                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2976                 if ($? ne 0) {
2977                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2978                     unlink ($filename);
2979                     goto VPNCONF_ERROR;
2980                 }
2981             }
2982
2983             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2984             $temp =~ /Subject:.*CN=(.*)[\n]/;
2985             $temp = $1;
2986             $temp =~ s+/Email+, E+;
2987             $temp =~ s/ ST=/ S=/;
2988             $cgiparams{'CERT_NAME'} = $temp;
2989             $cgiparams{'CERT_NAME'} =~ s/,//g;
2990             $cgiparams{'CERT_NAME'} =~ s/\'//g;
2991             if ($cgiparams{'CERT_NAME'} eq '') {
2992                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2993                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2994                 goto VPNCONF_ERROR;
2995             }
2996         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
2997             if ($cgiparams{'KEY'}) {
2998                 $errormessage = $Lang::tr{'cant change certificates'};
2999                 goto VPNCONF_ERROR;
3000             }
3001             # Validate input since the form was submitted
3002             if (length($cgiparams{'CERT_NAME'}) >60) {
3003                 $errormessage = $Lang::tr{'name too long'};
3004                 goto VPNCONF_ERROR;
3005             }
3006             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3007                 $errormessage = $Lang::tr{'invalid input for name'};
3008                 goto VPNCONF_ERROR;
3009             }
3010             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3011                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3012                 goto VPNCONF_ERROR;
3013             }
3014             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3015                 $errormessage = $Lang::tr{'e-mail address too long'};
3016                 goto VPNCONF_ERROR;
3017             }
3018             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3019                 $errormessage = $Lang::tr{'invalid input for department'};
3020                 goto VPNCONF_ERROR;
3021             }
3022             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3023                 $errormessage = $Lang::tr{'organization too long'};
3024                 goto VPNCONF_ERROR;
3025             }
3026             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3027                 $errormessage = $Lang::tr{'invalid input for organization'};
3028                 goto VPNCONF_ERROR;
3029             }
3030             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3031                 $errormessage = $Lang::tr{'invalid input for city'};
3032                 goto VPNCONF_ERROR;
3033             }
3034             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3035                 $errormessage = $Lang::tr{'invalid input for state or province'};
3036                 goto VPNCONF_ERROR;
3037             }
3038             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3039                 $errormessage = $Lang::tr{'invalid input for country'};
3040                 goto VPNCONF_ERROR;
3041             }
3042             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3043                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3044                     $errormessage = $Lang::tr{'password too short'};
3045                     goto VPNCONF_ERROR;
3046                 }
3047             }
3048             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3049                 $errormessage = $Lang::tr{'passwords do not match'};
3050                 goto VPNCONF_ERROR;
3051             }
3052
3053             # Replace empty strings with a .
3054             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3055             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3056             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3057
3058             # Create the Host certificate request client
3059             my $pid = open(OPENSSL, "|-");
3060             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3061             if ($pid) { # parent
3062                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3063                 print OPENSSL "$state\n";
3064                 print OPENSSL "$city\n";
3065                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3066                 print OPENSSL "$ou\n";
3067                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3068                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3069                 print OPENSSL ".\n";
3070                 print OPENSSL ".\n";
3071                 close (OPENSSL);
3072                 if ($?) {
3073                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3074                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3075                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3076                     goto VPNCONF_ERROR;
3077                 }
3078             } else {    # child
3079                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3080                         '-newkey', 'rsa:1024',
3081                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3082                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3083                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3084                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3085                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3086                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3087                     goto VPNCONF_ERROR;
3088                 }
3089             }
3090
3091             # Sign the host certificate request
3092             system('/usr/bin/openssl', 'ca', '-days', '999999',
3093                 '-batch', '-notext',
3094                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3095                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3096                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3097             if ($?) {
3098                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3099                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3100                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3101                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3102                 &newcleanssldatabase();
3103                 goto VPNCONF_ERROR;
3104             } else {
3105                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3106                 &deletebackupcert();
3107             }
3108
3109             # Create the pkcs12 file
3110             system('/usr/bin/openssl', 'pkcs12', '-export',
3111                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3112                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3113                 '-name', $cgiparams{'NAME'},
3114                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3115                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3116                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3117                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3118             if ($?) {
3119                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3120                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3121                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3122                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3123                 goto VPNCONF_ERROR;
3124             } else {
3125                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3126             }
3127         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3128             ;# Nothing, just editing
3129         } else {
3130             $errormessage = $Lang::tr{'invalid input for authentication method'};
3131             goto VPNCONF_ERROR;
3132         }
3133
3134         # Check if there is no other entry with this common name
3135         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3136             foreach my $key (keys %confighash) {
3137                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3138                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3139                     goto VPNCONF_ERROR;
3140                 }
3141             }
3142         }
3143
3144         # Save the config
3145         my $key = $cgiparams{'KEY'};
3146         if (! $key) {
3147             $key = &General::findhasharraykey (\%confighash);
3148             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3149         }
3150         $confighash{$key}[0] = $cgiparams{'ENABLED'};
3151         $confighash{$key}[1] = $cgiparams{'NAME'};
3152         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3153             $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
3154         }
3155         $confighash{$key}[3] = $cgiparams{'TYPE'};
3156         if ($cgiparams{'AUTH'} eq 'psk') {
3157             $confighash{$key}[4] = 'psk';
3158             $confighash{$key}[5] = $cgiparams{'PSK'};
3159         } else {
3160             $confighash{$key}[4] = 'cert';
3161         }
3162         if ($cgiparams{'TYPE'} eq 'net') {
3163             $confighash{$key}[6] = $cgiparams{'SIDE'};
3164             $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
3165         }
3166         $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
3167         $confighash{$key}[10] = $cgiparams{'REMOTE'};
3168   if ($cgiparams{'OVPN_MGMT'} eq '') {
3169   $confighash{$key}[22] = $confighash{$key}[29];
3170   } else {
3171   $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
3172   }
3173   $confighash{$key}[23] = $cgiparams{'MSSFIX'};
3174   $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
3175         $confighash{$key}[25] = $cgiparams{'REMARK'};
3176         $confighash{$key}[26] = $cgiparams{'INTERFACE'};
3177 # new fields
3178         $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
3179         $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
3180         $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
3181         $confighash{$key}[30] = $cgiparams{'COMPLZO'};
3182         $confighash{$key}[31] = $cgiparams{'MTU'};
3183 # new fileds
3184         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3185
3186 ###
3187 # m.a.d n2n begin
3188 ###
3189
3190         if ($cgiparams{'TYPE'} eq 'net') {
3191
3192         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3193   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
3194
3195   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3196         my $key = $cgiparams{'KEY'};
3197         if (! $key) {
3198             $key = &General::findhasharraykey (\%confighash);
3199             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3200             }
3201   $confighash{$key}[0] = 'on';
3202   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3203
3204   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
3205          }
3206   }
3207
3208 ###
3209 # m.a.d n2n end
3210 ###
3211
3212         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
3213             $cgiparams{'KEY'} = $key;
3214             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
3215         }
3216         goto VPNCONF_END;
3217     } else {
3218         $cgiparams{'ENABLED'} = 'on';
3219 ###
3220 # m.a.d n2n begin
3221 ###
3222         $cgiparams{'MSSFIX'} = 'on';
3223         $cgiparams{'FRAGMENT'} = '1300';
3224 ###
3225 # m.a.d n2n end
3226 ###
3227         $cgiparams{'SIDE'} = 'left';
3228         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
3229             $cgiparams{'AUTH'} = 'psk';
3230         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3231             $cgiparams{'AUTH'} = 'certfile';
3232         } else {
3233             $cgiparams{'AUTH'} = 'certgen';
3234         }
3235         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
3236         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
3237         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
3238         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
3239         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
3240     }
3241
3242     VPNCONF_ERROR:
3243     $checked{'ENABLED'}{'off'} = '';
3244     $checked{'ENABLED'}{'on'} = '';
3245     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3246     $checked{'ENABLED_BLUE'}{'off'} = '';
3247     $checked{'ENABLED_BLUE'}{'on'} = '';
3248     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3249     $checked{'ENABLED_ORANGE'}{'off'} = '';
3250     $checked{'ENABLED_ORANGE'}{'on'} = '';
3251     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3252
3253
3254     $checked{'EDIT_ADVANCED'}{'off'} = '';
3255     $checked{'EDIT_ADVANCED'}{'on'} = '';
3256     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
3257
3258     $selected{'SIDE'}{'server'} = '';
3259     $selected{'SIDE'}{'client'} = '';
3260     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
3261
3262     $selected{'PROTOCOL'}{'udp'} = '';
3263     $selected{'PROTOCOL'}{'tcp'} = '';
3264     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
3265
3266
3267     $checked{'AUTH'}{'psk'} = '';
3268     $checked{'AUTH'}{'certreq'} = '';
3269     $checked{'AUTH'}{'certgen'} = '';
3270     $checked{'AUTH'}{'certfile'} = '';
3271     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
3272
3273     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
3274
3275     $checked{'COMPLZO'}{'off'} = '';
3276     $checked{'COMPLZO'}{'on'} = '';
3277     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
3278
3279     $checked{'MSSFIX'}{'off'} = '';
3280     $checked{'MSSFIX'}{'on'} = '';
3281     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3282
3283
3284     if (1) {
3285         &Header::showhttpheaders();
3286         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
3287         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3288         if ($errormessage) {
3289             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3290             print "<class name='base'>$errormessage";
3291             print "&nbsp;</class>";
3292             &Header::closebox();
3293         }
3294
3295         if ($warnmessage) {
3296             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
3297             print "<class name='base'>$warnmessage";
3298             print "&nbsp;</class>";
3299             &Header::closebox();
3300         }
3301
3302         print "<form method='post' enctype='multipart/form-data'>";
3303         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
3304
3305         if ($cgiparams{'KEY'}) {
3306             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
3307             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
3308         }
3309
3310         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
3311         print "<table width='100%'>\n";
3312         print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>";
3313         if ($cgiparams{'TYPE'} eq 'host') {
3314             if ($cgiparams{'KEY'}) {
3315                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>\n";
3316             } else {
3317                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
3318             }
3319 #           print "<tr><td>$Lang::tr{'interface'}</td>";
3320 #           print "<td><select name='INTERFACE'>";
3321 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
3322 #           if ($netsettings{'BLUE_DEV'} ne '') {
3323 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
3324 #           }
3325 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
3326 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
3327 #           print "</select></td></tr>";
3328 #           print <<END
3329         } else {
3330             print "<input type='hidden' name='INTERFACE' value='red' />";
3331             if ($cgiparams{'KEY'}) {
3332                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
3333             } else {
3334                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
3335             }
3336             print <<END
3337                     <td width='25%'>&nbsp;</td>
3338                     <td width='25%'>&nbsp;</td></tr>
3339                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
3340                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
3341                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
3342                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
3343                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
3344                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
3345                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
3346                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
3347                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
3348                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
3349                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
3350                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3351
3352      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
3353                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
3354
3355         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3356                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
3357                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
3358                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
3359
3360                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
3361                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
3362         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
3363
3364           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
3365                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
3366                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
3367
3368                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
3369                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
3370         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
3371
3372         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
3373                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
3374         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
3375
3376 END
3377             ;
3378         }
3379
3380         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
3381         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr>";
3382
3383         if ($cgiparams{'TYPE'} eq 'host') {
3384
3385       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>\n";
3386          }
3387
3388 #           if ($cgiparams{'KEY'}) {
3389 #               print "<td colspan='3'>&nbsp;</td></tr></table>";
3390 #           } else {
3391 #               print "<td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</tr></table>";
3392 #           }
3393 #       }else{
3394             print "<td colspan='3'>&nbsp;</td></tr></table>";
3395 #       }
3396
3397
3398
3399         &Header::closebox();
3400
3401         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
3402         #    &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3403         #    print <<END
3404         #    <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3405         #    <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
3406         #       <td class='base' width='50%'><input type='text' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
3407         #    </table>
3408 END
3409         #    ;
3410         #    &Header::closebox();
3411         } elsif (! $cgiparams{'KEY'}) {
3412             my $disabled='';
3413             my $cakeydisabled='';
3414             my $cacrtdisabled='';
3415             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
3416             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
3417             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3418
3419
3420  if ($cgiparams{'TYPE'} eq 'host') {
3421
3422 print <<END
3423             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3424
3425             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
3426             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
3427             <tr><td colspan='3'>&nbsp;</td></tr>
3428       <tr><td colspan='3'><hr /></td></tr>
3429       <tr><td colspan='3'>&nbsp;</td></tr>
3430             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3431             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3432             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3433             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3434             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3435             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3436             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3437             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3438 END
3439 ;
3440
3441 ###
3442 # m.a.d net2net
3443 ###
3444
3445 } else {
3446
3447 print <<END
3448             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3449
3450             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3451             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3452             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3453             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3454             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3455             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3456             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3457             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3458
3459
3460 END
3461 ;
3462
3463 }
3464
3465 ###
3466 # m.a.d net2net
3467 ###
3468
3469             foreach my $country (sort keys %{Countries::countries}) {
3470                 print "<option value='$Countries::countries{$country}'";
3471                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
3472                     print " selected='selected'";
3473                 }
3474                 print ">$country</option>";
3475             }
3476 ###
3477 # m.a.d net2net
3478 ###
3479
3480 if ($cgiparams{'TYPE'} eq 'host') {
3481             print <<END
3482             </select></td></tr>
3483
3484         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
3485         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
3486    <tr><td>&nbsp;</td>
3487                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
3488                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
3489             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
3490                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
3491      <tr><td colspan='3'>&nbsp;</td></tr>
3492      <tr><td colspan='3'><hr /></td></tr>
3493      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
3494      </table>
3495 END
3496 }else{
3497             print <<END
3498             </select></td></tr>
3499    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3500          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3501          <tr><td colspan='3'><hr /></td></tr>
3502          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
3503        </table>
3504
3505 END
3506 }
3507
3508 ###
3509 # m.a.d net2net
3510 ###
3511             ;
3512             &Header::closebox();
3513         }
3514
3515         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
3516         if ($cgiparams{'KEY'}) {
3517 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
3518         }
3519         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3520         &Header::closebigbox();
3521         &Header::closepage();
3522         exit (0);
3523     }
3524     VPNCONF_END:
3525 }
3526
3527 #    SETTINGS_ERROR:
3528 ###
3529 ### Default status page
3530 ###
3531     %cgiparams = ();
3532     %cahash = ();
3533     %confighash = ();
3534     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
3535     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3536     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3537
3538     my @status = `/bin/cat /var/log/ovpnserver.log`;
3539
3540     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
3541         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
3542             my $ipaddr = <IPADDR>;
3543             close IPADDR;
3544             chomp ($ipaddr);
3545             $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
3546             if ($cgiparams{'VPN_IP'} eq '') {
3547                 $cgiparams{'VPN_IP'} = $ipaddr;
3548             }
3549         }
3550     }
3551
3552 #default setzen
3553     if ($cgiparams{'DCIPHER'} eq '') {
3554         $cgiparams{'DCIPHER'} =  'BF-CBC';
3555     }
3556 #    if ($cgiparams{'DCOMPLZO'} eq '') {
3557 #       $cgiparams{'DCOMPLZO'} =  'on';
3558 #    }
3559     if ($cgiparams{'DDEST_PORT'} eq '') {
3560         $cgiparams{'DDEST_PORT'} =  '1194';
3561     }
3562     if ($cgiparams{'DMTU'} eq '') {
3563         $cgiparams{'DMTU'} =  '1400';
3564     }
3565     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
3566         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
3567     }
3568
3569     $checked{'ENABLED'}{'off'} = '';
3570     $checked{'ENABLED'}{'on'} = '';
3571     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3572     $checked{'ENABLED_BLUE'}{'off'} = '';
3573     $checked{'ENABLED_BLUE'}{'on'} = '';
3574     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3575     $checked{'ENABLED_ORANGE'}{'off'} = '';
3576     $checked{'ENABLED_ORANGE'}{'on'} = '';
3577     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3578     $selected{'DDEVICE'}{'tun'} = '';
3579     $selected{'DDEVICE'}{'tap'} = '';
3580     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
3581
3582     $selected{'DPROTOCOL'}{'udp'} = '';
3583     $selected{'DPROTOCOL'}{'tcp'} = '';
3584     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
3585
3586     $selected{'DCIPHER'}{'DES-CBC'} = '';
3587     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
3588     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
3589     $selected{'DCIPHER'}{'DESX-CBC'} = '';
3590     $selected{'DCIPHER'}{'RC2-CBC'} = '';
3591     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
3592     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
3593     $selected{'DCIPHER'}{'BF-CBC'} = '';
3594     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
3595     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
3596     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
3597     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
3598     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
3599     $checked{'DCOMPLZO'}{'off'} = '';
3600     $checked{'DCOMPLZO'}{'on'} = '';
3601     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
3602 # m.a.d
3603     $checked{'MSSFIX'}{'off'} = '';
3604     $checked{'MSSFIX'}{'on'} = '';
3605     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3606 #new settings
3607     &Header::showhttpheaders();
3608     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
3609     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3610
3611     if ($errormessage) {
3612         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3613         print "<class name='base'>$errormessage\n";
3614         print "&nbsp;</class>\n";
3615         &Header::closebox();
3616     }
3617
3618     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
3619     my $srunning = "no";
3620     my $activeonrun = "";
3621     if ( -e "/var/run/openvpn.pid"){
3622         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
3623         $srunning ="yes";
3624         $activeonrun = "";
3625     } else {
3626         $activeonrun = "disabled='disabled'";
3627     }
3628     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
3629     print <<END
3630     <table width='100%'>
3631     <form method='post'>
3632     <td width='25%'>&nbsp;</td>
3633     <td width='25%'>&nbsp;</td>
3634     <td width='25%'>&nbsp;</td></tr>
3635     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
3636     <td align='left'>$sactive</td>
3637     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
3638         <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
3639 END
3640 ;
3641     if (&haveBlueNet()) {
3642         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
3643         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
3644     }
3645     if (&haveOrangeNet()) {
3646         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
3647         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
3648     }
3649     print <<END
3650     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
3651         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
3652     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
3653         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
3654                                 <!-- this is still not working
3655                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
3656     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3657         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
3658                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
3659         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3660         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
3661     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
3662         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
3663     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
3664         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
3665         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
3666         <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
3667                                    <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
3668                                    <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
3669                                    <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
3670                                    <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
3671                                    <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
3672                                    <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
3673                                    <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
3674                                    <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
3675                                    <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
3676                                    <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
3677                                    <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td>
3678 END
3679 ;
3680
3681     if ( $srunning eq "yes" ) {
3682         print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' /></td>";
3683         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' disabled='disabled'/></td>";
3684         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td>";
3685         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3686     } else{
3687         print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>";
3688         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' /></td>";
3689         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
3690              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
3691              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
3692              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
3693             (( $cgiparams{'ENABLED'} eq 'on') ||
3694             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3695             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
3696             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td>";
3697             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3698         } else {
3699             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td>";
3700             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' disabled='disabled' /></td></tr>";
3701         }
3702     }
3703     print "</form></table>";
3704     &Header::closebox();
3705     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
3706     print <<EOF#'
3707     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3708     <tr>
3709         <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3710         <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
3711         <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
3712     </tr>
3713 EOF
3714     ;
3715     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
3716         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
3717         $casubject    =~ /Subject: (.*)[\n]/;
3718         $casubject    = $1;
3719         $casubject    =~ s+/Email+, E+;
3720         $casubject    =~ s/ ST=/ S=/;
3721
3722         print <<END
3723         <tr bgcolor='$color{'color22'}'>
3724         <td class='base'>$Lang::tr{'root certificate'}</td>
3725         <td class='base'>$casubject</td>
3726         <form method='post' name='frmrootcrta'><td width='3%' align='center'>
3727             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
3728             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
3729         </td></form>
3730         <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
3731             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
3732             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
3733         </td></form>
3734         <td width='4%'>&nbsp;</td></tr>
3735 END
3736         ;
3737     } else {
3738         # display rootcert generation buttons
3739         print <<END
3740         <tr bgcolor='$color{'color22'}'>
3741         <td class='base'>$Lang::tr{'root certificate'}:</td>
3742         <td class='base'>$Lang::tr{'not present'}</td>
3743         <td colspan='3'>&nbsp;</td></tr>
3744 END
3745         ;
3746     }
3747
3748     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
3749         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
3750         $hostsubject    =~ /Subject: (.*)[\n]/;
3751         $hostsubject    = $1;
3752         $hostsubject    =~ s+/Email+, E+;
3753         $hostsubject    =~ s/ ST=/ S=/;
3754
3755         print <<END
3756         <tr bgcolor='$color{'color20'}'>
3757         <td class='base'>$Lang::tr{'host certificate'}</td>
3758         <td class='base'>$hostsubject</td>
3759         <form method='post' name='frmhostcrta'><td width='3%' align='center'>
3760             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
3761             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
3762         </td></form>
3763         <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
3764             <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
3765             <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
3766         </td></form>
3767         <td width='4%'>&nbsp;</td></tr>
3768 END
3769         ;
3770     } else {
3771         # Nothing
3772         print <<END
3773         <tr bgcolor='$color{'color20'}'>
3774         <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
3775         <td class='base'>$Lang::tr{'not present'}</td>
3776         </td><td colspan='3'>&nbsp;</td></tr>
3777 END
3778         ;
3779     }
3780
3781     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3782         print "<tr><td colspan='5' align='center'><form method='post'>";
3783         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
3784         print "</form></td></tr>\n";
3785     }
3786
3787     if (keys %cahash > 0) {
3788         foreach my $key (keys %cahash) {
3789             if (($key + 1) % 2) {
3790                 print "<tr bgcolor='$color{'color20'}'>\n";
3791             } else {
3792                 print "<tr bgcolor='$color{'color22'}'>\n";
3793             }
3794             print "<td class='base'>$cahash{$key}[0]</td>\n";
3795             print "<td class='base'>$cahash{$key}[1]</td>\n";
3796             print <<END
3797             <form method='post' name='cafrm${key}a'><td align='center'>
3798                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
3799                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
3800                 <input type='hidden' name='KEY' value='$key' />
3801             </td></form>
3802             <form method='post' name='cafrm${key}b'><td align='center'>
3803                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
3804                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
3805                 <input type='hidden' name='KEY' value='$key' />
3806             </td></form>
3807             <form method='post' name='cafrm${key}c'><td align='center'>
3808                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
3809                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
3810                 <input type='hidden' name='KEY' value='$key' />
3811             </td></form></tr>
3812 END
3813             ;
3814         }
3815     }
3816
3817     print "</table>";
3818
3819     # If the file contains entries, print Key to action icons
3820     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
3821     print <<END
3822     <table>
3823     <tr>
3824         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
3825         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
3826         <td class='base'>$Lang::tr{'show certificate'}</td>
3827         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
3828         <td class='base'>$Lang::tr{'download certificate'}</td>
3829     </tr>
3830     </table>
3831 END
3832     ;
3833     }
3834     print <<END
3835     <form method='post' enctype='multipart/form-data'>
3836     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3837     <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td>
3838     <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' />
3839     <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td>
3840     <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /><br /><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
3841     </tr></table></form>
3842 END
3843     ;
3844
3845     &Header::closebox();
3846     if ( $srunning eq "yes" ) {
3847         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
3848     }else{
3849         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
3850     }
3851     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
3852
3853 ###
3854 # m.a.d net2net
3855 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
3856 ###
3857
3858     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
3859     print <<END
3860
3861
3862     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3863 <tr>
3864     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3865     <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
3866     <td width='18%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></td>
3867     <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'valid till'}</b></td>
3868     <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
3869     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
3870     <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
3871 </tr>
3872 END
3873         ;
3874         my $id = 0;
3875         my $gif;
3876         foreach my $key (keys %confighash) {
3877         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
3878
3879         if ($id % 2) {
3880             print "<tr bgcolor='$color{'color20'}'>\n";
3881         } else {
3882             print "<tr bgcolor='$color{'color22'}'>\n";
3883         }
3884         print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
3885         print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
3886         if ($confighash{$key}[4] eq 'cert') {
3887             print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
3888         } else {
3889             print "<td align='left'>&nbsp;</td>";
3890         }
3891         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
3892         $cavalid    =~ /Not After : (.*)[\n]/;
3893         $cavalid    = $1;
3894         print "<td align='center'>$cavalid</td>";
3895         print "<td align='center'>$confighash{$key}[25]</td>";
3896
3897         my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3898
3899         if ($confighash{$key}[0] eq 'off') {
3900          $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3901         } else {
3902
3903 ###
3904 # m.a.d net2net
3905 ###
3906
3907        if ($confighash{$key}[3] eq 'net') {
3908
3909         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3910           my @output = "";
3911           my @tustate = "";
3912           my $tport = $confighash{$key}[22];
3913           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
3914           if ($tport ne '') {
3915           $tnet->open('127.0.0.1');
3916           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
3917           @tustate = split(/\,/, $output[1]);
3918 ###
3919 #CONNECTING    -- OpenVPN's initial state.
3920 #WAIT          -- (Client only) Waiting for initial response from server.
3921 #AUTH          -- (Client only) Authenticating with server.
3922 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
3923 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
3924 #ADD_ROUTES    -- Adding routes to system.
3925 #CONNECTED     -- Initialization Sequence Completed.
3926 #RECONNECTING  -- A restart has occurred.
3927 #EXITING       -- A graceful exit is in progress.
3928 ####
3929
3930         if ( $tustate[1] eq 'CONNECTED') {
3931           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></tr></td></table>";
3932                           } else {
3933           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$tustate[1]</font></b></td></tr></table>";
3934            }
3935            }
3936            }
3937         }       else {
3938
3939                 my $cn;
3940             my @match = ();
3941           foreach my $line (@status) {
3942                 chomp($line);
3943                 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3944                     @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3945                     if ($match[1] ne "Common Name") {
3946                         $cn = $match[1];
3947                     }
3948                 $cn =~ s/[_]/ /g;
3949                     if ($cn eq "$confighash{$key}[2]") {
3950                         $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
3951                     }
3952    }
3953
3954         }
3955 }
3956 }
3957
3958
3959         my $disable_clientdl = "disabled='disabled'";
3960         if (( $cgiparams{'ENABLED'} eq 'on') ||
3961             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3962             ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
3963             $disable_clientdl = "";
3964         }
3965         print <<END
3966         <td align='center'>$active</td>
3967
3968         <form method='post' name='frm${key}a'><td align='center'>
3969             <input type='image'  name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
3970             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
3971             <input type='hidden' name='KEY' value='$key' $disable_clientdl />
3972         </td></form>
3973 END
3974         ;
3975         if ($confighash{$key}[4] eq 'cert') {
3976             print <<END
3977             <form method='post' name='frm${key}b'><td align='center'>
3978                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
3979                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
3980                 <input type='hidden' name='KEY' value='$key' />
3981             </td></form>
3982 END
3983         ; } else {
3984             print "<td>&nbsp;</td>";
3985         }
3986         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
3987             print <<END
3988             <form method='post' name='frm${key}c'><td align='center'>
3989                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
3990                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
3991                 <input type='hidden' name='KEY' value='$key' />
3992             </td></form>
3993 END
3994         ; } elsif ($confighash{$key}[4] eq 'cert') {
3995             print <<END
3996             <form method='post' name='frm${key}c'><td align='center'>
3997                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
3998                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
3999                 <input type='hidden' name='KEY' value='$key' />
4000             </td></form>
4001 END
4002         ; } else {
4003             print "<td>&nbsp;</td>";
4004         }
4005         print <<END
4006         <form method='post' name='frm${key}d'><td align='center'>
4007             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
4008             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
4009             <input type='hidden' name='KEY' value='$key' />
4010         </td></form>
4011
4012         <form method='post' name='frm${key}e'><td align='center'>
4013             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
4014             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
4015             <input type='hidden' name='KEY' value='$key' />
4016         </td></form>
4017         <form method='post' name='frm${key}f'><td align='center'>
4018             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
4019             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
4020             <input type='hidden' name='KEY' value='$key' />
4021         </td></form>
4022         </tr>
4023 END
4024         ;
4025         $id++;
4026     }
4027     ;
4028
4029     # If the config file contains entries, print Key to action icons
4030     if ( $id ) {
4031     print <<END
4032     <table>
4033     <tr>
4034         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4035         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
4036         <td class='base'>$Lang::tr{'click to disable'}</td>
4037         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4038         <td class='base'>$Lang::tr{'show certificate'}</td>
4039         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
4040         <td class='base'>$Lang::tr{'edit'}</td>
4041         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
4042         <td class='base'>$Lang::tr{'remove'}</td>
4043     </tr>
4044     <tr>
4045         <td>&nbsp; </td>
4046         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
4047         <td class='base'>$Lang::tr{'click to enable'}</td>
4048         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
4049         <td class='base'>$Lang::tr{'download certificate'}</td>
4050         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
4051         <td class='base'>$Lang::tr{'dl client arch'}</td>
4052     </tr>
4053     </table>
4054 END
4055     ;
4056     }
4057
4058     print <<END
4059     <table width='100%'>
4060     <form method='post'>
4061     <tr><td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
4062         <td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
4063     </form>
4064     </table>
4065 END
4066     ;
4067     &Header::closebox();
4068 }
4069 &Header::closepage();
4070
4071
4072