html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/countries.pl";
  37
  38 # enable only the following on debugging purpose
  39 use warnings;
  40 use CGI::Carp 'fatalsToBrowser';
  41 #workaround to suppress a warning when a variable is used only once
  42 my @dummy = ( ${Header::colourgreen} );
  43 undef (@dummy);
  44
  45 my %color = ();
  46 my %mainsettings = ();
  47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  49
  50 ###
  51 ### Initialize variables
  52 ###
  53 my %netsettings=();
  54 my %cgiparams=();
  55 my %vpnsettings=();
  56 my %checked=();
  57 my %confighash=();
  58 my %cahash=();
  59 my %selected=();
  60 my $warnmessage = '';
  61 my $errormessage = '';
  62 my %settings=();
  63 my $routes_push_file = '';
  64 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  65 $cgiparams{'ENABLED'} = 'off';
  66 $cgiparams{'ENABLED_BLUE'} = 'off';
  67 $cgiparams{'ENABLED_ORANGE'} = 'off';
  68 $cgiparams{'EDIT_ADVANCED'} = 'off';
  69 $cgiparams{'NAT'} = 'off';
  70 $cgiparams{'COMPRESSION'} = 'off';
  71 $cgiparams{'ONLY_PROPOSED'} = 'off';
  72 $cgiparams{'ACTION'} = '';
  73 $cgiparams{'CA_NAME'} = '';
  74 $cgiparams{'DHCP_DOMAIN'} = '';
  75 $cgiparams{'DHCP_DNS'} = '';
  76 $cgiparams{'DHCP_WINS'} = '';
  77 $cgiparams{'ROUTES_PUSH'} = '';
  78 $cgiparams{'DCOMPLZO'} = 'off';
  79 $cgiparams{'MSSFIX'} = '';
  80 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  81 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  82
  83 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  84
  85 # prepare openvpn config file
  86 ###
  87 ### Useful functions
  88 ###
  89 sub haveOrangeNet
  90 {
  91         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
  92         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
  93         return 0;
  94 }
  95
  96 sub haveBlueNet
  97 {
  98         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
  99         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 100         return 0;
 101 }
 102
 103 sub sizeformat{
 104     my $bytesize = shift;
 105     my $i = 0;
 106
 107     while(abs($bytesize) >= 1024){
 108         $bytesize=$bytesize/1024;
 109         $i++;
 110         last if($i==6);
 111     }
 112
 113     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 114     my $newsize=(int($bytesize*100 +0.5))/100;
 115     return("$newsize $units[$i]");
 116 }
 117
 118 sub valid_dns_host {
 119         my $hostname = $_[0];
 120         unless ($hostname) { return "No hostname"};
 121         my $res = new Net::DNS::Resolver;
 122         my $query = $res->search("$hostname");
 123         if ($query) {
 124                 foreach my $rr ($query->answer) {
 125                         ## Potential bug - we are only looking at A records:
 126                         return 0 if $rr->type eq "A";
 127                 }
 128         } else {
 129                 return $res->errorstring;
 130         }
 131 }
 132
 133 sub cleanssldatabase
 134 {
 135     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 136         print FILE "01";
 137         close FILE;
 138     }
 139     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 140         print FILE "";
 141         close FILE;
 142     }
 143     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 144     unlink ("${General::swroot}/ovpn/certs/serial.old");
 145     unlink ("${General::swroot}/ovpn/certs/01.pem");
 146 }
 147
 148 sub newcleanssldatabase
 149 {
 150     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 151         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 152         print FILE "01";
 153         close FILE;
 154     }
 155     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 156         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 157     }
 158     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 159     unlink ("${General::swroot}/ovpn/certs/serial.old");
 160 }
 161
 162 sub deletebackupcert
 163 {
 164         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 165                 my $hexvalue = <FILE>;
 166                 chomp $hexvalue;
 167                 close FILE;
 168                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 169         }
 170 }
 171
 172 sub checkportfw {
 173     my $KEY2 = $_[0]; # key2
 174     my $SRC_PORT = $_[1]; # src_port
 175     my $PROTOCOL = $_[2]; # protocol
 176     my $SRC_IP = $_[3]; # sourceip
 177
 178     my $pfwfilename = "${General::swroot}/portfw/config";
 179     open(FILE, $pfwfilename) or die 'Unable to open config file.';
 180     my @pfwcurrent = <FILE>;
 181     close(FILE);
 182     my $pfwkey1 = 0; # used for finding last sequence number used
 183     foreach my $pfwline (@pfwcurrent)
 184     {
 185         my @pfwtemp = split(/\,/,$pfwline);
 186
 187         chomp ($pfwtemp[8]);
 188         if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
 189                 if ( $SRC_PORT eq $pfwtemp[3] &&
 190                         $PROTOCOL eq $pfwtemp[2] &&
 191                         $SRC_IP eq $pfwtemp[7])
 192                 {
 193                          $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
 194                 }
 195                 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
 196                 if ( $pfwtemp[1] eq "0") {
 197                         $pfwkey1=$pfwtemp[0];
 198                 }
 199                 # Darren Critchley - Duplicate or overlapping Port range check
 200                 if ($pfwtemp[1] eq "0" &&
 201                         $PROTOCOL eq $pfwtemp[2] &&
 202                         $SRC_IP eq $pfwtemp[7] &&
 203                         $errormessage eq '')
 204                 {
 205                         &portchecks($SRC_PORT, $pfwtemp[5]);
 206 #                       &portchecks($pfwtemp[3], $pfwtemp[5]);
 207 #                       &portchecks($pfwtemp[3], $SRC_IP);
 208                 }
 209         }
 210     }
 211 #    $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
 212
 213     return;
 214 }
 215
 216 sub checkportoverlap
 217 {
 218         my $portrange1 = $_[0]; # New port range
 219         my $portrange2 = $_[1]; # existing port range
 220         my @tempr1 = split(/\:/,$portrange1);
 221         my @tempr2 = split(/\:/,$portrange2);
 222
 223         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 224         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 225
 226         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 227         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 228
 229         return 1; # Everything checks out!
 230 }
 231
 232 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 233 sub checkportinc
 234 {
 235         my $port1 = $_[0]; # Port
 236         my $portrange2 = $_[1]; # Port range
 237         my @tempr1 = split(/\:/,$portrange2);
 238
 239         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 240                 return 1;
 241         } else {
 242                 return 0;
 243         }
 244 }
 245 # Darren Critchley - Duplicate or overlapping Port range check
 246 sub portchecks
 247 {
 248         my $p1 = $_[0]; # New port range
 249         my $p2 = $_[1]; # existing port range
 250 #       $_ = $_[0];
 251         our ($prtrange1, $prtrange2);
 252         $prtrange1 = 0;
 253 #       if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
 254 #               unless (&checkportoverlap($p1,$p2)) {
 255 #                       $errormessage = "$Lang::tr{'source port overlaps'} $p1";
 256 #               }
 257 #       }
 258         if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
 259                 unless (&checkportinc($p2,$p1)) {
 260                         $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
 261                 }
 262         }
 263         $prtrange1 = 1;
 264         if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
 265                 unless (&checkportinc($p1,$p2)) {
 266                         $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
 267                 }
 268         }
 269         return;
 270 }
 271
 272 # Darren Critchley - certain ports are reserved for IPFire
 273 # TCP 67,68,81,222,445
 274 # UDP 67,68
 275 # Params passed in -> port, rangeyn, protocol
 276 sub disallowreserved
 277 {
 278         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 279         my $msg = "";
 280         my @tcp_reserved = (81,222,445);
 281         my $prt = $_[0]; # the port or range
 282         my $ryn = $_[1]; # tells us whether or not it is a port range
 283         my $prot = $_[2]; # protocol
 284         my $srcdst = $_[3]; # source or destination
 285         if ($ryn) { # disect port range
 286                 if ($srcdst eq "src") {
 287                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 288                 } else {
 289                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 290                 }
 291                 my @tmprng = split(/\:/,$prt);
 292                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 293                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 294                 if ($prot eq "tcp") {
 295                         foreach my $prange (@tcp_reserved) {
 296                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 297                         }
 298                 }
 299         } else {
 300                 if ($srcdst eq "src") {
 301                         $msg = "$Lang::tr{'reserved src port'}";
 302                 } else {
 303                         $msg = "$Lang::tr{'reserved dst port'}";
 304                 }
 305                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 306                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 307                 if ($prot eq "tcp") {
 308                         foreach my $prange (@tcp_reserved) {
 309                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 310                         }
 311                 }
 312         }
 313         return;
 314 }
 315
 316
 317 sub writeserverconf {
 318     my %sovpnsettings = ();
 319     my @temp = ();
 320     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 321     &read_routepushfile;
 322
 323     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 324     flock CONF, 2;
 325     print CONF "#OpenVPN Server conf\n";
 326     print CONF "\n";
 327     print CONF "daemon openvpnserver\n";
 328     print CONF "writepid /var/run/openvpn.pid\n";
 329     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 330     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 331     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 332     print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
 333     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 334     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 335     print CONF "script-security 3 system\n";
 336     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 337     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 338     print CONF "tls-server\n";
 339     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 340     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 341     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 342     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 343     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 344     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 345     print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 346
 347     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 348         @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 349         foreach (@temp)
 350         {
 351                 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 352                 print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 353         }
 354     }
 355
 356     if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 357         print CONF "client-to-client\n";
 358     }
 359     if ($sovpnsettings{'DPROTOCOL'} eq 'udp') {
 360         if ($sovpnsettings{MSSFIX} eq 'on') {
 361             print CONF "mssfix\n";
 362         }
 363         if ($sovpnsettings{'FRAGMENT'} eq '' || $sovpnsettings{'FRAGMENT'} eq 0) {
 364                 $sovpnsettings{'FRAGMENT'} = '1300';
 365         }
 366         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 367     }
 368     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 369         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 370     }
 371     print CONF "status-version 1\n";
 372     print CONF "status /var/log/ovpnserver.log 30\n";
 373     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 374     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 375         print CONF "comp-lzo\n";
 376     }
 377     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 378         print CONF "push \"redirect-gateway def1\"\n";
 379     }
 380     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 381         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 382     }
 383
 384     if ($sovpnsettings{DHCP_DNS} ne '') {
 385         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 386     }
 387
 388     if ($sovpnsettings{DHCP_WINS} ne '') {
 389         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 390     }
 391
 392     if ($sovpnsettings{DHCP_WINS} eq '') {
 393         print CONF "max-clients 100\n";
 394     }
 395     if ($sovpnsettings{DHCP_WINS} ne '') {
 396         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 397     }
 398     print CONF "tls-verify /var/ipfire/ovpn/verify\n";
 399     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 400     print CONF "user nobody\n";
 401     print CONF "group nobody\n";
 402     print CONF "persist-key\n";
 403     print CONF "persist-tun\n";
 404         if ($sovpnsettings{LOG_VERB} ne '') {
 405                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 406         } else {
 407                 print CONF "verb 3\n";
 408         }
 409     print CONF "\n";
 410
 411     close(CONF);
 412 }
 413 #
 414 sub emptyserverlog{
 415     if (open(FILE, ">/var/log/ovpnserver.log")) {
 416         flock FILE, 2;
 417         print FILE "";
 418         close FILE;
 419     }
 420
 421 }
 422
 423 ###
 424 # m.a.d net2net
 425 ###
 426
 427 sub validdotmask
 428 {
 429         my $ipdotmask = $_[0];
 430         if (&General::validip($ipdotmask)) { return 0; }
 431         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 432         my $mask = $2;
 433         if (($mask =~ /\./ )) { return 0; }
 434   return 1;
 435 }
 436
 437 # -------------------------------------------------------------------
 438
 439 sub write_routepushfile
 440 {
 441         open(FILE, ">$routes_push_file");
 442         flock(FILE, 2);
 443         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 444                 print FILE $vpnsettings{'ROUTES_PUSH'};
 445         }
 446         close(FILE);
 447 }
 448
 449 sub read_routepushfile
 450 {
 451         if (-e "$routes_push_file") {
 452                 open(FILE,"$routes_push_file");
 453                 delete $vpnsettings{'ROUTES_PUSH'};
 454                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 455                 close(FILE);
 456                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 457         }
 458 }
 459
 460
 461 #hier die refresh page
 462 if ( -e "${General::swroot}/ovpn/gencanow") {
 463     my $refresh = '';
 464     $refresh = "<meta http-equiv='refresh' content='15;' />";
 465     &Header::showhttpheaders();
 466     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 467     &Header::openbigbox('100%', 'center');
 468     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 469     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 470     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 471     &Header::closebox();
 472     &Header::closebigbox();
 473     &Header::closepage();
 474     exit (0);
 475 }
 476 ##hier die refresh page
 477
 478
 479 ###
 480 ### OpenVPN Server Control
 481 ###
 482 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 483     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 484     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 485     #start openvpn server
 486     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 487         &emptyserverlog();
 488         system('/usr/local/bin/openvpnctrl', '-s');
 489     }
 490     #stop openvpn server
 491     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 492         system('/usr/local/bin/openvpnctrl', '-k');
 493         &emptyserverlog();
 494     }
 495 #    #restart openvpn server
 496     if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 497 #workarund, till SIGHUP also works when running as nobody
 498         system('/usr/local/bin/openvpnctrl', '-r');
 499         &emptyserverlog();
 500     }
 501 }
 502
 503 ###
 504 ### Save Advanced options
 505 ###
 506
 507 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 508     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 509     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 510     #DAN this value has to leave.
 511 #new settings for daemon
 512     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 513     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 514     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 515     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 516     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 517     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 518     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 519     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 520     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 521     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 522     my @temp=();
 523
 524     if ($cgiparams{'FRAGMENT'} eq '') {
 525         delete $vpnsettings{'FRAGMENT'};
 526     } else {
 527         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 528             $errormessage = "Incorrect value, please insert only numbers.";
 529         goto ADV_ERROR;
 530                 } else {
 531                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 532         }
 533     }
 534     if ($cgiparams{'MSSFIX'} ne 'on') {
 535         $vpnsettings{'MSSFIX'} = 'off';
 536     } else {
 537         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 538     }
 539     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 540         unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 541                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 542         goto ADV_ERROR;
 543         }
 544     }
 545     if ($cgiparams{'DHCP_DNS'} ne ''){
 546         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 547                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 548         goto ADV_ERROR;
 549         }
 550     }
 551     if ($cgiparams{'DHCP_WINS'} ne ''){
 552         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 553                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 554                 goto ADV_ERROR;
 555         }
 556     }
 557     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 558         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 559         undef $vpnsettings{'ROUTES_PUSH'};
 560         foreach (@temp)
 561         {
 562                 s/^\s+//g; s/\s+$//g;
 563                 if ($_)
 564                 {
 565                         unless (&General::validipandmask($_)) {
 566                                 $errormessage = $Lang::tr{'ovpn errmsg invalid ip or mask'};
 567                         goto ADV_ERROR;
 568                         }
 569                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($_));
 570                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 571                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 572   goto ADV_ERROR;
 573                         }
 574                         $vpnsettings{'ROUTES_PUSH'} .= $_."\n";
 575                 }
 576         }
 577         &write_routepushfile;
 578         undef $vpnsettings{'ROUTES_PUSH'};
 579     }
 580         else {
 581         undef $vpnsettings{'ROUTES_PUSH'};
 582         &write_routepushfile;
 583     }
 584     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 585         $errormessage = $Lang::tr{'invalid input for max clients'};
 586         goto ADV_ERROR;
 587     }
 588     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 589         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 590             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 591         goto ADV_ERROR;
 592         }
 593     }
 594     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 595         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 596             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 597         goto ADV_ERROR;
 598         }
 599     }
 600     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 601         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 602         goto ADV_ERROR;
 603     }
 604
 605     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 606     &writeserverconf();#hier ok
 607 }
 608
 609 ###
 610 # m.a.d net2net
 611 ###
 612
 613 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 614 {
 615
 616 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 617 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 618 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 619 my $tunmtu =  '';
 620
 621 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 622 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 623
 624   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 625
 626   flock SERVERCONF, 2;
 627   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 628   print SERVERCONF "\n";
 629   print SERVERCONF "# User Security\n";
 630   print SERVERCONF "user nobody\n";
 631   print SERVERCONF "group nobody\n";
 632   print SERVERCONF "persist-tun\n";
 633   print SERVERCONF "persist-key\n";
 634   print SERVERCONF "script-security 2\n";
 635   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 636   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 637   print SERVERCONF "float\n";
 638   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 639   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 640   print SERVERCONF "# Client Gateway Network\n";
 641   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 642   print SERVERCONF "# tun Device\n";
 643   print SERVERCONF "dev tun\n";
 644   print SERVERCONF "# Port and Protokol\n";
 645   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 646
 647   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 648   print SERVERCONF "proto tcp-server\n";
 649   print SERVERCONF "# Packet size\n";
 650   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 651   print SERVERCONF "tun-mtu $tunmtu\n";
 652   }
 653
 654   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 655   print SERVERCONF "proto udp\n";
 656   print SERVERCONF "# Paketsize\n";
 657   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 658   print SERVERCONF "tun-mtu $tunmtu\n";
 659   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 660   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
 661   }
 662   print SERVERCONF "# Auth. Server\n";
 663   print SERVERCONF "tls-server\n";
 664   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 665   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 666   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 667   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
 668   print SERVERCONF "# Cipher\n";
 669   print SERVERCONF "cipher AES-256-CBC\n";
 670   if ($cgiparams{'COMPLZO'} eq 'on') {
 671    print SERVERCONF "# Enable Compression\n";
 672    print SERVERCONF "comp-lzo\r\n";
 673      }
 674   print SERVERCONF "# Debug Level\n";
 675   print SERVERCONF "verb 3\n";
 676   print SERVERCONF "# Tunnel check\n";
 677   print SERVERCONF "keepalive 10 60\n";
 678   print SERVERCONF "# Start as daemon\n";
 679   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
 680   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 681   print SERVERCONF "# Activate Management Interface and Port\n";
 682   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 683   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 684   close(SERVERCONF);
 685
 686 }
 687
 688 ###
 689 # m.a.d net2net
 690 ###
 691
 692 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
 693 {
 694         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 695         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 696         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
 697         my $tunmtu =  '';
 698
 699 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 700 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 701
 702   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 703
 704   flock CLIENTCONF, 2;
 705   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
 706   print CLIENTCONF "#\n";
 707   print CLIENTCONF "# User Security\n";
 708   print CLIENTCONF "user nobody\n";
 709   print CLIENTCONF "group nobody\n";
 710   print CLIENTCONF "persist-tun\n";
 711   print CLIENTCONF "persist-key\n";
 712   print CLIENTCONF "script-security 2\n";
 713   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
 714   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
 715   print CLIENTCONF "float\n";
 716   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
 717   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
 718   print CLIENTCONF "# Server Gateway Network\n";
 719   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
 720   print CLIENTCONF "# tun Device\n";
 721   print CLIENTCONF "dev tun\n";
 722   print CLIENTCONF "# Port and Protokol\n";
 723   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
 724
 725   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 726   print CLIENTCONF "proto tcp-client\n";
 727   print CLIENTCONF "# Packet size\n";
 728   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 729   print CLIENTCONF "tun-mtu $tunmtu\n";
 730   }
 731
 732   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 733   print CLIENTCONF "proto udp\n";
 734   print CLIENTCONF "# Paketsize\n";
 735   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 736   print CLIENTCONF "tun-mtu $tunmtu\n";
 737   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 738   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
 739   }
 740
 741   print CLIENTCONF "ns-cert-type server\n";
 742   print CLIENTCONF "# Auth. Client\n";
 743   print CLIENTCONF "tls-client\n";
 744   print CLIENTCONF "# Cipher\n";
 745   print CLIENTCONF "cipher AES-256-CBC\n";
 746   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
 747   if ($cgiparams{'COMPLZO'} eq 'on') {
 748    print CLIENTCONF "# Enable Compression\n";
 749    print CLIENTCONF "comp-lzo\r\n";
 750      }
 751   print CLIENTCONF "# Debug Level\n";
 752   print CLIENTCONF "verb 3\n";
 753   print CLIENTCONF "# Tunnel check\n";
 754   print CLIENTCONF "keepalive 10 60\n";
 755   print CLIENTCONF "# Start as daemon\n";
 756   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
 757   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 758   print CLIENTCONF "# Activate Management Interface and Port\n";
 759   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 760   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 761   close(CLIENTCONF);
 762
 763 }
 764
 765 ###
 766 ### Save main settings
 767 ###
 768
 769
 770 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
 771     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 772     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 773     #DAN this value has to leave.
 774     if ($cgiparams{'ENABLED'} eq 'on'){
 775         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
 776                 $errormessage = $Lang::tr{'invalid input for hostname'};
 777         goto SETTINGS_ERROR;
 778         }
 779     }
 780     if ($cgiparams{'ENABLED'} eq 'on'){
 781         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
 782     }
 783     if ($errormessage) { goto SETTINGS_ERROR; }
 784
 785
 786     if ($cgiparams{'ENABLED'} eq 'on'){
 787         &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
 788     }
 789
 790     if ($errormessage) { goto SETTINGS_ERROR; }
 791
 792     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
 793             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
 794         goto SETTINGS_ERROR;
 795     }
 796     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
 797
 798     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
 799         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 800         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
 801         goto SETTINGS_ERROR;
 802     }
 803
 804     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
 805         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 806         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
 807         goto SETTINGS_ERROR;
 808     }
 809
 810     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
 811         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 812         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
 813         goto SETTINGS_ERROR;
 814     }
 815
 816     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
 817         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 818         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
 819         goto SETTINGS_ERROR;
 820     }
 821     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
 822     while (<ALIASES>)
 823     {
 824         chomp($_);
 825         my @tempalias = split(/\,/,$_);
 826         if ($tempalias[1] eq 'on') {
 827             if (&General::IpInSubnet ($tempalias[0] ,
 828                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 829                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
 830             }
 831         }
 832     }
 833     close(ALIASES);
 834     if ($errormessage ne ''){
 835         goto SETTINGS_ERROR;
 836     }
 837     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
 838         $errormessage = $Lang::tr{'invalid input'};
 839         goto SETTINGS_ERROR;
 840     }
 841     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
 842         $errormessage = $Lang::tr{'invalid mtu input'};
 843         goto SETTINGS_ERROR;
 844     }
 845
 846     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
 847         $errormessage = $Lang::tr{'invalid port'};
 848         goto SETTINGS_ERROR;
 849     }
 850     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
 851     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
 852     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
 853     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
 854 #new settings for daemon
 855     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
 856     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
 857     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
 858     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
 859     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
 860     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
 861     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
 862 #wrtie enable
 863
 864   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
 865   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
 866   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
 867 #new settings for daemon
 868     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 869     &writeserverconf();#hier ok
 870 SETTINGS_ERROR:
 871 ###
 872 ### Reset all step 2
 873 ###
 874 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
 875     my $file = '';
 876     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 877
 878     foreach my $key (keys %confighash) {
 879         if ($confighash{$key}[4] eq 'cert') {
 880             delete $confighash{$cgiparams{'$key'}};
 881         }
 882     }
 883     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
 884         unlink $file
 885     }
 886     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
 887         unlink $file
 888     }
 889     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
 890         unlink $file
 891     }
 892     &cleanssldatabase();
 893     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
 894         print FILE "";
 895         close FILE;
 896     }
 897     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 898     #&writeserverconf();
 899 ###
 900 ### Reset all step 1
 901 ###
 902 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
 903     &Header::showhttpheaders();
 904     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
 905     &Header::openbigbox('100%', 'LEFT', '', '');
 906     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
 907     print <<END
 908         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
 909             <tr><td align='center'>
 910                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
 911                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
 912             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
 913                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
 914         </form></table>
 915 END
 916     ;
 917     &Header::closebox();
 918     &Header::closebigbox();
 919     &Header::closepage();
 920     exit (0);
 921
 922 ###
 923 ### Upload CA Certificate
 924 ###
 925 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
 926     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 927
 928     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
 929         $errormessage = $Lang::tr{'name must only contain characters'};
 930         goto UPLOADCA_ERROR;
 931     }
 932
 933     if (length($cgiparams{'CA_NAME'}) >60) {
 934         $errormessage = $Lang::tr{'name too long'};
 935         goto VPNCONF_ERROR;
 936     }
 937
 938     if ($cgiparams{'CA_NAME'} eq 'ca') {
 939         $errormessage = $Lang::tr{'name is invalid'};
 940         goto UPLOAD_CA_ERROR;
 941     }
 942
 943     # Check if there is no other entry with this name
 944     foreach my $key (keys %cahash) {
 945         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
 946             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
 947             goto UPLOADCA_ERROR;
 948         }
 949     }
 950
 951     if (ref ($cgiparams{'FH'}) ne 'Fh') {
 952         $errormessage = $Lang::tr{'there was no file upload'};
 953         goto UPLOADCA_ERROR;
 954     }
 955     # Move uploaded ca to a temporary file
 956     (my $fh, my $filename) = tempfile( );
 957     if (copy ($cgiparams{'FH'}, $fh) != 1) {
 958         $errormessage = $!;
 959         goto UPLOADCA_ERROR;
 960     }
 961     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
 962     if ($temp !~ /CA:TRUE/i) {
 963         $errormessage = $Lang::tr{'not a valid ca certificate'};
 964         unlink ($filename);
 965         goto UPLOADCA_ERROR;
 966     } else {
 967         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
 968         if ($? ne 0) {
 969             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
 970             unlink ($filename);
 971             goto UPLOADCA_ERROR;
 972         }
 973     }
 974
 975     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
 976     $casubject    =~ /Subject: (.*)[\n]/;
 977     $casubject    = $1;
 978     $casubject    =~ s+/Email+, E+;
 979     $casubject    =~ s/ ST=/ S=/;
 980     $casubject    = &Header::cleanhtml($casubject);
 981
 982     my $key = &General::findhasharraykey (\%cahash);
 983     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
 984     $cahash{$key}[1] = $casubject;
 985     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 986 #    system('/usr/local/bin/ipsecctrl', 'R');
 987
 988     UPLOADCA_ERROR:
 989
 990 ###
 991 ### Display ca certificate
 992 ###
 993 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
 994     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 995
 996     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
 997         &Header::showhttpheaders();
 998         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
 999         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1000         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
1001         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1002         $output = &Header::cleanhtml($output,"y");
1003         print "<pre>$output</pre>\n";
1004         &Header::closebox();
1005         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1006         &Header::closebigbox();
1007         &Header::closepage();
1008         exit(0);
1009     } else {
1010         $errormessage = $Lang::tr{'invalid key'};
1011     }
1012
1013 ###
1014 ### Download ca certificate
1015 ###
1016 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1017     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1018
1019     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1020         print "Content-Type: application/octet-stream\r\n";
1021         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1022         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1023         exit(0);
1024     } else {
1025         $errormessage = $Lang::tr{'invalid key'};
1026     }
1027
1028 ###
1029 ### Remove ca certificate (step 2)
1030 ###
1031 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1032     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1033     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1034
1035     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1036         foreach my $key (keys %confighash) {
1037             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1038             if ($test =~ /: OK/) {
1039                 # Delete connection
1040 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1041 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1042 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1043 #               }
1044                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1045                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1046                 delete $confighash{$key};
1047                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1048 #               &writeipsecfiles();
1049             }
1050         }
1051         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1052         delete $cahash{$cgiparams{'KEY'}};
1053         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1054 #       system('/usr/local/bin/ipsecctrl', 'R');
1055     } else {
1056         $errormessage = $Lang::tr{'invalid key'};
1057     }
1058 ###
1059 ### Remove ca certificate (step 1)
1060 ###
1061 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1062     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1063     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1064
1065     my $assignedcerts = 0;
1066     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1067         foreach my $key (keys %confighash) {
1068             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1069             if ($test =~ /: OK/) {
1070                 $assignedcerts++;
1071             }
1072         }
1073         if ($assignedcerts) {
1074             &Header::showhttpheaders();
1075             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1076             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1077             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1078             print <<END
1079                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1080                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1081                     <tr><td align='center'>
1082                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1083                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1084                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1085                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1086                 </form></table>
1087 END
1088             ;
1089             &Header::closebox();
1090             &Header::closebigbox();
1091             &Header::closepage();
1092             exit (0);
1093         } else {
1094             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1095             delete $cahash{$cgiparams{'KEY'}};
1096             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1097 #           system('/usr/local/bin/ipsecctrl', 'R');
1098         }
1099     } else {
1100         $errormessage = $Lang::tr{'invalid key'};
1101     }
1102
1103 ###
1104 ### Display root certificate
1105 ###
1106 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1107     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1108     my $output;
1109     &Header::showhttpheaders();
1110     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1111     &Header::openbigbox('100%', 'LEFT', '', '');
1112     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1113         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1114         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1115     } else {
1116         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1117         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1118     }
1119     $output = &Header::cleanhtml($output,"y");
1120     print "<pre>$output</pre>\n";
1121     &Header::closebox();
1122     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1123     &Header::closebigbox();
1124     &Header::closepage();
1125     exit(0);
1126
1127 ###
1128 ### Download root certificate
1129 ###
1130 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1131     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1132         print "Content-Type: application/octet-stream\r\n";
1133         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1134         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1135         exit(0);
1136     }
1137
1138 ###
1139 ### Download host certificate
1140 ###
1141 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1142     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1143         print "Content-Type: application/octet-stream\r\n";
1144         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1145         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1146         exit(0);
1147     }
1148 ###
1149 ### Form for generating a root certificate
1150 ###
1151 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1152          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1153
1154     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1155     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1156         $errormessage = $Lang::tr{'valid root certificate already exists'};
1157         $cgiparams{'ACTION'} = '';
1158         goto ROOTCERT_ERROR;
1159     }
1160
1161     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1162         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1163             my $ipaddr = <IPADDR>;
1164             close IPADDR;
1165             chomp ($ipaddr);
1166             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1167             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1168                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1169             }
1170         }
1171     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1172
1173         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1174             $errormessage = $Lang::tr{'there was no file upload'};
1175             goto ROOTCERT_ERROR;
1176         }
1177
1178         # Move uploaded certificate request to a temporary file
1179         (my $fh, my $filename) = tempfile( );
1180         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1181             $errormessage = $!;
1182             goto ROOTCERT_ERROR;
1183         }
1184
1185         # Create a temporary dirctory
1186         my $tempdir = tempdir( CLEANUP => 1 );
1187
1188         # Extract the CA certificate from the file
1189         my $pid = open(OPENSSL, "|-");
1190         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1191         if ($pid) {     # parent
1192             if ($cgiparams{'P12_PASS'} ne '') {
1193                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1194             }
1195             close (OPENSSL);
1196             if ($?) {
1197                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1198                 unlink ($filename);
1199                 goto ROOTCERT_ERROR;
1200             }
1201         } else {        # child
1202             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1203                     '-in', $filename,
1204                     '-out', "$tempdir/cacert.pem")) {
1205                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1206                 unlink ($filename);
1207                 goto ROOTCERT_ERROR;
1208             }
1209         }
1210
1211         # Extract the Host certificate from the file
1212         $pid = open(OPENSSL, "|-");
1213         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1214         if ($pid) {     # parent
1215             if ($cgiparams{'P12_PASS'} ne '') {
1216                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1217             }
1218             close (OPENSSL);
1219             if ($?) {
1220                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1221                 unlink ($filename);
1222                 goto ROOTCERT_ERROR;
1223             }
1224         } else {        # child
1225             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1226                     '-in', $filename,
1227                     '-out', "$tempdir/hostcert.pem")) {
1228                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1229                 unlink ($filename);
1230                 goto ROOTCERT_ERROR;
1231             }
1232         }
1233
1234         # Extract the Host key from the file
1235         $pid = open(OPENSSL, "|-");
1236         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1237         if ($pid) {     # parent
1238             if ($cgiparams{'P12_PASS'} ne '') {
1239                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1240             }
1241             close (OPENSSL);
1242             if ($?) {
1243                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1244                 unlink ($filename);
1245                 goto ROOTCERT_ERROR;
1246             }
1247         } else {        # child
1248             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1249                     '-nodes',
1250                     '-in', $filename,
1251                     '-out', "$tempdir/serverkey.pem")) {
1252                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1253                 unlink ($filename);
1254                 goto ROOTCERT_ERROR;
1255             }
1256         }
1257
1258         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1259         if ($? ne 0) {
1260             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1261             unlink ($filename);
1262             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1263             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1264             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1265             goto ROOTCERT_ERROR;
1266         }
1267
1268         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1269         if ($? ne 0) {
1270             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1271             unlink ($filename);
1272             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1273             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1274             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1275             goto ROOTCERT_ERROR;
1276         }
1277
1278         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1279         if ($? ne 0) {
1280             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1281             unlink ($filename);
1282             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1283             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1284             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1285             goto ROOTCERT_ERROR;
1286         }
1287
1288         goto ROOTCERT_SUCCESS;
1289
1290     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1291
1292         # Validate input since the form was submitted
1293         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1294             $errormessage = $Lang::tr{'organization cant be empty'};
1295             goto ROOTCERT_ERROR;
1296         }
1297         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1298             $errormessage = $Lang::tr{'organization too long'};
1299             goto ROOTCERT_ERROR;
1300         }
1301         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1302             $errormessage = $Lang::tr{'invalid input for organization'};
1303             goto ROOTCERT_ERROR;
1304         }
1305         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1306             $errormessage = $Lang::tr{'hostname cant be empty'};
1307             goto ROOTCERT_ERROR;
1308         }
1309         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1310             $errormessage = $Lang::tr{'invalid input for hostname'};
1311             goto ROOTCERT_ERROR;
1312         }
1313         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1314             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1315             goto ROOTCERT_ERROR;
1316         }
1317         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1318             $errormessage = $Lang::tr{'e-mail address too long'};
1319             goto ROOTCERT_ERROR;
1320         }
1321         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1322             $errormessage = $Lang::tr{'invalid input for department'};
1323             goto ROOTCERT_ERROR;
1324         }
1325         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1326             $errormessage = $Lang::tr{'invalid input for city'};
1327             goto ROOTCERT_ERROR;
1328         }
1329         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1330             $errormessage = $Lang::tr{'invalid input for state or province'};
1331             goto ROOTCERT_ERROR;
1332         }
1333         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1334             $errormessage = $Lang::tr{'invalid input for country'};
1335             goto ROOTCERT_ERROR;
1336         }
1337
1338         # Copy the cgisettings to vpnsettings and save the configfile
1339         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1340         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1341         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1342         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1343         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1344         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1345         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1346         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1347
1348         # Replace empty strings with a .
1349         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1350         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1351         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1352
1353         # refresh
1354         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1355
1356         # Create the CA certificate
1357         my $pid = open(OPENSSL, "|-");
1358         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1359         if ($pid) {     # parent
1360             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1361             print OPENSSL "$state\n";
1362             print OPENSSL "$city\n";
1363             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1364             print OPENSSL "$ou\n";
1365             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1366             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1367             close (OPENSSL);
1368             if ($?) {
1369                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1370                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1371                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1372                 goto ROOTCERT_ERROR;
1373             }
1374         } else {        # child
1375             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1376                         '-days', '999999', '-newkey', 'rsa:2048',
1377                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1378                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1379                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1380                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1381                 goto ROOTCERT_ERROR;
1382             }
1383         }
1384
1385         # Create the Host certificate request
1386         $pid = open(OPENSSL, "|-");
1387         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1388         if ($pid) {     # parent
1389             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1390             print OPENSSL "$state\n";
1391             print OPENSSL "$city\n";
1392             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1393             print OPENSSL "$ou\n";
1394             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1395             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1396             print OPENSSL ".\n";
1397             print OPENSSL ".\n";
1398             close (OPENSSL);
1399             if ($?) {
1400                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1401                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1402                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1403                 goto ROOTCERT_ERROR;
1404             }
1405         } else {        # child
1406             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1407                         '-newkey', 'rsa:1024',
1408                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1409                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1410                         '-extensions', 'server',
1411                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1412                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1413                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1414                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1415                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1416                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1417                 goto ROOTCERT_ERROR;
1418             }
1419         }
1420
1421         # Sign the host certificate request
1422         system('/usr/bin/openssl', 'ca', '-days', '999999',
1423                 '-batch', '-notext',
1424                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1425                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1426                 '-extensions', 'server',
1427                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1428         if ($?) {
1429             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1430             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1431             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1432             unlink ("${General::swroot}/ovpn/serverkey.pem");
1433             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1434             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1435             &newcleanssldatabase();
1436             goto ROOTCERT_ERROR;
1437         } else {
1438             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1439             &deletebackupcert();
1440         }
1441
1442         # Create an empty CRL
1443         system('/usr/bin/openssl', 'ca', '-gencrl',
1444                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1445                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1446         if ($?) {
1447             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1448             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1449             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1450             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1451             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1452             &cleanssldatabase();
1453             goto ROOTCERT_ERROR;
1454 #       } else {
1455 #           &cleanssldatabase();
1456         }
1457         # Create Diffie Hellmann Parameter
1458         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1459                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1460                '1024' );
1461         if ($?) {
1462             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1463             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1464             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1465             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1466             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1467             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1468             &cleanssldatabase();
1469             goto ROOTCERT_ERROR;
1470 #       } else {
1471 #           &cleanssldatabase();
1472         }
1473         goto ROOTCERT_SUCCESS;
1474     }
1475     ROOTCERT_ERROR:
1476     if ($cgiparams{'ACTION'} ne '') {
1477         &Header::showhttpheaders();
1478         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1479         &Header::openbigbox('100%', 'LEFT', '', '');
1480         if ($errormessage) {
1481             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1482             print "<class name='base'>$errormessage";
1483             print "&nbsp;</class>";
1484             &Header::closebox();
1485         }
1486         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1487         print <<END
1488         <form method='post' enctype='multipart/form-data'>
1489         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1490         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1491             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1492             <td width='35%' colspan='2'>&nbsp;</td></tr>
1493         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1494             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1495             <td colspan='2'>&nbsp;</td></tr>
1496         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1497             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1498             <td colspan='2'>&nbsp;</td></tr>
1499         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1500             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1501             <td colspan='2'>&nbsp;</td></tr>
1502         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1503             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1504             <td colspan='2'>&nbsp;</td></tr>
1505         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1506             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1507             <td colspan='2'>&nbsp;</td></tr>
1508         <tr><td class='base'>$Lang::tr{'country'}:</td>
1509             <td class='base'><select name='ROOTCERT_COUNTRY'>
1510
1511 END
1512         ;
1513         foreach my $country (sort keys %{Countries::countries}) {
1514             print "<option value='$Countries::countries{$country}'";
1515             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1516                 print " selected='selected'";
1517             }
1518             print ">$country</option>";
1519         }
1520         print <<END
1521             </select></td>
1522             <td colspan='2'>&nbsp;</td></tr>
1523         <tr><td>&nbsp;</td>
1524             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1525             <td>&nbsp;</td><td>&nbsp;</td></tr>
1526         <tr><td class='base' colspan='4' align='left'>
1527             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1528         <tr><td class='base' colspan='4' align='left'>
1529             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1530             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1531         </td></tr>
1532         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1533         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1534             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1535             <td colspan='2'>&nbsp;</td></tr>
1536         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1537             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1538             <td colspan='2'>&nbsp;</td></tr>
1539         <tr><td>&nbsp;</td>
1540             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1541             <td colspan='2'>&nbsp;</td></tr>
1542         <tr><td class='base' colspan='4' align='left'>
1543             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1544         </form></table>
1545 END
1546         ;
1547         &Header::closebox();
1548
1549         &Header::closebigbox();
1550         &Header::closepage();
1551         exit(0)
1552     }
1553
1554     ROOTCERT_SUCCESS:
1555     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1556 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1557 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1558 #       system('/usr/local/bin/ipsecctrl', 'S');
1559 #    }
1560
1561 ###
1562 ### Enable/Disable connection
1563 ###
1564
1565 ###
1566 # m.a.d net2net
1567 ###
1568
1569 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1570
1571     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1572     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1573 #    my $n2nactive = '';
1574     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1575
1576     if ($confighash{$cgiparams{'KEY'}}) {
1577
1578
1579         if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1580             $confighash{$cgiparams{'KEY'}}[0] = 'on';
1581             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1582
1583      if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1584                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1585           }
1586
1587   } else {
1588
1589             $confighash{$cgiparams{'KEY'}}[0] = 'off';
1590       &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1591
1592           if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1593                     if ($n2nactive ne ''){
1594                     system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1595            }
1596
1597           } else {
1598                   $errormessage = $Lang::tr{'invalid key'};
1599           }
1600       }
1601   }
1602
1603 ###
1604 ### Download OpenVPN client package
1605 ###
1606
1607
1608 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1609     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1610     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1611     my $file = '';
1612     my $clientovpn = '';
1613     my @fileholder;
1614     my $tempdir = tempdir( CLEANUP => 1 );
1615     my $zippath = "$tempdir/";
1616
1617 ###
1618 # m.a.d net2net
1619 ###
1620
1621 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1622
1623         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1624         my $zippathname = "$zippath$zipname";
1625         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1626         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1627         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1628         my $tunmtu = '';
1629         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1630         my $n2nfragment = '';
1631
1632     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1633     flock CLIENTCONF, 2;
1634
1635     my $zip = Archive::Zip->new();
1636    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1637    print CLIENTCONF "# \n";
1638    print CLIENTCONF "# User Security\n";
1639    print CLIENTCONF "user nobody\n";
1640    print CLIENTCONF "group nobody\n";
1641    print CLIENTCONF "persist-tun\n";
1642    print CLIENTCONF "persist-key\n";
1643    print CLIENTCONF "script-security 2\n";
1644    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1645    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1646    print CLIENTCONF "float\n";
1647    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1648    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1649    print CLIENTCONF "# Server Gateway Network\n";
1650    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1651    print CLIENTCONF "# tun Device\n";
1652    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1653    print CLIENTCONF "# Port and Protokoll\n";
1654    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1655
1656    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1657    print CLIENTCONF "proto tcp-client\n";
1658    print CLIENTCONF "# Packet size\n";
1659    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1660    print CLIENTCONF "tun-mtu $tunmtu\n";
1661    }
1662
1663    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1664    print CLIENTCONF "proto udp\n";
1665    print CLIENTCONF "# Paketsize\n";
1666    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1667    print CLIENTCONF "tun-mtu $tunmtu\n";
1668    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1669    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1670    }
1671    print CLIENTCONF "ns-cert-type server\n";
1672    print CLIENTCONF "# Auth. Client\n";
1673    print CLIENTCONF "tls-client\n";
1674    print CLIENTCONF "# Cipher\n";
1675    print CLIENTCONF "cipher AES-256-CBC\n";
1676     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1677          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1678      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1679    }
1680     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1681    print CLIENTCONF "# Enable Compression\n";
1682    print CLIENTCONF "comp-lzo\r\n";
1683      }
1684    print CLIENTCONF "# Debug Level\n";
1685    print CLIENTCONF "verb 3\n";
1686    print CLIENTCONF "# Tunnel check\n";
1687    print CLIENTCONF "keepalive 10 60\n";
1688    print CLIENTCONF "# Start as daemon\n";
1689    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1690    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
1691    print CLIENTCONF "# Activate Management Interface and Port\n";
1692    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
1693     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
1694    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
1695
1696
1697     close(CLIENTCONF);
1698
1699     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1700     my $status = $zip->writeToFileNamed($zippathname);
1701
1702     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1703     @fileholder = <DLFILE>;
1704     print "Content-Type:application/x-download\n";
1705     print "Content-Disposition:attachment;filename=$zipname\n\n";
1706     print @fileholder;
1707     exit (0);
1708 }
1709 else
1710 {
1711         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1712         my $zippathname = "$zippath$zipname";
1713         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1714
1715 ###
1716 # m.a.d net2net
1717 ###
1718
1719     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1720     flock CLIENTCONF, 2;
1721
1722     my $zip = Archive::Zip->new();
1723
1724     print CLIENTCONF "#OpenVPN Server conf\r\n";
1725     print CLIENTCONF "tls-client\r\n";
1726     print CLIENTCONF "client\r\n";
1727     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
1728     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
1729     print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1730     if ( $vpnsettings{'ENABLED'} eq 'on'){
1731         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
1732         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1733             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1734             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1735         }
1736         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1737             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1738             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1739         }
1740     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1741         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1742         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1743             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1744             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1745         }
1746     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1747         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1748     }
1749
1750     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1751         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1752         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1753     } else {
1754         print CLIENTCONF "ca cacert.pem\r\n";
1755         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1756         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1757         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
1758         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
1759     }
1760     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1761     if ($vpnsettings{DCOMPLZO} eq 'on') {
1762         print CLIENTCONF "comp-lzo\r\n";
1763     }
1764     print CLIENTCONF "verb 3\r\n";
1765     print CLIENTCONF "ns-cert-type server\r\n";
1766     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1767     if ($vpnsettings{MSSFIX} eq 'on') {
1768         print CLIENTCONF "mssfix\r\n";
1769     }
1770     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
1771         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1772     }
1773     close(CLIENTCONF);
1774
1775     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1776     my $status = $zip->writeToFileNamed($zippathname);
1777
1778     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1779     @fileholder = <DLFILE>;
1780     print "Content-Type:application/x-download\n";
1781     print "Content-Disposition:attachment;filename=$zipname\n\n";
1782     print @fileholder;
1783     exit (0);
1784    }
1785
1786
1787
1788 ###
1789 ### Remove connection
1790 ###
1791
1792
1793 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1794     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1795     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1796
1797     if ($confighash{$cgiparams{'KEY'}}) {
1798 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
1799 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1800 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1801 #       }
1802 #
1803         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1804
1805 ###
1806 # m.a.d net2net
1807 ###
1808
1809  if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1810
1811         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1812   my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1813   unlink ($certfile) or die "Removing $certfile fail: $!";
1814   unlink ($conffile) or die "Removing $conffile fail: $!";
1815   rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1816
1817 }
1818
1819   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1820         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1821         delete $confighash{$cgiparams{'KEY'}};
1822         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1823         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1824         #&writeserverconf();
1825     } else {
1826         $errormessage = $Lang::tr{'invalid key'};
1827     }
1828
1829
1830 ###
1831 ### Download PKCS12 file
1832 ###
1833 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1834     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1835
1836     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1837     print "Content-Type: application/octet-stream\r\n\r\n";
1838     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1839     exit (0);
1840
1841 ###
1842 ### Display certificate
1843 ###
1844 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1845     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1846
1847     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1848         &Header::showhttpheaders();
1849         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1850         &Header::openbigbox('100%', 'LEFT', '', '');
1851         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1852         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1853         $output = &Header::cleanhtml($output,"y");
1854         print "<pre>$output</pre>\n";
1855         &Header::closebox();
1856         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1857         &Header::closebigbox();
1858         &Header::closepage();
1859         exit(0);
1860     }
1861 ###
1862 ### Display Certificate Revoke List
1863 ###
1864 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
1865 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1866
1867     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
1868         &Header::showhttpheaders();
1869         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1870         &Header::openbigbox('100%', 'LEFT', '', '');
1871         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1872         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1873         $output = &Header::cleanhtml($output,"y");
1874         print "<pre>$output</pre>\n";
1875         &Header::closebox();
1876         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1877         &Header::closebigbox();
1878         &Header::closepage();
1879         exit(0);
1880     }
1881
1882 ###
1883 ### Advanced Server Settings
1884 ###
1885
1886 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1887     %cgiparams = ();
1888     %cahash = ();
1889     %confighash = ();
1890     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
1891     read_routepushfile;
1892
1893 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1894 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
1895 #    }
1896 ADV_ERROR:
1897     if ($cgiparams{'MAX_CLIENTS'} eq '') {
1898         $cgiparams{'MAX_CLIENTS'} =  '100';
1899     }
1900     if ($cgiparams{'KEEPALIVE_1'} eq '') {
1901         $cgiparams{'KEEPALIVE_1'} =  '10';
1902     }
1903     if ($cgiparams{'KEEPALIVE_2'} eq '') {
1904         $cgiparams{'KEEPALIVE_2'} =  '60';
1905     }
1906     if ($cgiparams{'LOG_VERB'} eq '') {
1907         $cgiparams{'LOG_VERB'} =  '3';
1908     }
1909     if ($cgiparams{'MSSFIX'} eq '') {
1910         $cgiparams{'MSSFIX'} = 'on';
1911     }
1912     if ($cgiparams{'FRAGMENT'} eq '') {
1913         $cgiparams{'FRAGMENT'} = '1300';
1914     }
1915     $checked{'CLIENT2CLIENT'}{'off'} = '';
1916     $checked{'CLIENT2CLIENT'}{'on'} = '';
1917     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1918     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1919     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1920     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
1921     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1922     $checked{'MSSFIX'}{'off'} = '';
1923     $checked{'MSSFIX'}{'on'} = '';
1924     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
1925     $selected{'LOG_VERB'}{'1'} = '';
1926     $selected{'LOG_VERB'}{'2'} = '';
1927     $selected{'LOG_VERB'}{'3'} = '';
1928     $selected{'LOG_VERB'}{'4'} = '';
1929     $selected{'LOG_VERB'}{'5'} = '';
1930     $selected{'LOG_VERB'}{'6'} = '';
1931     $selected{'LOG_VERB'}{'7'} = '';
1932     $selected{'LOG_VERB'}{'8'} = '';
1933     $selected{'LOG_VERB'}{'9'} = '';
1934     $selected{'LOG_VERB'}{'10'} = '';
1935     $selected{'LOG_VERB'}{'11'} = '';
1936     $selected{'LOG_VERB'}{'0'} = '';
1937     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
1938
1939
1940
1941     &Header::showhttpheaders();
1942     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1943     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1944     if ($errormessage) {
1945         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1946         print "<class name='base'>$errormessage\n";
1947         print "&nbsp;</class>\n";
1948         &Header::closebox();
1949     }
1950     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1951     print <<END
1952     <form method='post' enctype='multipart/form-data'>
1953     <table width='100%'>
1954     <tr>
1955         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1956     </tr>
1957     <tr>
1958         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1959     </tr>
1960     <tr>
1961         <td class='base'>Domain</td>
1962         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1963     </tr>
1964     <tr>
1965         <td class='base'>DNS</td>
1966         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1967     </tr>
1968     <tr>
1969         <td class='base'>WINS</td>
1970         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
1971        </tr>
1972     <tr>
1973         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
1974     </tr>
1975     <tr>
1976         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
1977   <td colspan='2'>
1978        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
1979 END
1980 ;
1981
1982 if ($cgiparams{'ROUTES_PUSH'} ne '')
1983 {
1984         print $cgiparams{'ROUTES_PUSH'};
1985 }
1986
1987 print <<END
1988 </textarea></td>
1989 </tr>
1990     </tr>
1991 </table>
1992 <hr size='1'>
1993     <table width='100%'>
1994     <tr>
1995         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1996     </tr>
1997     <tr>
1998         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
1999     </tr>
2000     <tr>
2001         <td class='base'>Client-To-Client</td>
2002         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
2003     </tr>
2004     <tr>
2005         <td class='base'>Redirect-Gateway def1</td>
2006         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
2007     </tr>
2008     <tr>
2009         <td class='base'>Max-Clients</td>
2010         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2011     </tr>
2012         <tr>
2013           <td class='base'>Keppalive <br />
2014             (ping/ping-restart)</td>
2015           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2016           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2017     </tr>
2018         <tr>
2019           <td class='base'>fragment <br></td>
2020           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2021         <td>Default: <span class="base">1300</span></td>
2022       </tr>
2023         <tr>
2024           <td class='base'>mssfix</td>
2025           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2026           <td>Default: on</td>
2027           </tr>
2028 </table>
2029
2030 <!--
2031 <hr size='1'>
2032     <table width='100%'>
2033     <tr>
2034  <td class'base'><b>Crypto-Engines</b></td>
2035     </tr>
2036     <tr>
2037         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2038     </tr>
2039     <tr><td class='base'>Engines:</td>
2040         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2041                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2042                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2043                         </select>
2044                 </td>
2045 </table>
2046 -->
2047 <hr size='1'>
2048     <table width='100%'>
2049     <tr>
2050         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2051     </tr>
2052     <tr>
2053         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2054     </tr>
2055
2056     <tr><td class='base'>VERB</td>
2057         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2058                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2059                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2060                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2061                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2062                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2063                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2064                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2065                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2066                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2067                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2068                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2069 </table>
2070 <hr size='1'>
2071 <table width='100%'>
2072 <tr>
2073     <td>&nbsp;</td>
2074     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2075     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2076     <td>&nbsp;</td>
2077 </tr>
2078 </table>
2079 </form>
2080 END
2081 ;
2082
2083     &Header::closebox();
2084 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2085     &Header::closebigbox();
2086     &Header::closepage();
2087     exit(0);
2088
2089 ###
2090 ### Openvpn Connections Statistics
2091 ###
2092 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2093         &Header::showhttpheaders();
2094         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2095         &Header::openbigbox('100%', 'LEFT', '', '');
2096     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2097
2098 #
2099 #       <td><b>$Lang::tr{'protocol'}</b></td>
2100 # protocol temp removed
2101     print <<END
2102     <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2103     <tr>
2104         <td><b>$Lang::tr{'common name'}</b></td>
2105         <td><b>$Lang::tr{'real address'}</b></td>
2106         <td><b>$Lang::tr{'virtual address'}</b></td>
2107         <td><b>$Lang::tr{'loged in at'}</b></td>
2108         <td><b>$Lang::tr{'bytes sent'}</b></td>
2109         <td><b>$Lang::tr{'bytes received'}</b></td>
2110         <td><b>$Lang::tr{'last activity'}</b></td>
2111     </tr>
2112 END
2113 ;
2114         my $filename = "/var/log/ovpnserver.log";
2115         open(FILE, $filename) or die 'Unable to open config file.';
2116         my @current = <FILE>;
2117         close(FILE);
2118         my @users =();
2119         my $status;
2120         my $uid = 0;
2121         my $cn;
2122         my @match = ();
2123         my $proto = "udp";
2124         my $address;
2125         my %userlookup = ();
2126         foreach my $line (@current)
2127         {
2128             chomp($line);
2129             if ( $line =~ /^Updated,(.+)/){
2130                 @match = split( /^Updated,(.+)/, $line);
2131                 $status = $match[1];
2132             }
2133 #gian
2134             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2135                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2136                 if ($match[1] ne "Common Name") {
2137                     $cn = $match[1];
2138                     $userlookup{$match[2]} = $uid;
2139                     $users[$uid]{'CommonName'} = $match[1];
2140                     $users[$uid]{'RealAddress'} = $match[2];
2141                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2142                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2143                     $users[$uid]{'Since'} = $match[5];
2144                     $users[$uid]{'Proto'} = $proto;
2145                     $uid++;
2146                 }
2147             }
2148             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2149                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2150                 if ($match[1] ne "Virtual Address") {
2151                     $address = $match[3];
2152                     #find the uid in the lookup table
2153                     $uid = $userlookup{$address};
2154                     $users[$uid]{'VirtualAddress'} = $match[1];
2155                     $users[$uid]{'LastRef'} = $match[4];
2156                 }
2157             }
2158         }
2159         my $user2 = @users;
2160         if ($user2 >= 1){
2161             for (my $idx = 1; $idx <= $user2; $idx++){
2162                                                 if ($idx % 2) {
2163                                         print "<tr bgcolor='$color{'color20'}'>\n";
2164                                 } else {
2165                                         print "<tr bgcolor='$color{'color22'}'>\n";
2166                                                 }
2167                                                 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2168                                                 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2169                                                 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2170                                                 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2171                                                 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2172                                                 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2173                                                 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2174 #                       print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2175             }
2176         }
2177
2178         print "</table>";
2179         print <<END
2180         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2181         <tr><td></td></tr>
2182         <tr><td></td></tr>
2183         <tr><td></td></tr>
2184         <tr><td></td></tr>
2185         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2186         </table>
2187 END
2188 ;
2189         &Header::closebox();
2190         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2191         &Header::closebigbox();
2192         &Header::closepage();
2193         exit(0);
2194
2195 ###
2196 ### Download Certificate
2197 ###
2198 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2199     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2200
2201     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2202         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2203         print "Content-Type: application/octet-stream\r\n\r\n";
2204         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2205         exit (0);
2206     }
2207
2208 ###
2209 ### Enable/Disable connection
2210 ###
2211
2212 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2213
2214     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2215     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2216
2217     if ($confighash{$cgiparams{'KEY'}}) {
2218            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2219             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2220             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2221             #&writeserverconf();
2222 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2223 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2224 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2225 #           }
2226         } else {
2227             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2228 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2229 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2230 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2231 #           }
2232             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2233             #&writeserverconf();
2234         }
2235     } else {
2236         $errormessage = $Lang::tr{'invalid key'};
2237     }
2238
2239 ###
2240 ### Restart connection
2241 ###
2242 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2243     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2244     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2245
2246     if ($confighash{$cgiparams{'KEY'}}) {
2247 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2248 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2249 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2250 #       }
2251     } else {
2252         $errormessage = $Lang::tr{'invalid key'};
2253     }
2254
2255 ###
2256 ### Remove connection
2257 ###
2258 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2259     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2260     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2261
2262     if ($confighash{$cgiparams{'KEY'}}) {
2263 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2264 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2265 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2266 #       }
2267         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2268         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2269         delete $confighash{$cgiparams{'KEY'}};
2270         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2271         #&writeserverconf();
2272     } else {
2273         $errormessage = $Lang::tr{'invalid key'};
2274     }
2275 #test33
2276
2277 ###
2278 ### Choose between adding a host-net or net-net connection
2279 ###
2280
2281 ###
2282 # m.a.d net2net
2283 ###
2284
2285 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2286         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2287         &Header::showhttpheaders();
2288         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2289         &Header::openbigbox('100%', 'LEFT', '', '');
2290         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2291
2292 if ( -s "${General::swroot}/ovpn/settings") {
2293
2294         print <<END
2295             <b>$Lang::tr{'connection type'}:</b><br />
2296             <table><form method='post' ENCTYPE="multipart/form-data">
2297             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2298                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2299             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2300                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2301                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2302                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2303           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2304           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2305     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'><td class='base'>Default : Client Packagename</td></td></tr>
2306           <tr><td colspan='3'><hr /></td></tr>
2307     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2308           <tr><td>&nbsp;</td></tr>
2309           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2310             </form></table>
2311 END
2312         ;
2313
2314 } else {
2315         print <<END
2316                     <b>$Lang::tr{'connection type'}:</b><br />
2317             <table><form method='post' ENCTYPE="multipart/form-data">
2318             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2319             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2320             </form></table>
2321 END
2322         ;
2323
2324 }
2325
2326         &Header::closebox();
2327         &Header::closebigbox();
2328         &Header::closepage();
2329         exit (0);
2330
2331 ###
2332 # m.a.d net2net
2333 ###
2334
2335 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2336
2337         my @firen2nconf;
2338         my @confdetails;
2339         my $uplconffilename ='';
2340         my $uplconffilename2 ='';
2341         my $uplp12name = '';
2342         my $uplp12name2 = '';
2343         my @rem_subnet;
2344         my @rem_subnet2;
2345         my @tmposupnet3;
2346         my $key;
2347         my @n2nname;
2348
2349         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2350
2351 # Check if a file is uploaded
2352
2353         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2354                 $errormessage = $Lang::tr{'there was no file upload'};
2355                 goto N2N_ERROR;
2356     }
2357
2358 # Move uploaded IPfire n2n package to temporary file
2359
2360     (my $fh, my $filename) = tempfile( );
2361     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2362                 $errormessage = $!;
2363                 goto N2N_ERROR;
2364     }
2365
2366         my $zip = Archive::Zip->new();
2367         my $zipName = $filename;
2368         my $status = $zip->read( $zipName );
2369         if ($status != AZ_OK) {
2370                 $errormessage = "Read of $zipName failed\n";
2371                 goto N2N_ERROR;
2372         }
2373
2374         my $tempdir = tempdir( CLEANUP => 1 );
2375         my @files = $zip->memberNames();
2376         for(@files) {
2377         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2378         }
2379         my $countfiles = @files;
2380
2381 # Check if we have not more then 2 files
2382
2383         if ( $countfiles == 2){
2384                 foreach (@files){
2385                         if ( $_ =~ /.conf$/){
2386                                 $uplconffilename = $_;
2387                         }
2388                         if ( $_ =~ /.p12$/){
2389                                 $uplp12name = $_;
2390                         }
2391                 }
2392                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2393                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2394                         goto N2N_ERROR;
2395                 }
2396
2397                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2398                 @firen2nconf = <FILE>;
2399                 close (FILE);
2400                 chomp(@firen2nconf);
2401
2402         } else {
2403
2404                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2405                 goto N2N_ERROR;
2406         }
2407
2408 ###
2409 # m.a.d net2net
2410 ###
2411
2412  if ($cgiparams{'n2nname'} ne ''){
2413
2414   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2415   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2416   $n2nname[0] = $cgiparams{'n2nname'};
2417   my @n2nname2 = split(/\./,$uplconffilename);
2418   $n2nname2[0] =~ s/\n|\r//g;
2419   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2420         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2421         my $input2 = "$n2nname2[0]n2n";
2422   my $output2 = "$n2nname[0]n2n";
2423   my $filename = "$tempdir/$uplconffilename";
2424   open(FILE, "< $filename") or die 'Unable to open config file.';
2425         my @current = <FILE>;
2426         close(FILE);
2427         foreach (@current) {s/$input1/$output1/g;}
2428         foreach (@current) {s/$input2/$output2/g;}
2429   open (OUT, "> $filename") || die 'Unable to open config file.';
2430   print OUT @current;
2431   close OUT;
2432
2433     }else{
2434     $uplconffilename2 =  $uplconffilename;
2435     $uplp12name2 = $uplp12name;
2436     @n2nname = split(/\./,$uplconffilename);
2437     $n2nname[0] =~ s/\n|\r//g;
2438    }
2439     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2440     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2441
2442         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
2443
2444         if ($? ne 0) {
2445             $errormessage = "*.conf move failed: $!";
2446             unlink ($filename);
2447             goto N2N_ERROR;
2448         }
2449
2450         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
2451         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2452
2453         if ($? ne 0) {
2454             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2455             unlink ($filename);
2456             goto N2N_ERROR;
2457         }
2458
2459 my $complzoactive;
2460 my $mssfixactive;
2461 my $n2nfragment;
2462 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2463 my @n2nproto = split(/-/, $n2nproto2[1]);
2464 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2465 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2466 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2467 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2468 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
2469 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2470 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
2471 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
2472 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2473 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2474 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
2475 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2476 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
2477 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2478
2479
2480 ###
2481 # m.a.d delete CR and LF from arrays for this chomp doesnt work
2482 ###
2483
2484 $n2nremote[1] =~ s/\n|\r//g;
2485 $n2novpnsub[0] =~ s/\n|\r//g;
2486 $n2novpnsub[1] =~ s/\n|\r//g;
2487 $n2novpnsub[2] =~ s/\n|\r//g;
2488 $n2nproto[0] =~ s/\n|\r//g;
2489 $n2nport[1] =~ s/\n|\r//g;
2490 $n2ntunmtu[1] =~ s/\n|\r//g;
2491 $n2nremsub[1] =~ s/\n|\r//g;
2492 $n2nremsub[2] =~ s/\n|\r//g;
2493 $n2nlocalsub[2] =~ s/\n|\r//g;
2494 $n2nfragment[1] =~ s/\n|\r//g;
2495 $n2nmgmt[2] =~ s/\n|\r//g;
2496 chomp ($complzoactive);
2497 chomp ($mssfixactive);
2498
2499 ###
2500 # m.a.d net2net
2501 ###
2502
2503 ###
2504 # Check if there is no other entry with this name
2505 ###
2506
2507         foreach my $dkey (keys %confighash) {
2508                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2509                         $errormessage = $Lang::tr{'a connection with this name already exists'};
2510                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2511             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2512       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2513                         goto N2N_ERROR;
2514                 }
2515         }
2516
2517 ###
2518 # Check if OpenVPN Subnet is valid
2519 ###
2520
2521 foreach my $dkey (keys %confighash) {
2522                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2523                         $errormessage = 'The OpenVPN Subnet is already in use';
2524                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2525             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2526       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2527                         goto N2N_ERROR;
2528                 }
2529         }
2530
2531 ###
2532 # Check im Dest Port is vaild
2533 ###
2534
2535 foreach my $dkey (keys %confighash) {
2536                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2537                         $errormessage = 'The OpenVPN Port is already in use';
2538                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2539             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2540       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2541                         goto N2N_ERROR;
2542                 }
2543         }
2544
2545
2546
2547   $key = &General::findhasharraykey (\%confighash);
2548
2549         foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2550         $confighash{$key}[0] = 'off';
2551         $confighash{$key}[1] = $n2nname[0];
2552   $confighash{$key}[2] = $n2nname[0];
2553         $confighash{$key}[3] = 'net';
2554         $confighash{$key}[4] = 'cert';
2555         $confighash{$key}[6] = 'client';
2556         $confighash{$key}[8] =  $n2nlocalsub[2];
2557   $confighash{$key}[10] = $n2nremote[1];
2558   $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
2559         $confighash{$key}[22] = $n2nmgmt[2];
2560   $confighash{$key}[23] = $mssfixactive;
2561         $confighash{$key}[24] = $n2nfragment[1];
2562   $confighash{$key}[25] = 'IPFire n2n Client';
2563         $confighash{$key}[26] = 'red';
2564   $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
2565   $confighash{$key}[28] = $n2nproto[0];
2566   $confighash{$key}[29] = $n2nport[1];
2567   $confighash{$key}[30] = $complzoactive;
2568   $confighash{$key}[31] = $n2ntunmtu[1];
2569
2570
2571   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2572
2573   N2N_ERROR:
2574
2575         &Header::showhttpheaders();
2576         &Header::openpage('Validate imported configuration', 1, '');
2577         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2578         if ($errormessage) {
2579             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2580             print "<class name='base'>$errormessage";
2581             print "&nbsp;</class>";
2582             &Header::closebox();
2583
2584         } else
2585   {
2586                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2587         }
2588         if ($errormessage eq ''){
2589                 print <<END
2590                 <!-- ipfire net2net config gui -->
2591                 <table width='100%'>
2592                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2593     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2594     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2595                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2596                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2597                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2598                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2599                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2600                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2601                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2602                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
2603                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
2604                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
2605                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
2606                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
2607                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2608     </table>
2609 END
2610 ;
2611                 &Header::closebox();
2612         }
2613
2614         if ($errormessage) {
2615                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2616         } else {
2617                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2618                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2619                 print "<input type='hidden' name='KEY' value='$key' />";
2620                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2621         }
2622         &Header::closebigbox();
2623         &Header::closepage();
2624         exit(0);
2625
2626
2627 ##
2628 ### Accept IPFire n2n Package Settings
2629 ###
2630
2631   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2632
2633 ###
2634 ### Discard and Rollback IPFire n2n Package Settings
2635 ###
2636
2637   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2638
2639      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2640
2641 if ($confighash{$cgiparams{'KEY'}}) {
2642
2643      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2644      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2645      unlink ($certfile) or die "Removing $certfile fail: $!";
2646      unlink ($conffile) or die "Removing $conffile fail: $!";
2647      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2648      delete $confighash{$cgiparams{'KEY'}};
2649     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2650
2651      } else {
2652                 $errormessage = $Lang::tr{'invalid key'};
2653    }
2654
2655
2656 ###
2657 # m.a.d net2net
2658 ###
2659
2660
2661 ###
2662 ### Adding a new connection
2663 ###
2664 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2665          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2666          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2667
2668     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2669     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2670     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2671
2672     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
2673         if (! $confighash{$cgiparams{'KEY'}}[0]) {
2674             $errormessage = $Lang::tr{'invalid key'};
2675             goto VPNCONF_END;
2676         }
2677         $cgiparams{'ENABLED'}   = $confighash{$cgiparams{'KEY'}}[0];
2678         $cgiparams{'NAME'}      = $confighash{$cgiparams{'KEY'}}[1];
2679         $cgiparams{'TYPE'}      = $confighash{$cgiparams{'KEY'}}[3];
2680         $cgiparams{'AUTH'}      = $confighash{$cgiparams{'KEY'}}[4];
2681         $cgiparams{'PSK'}       = $confighash{$cgiparams{'KEY'}}[5];
2682         $cgiparams{'SIDE'}      = $confighash{$cgiparams{'KEY'}}[6];
2683         $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
2684   $cgiparams{'REMOTE'}  = $confighash{$cgiparams{'KEY'}}[10];
2685   $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
2686 # n2n m.a.d new fields
2687   $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
2688   $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2689   $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
2690         $cgiparams{'REMARK'}    = $confighash{$cgiparams{'KEY'}}[25];
2691         $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
2692 #new fields
2693         $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
2694         $cgiparams{'PROTOCOL'}    = $confighash{$cgiparams{'KEY'}}[28];
2695         $cgiparams{'DEST_PORT'}   = $confighash{$cgiparams{'KEY'}}[29];
2696         $cgiparams{'COMPLZO'}     = $confighash{$cgiparams{'KEY'}}[30];
2697         $cgiparams{'MTU'}         = $confighash{$cgiparams{'KEY'}}[31];
2698
2699 #new fields
2700 #ab hiere error uebernehmen
2701
2702     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2703         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
2704
2705   if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
2706             $errormessage = $Lang::tr{'connection type is invalid'};
2707             if ($cgiparams{'TYPE'} eq 'net') {
2708       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2709             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2710       }
2711             goto VPNCONF_ERROR;
2712         }
2713
2714
2715         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
2716             $errormessage = $Lang::tr{'name must only contain characters'};
2717       if ($cgiparams{'TYPE'} eq 'net') {
2718       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2719             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2720       }
2721       goto VPNCONF_ERROR;
2722   }
2723
2724         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
2725             $errormessage = $Lang::tr{'name is invalid'};
2726             if ($cgiparams{'TYPE'} eq 'net') {
2727       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2728             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2729       }
2730             goto VPNCONF_ERROR;
2731         }
2732
2733         if (length($cgiparams{'NAME'}) >60) {
2734             $errormessage = $Lang::tr{'name too long'};
2735             if ($cgiparams{'TYPE'} eq 'net') {
2736       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2737             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2738       }
2739             goto VPNCONF_ERROR;
2740         }
2741
2742 ###
2743 # m.a.d net2net
2744 ###
2745
2746 if ($cgiparams{'TYPE'} eq 'net') {
2747
2748     if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
2749                         $errormessage = $Lang::tr{'openvpn destination port used'};
2750                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2751             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2752       goto VPNCONF_ERROR;
2753                 }
2754
2755     if ($cgiparams{'DEST_PORT'} eq  '') {
2756                         $errormessage = $Lang::tr{'openvpn destination port used'};
2757                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2758             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2759       goto VPNCONF_ERROR;
2760                 }
2761
2762     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
2763                         $errormessage = $Lang::tr{'openvpn subnet is used'};
2764                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2765             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2766                         goto VPNCONF_ERROR;
2767                 }
2768
2769           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
2770             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
2771             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2772             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2773             goto VPNCONF_ERROR;
2774     }
2775
2776     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
2777             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
2778             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2779             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2780             goto VPNCONF_ERROR;
2781     }
2782
2783     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
2784                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
2785                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2786             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2787                   goto VPNCONF_ERROR;
2788                 }
2789
2790     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
2791                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
2792                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2793             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2794                   goto VPNCONF_ERROR;
2795                 }
2796
2797     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
2798                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
2799                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2800             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2801                   goto VPNCONF_ERROR;
2802                 }
2803
2804     if ($cgiparams{'OVPN_MGMT'} eq  '') {
2805                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
2806                 }
2807
2808 }
2809
2810 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
2811 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
2812 #           goto VPNCONF_ERROR;
2813 #       }
2814
2815         # Check if there is no other entry with this name
2816         if (! $cgiparams{'KEY'}) {
2817             foreach my $key (keys %confighash) {
2818                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
2819                     $errormessage = $Lang::tr{'a connection with this name already exists'};
2820                     if ($cgiparams{'TYPE'} eq 'net') {
2821         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2822               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2823         }
2824                     goto VPNCONF_ERROR;
2825                 }
2826             }
2827         }
2828
2829         if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
2830             $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2831             if ($cgiparams{'TYPE'} eq 'net') {
2832       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2833             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2834       }
2835             goto VPNCONF_ERROR;
2836         }
2837
2838         if ($cgiparams{'REMOTE'}) {
2839             if (! &General::validip($cgiparams{'REMOTE'})) {
2840                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
2841                     $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2842                     if ($cgiparams{'TYPE'} eq 'net') {
2843         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2844               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2845         }
2846                     goto VPNCONF_ERROR;
2847                 } else {
2848                     if (&valid_dns_host($cgiparams{'REMOTE'})) {
2849                         $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
2850                         if ($cgiparams{'TYPE'} eq 'net') {
2851
2852       }
2853                     }
2854                 }
2855             }
2856         }
2857         if ($cgiparams{'TYPE'} ne 'host') {
2858             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
2859                     $errormessage = $Lang::tr{'local subnet is invalid'};
2860                     if ($cgiparams{'TYPE'} eq 'net') {
2861               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2862                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2863               }
2864                         goto VPNCONF_ERROR;}
2865         }
2866         # Check if there is no other entry without IP-address and PSK
2867         if ($cgiparams{'REMOTE'} eq '') {
2868             foreach my $key (keys %confighash) {
2869                 if(($cgiparams{'KEY'} ne $key) &&
2870                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
2871                     $confighash{$key}[10] eq '') {
2872                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
2873                         goto VPNCONF_ERROR;
2874                 }
2875             }
2876         }
2877         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
2878                 $errormessage = $Lang::tr{'remote subnet is invalid'};
2879                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2880                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2881                 goto VPNCONF_ERROR;
2882         }
2883
2884         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
2885             $errormessage = $Lang::tr{'invalid input'};
2886             goto VPNCONF_ERROR;
2887         }
2888         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
2889             $errormessage = $Lang::tr{'invalid input'};
2890             goto VPNCONF_ERROR;
2891         }
2892
2893 #fixplausi
2894         if ($cgiparams{'AUTH'} eq 'psk')  {
2895 #           if (! length($cgiparams{'PSK'}) ) {
2896 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
2897 #               goto VPNCONF_ERROR;
2898 #           }
2899 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
2900 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
2901 #               goto VPNCONF_ERROR;
2902 #           }
2903         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
2904             if ($cgiparams{'KEY'}) {
2905                 $errormessage = $Lang::tr{'cant change certificates'};
2906                 goto VPNCONF_ERROR;
2907             }
2908             if (ref ($cgiparams{'FH'}) ne 'Fh') {
2909                 $errormessage = $Lang::tr{'there was no file upload'};
2910                 goto VPNCONF_ERROR;
2911             }
2912
2913             # Move uploaded certificate request to a temporary file
2914             (my $fh, my $filename) = tempfile( );
2915             if (copy ($cgiparams{'FH'}, $fh) != 1) {
2916                 $errormessage = $!;
2917                 goto VPNCONF_ERROR;
2918             }
2919
2920             # Sign the certificate request and move it
2921             # Sign the host certificate request
2922             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
2923                 '-batch', '-notext',
2924                 '-in', $filename,
2925                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2926                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
2927             if ($?) {
2928                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2929                 unlink ($filename);
2930                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2931                 &newcleanssldatabase();
2932                 goto VPNCONF_ERROR;
2933             } else {
2934                 unlink ($filename);
2935                 &deletebackupcert();
2936             }
2937
2938             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2939             $temp =~ /Subject:.*CN=(.*)[\n]/;
2940             $temp = $1;
2941             $temp =~ s+/Email+, E+;
2942             $temp =~ s/ ST=/ S=/;
2943             $cgiparams{'CERT_NAME'} = $temp;
2944             $cgiparams{'CERT_NAME'} =~ s/,//g;
2945             $cgiparams{'CERT_NAME'} =~ s/\'//g;
2946             if ($cgiparams{'CERT_NAME'} eq '') {
2947                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2948                 goto VPNCONF_ERROR;
2949             }
2950         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
2951             if ($cgiparams{'KEY'}) {
2952                 $errormessage = $Lang::tr{'cant change certificates'};
2953                 goto VPNCONF_ERROR;
2954             }
2955             if (ref ($cgiparams{'FH'}) ne 'Fh') {
2956                 $errormessage = $Lang::tr{'there was no file upload'};
2957                 goto VPNCONF_ERROR;
2958             }
2959             # Move uploaded certificate to a temporary file
2960             (my $fh, my $filename) = tempfile( );
2961             if (copy ($cgiparams{'FH'}, $fh) != 1) {
2962                 $errormessage = $!;
2963                 goto VPNCONF_ERROR;
2964             }
2965
2966             # Verify the certificate has a valid CA and move it
2967             my $validca = 0;
2968             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
2969             if ($test =~ /: OK/) {
2970                 $validca = 1;
2971             } else {
2972                 foreach my $key (keys %cahash) {
2973                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
2974                     if ($test =~ /: OK/) {
2975                         $validca = 1;
2976                     }
2977                 }
2978             }
2979             if (! $validca) {
2980                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
2981                 unlink ($filename);
2982                 goto VPNCONF_ERROR;
2983             } else {
2984                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2985                 if ($? ne 0) {
2986                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2987                     unlink ($filename);
2988                     goto VPNCONF_ERROR;
2989                 }
2990             }
2991
2992             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2993             $temp =~ /Subject:.*CN=(.*)[\n]/;
2994             $temp = $1;
2995             $temp =~ s+/Email+, E+;
2996             $temp =~ s/ ST=/ S=/;
2997             $cgiparams{'CERT_NAME'} = $temp;
2998             $cgiparams{'CERT_NAME'} =~ s/,//g;
2999             $cgiparams{'CERT_NAME'} =~ s/\'//g;
3000             if ($cgiparams{'CERT_NAME'} eq '') {
3001                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3002                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
3003                 goto VPNCONF_ERROR;
3004             }
3005         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
3006             if ($cgiparams{'KEY'}) {
3007                 $errormessage = $Lang::tr{'cant change certificates'};
3008                 goto VPNCONF_ERROR;
3009             }
3010             # Validate input since the form was submitted
3011             if (length($cgiparams{'CERT_NAME'}) >60) {
3012                 $errormessage = $Lang::tr{'name too long'};
3013                 goto VPNCONF_ERROR;
3014             }
3015             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3016                 $errormessage = $Lang::tr{'invalid input for name'};
3017                 goto VPNCONF_ERROR;
3018             }
3019             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3020                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3021                 goto VPNCONF_ERROR;
3022             }
3023             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3024                 $errormessage = $Lang::tr{'e-mail address too long'};
3025                 goto VPNCONF_ERROR;
3026             }
3027             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3028                 $errormessage = $Lang::tr{'invalid input for department'};
3029                 goto VPNCONF_ERROR;
3030             }
3031             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3032                 $errormessage = $Lang::tr{'organization too long'};
3033                 goto VPNCONF_ERROR;
3034             }
3035             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3036                 $errormessage = $Lang::tr{'invalid input for organization'};
3037                 goto VPNCONF_ERROR;
3038             }
3039             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3040                 $errormessage = $Lang::tr{'invalid input for city'};
3041                 goto VPNCONF_ERROR;
3042             }
3043             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3044                 $errormessage = $Lang::tr{'invalid input for state or province'};
3045                 goto VPNCONF_ERROR;
3046             }
3047             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3048                 $errormessage = $Lang::tr{'invalid input for country'};
3049                 goto VPNCONF_ERROR;
3050             }
3051             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3052                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3053                     $errormessage = $Lang::tr{'password too short'};
3054                     goto VPNCONF_ERROR;
3055                 }
3056             }
3057             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3058                 $errormessage = $Lang::tr{'passwords do not match'};
3059                 goto VPNCONF_ERROR;
3060             }
3061
3062             # Replace empty strings with a .
3063             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3064             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3065             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3066
3067             # Create the Host certificate request client
3068             my $pid = open(OPENSSL, "|-");
3069             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3070             if ($pid) { # parent
3071                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3072                 print OPENSSL "$state\n";
3073                 print OPENSSL "$city\n";
3074                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3075                 print OPENSSL "$ou\n";
3076                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3077                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3078                 print OPENSSL ".\n";
3079                 print OPENSSL ".\n";
3080                 close (OPENSSL);
3081                 if ($?) {
3082                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3083                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3084                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3085                     goto VPNCONF_ERROR;
3086                 }
3087             } else {    # child
3088                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3089                         '-newkey', 'rsa:1024',
3090                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3091                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3092                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3093                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3094                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3095                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3096                     goto VPNCONF_ERROR;
3097                 }
3098             }
3099
3100             # Sign the host certificate request
3101             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3102                 '-batch', '-notext',
3103                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3104                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3105                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3106             if ($?) {
3107                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3108                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3109                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3110                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3111                 &newcleanssldatabase();
3112                 goto VPNCONF_ERROR;
3113             } else {
3114                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3115                 &deletebackupcert();
3116             }
3117
3118             # Create the pkcs12 file
3119             system('/usr/bin/openssl', 'pkcs12', '-export',
3120                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3121                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3122                 '-name', $cgiparams{'NAME'},
3123                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3124                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3125                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3126                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3127             if ($?) {
3128                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3129                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3130                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3131                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3132                 goto VPNCONF_ERROR;
3133             } else {
3134                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3135             }
3136         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3137             ;# Nothing, just editing
3138         } else {
3139             $errormessage = $Lang::tr{'invalid input for authentication method'};
3140             goto VPNCONF_ERROR;
3141         }
3142
3143         # Check if there is no other entry with this common name
3144         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3145             foreach my $key (keys %confighash) {
3146                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3147                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3148                     goto VPNCONF_ERROR;
3149                 }
3150             }
3151         }
3152
3153         # Save the config
3154         my $key = $cgiparams{'KEY'};
3155         if (! $key) {
3156             $key = &General::findhasharraykey (\%confighash);
3157             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3158         }
3159         $confighash{$key}[0] = $cgiparams{'ENABLED'};
3160         $confighash{$key}[1] = $cgiparams{'NAME'};
3161         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3162             $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
3163         }
3164         $confighash{$key}[3] = $cgiparams{'TYPE'};
3165         if ($cgiparams{'AUTH'} eq 'psk') {
3166             $confighash{$key}[4] = 'psk';
3167             $confighash{$key}[5] = $cgiparams{'PSK'};
3168         } else {
3169             $confighash{$key}[4] = 'cert';
3170         }
3171         if ($cgiparams{'TYPE'} eq 'net') {
3172             $confighash{$key}[6] = $cgiparams{'SIDE'};
3173             $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
3174         }
3175         $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
3176         $confighash{$key}[10] = $cgiparams{'REMOTE'};
3177   if ($cgiparams{'OVPN_MGMT'} eq '') {
3178   $confighash{$key}[22] = $confighash{$key}[29];
3179   } else {
3180   $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
3181   }
3182   $confighash{$key}[23] = $cgiparams{'MSSFIX'};
3183   $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
3184         $confighash{$key}[25] = $cgiparams{'REMARK'};
3185         $confighash{$key}[26] = $cgiparams{'INTERFACE'};
3186 # new fields
3187         $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
3188         $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
3189         $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
3190         $confighash{$key}[30] = $cgiparams{'COMPLZO'};
3191         $confighash{$key}[31] = $cgiparams{'MTU'};
3192 # new fileds
3193         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3194
3195 ###
3196 # m.a.d n2n begin
3197 ###
3198
3199         if ($cgiparams{'TYPE'} eq 'net') {
3200
3201         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3202   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
3203
3204   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3205         my $key = $cgiparams{'KEY'};
3206         if (! $key) {
3207             $key = &General::findhasharraykey (\%confighash);
3208             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3209             }
3210   $confighash{$key}[0] = 'on';
3211   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3212
3213   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
3214          }
3215   }
3216
3217 ###
3218 # m.a.d n2n end
3219 ###
3220
3221         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
3222             $cgiparams{'KEY'} = $key;
3223             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
3224         }
3225         goto VPNCONF_END;
3226     } else {
3227         $cgiparams{'ENABLED'} = 'on';
3228 ###
3229 # m.a.d n2n begin
3230 ###
3231         $cgiparams{'MSSFIX'} = 'on';
3232         $cgiparams{'FRAGMENT'} = '1300';
3233 ###
3234 # m.a.d n2n end
3235 ###
3236         $cgiparams{'SIDE'} = 'left';
3237         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
3238             $cgiparams{'AUTH'} = 'psk';
3239         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3240             $cgiparams{'AUTH'} = 'certfile';
3241         } else {
3242             $cgiparams{'AUTH'} = 'certgen';
3243         }
3244         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
3245         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
3246         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
3247         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
3248         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
3249     }
3250
3251     VPNCONF_ERROR:
3252     $checked{'ENABLED'}{'off'} = '';
3253     $checked{'ENABLED'}{'on'} = '';
3254     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3255     $checked{'ENABLED_BLUE'}{'off'} = '';
3256     $checked{'ENABLED_BLUE'}{'on'} = '';
3257     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3258     $checked{'ENABLED_ORANGE'}{'off'} = '';
3259     $checked{'ENABLED_ORANGE'}{'on'} = '';
3260     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3261
3262
3263     $checked{'EDIT_ADVANCED'}{'off'} = '';
3264     $checked{'EDIT_ADVANCED'}{'on'} = '';
3265     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
3266
3267     $selected{'SIDE'}{'server'} = '';
3268     $selected{'SIDE'}{'client'} = '';
3269     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
3270
3271     $selected{'PROTOCOL'}{'udp'} = '';
3272     $selected{'PROTOCOL'}{'tcp'} = '';
3273     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
3274
3275
3276     $checked{'AUTH'}{'psk'} = '';
3277     $checked{'AUTH'}{'certreq'} = '';
3278     $checked{'AUTH'}{'certgen'} = '';
3279     $checked{'AUTH'}{'certfile'} = '';
3280     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
3281
3282     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
3283
3284     $checked{'COMPLZO'}{'off'} = '';
3285     $checked{'COMPLZO'}{'on'} = '';
3286     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
3287
3288     $checked{'MSSFIX'}{'off'} = '';
3289     $checked{'MSSFIX'}{'on'} = '';
3290     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3291
3292
3293     if (1) {
3294         &Header::showhttpheaders();
3295         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
3296         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3297         if ($errormessage) {
3298             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3299             print "<class name='base'>$errormessage";
3300             print "&nbsp;</class>";
3301             &Header::closebox();
3302         }
3303
3304         if ($warnmessage) {
3305             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
3306             print "<class name='base'>$warnmessage";
3307             print "&nbsp;</class>";
3308             &Header::closebox();
3309         }
3310
3311         print "<form method='post' enctype='multipart/form-data'>";
3312         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
3313
3314         if ($cgiparams{'KEY'}) {
3315             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
3316             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
3317         }
3318
3319         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
3320         print "<table width='100%'>\n";
3321         print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>";
3322         if ($cgiparams{'TYPE'} eq 'host') {
3323             if ($cgiparams{'KEY'}) {
3324                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>\n";
3325             } else {
3326                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
3327             }
3328 #           print "<tr><td>$Lang::tr{'interface'}</td>";
3329 #           print "<td><select name='INTERFACE'>";
3330 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
3331 #           if ($netsettings{'BLUE_DEV'} ne '') {
3332 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
3333 #           }
3334 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
3335 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
3336 #           print "</select></td></tr>";
3337 #           print <<END
3338         } else {
3339             print "<input type='hidden' name='INTERFACE' value='red' />";
3340             if ($cgiparams{'KEY'}) {
3341                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
3342             } else {
3343                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
3344             }
3345             print <<END
3346                     <td width='25%'>&nbsp;</td>
3347                     <td width='25%'>&nbsp;</td></tr>
3348                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
3349                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
3350                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
3351                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
3352                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
3353                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
3354                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
3355                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
3356                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
3357                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
3358                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
3359                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3360
3361      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
3362                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
3363
3364         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3365                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
3366                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
3367                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
3368
3369                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
3370                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
3371         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
3372
3373           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
3374                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
3375                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
3376
3377                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
3378                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
3379         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
3380
3381         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
3382                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
3383         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
3384
3385 END
3386             ;
3387         }
3388
3389         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
3390         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr>";
3391
3392         if ($cgiparams{'TYPE'} eq 'host') {
3393
3394       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>\n";
3395          }
3396
3397 #           if ($cgiparams{'KEY'}) {
3398 #               print "<td colspan='3'>&nbsp;</td></tr></table>";
3399 #           } else {
3400 #               print "<td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</tr></table>";
3401 #           }
3402 #       }else{
3403             print "<td colspan='3'>&nbsp;</td></tr></table>";
3404 #       }
3405
3406
3407
3408         &Header::closebox();
3409
3410         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
3411         #    &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3412         #    print <<END
3413         #    <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3414         #    <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
3415         #       <td class='base' width='50%'><input type='text' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
3416         #    </table>
3417 END
3418         #    ;
3419         #    &Header::closebox();
3420         } elsif (! $cgiparams{'KEY'}) {
3421             my $disabled='';
3422             my $cakeydisabled='';
3423             my $cacrtdisabled='';
3424             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
3425             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
3426             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3427
3428
3429  if ($cgiparams{'TYPE'} eq 'host') {
3430
3431 print <<END
3432             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3433
3434             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
3435             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
3436             <tr><td colspan='3'>&nbsp;</td></tr>
3437       <tr><td colspan='3'><hr /></td></tr>
3438       <tr><td colspan='3'>&nbsp;</td></tr>
3439             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3440             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3441             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3442             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3443             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3444             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3445             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3446             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3447 END
3448 ;
3449
3450 ###
3451 # m.a.d net2net
3452 ###
3453
3454 } else {
3455
3456 print <<END
3457             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3458
3459             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3460             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3461             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3462             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3463             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3464             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3465             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3466             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3467
3468
3469 END
3470 ;
3471
3472 }
3473
3474 ###
3475 # m.a.d net2net
3476 ###
3477
3478             foreach my $country (sort keys %{Countries::countries}) {
3479                 print "<option value='$Countries::countries{$country}'";
3480                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
3481                     print " selected='selected'";
3482                 }
3483                 print ">$country</option>";
3484             }
3485 ###
3486 # m.a.d net2net
3487 ###
3488
3489 if ($cgiparams{'TYPE'} eq 'host') {
3490             print <<END
3491             </select></td></tr>
3492
3493         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
3494         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
3495    <tr><td>&nbsp;</td>
3496                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
3497                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
3498             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
3499                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
3500      <tr><td colspan='3'>&nbsp;</td></tr>
3501      <tr><td colspan='3'><hr /></td></tr>
3502      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
3503      </table>
3504 END
3505 }else{
3506             print <<END
3507             </select></td></tr>
3508    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3509          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3510          <tr><td colspan='3'><hr /></td></tr>
3511          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
3512        </table>
3513
3514 END
3515 }
3516
3517 ###
3518 # m.a.d net2net
3519 ###
3520             ;
3521             &Header::closebox();
3522         }
3523
3524         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
3525         if ($cgiparams{'KEY'}) {
3526 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
3527         }
3528         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3529         &Header::closebigbox();
3530         &Header::closepage();
3531         exit (0);
3532     }
3533     VPNCONF_END:
3534 }
3535
3536 #    SETTINGS_ERROR:
3537 ###
3538 ### Default status page
3539 ###
3540     %cgiparams = ();
3541     %cahash = ();
3542     %confighash = ();
3543     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
3544     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3545     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3546
3547     my @status = `/bin/cat /var/log/ovpnserver.log`;
3548
3549     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
3550         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
3551             my $ipaddr = <IPADDR>;
3552             close IPADDR;
3553             chomp ($ipaddr);
3554             $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
3555             if ($cgiparams{'VPN_IP'} eq '') {
3556                 $cgiparams{'VPN_IP'} = $ipaddr;
3557             }
3558         }
3559     }
3560
3561 #default setzen
3562     if ($cgiparams{'DCIPHER'} eq '') {
3563         $cgiparams{'DCIPHER'} =  'BF-CBC';
3564     }
3565 #    if ($cgiparams{'DCOMPLZO'} eq '') {
3566 #       $cgiparams{'DCOMPLZO'} =  'on';
3567 #    }
3568     if ($cgiparams{'DDEST_PORT'} eq '') {
3569         $cgiparams{'DDEST_PORT'} =  '1194';
3570     }
3571     if ($cgiparams{'DMTU'} eq '') {
3572         $cgiparams{'DMTU'} =  '1400';
3573     }
3574     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
3575         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
3576     }
3577
3578     $checked{'ENABLED'}{'off'} = '';
3579     $checked{'ENABLED'}{'on'} = '';
3580     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3581     $checked{'ENABLED_BLUE'}{'off'} = '';
3582     $checked{'ENABLED_BLUE'}{'on'} = '';
3583     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3584     $checked{'ENABLED_ORANGE'}{'off'} = '';
3585     $checked{'ENABLED_ORANGE'}{'on'} = '';
3586     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3587     $selected{'DDEVICE'}{'tun'} = '';
3588     $selected{'DDEVICE'}{'tap'} = '';
3589     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
3590
3591     $selected{'DPROTOCOL'}{'udp'} = '';
3592     $selected{'DPROTOCOL'}{'tcp'} = '';
3593     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
3594
3595     $selected{'DCIPHER'}{'DES-CBC'} = '';
3596     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
3597     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
3598     $selected{'DCIPHER'}{'DESX-CBC'} = '';
3599     $selected{'DCIPHER'}{'RC2-CBC'} = '';
3600     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
3601     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
3602     $selected{'DCIPHER'}{'BF-CBC'} = '';
3603     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
3604     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
3605     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
3606     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
3607     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
3608     $checked{'DCOMPLZO'}{'off'} = '';
3609     $checked{'DCOMPLZO'}{'on'} = '';
3610     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
3611 # m.a.d
3612     $checked{'MSSFIX'}{'off'} = '';
3613     $checked{'MSSFIX'}{'on'} = '';
3614     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3615 #new settings
3616     &Header::showhttpheaders();
3617     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
3618     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3619
3620     if ($errormessage) {
3621         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3622         print "<class name='base'>$errormessage\n";
3623         print "&nbsp;</class>\n";
3624         &Header::closebox();
3625     }
3626
3627     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
3628     my $srunning = "no";
3629     my $activeonrun = "";
3630     if ( -e "/var/run/openvpn.pid"){
3631         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
3632         $srunning ="yes";
3633         $activeonrun = "";
3634     } else {
3635         $activeonrun = "disabled='disabled'";
3636     }
3637     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
3638     print <<END
3639     <table width='100%'>
3640     <form method='post'>
3641     <td width='25%'>&nbsp;</td>
3642     <td width='25%'>&nbsp;</td>
3643     <td width='25%'>&nbsp;</td></tr>
3644     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
3645     <td align='left'>$sactive</td>
3646     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
3647         <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
3648 END
3649 ;
3650     if (&haveBlueNet()) {
3651         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
3652         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
3653     }
3654     if (&haveOrangeNet()) {
3655         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
3656         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
3657     }
3658     print <<END
3659     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
3660         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
3661     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
3662         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
3663                                 <!-- this is still not working
3664                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
3665     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3666         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
3667                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
3668         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3669         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
3670     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
3671         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
3672     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
3673         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
3674         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
3675         <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
3676                                    <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
3677                                    <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
3678                                    <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
3679                                    <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
3680                                    <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
3681                                    <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
3682                                    <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
3683                                    <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
3684                                    <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
3685                                    <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
3686                                    <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td>
3687 END
3688 ;
3689
3690     if ( $srunning eq "yes" ) {
3691         print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' /></td>";
3692         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' disabled='disabled'/></td>";
3693         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td>";
3694         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3695     } else{
3696         print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>";
3697         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' /></td>";
3698         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
3699              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
3700              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
3701              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
3702             (( $cgiparams{'ENABLED'} eq 'on') ||
3703             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3704             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
3705             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td>";
3706             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3707         } else {
3708             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td>";
3709             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' disabled='disabled' /></td></tr>";
3710         }
3711     }
3712     print "</form></table>";
3713     &Header::closebox();
3714     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
3715     print <<EOF#'
3716     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3717     <tr>
3718         <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3719         <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
3720         <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
3721     </tr>
3722 EOF
3723     ;
3724     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
3725         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
3726         $casubject    =~ /Subject: (.*)[\n]/;
3727         $casubject    = $1;
3728         $casubject    =~ s+/Email+, E+;
3729         $casubject    =~ s/ ST=/ S=/;
3730
3731         print <<END
3732         <tr bgcolor='$color{'color22'}'>
3733         <td class='base'>$Lang::tr{'root certificate'}</td>
3734         <td class='base'>$casubject</td>
3735         <form method='post' name='frmrootcrta'><td width='3%' align='center'>
3736             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
3737             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
3738         </td></form>
3739         <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
3740             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
3741             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
3742         </td></form>
3743         <td width='4%'>&nbsp;</td></tr>
3744 END
3745         ;
3746     } else {
3747         # display rootcert generation buttons
3748         print <<END
3749         <tr bgcolor='$color{'color22'}'>
3750         <td class='base'>$Lang::tr{'root certificate'}:</td>
3751         <td class='base'>$Lang::tr{'not present'}</td>
3752         <td colspan='3'>&nbsp;</td></tr>
3753 END
3754         ;
3755     }
3756
3757     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
3758         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
3759         $hostsubject    =~ /Subject: (.*)[\n]/;
3760         $hostsubject    = $1;
3761         $hostsubject    =~ s+/Email+, E+;
3762         $hostsubject    =~ s/ ST=/ S=/;
3763
3764         print <<END
3765         <tr bgcolor='$color{'color20'}'>
3766         <td class='base'>$Lang::tr{'host certificate'}</td>
3767         <td class='base'>$hostsubject</td>
3768         <form method='post' name='frmhostcrta'><td width='3%' align='center'>
3769             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
3770             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
3771         </td></form>
3772         <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
3773             <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
3774             <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
3775         </td></form>
3776         <td width='4%'>&nbsp;</td></tr>
3777 END
3778         ;
3779     } else {
3780         # Nothing
3781         print <<END
3782         <tr bgcolor='$color{'color20'}'>
3783         <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
3784         <td class='base'>$Lang::tr{'not present'}</td>
3785         </td><td colspan='3'>&nbsp;</td></tr>
3786 END
3787         ;
3788     }
3789
3790     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3791         print "<tr><td colspan='5' align='center'><form method='post'>";
3792         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
3793         print "</form></td></tr>\n";
3794     }
3795
3796     if (keys %cahash > 0) {
3797         foreach my $key (keys %cahash) {
3798             if (($key + 1) % 2) {
3799                 print "<tr bgcolor='$color{'color20'}'>\n";
3800             } else {
3801                 print "<tr bgcolor='$color{'color22'}'>\n";
3802             }
3803             print "<td class='base'>$cahash{$key}[0]</td>\n";
3804             print "<td class='base'>$cahash{$key}[1]</td>\n";
3805             print <<END
3806             <form method='post' name='cafrm${key}a'><td align='center'>
3807                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
3808                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
3809                 <input type='hidden' name='KEY' value='$key' />
3810             </td></form>
3811             <form method='post' name='cafrm${key}b'><td align='center'>
3812                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
3813                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
3814                 <input type='hidden' name='KEY' value='$key' />
3815             </td></form>
3816             <form method='post' name='cafrm${key}c'><td align='center'>
3817                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
3818                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
3819                 <input type='hidden' name='KEY' value='$key' />
3820             </td></form></tr>
3821 END
3822             ;
3823         }
3824     }
3825
3826     print "</table>";
3827
3828     # If the file contains entries, print Key to action icons
3829     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
3830     print <<END
3831     <table>
3832     <tr>
3833         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
3834         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
3835         <td class='base'>$Lang::tr{'show certificate'}</td>
3836         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
3837         <td class='base'>$Lang::tr{'download certificate'}</td>
3838     </tr>
3839     </table>
3840 END
3841     ;
3842     }
3843     print <<END
3844     <form method='post' enctype='multipart/form-data'>
3845     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3846     <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td>
3847     <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' />
3848     <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td>
3849     <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /><br /><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
3850     </tr></table></form>
3851 END
3852     ;
3853
3854     &Header::closebox();
3855     if ( $srunning eq "yes" ) {
3856         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
3857     }else{
3858         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
3859     }
3860     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
3861
3862 ###
3863 # m.a.d net2net
3864 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
3865 ###
3866
3867     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
3868     print <<END
3869
3870
3871     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3872 <tr>
3873     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3874     <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
3875     <td width='18%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></td>
3876     <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'valid till'}</b></td>
3877     <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
3878     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
3879     <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
3880 </tr>
3881 END
3882         ;
3883         my $id = 0;
3884         my $gif;
3885          foreach my $key (sort { uc($confighash{$a}[1]) cmp uc($confighash{$b}[1]) } keys %confighash) {
3886         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
3887
3888         if ($id % 2) {
3889             print "<tr bgcolor='$color{'color20'}'>\n";
3890         } else {
3891             print "<tr bgcolor='$color{'color22'}'>\n";
3892         }
3893         print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
3894         print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
3895         if ($confighash{$key}[4] eq 'cert') {
3896             print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
3897         } else {
3898             print "<td align='left'>&nbsp;</td>";
3899         }
3900         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
3901         $cavalid    =~ /Not After : (.*)[\n]/;
3902         $cavalid    = $1;
3903         print "<td align='center'>$cavalid</td>";
3904         print "<td align='center'>$confighash{$key}[25]</td>";
3905
3906         my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3907
3908         if ($confighash{$key}[0] eq 'off') {
3909          $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3910         } else {
3911
3912 ###
3913 # m.a.d net2net
3914 ###
3915
3916        if ($confighash{$key}[3] eq 'net') {
3917
3918         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3919           my @output = "";
3920           my @tustate = "";
3921           my $tport = $confighash{$key}[22];
3922           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
3923           if ($tport ne '') {
3924           $tnet->open('127.0.0.1');
3925           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
3926           @tustate = split(/\,/, $output[1]);
3927 ###
3928 #CONNECTING    -- OpenVPN's initial state.
3929 #WAIT          -- (Client only) Waiting for initial response from server.
3930 #AUTH          -- (Client only) Authenticating with server.
3931 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
3932 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
3933 #ADD_ROUTES    -- Adding routes to system.
3934 #CONNECTED     -- Initialization Sequence Completed.
3935 #RECONNECTING  -- A restart has occurred.
3936 #EXITING       -- A graceful exit is in progress.
3937 ####
3938
3939         if ( $tustate[1] eq 'CONNECTED') {
3940           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></tr></td></table>";
3941                           } else {
3942           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$tustate[1]</font></b></td></tr></table>";
3943            }
3944            }
3945            }
3946         }       else {
3947
3948                 my $cn;
3949             my @match = ();
3950           foreach my $line (@status) {
3951                 chomp($line);
3952                 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3953                     @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3954                     if ($match[1] ne "Common Name") {
3955                         $cn = $match[1];
3956                     }
3957                 $cn =~ s/[_]/ /g;
3958                     if ($cn eq "$confighash{$key}[2]") {
3959                         $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
3960                     }
3961    }
3962
3963         }
3964 }
3965 }
3966
3967
3968         my $disable_clientdl = "disabled='disabled'";
3969         if (( $cgiparams{'ENABLED'} eq 'on') ||
3970             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3971             ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
3972             $disable_clientdl = "";
3973         }
3974         print <<END
3975         <td align='center'>$active</td>
3976
3977         <form method='post' name='frm${key}a'><td align='center'>
3978             <input type='image'  name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
3979             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
3980             <input type='hidden' name='KEY' value='$key' $disable_clientdl />
3981         </td></form>
3982 END
3983         ;
3984         if ($confighash{$key}[4] eq 'cert') {
3985             print <<END
3986             <form method='post' name='frm${key}b'><td align='center'>
3987                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
3988                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
3989                 <input type='hidden' name='KEY' value='$key' />
3990             </td></form>
3991 END
3992         ; } else {
3993             print "<td>&nbsp;</td>";
3994         }
3995         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
3996             print <<END
3997             <form method='post' name='frm${key}c'><td align='center'>
3998                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
3999                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
4000                 <input type='hidden' name='KEY' value='$key' />
4001             </td></form>
4002 END
4003         ; } elsif ($confighash{$key}[4] eq 'cert') {
4004             print <<END
4005             <form method='post' name='frm${key}c'><td align='center'>
4006                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
4007                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
4008                 <input type='hidden' name='KEY' value='$key' />
4009             </td></form>
4010 END
4011         ; } else {
4012             print "<td>&nbsp;</td>";
4013         }
4014         print <<END
4015         <form method='post' name='frm${key}d'><td align='center'>
4016             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
4017             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
4018             <input type='hidden' name='KEY' value='$key' />
4019         </td></form>
4020
4021         <form method='post' name='frm${key}e'><td align='center'>
4022             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
4023             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
4024             <input type='hidden' name='KEY' value='$key' />
4025         </td></form>
4026         <form method='post' name='frm${key}f'><td align='center'>
4027             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
4028             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
4029             <input type='hidden' name='KEY' value='$key' />
4030         </td></form>
4031         </tr>
4032 END
4033         ;
4034         $id++;
4035     }
4036     ;
4037
4038     # If the config file contains entries, print Key to action icons
4039     if ( $id ) {
4040     print <<END
4041     <table>
4042     <tr>
4043         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4044         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
4045         <td class='base'>$Lang::tr{'click to disable'}</td>
4046         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4047         <td class='base'>$Lang::tr{'show certificate'}</td>
4048         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
4049         <td class='base'>$Lang::tr{'edit'}</td>
4050         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
4051         <td class='base'>$Lang::tr{'remove'}</td>
4052     </tr>
4053     <tr>
4054         <td>&nbsp; </td>
4055         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
4056         <td class='base'>$Lang::tr{'click to enable'}</td>
4057         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
4058         <td class='base'>$Lang::tr{'download certificate'}</td>
4059         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
4060         <td class='base'>$Lang::tr{'dl client arch'}</td>
4061     </tr>
4062     </table>
4063 END
4064     ;
4065     }
4066
4067     print <<END
4068     <table width='100%'>
4069     <form method='post'>
4070     <tr><td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
4071         <td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
4072     </form>
4073     </table>
4074 END
4075     ;
4076     &Header::closebox();
4077 }
4078 &Header::closepage();
4079
4080
4081