html/cgi-bin/ovpnmain.cgi

   1 #!/usr/bin/perl
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2007-2011  IPFire Team  <info@ipfire.org>                     #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21 ###
  22 # Based on IPFireCore 55
  23 ###
  24 use CGI;
  25 use CGI qw/:standard/;
  26 use Net::DNS;
  27 use Net::Ping;
  28 use Net::Telnet;
  29 use File::Copy;
  30 use File::Temp qw/ tempfile tempdir /;
  31 use strict;
  32 use Archive::Zip qw(:ERROR_CODES :CONSTANTS);
  33 require '/var/ipfire/general-functions.pl';
  34 require "${General::swroot}/lang.pl";
  35 require "${General::swroot}/header.pl";
  36 require "${General::swroot}/countries.pl";
  37
  38 # enable only the following on debugging purpose
  39 use warnings;
  40 use CGI::Carp 'fatalsToBrowser';
  41 #workaround to suppress a warning when a variable is used only once
  42 my @dummy = ( ${Header::colourgreen} );
  43 undef (@dummy);
  44
  45 my %color = ();
  46 my %mainsettings = ();
  47 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
  48 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
  49
  50 ###
  51 ### Initialize variables
  52 ###
  53 my %netsettings=();
  54 my %cgiparams=();
  55 my %vpnsettings=();
  56 my %checked=();
  57 my %confighash=();
  58 my %cahash=();
  59 my %selected=();
  60 my $warnmessage = '';
  61 my $errormessage = '';
  62 my %settings=();
  63 my $routes_push_file = '';
  64 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
  65 $cgiparams{'ENABLED'} = 'off';
  66 $cgiparams{'ENABLED_BLUE'} = 'off';
  67 $cgiparams{'ENABLED_ORANGE'} = 'off';
  68 $cgiparams{'EDIT_ADVANCED'} = 'off';
  69 $cgiparams{'NAT'} = 'off';
  70 $cgiparams{'COMPRESSION'} = 'off';
  71 $cgiparams{'ONLY_PROPOSED'} = 'off';
  72 $cgiparams{'ACTION'} = '';
  73 $cgiparams{'CA_NAME'} = '';
  74 $cgiparams{'DHCP_DOMAIN'} = '';
  75 $cgiparams{'DHCP_DNS'} = '';
  76 $cgiparams{'DHCP_WINS'} = '';
  77 $cgiparams{'ROUTES_PUSH'} = '';
  78 $cgiparams{'DCOMPLZO'} = 'off';
  79 $cgiparams{'MSSFIX'} = '';
  80 $routes_push_file = "${General::swroot}/ovpn/routes_push";
  81 unless (-e $routes_push_file)    { system("touch $routes_push_file"); }
  82
  83 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
  84
  85 # prepare openvpn config file
  86 ###
  87 ### Useful functions
  88 ###
  89 sub haveOrangeNet
  90 {
  91         if ($netsettings{'CONFIG_TYPE'} == 2) {return 1;}
  92         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
  93         return 0;
  94 }
  95
  96 sub haveBlueNet
  97 {
  98         if ($netsettings{'CONFIG_TYPE'} == 3) {return 1;}
  99         if ($netsettings{'CONFIG_TYPE'} == 4) {return 1;}
 100         return 0;
 101 }
 102
 103 sub sizeformat{
 104     my $bytesize = shift;
 105     my $i = 0;
 106
 107     while(abs($bytesize) >= 1024){
 108         $bytesize=$bytesize/1024;
 109         $i++;
 110         last if($i==6);
 111     }
 112
 113     my @units = ("Bytes","KB","MB","GB","TB","PB","EB");
 114     my $newsize=(int($bytesize*100 +0.5))/100;
 115     return("$newsize $units[$i]");
 116 }
 117
 118 sub valid_dns_host {
 119         my $hostname = $_[0];
 120         unless ($hostname) { return "No hostname"};
 121         my $res = new Net::DNS::Resolver;
 122         my $query = $res->search("$hostname");
 123         if ($query) {
 124                 foreach my $rr ($query->answer) {
 125                         ## Potential bug - we are only looking at A records:
 126                         return 0 if $rr->type eq "A";
 127                 }
 128         } else {
 129                 return $res->errorstring;
 130         }
 131 }
 132
 133 sub cleanssldatabase
 134 {
 135     if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
 136         print FILE "01";
 137         close FILE;
 138     }
 139     if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) {
 140         print FILE "";
 141         close FILE;
 142     }
 143     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 144     unlink ("${General::swroot}/ovpn/certs/serial.old");
 145     unlink ("${General::swroot}/ovpn/certs/01.pem");
 146 }
 147
 148 sub newcleanssldatabase
 149 {
 150     if (! -s "${General::swroot}/ovpn/certs/serial" )  {
 151         open(FILE, ">${General::swroot}(ovpn/certs/serial");
 152         print FILE "01";
 153         close FILE;
 154     }
 155     if (! -s ">${General::swroot}/ovpn/certs/index.txt") {
 156         system ("touch ${General::swroot}/ovpn/certs/index.txt");
 157     }
 158     unlink ("${General::swroot}/ovpn/certs/index.txt.old");
 159     unlink ("${General::swroot}/ovpn/certs/serial.old");
 160 }
 161
 162 sub deletebackupcert
 163 {
 164         if (open(FILE, "${General::swroot}/ovpn/certs/serial.old")) {
 165                 my $hexvalue = <FILE>;
 166                 chomp $hexvalue;
 167                 close FILE;
 168                 unlink ("${General::swroot}/ovpn/certs/$hexvalue.pem");
 169         }
 170 }
 171
 172 sub checkportfw {
 173     my $KEY2 = $_[0]; # key2
 174     my $SRC_PORT = $_[1]; # src_port
 175     my $PROTOCOL = $_[2]; # protocol
 176     my $SRC_IP = $_[3]; # sourceip
 177
 178     my $pfwfilename = "${General::swroot}/portfw/config";
 179     open(FILE, $pfwfilename) or die 'Unable to open config file.';
 180     my @pfwcurrent = <FILE>;
 181     close(FILE);
 182     my $pfwkey1 = 0; # used for finding last sequence number used
 183     foreach my $pfwline (@pfwcurrent)
 184     {
 185         my @pfwtemp = split(/\,/,$pfwline);
 186
 187         chomp ($pfwtemp[8]);
 188         if ($KEY2 eq "0"){ # if key2 is 0 then it is a portfw addition
 189                 if ( $SRC_PORT eq $pfwtemp[3] &&
 190                         $PROTOCOL eq $pfwtemp[2] &&
 191                         $SRC_IP eq $pfwtemp[7])
 192                 {
 193                          $errormessage = "$Lang::tr{'source port in use'} $SRC_PORT";
 194                 }
 195                 # Check if key2 = 0, if it is then it is a port forward entry and we want the sequence number
 196                 if ( $pfwtemp[1] eq "0") {
 197                         $pfwkey1=$pfwtemp[0];
 198                 }
 199                 # Darren Critchley - Duplicate or overlapping Port range check
 200                 if ($pfwtemp[1] eq "0" &&
 201                         $PROTOCOL eq $pfwtemp[2] &&
 202                         $SRC_IP eq $pfwtemp[7] &&
 203                         $errormessage eq '')
 204                 {
 205                         &portchecks($SRC_PORT, $pfwtemp[5]);
 206 #                       &portchecks($pfwtemp[3], $pfwtemp[5]);
 207 #                       &portchecks($pfwtemp[3], $SRC_IP);
 208                 }
 209         }
 210     }
 211 #    $errormessage="$KEY2 $SRC_PORT $PROTOCOL $SRC_IP";
 212
 213     return;
 214 }
 215
 216 sub checkportoverlap
 217 {
 218         my $portrange1 = $_[0]; # New port range
 219         my $portrange2 = $_[1]; # existing port range
 220         my @tempr1 = split(/\:/,$portrange1);
 221         my @tempr2 = split(/\:/,$portrange2);
 222
 223         unless (&checkportinc($tempr1[0], $portrange2)){ return 0;}
 224         unless (&checkportinc($tempr1[1], $portrange2)){ return 0;}
 225
 226         unless (&checkportinc($tempr2[0], $portrange1)){ return 0;}
 227         unless (&checkportinc($tempr2[1], $portrange1)){ return 0;}
 228
 229         return 1; # Everything checks out!
 230 }
 231
 232 # Darren Critchley - we want to make sure that a port entry is not within an already existing range
 233 sub checkportinc
 234 {
 235         my $port1 = $_[0]; # Port
 236         my $portrange2 = $_[1]; # Port range
 237         my @tempr1 = split(/\:/,$portrange2);
 238
 239         if ($port1 < $tempr1[0] || $port1 > $tempr1[1]) {
 240                 return 1;
 241         } else {
 242                 return 0;
 243         }
 244 }
 245 # Darren Critchley - Duplicate or overlapping Port range check
 246 sub portchecks
 247 {
 248         my $p1 = $_[0]; # New port range
 249         my $p2 = $_[1]; # existing port range
 250 #       $_ = $_[0];
 251         our ($prtrange1, $prtrange2);
 252         $prtrange1 = 0;
 253 #       if (m/:/ && $prtrange1 == 1) { # comparing two port ranges
 254 #               unless (&checkportoverlap($p1,$p2)) {
 255 #                       $errormessage = "$Lang::tr{'source port overlaps'} $p1";
 256 #               }
 257 #       }
 258         if (m/:/ && $prtrange1 == 0 && $errormessage eq '') { # compare one port to a range
 259                 unless (&checkportinc($p2,$p1)) {
 260                         $errormessage = "$Lang::tr{'srcprt within existing'} $p1";
 261                 }
 262         }
 263         $prtrange1 = 1;
 264         if (! m/:/ && $prtrange1 == 1 && $errormessage eq '') { # compare one port to a range
 265                 unless (&checkportinc($p1,$p2)) {
 266                         $errormessage = "$Lang::tr{'srcprt range overlaps'} $p2";
 267                 }
 268         }
 269         return;
 270 }
 271
 272 # Darren Critchley - certain ports are reserved for IPFire
 273 # TCP 67,68,81,222,445
 274 # UDP 67,68
 275 # Params passed in -> port, rangeyn, protocol
 276 sub disallowreserved
 277 {
 278         # port 67 and 68 same for tcp and udp, don't bother putting in an array
 279         my $msg = "";
 280         my @tcp_reserved = (81,222,445);
 281         my $prt = $_[0]; # the port or range
 282         my $ryn = $_[1]; # tells us whether or not it is a port range
 283         my $prot = $_[2]; # protocol
 284         my $srcdst = $_[3]; # source or destination
 285         if ($ryn) { # disect port range
 286                 if ($srcdst eq "src") {
 287                         $msg = "$Lang::tr{'rsvd src port overlap'}";
 288                 } else {
 289                         $msg = "$Lang::tr{'rsvd dst port overlap'}";
 290                 }
 291                 my @tmprng = split(/\:/,$prt);
 292                 unless (67 < $tmprng[0] || 67 > $tmprng[1]) { $errormessage="$msg 67"; return; }
 293                 unless (68 < $tmprng[0] || 68 > $tmprng[1]) { $errormessage="$msg 68"; return; }
 294                 if ($prot eq "tcp") {
 295                         foreach my $prange (@tcp_reserved) {
 296                                 unless ($prange < $tmprng[0] || $prange > $tmprng[1]) { $errormessage="$msg $prange"; return; }
 297                         }
 298                 }
 299         } else {
 300                 if ($srcdst eq "src") {
 301                         $msg = "$Lang::tr{'reserved src port'}";
 302                 } else {
 303                         $msg = "$Lang::tr{'reserved dst port'}";
 304                 }
 305                 if ($prt == 67) { $errormessage="$msg 67"; return; }
 306                 if ($prt == 68) { $errormessage="$msg 68"; return; }
 307                 if ($prot eq "tcp") {
 308                         foreach my $prange (@tcp_reserved) {
 309                                 if ($prange == $prt) { $errormessage="$msg $prange"; return; }
 310                         }
 311                 }
 312         }
 313         return;
 314 }
 315
 316
 317 sub writeserverconf {
 318     my %sovpnsettings = ();
 319     my @temp = ();
 320     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
 321     &read_routepushfile;
 322
 323     open(CONF,    ">${General::swroot}/ovpn/server.conf") or die "Unable to open ${General::swroot}/ovpn/server.conf: $!";
 324     flock CONF, 2;
 325     print CONF "#OpenVPN Server conf\n";
 326     print CONF "\n";
 327     print CONF "daemon openvpnserver\n";
 328     print CONF "writepid /var/run/openvpn.pid\n";
 329     print CONF "#DAN prepare OpenVPN for listening on blue and orange\n";
 330     print CONF ";local $sovpnsettings{'VPN_IP'}\n";
 331     print CONF "dev $sovpnsettings{'DDEVICE'}\n";
 332     print CONF "$sovpnsettings{'DDEVICE'}-mtu $sovpnsettings{'DMTU'}\n";
 333     print CONF "proto $sovpnsettings{'DPROTOCOL'}\n";
 334     print CONF "port $sovpnsettings{'DDEST_PORT'}\n";
 335     print CONF "script-security 3 system\n";
 336     print CONF "ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600\n";
 337     print CONF "client-config-dir /var/ipfire/ovpn/ccd\n";
 338     print CONF "tls-server\n";
 339     print CONF "ca /var/ipfire/ovpn/ca/cacert.pem\n";
 340     print CONF "cert /var/ipfire/ovpn/certs/servercert.pem\n";
 341     print CONF "key /var/ipfire/ovpn/certs/serverkey.pem\n";
 342     print CONF "dh /var/ipfire/ovpn/ca/dh1024.pem\n";
 343     my @tempovpnsubnet = split("\/",$sovpnsettings{'DOVPN_SUBNET'});
 344     print CONF "server $tempovpnsubnet[0] $tempovpnsubnet[1]\n";
 345     print CONF "push \"route $netsettings{'GREEN_NETADDRESS'} $netsettings{'GREEN_NETMASK'}\"\n";
 346
 347     if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 348         @temp = split(/\n/,$vpnsettings{'ROUTES_PUSH'});
 349         foreach (@temp)
 350         {
 351                 @tempovpnsubnet = split("\/",&General::ipcidr2msk($_));
 352                 print CONF "push \"route " . $tempovpnsubnet[0]. " " .  $tempovpnsubnet[1] . "\"\n";
 353         }
 354     }
 355
 356     if ($sovpnsettings{CLIENT2CLIENT} eq 'on') {
 357         print CONF "client-to-client\n";
 358     }
 359     if ($sovpnsettings{MSSFIX} eq 'on') {
 360         print CONF "mssfix\n";
 361     }
 362     if (($sovpnsettings{FRAGMENT} ne '' && $sovpnsettings{FRAGMENT} ne 0) && $sovpnsettings{'DPROTOCOL'} ne 'tcp') {
 363         print CONF "fragment $sovpnsettings{'FRAGMENT'}\n";
 364     }
 365     if ($sovpnsettings{KEEPALIVE_1} > 0 && $sovpnsettings{KEEPALIVE_2} > 0) {
 366         print CONF "keepalive $sovpnsettings{'KEEPALIVE_1'} $sovpnsettings{'KEEPALIVE_2'}\n";
 367     }
 368     print CONF "status-version 1\n";
 369     print CONF "status /var/log/ovpnserver.log 30\n";
 370     print CONF "cipher $sovpnsettings{DCIPHER}\n";
 371     if ($sovpnsettings{DCOMPLZO} eq 'on') {
 372         print CONF "comp-lzo\n";
 373     }
 374     if ($sovpnsettings{REDIRECT_GW_DEF1} eq 'on') {
 375         print CONF "push \"redirect-gateway def1\"\n";
 376     }
 377     if ($sovpnsettings{DHCP_DOMAIN} ne '') {
 378         print CONF "push \"dhcp-option DOMAIN $sovpnsettings{DHCP_DOMAIN}\"\n";
 379     }
 380
 381     if ($sovpnsettings{DHCP_DNS} ne '') {
 382         print CONF "push \"dhcp-option DNS $sovpnsettings{DHCP_DNS}\"\n";
 383     }
 384
 385     if ($sovpnsettings{DHCP_WINS} ne '') {
 386         print CONF "push \"dhcp-option WINS $sovpnsettings{DHCP_WINS}\"\n";
 387     }
 388
 389     if ($sovpnsettings{DHCP_WINS} eq '') {
 390         print CONF "max-clients 100\n";
 391     }
 392     if ($sovpnsettings{DHCP_WINS} ne '') {
 393         print CONF "max-clients $sovpnsettings{MAX_CLIENTS}\n";
 394     }
 395     print CONF "tls-verify /var/ipfire/ovpn/verify\n";
 396     print CONF "crl-verify /var/ipfire/ovpn/crls/cacrl.pem\n";
 397     print CONF "user nobody\n";
 398     print CONF "group nobody\n";
 399     print CONF "persist-key\n";
 400     print CONF "persist-tun\n";
 401         if ($sovpnsettings{LOG_VERB} ne '') {
 402                 print CONF "verb $sovpnsettings{LOG_VERB}\n";
 403         } else {
 404                 print CONF "verb 3\n";
 405         }
 406     print CONF "\n";
 407
 408     close(CONF);
 409 }
 410 #
 411 sub emptyserverlog{
 412     if (open(FILE, ">/var/log/ovpnserver.log")) {
 413         flock FILE, 2;
 414         print FILE "";
 415         close FILE;
 416     }
 417
 418 }
 419
 420 ###
 421 # m.a.d net2net
 422 ###
 423
 424 sub validdotmask
 425 {
 426         my $ipdotmask = $_[0];
 427         if (&General::validip($ipdotmask)) { return 0; }
 428         if (!($ipdotmask =~ /^(.*?)\/(.*?)$/)) {  }
 429         my $mask = $2;
 430         if (($mask =~ /\./ )) { return 0; }
 431   return 1;
 432 }
 433
 434 # -------------------------------------------------------------------
 435
 436 sub write_routepushfile
 437 {
 438         open(FILE, ">$routes_push_file");
 439         flock(FILE, 2);
 440         if ($vpnsettings{'ROUTES_PUSH'} ne '') {
 441                 print FILE $vpnsettings{'ROUTES_PUSH'};
 442         }
 443         close(FILE);
 444 }
 445
 446 sub read_routepushfile
 447 {
 448         if (-e "$routes_push_file") {
 449                 open(FILE,"$routes_push_file");
 450                 delete $vpnsettings{'ROUTES_PUSH'};
 451                 while (<FILE>) { $vpnsettings{'ROUTES_PUSH'} .= $_ };
 452                 close(FILE);
 453                 $cgiparams{'ROUTES_PUSH'} = $vpnsettings{'ROUTES_PUSH'};
 454         }
 455 }
 456
 457
 458 #hier die refresh page
 459 if ( -e "${General::swroot}/ovpn/gencanow") {
 460     my $refresh = '';
 461     $refresh = "<meta http-equiv='refresh' content='15;' />";
 462     &Header::showhttpheaders();
 463     &Header::openpage($Lang::tr{'OVPN'}, 1, $refresh);
 464     &Header::openbigbox('100%', 'center');
 465     &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
 466     print "<tr>\n<td align='center'><img src='/images/clock.gif' alt='' /></td>\n";
 467     print "<td colspan='2'><font color='red'>Please be patient this realy can take some time on older hardware...</font></td></tr>\n";
 468     &Header::closebox();
 469     &Header::closebigbox();
 470     &Header::closepage();
 471     exit (0);
 472 }
 473 ##hier die refresh page
 474
 475
 476 ###
 477 ### OpenVPN Server Control
 478 ###
 479 if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} ||
 480     $cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'} ||
 481     $cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}) {
 482     #start openvpn server
 483     if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'}){
 484         &emptyserverlog();
 485         system('/usr/local/bin/openvpnctrl', '-s');
 486     }
 487     #stop openvpn server
 488     if ($cgiparams{'ACTION'} eq $Lang::tr{'stop ovpn server'}){
 489         system('/usr/local/bin/openvpnctrl', '-k');
 490         &emptyserverlog();
 491     }
 492 #    #restart openvpn server
 493     if ($cgiparams{'ACTION'} eq $Lang::tr{'restart ovpn server'}){
 494 #workarund, till SIGHUP also works when running as nobody
 495         system('/usr/local/bin/openvpnctrl', '-r');
 496         &emptyserverlog();
 497     }
 498 }
 499
 500 ###
 501 ### Save Advanced options
 502 ###
 503
 504 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
 505     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 506     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 507     #DAN this value has to leave.
 508 #new settings for daemon
 509     $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'};
 510     $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'};
 511     $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'};
 512     $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'};
 513     $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'};
 514     $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'};
 515     $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'};
 516     $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'};
 517     $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'};
 518     $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'};
 519     my @temp=();
 520
 521     if ($cgiparams{'FRAGMENT'} eq '') {
 522         delete $vpnsettings{'FRAGMENT'};
 523     } else {
 524         if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) {
 525             $errormessage = "Incorrect value, please insert only numbers.";
 526         goto ADV_ERROR;
 527                 } else {
 528                         $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'};
 529         }
 530     }
 531     if ($cgiparams{'MSSFIX'} ne 'on') {
 532         delete $vpnsettings{'MSSFIX'};
 533     } else {
 534         $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'};
 535     }
 536     if ($cgiparams{'DHCP_DOMAIN'} ne ''){
 537         unless (&General::validfqdn($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) {
 538                 $errormessage = $Lang::tr{'invalid input for dhcp domain'};
 539         goto ADV_ERROR;
 540         }
 541     }
 542     if ($cgiparams{'DHCP_DNS'} ne ''){
 543         unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) {
 544                 $errormessage = $Lang::tr{'invalid input for dhcp dns'};
 545         goto ADV_ERROR;
 546         }
 547     }
 548     if ($cgiparams{'DHCP_WINS'} ne ''){
 549         unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) {
 550                 $errormessage = $Lang::tr{'invalid input for dhcp wins'};
 551                 goto ADV_ERROR;
 552         }
 553     }
 554     if ($cgiparams{'ROUTES_PUSH'} ne ''){
 555         @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
 556         undef $vpnsettings{'ROUTES_PUSH'};
 557         foreach (@temp)
 558         {
 559                 s/^\s+//g; s/\s+$//g;
 560                 if ($_)
 561                 {
 562                         unless (&General::validipandmask($_)) {
 563                                 $errormessage = $Lang::tr{'ovpn errmsg invalid ip or mask'};
 564                         goto ADV_ERROR;
 565                         }
 566                         my ($ip, $cidr) = split("\/",&General::ipcidr2msk($_));
 567                         if ($ip eq $netsettings{'GREEN_NETADDRESS'} && $cidr eq $netsettings{'GREEN_NETMASK'}) {
 568                                 $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
 569   goto ADV_ERROR;
 570                         }
 571                         $vpnsettings{'ROUTES_PUSH'} .= $_."\n";
 572                 }
 573         }
 574         &write_routepushfile;
 575         undef $vpnsettings{'ROUTES_PUSH'};
 576     }
 577         else {
 578         undef $vpnsettings{'ROUTES_PUSH'};
 579         &write_routepushfile;
 580     }
 581     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 255 )) {
 582         $errormessage = $Lang::tr{'invalid input for max clients'};
 583         goto ADV_ERROR;
 584     }
 585     if ($cgiparams{'KEEPALIVE_1'} ne '') {
 586         if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) {
 587             $errormessage = $Lang::tr{'invalid input for keepalive 1'};
 588         goto ADV_ERROR;
 589         }
 590     }
 591     if ($cgiparams{'KEEPALIVE_2'} ne ''){
 592         if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) {
 593             $errormessage = $Lang::tr{'invalid input for keepalive 2'};
 594         goto ADV_ERROR;
 595         }
 596     }
 597     if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){
 598         $errormessage = $Lang::tr{'invalid input for keepalive 1:2'};
 599         goto ADV_ERROR;
 600     }
 601
 602     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 603     &writeserverconf();#hier ok
 604 }
 605
 606 ###
 607 # m.a.d net2net
 608 ###
 609
 610 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'server')
 611 {
 612
 613 my @remsubnet = split(/\//,$cgiparams{'REMOTE_SUBNET'});
 614 my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 615 my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 616 my $tunmtu =  '';
 617
 618 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 619 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 620
 621   open(SERVERCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 622
 623   flock SERVERCONF, 2;
 624   print SERVERCONF "# IPFire n2n Open VPN Server Config by ummeegge und m.a.d\n";
 625   print SERVERCONF "\n";
 626   print SERVERCONF "# User Security\n";
 627   print SERVERCONF "user nobody\n";
 628   print SERVERCONF "group nobody\n";
 629   print SERVERCONF "persist-tun\n";
 630   print SERVERCONF "persist-key\n";
 631   print SERVERCONF "script-security 2\n";
 632   print SERVERCONF "# IP/DNS for remote Server Gateway\n";
 633   print SERVERCONF "remote $cgiparams{'REMOTE'}\n";
 634   print SERVERCONF "float\n";
 635   print SERVERCONF "# IP adresses of the VPN Subnet\n";
 636   print SERVERCONF "ifconfig $ovsubnet.1 $ovsubnet.2\n";
 637   print SERVERCONF "# Client Gateway Network\n";
 638   print SERVERCONF "route $remsubnet[0] $remsubnet[1]\n";
 639   print SERVERCONF "# tun Device\n";
 640   print SERVERCONF "dev tun\n";
 641   print SERVERCONF "# Port and Protokol\n";
 642   print SERVERCONF "port $cgiparams{'DEST_PORT'}\n";
 643
 644   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 645   print SERVERCONF "proto tcp-server\n";
 646   print SERVERCONF "# Packet size\n";
 647   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 648   print SERVERCONF "tun-mtu $tunmtu\n";
 649   }
 650
 651   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 652   print SERVERCONF "proto udp\n";
 653   print SERVERCONF "# Paketsize\n";
 654   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 655   print SERVERCONF "tun-mtu $tunmtu\n";
 656   if ($cgiparams{'FRAGMENT'} ne '') {print SERVERCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 657   if ($cgiparams{'MSSFIX'} eq 'on') {print SERVERCONF "mssfix\n"; };
 658   }
 659   print SERVERCONF "# Auth. Server\n";
 660   print SERVERCONF "tls-server\n";
 661   print SERVERCONF "ca ${General::swroot}/ovpn/ca/cacert.pem\n";
 662   print SERVERCONF "cert ${General::swroot}/ovpn/certs/servercert.pem\n";
 663   print SERVERCONF "key ${General::swroot}/ovpn/certs/serverkey.pem\n";
 664   print SERVERCONF "dh ${General::swroot}/ovpn/ca/dh1024.pem\n";
 665   print SERVERCONF "# Cipher\n";
 666   print SERVERCONF "cipher AES-256-CBC\n";
 667   if ($cgiparams{'COMPLZO'} eq 'on') {
 668    print SERVERCONF "# Enable Compression\n";
 669    print SERVERCONF "comp-lzo\r\n";
 670      }
 671   print SERVERCONF "# Debug Level\n";
 672   print SERVERCONF "verb 3\n";
 673   print SERVERCONF "# Tunnel check\n";
 674   print SERVERCONF "keepalive 10 60\n";
 675   print SERVERCONF "# Start as daemon\n";
 676   print SERVERCONF "daemon $cgiparams{'NAME'}n2n\n";
 677   print SERVERCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 678   print SERVERCONF "# Activate Management Interface and Port\n";
 679   if ($cgiparams{'OVPN_MGMT'} eq '') {print SERVERCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 680   else {print SERVERCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 681   close(SERVERCONF);
 682
 683 }
 684
 685 ###
 686 # m.a.d net2net
 687 ###
 688
 689 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq 'net' && $cgiparams{'SIDE'} eq 'client')
 690 {
 691         my @ovsubnettemp =  split(/\./,$cgiparams{'OVPN_SUBNET'});
 692         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
 693         my @remsubnet =  split(/\//,$cgiparams{'REMOTE_SUBNET'});
 694         my $tunmtu =  '';
 695
 696 unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
 697 unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}", 0770 or die "Unable to create dir $!";}
 698
 699   open(CLIENTCONF,    ">${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Unable to open ${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf: $!";
 700
 701   flock CLIENTCONF, 2;
 702   print CLIENTCONF "# IPFire rewritten n2n Open VPN Client Config by ummeegge und m.a.d\n";
 703   print CLIENTCONF "#\n";
 704   print CLIENTCONF "# User Security\n";
 705   print CLIENTCONF "user nobody\n";
 706   print CLIENTCONF "group nobody\n";
 707   print CLIENTCONF "persist-tun\n";
 708   print CLIENTCONF "persist-key\n";
 709   print CLIENTCONF "script-security 2\n";
 710   print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
 711   print CLIENTCONF "remote $cgiparams{'REMOTE'}\n";
 712   print CLIENTCONF "float\n";
 713   print CLIENTCONF "# IP adresses of the VPN Subnet\n";
 714   print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
 715   print CLIENTCONF "# Server Gateway Network\n";
 716   print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
 717   print CLIENTCONF "# tun Device\n";
 718   print CLIENTCONF "dev tun\n";
 719   print CLIENTCONF "# Port and Protokol\n";
 720   print CLIENTCONF "port $cgiparams{'DEST_PORT'}\n";
 721
 722   if ($cgiparams{'PROTOCOL'} eq 'tcp') {
 723   print CLIENTCONF "proto tcp-client\n";
 724   print CLIENTCONF "# Packet size\n";
 725   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}};
 726   print CLIENTCONF "tun-mtu $tunmtu\n";
 727   }
 728
 729   if ($cgiparams{'PROTOCOL'} eq 'udp') {
 730   print CLIENTCONF "proto udp\n";
 731   print CLIENTCONF "# Paketsize\n";
 732   if ($cgiparams{'MTU'} eq '') {$tunmtu = '1500'} else {$tunmtu = $cgiparams{'MTU'}};
 733   print CLIENTCONF "tun-mtu $tunmtu\n";
 734   if ($cgiparams{'FRAGMENT'} ne '') {print CLIENTCONF "fragment $cgiparams{'FRAGMENT'}\n";}
 735   if ($cgiparams{'MSSFIX'} eq 'on') {print CLIENTCONF "mssfix\n"; };
 736   }
 737
 738   print CLIENTCONF "ns-cert-type server\n";
 739   print CLIENTCONF "# Auth. Client\n";
 740   print CLIENTCONF "tls-client\n";
 741   print CLIENTCONF "# Cipher\n";
 742   print CLIENTCONF "cipher AES-256-CBC\n";
 743   print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n";
 744   if ($cgiparams{'COMPLZO'} eq 'on') {
 745    print CLIENTCONF "# Enable Compression\n";
 746    print CLIENTCONF "comp-lzo\r\n";
 747      }
 748   print CLIENTCONF "# Debug Level\n";
 749   print CLIENTCONF "verb 3\n";
 750   print CLIENTCONF "# Tunnel check\n";
 751   print CLIENTCONF "keepalive 10 60\n";
 752   print CLIENTCONF "# Start as daemon\n";
 753   print CLIENTCONF "daemon $cgiparams{'NAME'}n2n\n";
 754   print CLIENTCONF "writepid /var/run/$cgiparams{'NAME'}n2n.pid\n";
 755   print CLIENTCONF "# Activate Management Interface and Port\n";
 756   if ($cgiparams{'OVPN_MGMT'} eq '') {print CLIENTCONF "management localhost $cgiparams{'DEST_PORT'}\n"}
 757   else {print CLIENTCONF "management localhost $cgiparams{'OVPN_MGMT'}\n"};
 758   close(CLIENTCONF);
 759
 760 }
 761
 762 ###
 763 ### Save main settings
 764 ###
 765
 766
 767 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
 768     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
 769     #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
 770     #DAN this value has to leave.
 771     if ($cgiparams{'ENABLED'} eq 'on'){
 772         unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})) {
 773                 $errormessage = $Lang::tr{'invalid input for hostname'};
 774         goto SETTINGS_ERROR;
 775         }
 776     }
 777     if ($cgiparams{'ENABLED'} eq 'on'){
 778         &disallowreserved($cgiparams{'DDEST_PORT'},0,$cgiparams{'DPROTOCOL'},"dest");
 779     }
 780     if ($errormessage) { goto SETTINGS_ERROR; }
 781
 782
 783     if ($cgiparams{'ENABLED'} eq 'on'){
 784         &checkportfw(0,$cgiparams{'DDEST_PORT'},$cgiparams{'DPROTOCOL'},'0.0.0.0');
 785     }
 786
 787     if ($errormessage) { goto SETTINGS_ERROR; }
 788
 789     if (! &General::validipandmask($cgiparams{'DOVPN_SUBNET'})) {
 790             $errormessage = $Lang::tr{'ovpn subnet is invalid'};
 791         goto SETTINGS_ERROR;
 792     }
 793     my @tmpovpnsubnet = split("\/",$cgiparams{'DOVPN_SUBNET'});
 794
 795     if (&General::IpInSubnet ( $netsettings{'RED_ADDRESS'},
 796         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 797         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire RED Network $netsettings{'RED_ADDRESS'}";
 798         goto SETTINGS_ERROR;
 799     }
 800
 801     if (&General::IpInSubnet ( $netsettings{'GREEN_ADDRESS'},
 802         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 803         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Green Network $netsettings{'GREEN_ADDRESS'}";
 804         goto SETTINGS_ERROR;
 805     }
 806
 807     if (&General::IpInSubnet ( $netsettings{'BLUE_ADDRESS'},
 808         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 809         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Blue Network $netsettings{'BLUE_ADDRESS'}";
 810         goto SETTINGS_ERROR;
 811     }
 812
 813     if (&General::IpInSubnet ( $netsettings{'ORANGE_ADDRESS'},
 814         $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 815         $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire Orange Network $netsettings{'ORANGE_ADDRESS'}";
 816         goto SETTINGS_ERROR;
 817     }
 818     open(ALIASES, "${General::swroot}/ethernet/aliases") or die 'Unable to open aliases file.';
 819     while (<ALIASES>)
 820     {
 821         chomp($_);
 822         my @tempalias = split(/\,/,$_);
 823         if ($tempalias[1] eq 'on') {
 824             if (&General::IpInSubnet ($tempalias[0] ,
 825                 $tmpovpnsubnet[0], $tmpovpnsubnet[1])) {
 826                 $errormessage = "$Lang::tr{'ovpn subnet overlap'} IPFire alias entry $tempalias[0]";
 827             }
 828         }
 829     }
 830     close(ALIASES);
 831     if ($errormessage ne ''){
 832         goto SETTINGS_ERROR;
 833     }
 834     if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
 835         $errormessage = $Lang::tr{'invalid input'};
 836         goto SETTINGS_ERROR;
 837     }
 838     if ((length($cgiparams{'DMTU'})==0) || (($cgiparams{'DMTU'}) < 1000 )) {
 839         $errormessage = $Lang::tr{'invalid mtu input'};
 840         goto SETTINGS_ERROR;
 841     }
 842
 843     unless (&General::validport($cgiparams{'DDEST_PORT'})) {
 844         $errormessage = $Lang::tr{'invalid port'};
 845         goto SETTINGS_ERROR;
 846     }
 847     $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'};
 848     $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'};
 849     $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
 850     $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
 851 #new settings for daemon
 852     $vpnsettings{'DOVPN_SUBNET'} = $cgiparams{'DOVPN_SUBNET'};
 853     $vpnsettings{'DDEVICE'} = $cgiparams{'DDEVICE'};
 854     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
 855     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
 856     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
 857     $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'};
 858     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
 859 #wrtie enable
 860
 861   if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_blue 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_blue 2>/dev/null");}
 862   if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable_orange 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable_orange 2>/dev/null");}
 863   if ( $vpnsettings{'ENABLED'} eq 'on' ) {system("touch ${General::swroot}/ovpn/enable 2>/dev/null");}else{system("unlink ${General::swroot}/ovpn/enable 2>/dev/null");}
 864 #new settings for daemon
 865     &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
 866     &writeserverconf();#hier ok
 867 SETTINGS_ERROR:
 868 ###
 869 ### Reset all step 2
 870 ###
 871 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') {
 872     my $file = '';
 873     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 874
 875     foreach my $key (keys %confighash) {
 876         if ($confighash{$key}[4] eq 'cert') {
 877             delete $confighash{$cgiparams{'$key'}};
 878         }
 879     }
 880     while ($file = glob("${General::swroot}/ovpn/ca/*")) {
 881         unlink $file
 882     }
 883     while ($file = glob("${General::swroot}/ovpn/certs/*")) {
 884         unlink $file
 885     }
 886     while ($file = glob("${General::swroot}/ovpn/crls/*")) {
 887         unlink $file
 888     }
 889     &cleanssldatabase();
 890     if (open(FILE, ">${General::swroot}/ovpn/caconfig")) {
 891         print FILE "";
 892         close FILE;
 893     }
 894     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
 895     #&writeserverconf();
 896 ###
 897 ### Reset all step 1
 898 ###
 899 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) {
 900     &Header::showhttpheaders();
 901     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
 902     &Header::openbigbox('100%', 'LEFT', '', '');
 903     &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
 904     print <<END
 905         <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
 906             <tr><td align='center'>
 907                 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
 908                 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}
 909             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' />
 910                 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
 911         </form></table>
 912 END
 913     ;
 914     &Header::closebox();
 915     &Header::closebigbox();
 916     &Header::closepage();
 917     exit (0);
 918
 919 ###
 920 ### Upload CA Certificate
 921 ###
 922 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
 923     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 924
 925     if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
 926         $errormessage = $Lang::tr{'name must only contain characters'};
 927         goto UPLOADCA_ERROR;
 928     }
 929
 930     if (length($cgiparams{'CA_NAME'}) >60) {
 931         $errormessage = $Lang::tr{'name too long'};
 932         goto VPNCONF_ERROR;
 933     }
 934
 935     if ($cgiparams{'CA_NAME'} eq 'ca') {
 936         $errormessage = $Lang::tr{'name is invalid'};
 937         goto UPLOAD_CA_ERROR;
 938     }
 939
 940     # Check if there is no other entry with this name
 941     foreach my $key (keys %cahash) {
 942         if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
 943             $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
 944             goto UPLOADCA_ERROR;
 945         }
 946     }
 947
 948     if (ref ($cgiparams{'FH'}) ne 'Fh') {
 949         $errormessage = $Lang::tr{'there was no file upload'};
 950         goto UPLOADCA_ERROR;
 951     }
 952     # Move uploaded ca to a temporary file
 953     (my $fh, my $filename) = tempfile( );
 954     if (copy ($cgiparams{'FH'}, $fh) != 1) {
 955         $errormessage = $!;
 956         goto UPLOADCA_ERROR;
 957     }
 958     my $temp = `/usr/bin/openssl x509 -text -in $filename`;
 959     if ($temp !~ /CA:TRUE/i) {
 960         $errormessage = $Lang::tr{'not a valid ca certificate'};
 961         unlink ($filename);
 962         goto UPLOADCA_ERROR;
 963     } else {
 964         move($filename, "${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem");
 965         if ($? ne 0) {
 966             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
 967             unlink ($filename);
 968             goto UPLOADCA_ERROR;
 969         }
 970     }
 971
 972     my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cgiparams{'CA_NAME'}cert.pem`;
 973     $casubject    =~ /Subject: (.*)[\n]/;
 974     $casubject    = $1;
 975     $casubject    =~ s+/Email+, E+;
 976     $casubject    =~ s/ ST=/ S=/;
 977     $casubject    = &Header::cleanhtml($casubject);
 978
 979     my $key = &General::findhasharraykey (\%cahash);
 980     $cahash{$key}[0] = $cgiparams{'CA_NAME'};
 981     $cahash{$key}[1] = $casubject;
 982     &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 983 #    system('/usr/local/bin/ipsecctrl', 'R');
 984
 985     UPLOADCA_ERROR:
 986
 987 ###
 988 ### Display ca certificate
 989 ###
 990 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
 991     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
 992
 993     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
 994         &Header::showhttpheaders();
 995         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
 996         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
 997         &Header::openbox('100%', 'LEFT', "$Lang::tr{'ca certificate'}:");
 998         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
 999         $output = &Header::cleanhtml($output,"y");
1000         print "<pre>$output</pre>\n";
1001         &Header::closebox();
1002         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1003         &Header::closebigbox();
1004         &Header::closepage();
1005         exit(0);
1006     } else {
1007         $errormessage = $Lang::tr{'invalid key'};
1008     }
1009
1010 ###
1011 ### Download ca certificate
1012 ###
1013 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
1014     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1015
1016     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1017         print "Content-Type: application/octet-stream\r\n";
1018         print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
1019         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
1020         exit(0);
1021     } else {
1022         $errormessage = $Lang::tr{'invalid key'};
1023     }
1024
1025 ###
1026 ### Remove ca certificate (step 2)
1027 ###
1028 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
1029     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1030     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1031
1032     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1033         foreach my $key (keys %confighash) {
1034             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1035             if ($test =~ /: OK/) {
1036                 # Delete connection
1037 #               if ($vpnsettings{'ENABLED'} eq 'on' ||
1038 #                   $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1039 #                   system('/usr/local/bin/ipsecctrl', 'D', $key);
1040 #               }
1041                 unlink ("${General::swroot}/ovpn//certs/$confighash{$key}[1]cert.pem");
1042                 unlink ("${General::swroot}/ovpn/certs/$confighash{$key}[1].p12");
1043                 delete $confighash{$key};
1044                 &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1045 #               &writeipsecfiles();
1046             }
1047         }
1048         unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1049         delete $cahash{$cgiparams{'KEY'}};
1050         &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1051 #       system('/usr/local/bin/ipsecctrl', 'R');
1052     } else {
1053         $errormessage = $Lang::tr{'invalid key'};
1054     }
1055 ###
1056 ### Remove ca certificate (step 1)
1057 ###
1058 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
1059     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1060     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1061
1062     my $assignedcerts = 0;
1063     if ( -f "${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
1064         foreach my $key (keys %confighash) {
1065             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
1066             if ($test =~ /: OK/) {
1067                 $assignedcerts++;
1068             }
1069         }
1070         if ($assignedcerts) {
1071             &Header::showhttpheaders();
1072             &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1073             &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1074             &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'});
1075             print <<END
1076                 <table><form method='post'><input type='hidden' name='AREUSURE' value='yes' />
1077                        <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
1078                     <tr><td align='center'>
1079                         <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>: $assignedcerts
1080                         $Lang::tr{'connections are associated with this ca.  deleting the ca will delete these connections as well.'}
1081                     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
1082                         <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td></tr>
1083                 </form></table>
1084 END
1085             ;
1086             &Header::closebox();
1087             &Header::closebigbox();
1088             &Header::closepage();
1089             exit (0);
1090         } else {
1091             unlink ("${General::swroot}/ovpn/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
1092             delete $cahash{$cgiparams{'KEY'}};
1093             &General::writehasharray("${General::swroot}/ovpn/caconfig", \%cahash);
1094 #           system('/usr/local/bin/ipsecctrl', 'R');
1095         }
1096     } else {
1097         $errormessage = $Lang::tr{'invalid key'};
1098     }
1099
1100 ###
1101 ### Display root certificate
1102 ###
1103 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
1104     $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
1105     my $output;
1106     &Header::showhttpheaders();
1107     &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1108     &Header::openbigbox('100%', 'LEFT', '', '');
1109     if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
1110         &Header::openbox('100%', 'LEFT', "$Lang::tr{'root certificate'}:");
1111         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
1112     } else {
1113         &Header::openbox('100%', 'LEFT', "$Lang::tr{'host certificate'}:");
1114         $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
1115     }
1116     $output = &Header::cleanhtml($output,"y");
1117     print "<pre>$output</pre>\n";
1118     &Header::closebox();
1119     print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1120     &Header::closebigbox();
1121     &Header::closepage();
1122     exit(0);
1123
1124 ###
1125 ### Download root certificate
1126 ###
1127 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
1128     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
1129         print "Content-Type: application/octet-stream\r\n";
1130         print "Content-Disposition: filename=cacert.pem\r\n\r\n";
1131         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/ca/cacert.pem`;
1132         exit(0);
1133     }
1134
1135 ###
1136 ### Download host certificate
1137 ###
1138 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
1139     if ( -f "${General::swroot}/ovpn/certs/servercert.pem" ) {
1140         print "Content-Type: application/octet-stream\r\n";
1141         print "Content-Disposition: filename=servercert.pem\r\n\r\n";
1142         print `/usr/bin/openssl x509 -in ${General::swroot}/ovpn/certs/servercert.pem`;
1143         exit(0);
1144     }
1145 ###
1146 ### Form for generating a root certificate
1147 ###
1148 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
1149          $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1150
1151     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1152     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
1153         $errormessage = $Lang::tr{'valid root certificate already exists'};
1154         $cgiparams{'ACTION'} = '';
1155         goto ROOTCERT_ERROR;
1156     }
1157
1158     if (($cgiparams{'ROOTCERT_HOSTNAME'} eq '') && -e "${General::swroot}/red/active") {
1159         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
1160             my $ipaddr = <IPADDR>;
1161             close IPADDR;
1162             chomp ($ipaddr);
1163             $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
1164             if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
1165                 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
1166             }
1167         }
1168     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
1169
1170         if (ref ($cgiparams{'FH'}) ne 'Fh') {
1171             $errormessage = $Lang::tr{'there was no file upload'};
1172             goto ROOTCERT_ERROR;
1173         }
1174
1175         # Move uploaded certificate request to a temporary file
1176         (my $fh, my $filename) = tempfile( );
1177         if (copy ($cgiparams{'FH'}, $fh) != 1) {
1178             $errormessage = $!;
1179             goto ROOTCERT_ERROR;
1180         }
1181
1182         # Create a temporary dirctory
1183         my $tempdir = tempdir( CLEANUP => 1 );
1184
1185         # Extract the CA certificate from the file
1186         my $pid = open(OPENSSL, "|-");
1187         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1188         if ($pid) {     # parent
1189             if ($cgiparams{'P12_PASS'} ne '') {
1190                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1191             }
1192             close (OPENSSL);
1193             if ($?) {
1194                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1195                 unlink ($filename);
1196                 goto ROOTCERT_ERROR;
1197             }
1198         } else {        # child
1199             unless (exec ('/usr/bin/openssl', 'pkcs12', '-cacerts', '-nokeys',
1200                     '-in', $filename,
1201                     '-out', "$tempdir/cacert.pem")) {
1202                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1203                 unlink ($filename);
1204                 goto ROOTCERT_ERROR;
1205             }
1206         }
1207
1208         # Extract the Host certificate from the file
1209         $pid = open(OPENSSL, "|-");
1210         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1211         if ($pid) {     # parent
1212             if ($cgiparams{'P12_PASS'} ne '') {
1213                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1214             }
1215             close (OPENSSL);
1216             if ($?) {
1217                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1218                 unlink ($filename);
1219                 goto ROOTCERT_ERROR;
1220             }
1221         } else {        # child
1222             unless (exec ('/usr/bin/openssl', 'pkcs12', '-clcerts', '-nokeys',
1223                     '-in', $filename,
1224                     '-out', "$tempdir/hostcert.pem")) {
1225                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1226                 unlink ($filename);
1227                 goto ROOTCERT_ERROR;
1228             }
1229         }
1230
1231         # Extract the Host key from the file
1232         $pid = open(OPENSSL, "|-");
1233         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1234         if ($pid) {     # parent
1235             if ($cgiparams{'P12_PASS'} ne '') {
1236                 print OPENSSL "$cgiparams{'P12_PASS'}\n";
1237             }
1238             close (OPENSSL);
1239             if ($?) {
1240                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1241                 unlink ($filename);
1242                 goto ROOTCERT_ERROR;
1243             }
1244         } else {        # child
1245             unless (exec ('/usr/bin/openssl', 'pkcs12', '-nocerts',
1246                     '-nodes',
1247                     '-in', $filename,
1248                     '-out', "$tempdir/serverkey.pem")) {
1249                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1250                 unlink ($filename);
1251                 goto ROOTCERT_ERROR;
1252             }
1253         }
1254
1255         move("$tempdir/cacert.pem", "${General::swroot}/ovpn/ca/cacert.pem");
1256         if ($? ne 0) {
1257             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1258             unlink ($filename);
1259             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1260             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1261             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1262             goto ROOTCERT_ERROR;
1263         }
1264
1265         move("$tempdir/hostcert.pem", "${General::swroot}/ovpn/certs/servercert.pem");
1266         if ($? ne 0) {
1267             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1268             unlink ($filename);
1269             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1270             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1271             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1272             goto ROOTCERT_ERROR;
1273         }
1274
1275         move("$tempdir/serverkey.pem", "${General::swroot}/ovpn/certs/serverkey.pem");
1276         if ($? ne 0) {
1277             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1278             unlink ($filename);
1279             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1280             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1281             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1282             goto ROOTCERT_ERROR;
1283         }
1284
1285         goto ROOTCERT_SUCCESS;
1286
1287     } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
1288
1289         # Validate input since the form was submitted
1290         if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
1291             $errormessage = $Lang::tr{'organization cant be empty'};
1292             goto ROOTCERT_ERROR;
1293         }
1294         if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
1295             $errormessage = $Lang::tr{'organization too long'};
1296             goto ROOTCERT_ERROR;
1297         }
1298         if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1299             $errormessage = $Lang::tr{'invalid input for organization'};
1300             goto ROOTCERT_ERROR;
1301         }
1302         if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
1303             $errormessage = $Lang::tr{'hostname cant be empty'};
1304             goto ROOTCERT_ERROR;
1305         }
1306         unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
1307             $errormessage = $Lang::tr{'invalid input for hostname'};
1308             goto ROOTCERT_ERROR;
1309         }
1310         if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
1311             $errormessage = $Lang::tr{'invalid input for e-mail address'};
1312             goto ROOTCERT_ERROR;
1313         }
1314         if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
1315             $errormessage = $Lang::tr{'e-mail address too long'};
1316             goto ROOTCERT_ERROR;
1317         }
1318         if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1319             $errormessage = $Lang::tr{'invalid input for department'};
1320             goto ROOTCERT_ERROR;
1321         }
1322         if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1323             $errormessage = $Lang::tr{'invalid input for city'};
1324             goto ROOTCERT_ERROR;
1325         }
1326         if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1327             $errormessage = $Lang::tr{'invalid input for state or province'};
1328             goto ROOTCERT_ERROR;
1329         }
1330         if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
1331             $errormessage = $Lang::tr{'invalid input for country'};
1332             goto ROOTCERT_ERROR;
1333         }
1334
1335         # Copy the cgisettings to vpnsettings and save the configfile
1336         $vpnsettings{'ROOTCERT_ORGANIZATION'}   = $cgiparams{'ROOTCERT_ORGANIZATION'};
1337         $vpnsettings{'ROOTCERT_HOSTNAME'}       = $cgiparams{'ROOTCERT_HOSTNAME'};
1338         $vpnsettings{'ROOTCERT_EMAIL'}          = $cgiparams{'ROOTCERT_EMAIL'};
1339         $vpnsettings{'ROOTCERT_OU'}             = $cgiparams{'ROOTCERT_OU'};
1340         $vpnsettings{'ROOTCERT_CITY'}           = $cgiparams{'ROOTCERT_CITY'};
1341         $vpnsettings{'ROOTCERT_STATE'}          = $cgiparams{'ROOTCERT_STATE'};
1342         $vpnsettings{'ROOTCERT_COUNTRY'}        = $cgiparams{'ROOTCERT_COUNTRY'};
1343         &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings);
1344
1345         # Replace empty strings with a .
1346         (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
1347         (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
1348         (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
1349
1350         # refresh
1351         #system ('/bin/touch', "${General::swroot}/ovpn/gencanow");
1352
1353         # Create the CA certificate
1354         my $pid = open(OPENSSL, "|-");
1355         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1356         if ($pid) {     # parent
1357             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1358             print OPENSSL "$state\n";
1359             print OPENSSL "$city\n";
1360             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1361             print OPENSSL "$ou\n";
1362             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
1363             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1364             close (OPENSSL);
1365             if ($?) {
1366                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1367                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1368                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1369                 goto ROOTCERT_ERROR;
1370             }
1371         } else {        # child
1372             unless (exec ('/usr/bin/openssl', 'req', '-x509', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1373                         '-days', '999999', '-newkey', 'rsa:2048',
1374                         '-keyout', "${General::swroot}/ovpn/ca/cakey.pem",
1375                         '-out', "${General::swroot}/ovpn/ca/cacert.pem",
1376                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
1377                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1378                 goto ROOTCERT_ERROR;
1379             }
1380         }
1381
1382         # Create the Host certificate request
1383         $pid = open(OPENSSL, "|-");
1384         $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto ROOTCERT_ERROR;};
1385         if ($pid) {     # parent
1386             print OPENSSL "$cgiparams{'ROOTCERT_COUNTRY'}\n";
1387             print OPENSSL "$state\n";
1388             print OPENSSL "$city\n";
1389             print OPENSSL "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
1390             print OPENSSL "$ou\n";
1391             print OPENSSL "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
1392             print OPENSSL "$cgiparams{'ROOTCERT_EMAIL'}\n";
1393             print OPENSSL ".\n";
1394             print OPENSSL ".\n";
1395             close (OPENSSL);
1396             if ($?) {
1397                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1398                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1399                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1400                 goto ROOTCERT_ERROR;
1401             }
1402         } else {        # child
1403             unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1404                         '-newkey', 'rsa:1024',
1405                         '-keyout', "${General::swroot}/ovpn/certs/serverkey.pem",
1406                         '-out', "${General::swroot}/ovpn/certs/serverreq.pem",
1407                         '-extensions', 'server',
1408                         '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" )) {
1409                 $errormessage = "$Lang::tr{'cant start openssl'}: $!";
1410                 unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1411                 unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1412                 unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1413                 unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1414                 goto ROOTCERT_ERROR;
1415             }
1416         }
1417
1418         # Sign the host certificate request
1419         system('/usr/bin/openssl', 'ca', '-days', '999999',
1420                 '-batch', '-notext',
1421                 '-in',  "${General::swroot}/ovpn/certs/serverreq.pem",
1422                 '-out', "${General::swroot}/ovpn/certs/servercert.pem",
1423                 '-extensions', 'server',
1424                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf");
1425         if ($?) {
1426             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1427             unlink ("${General::swroot}/ovpn/ca/cakey.pem");
1428             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1429             unlink ("${General::swroot}/ovpn/serverkey.pem");
1430             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1431             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1432             &newcleanssldatabase();
1433             goto ROOTCERT_ERROR;
1434         } else {
1435             unlink ("${General::swroot}/ovpn/certs/serverreq.pem");
1436             &deletebackupcert();
1437         }
1438
1439         # Create an empty CRL
1440         system('/usr/bin/openssl', 'ca', '-gencrl',
1441                 '-out', "${General::swroot}/ovpn/crls/cacrl.pem",
1442                 '-config', "${General::swroot}/ovpn/openssl/ovpn.cnf" );
1443         if ($?) {
1444             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1445             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1446             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1447             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1448             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1449             &cleanssldatabase();
1450             goto ROOTCERT_ERROR;
1451 #       } else {
1452 #           &cleanssldatabase();
1453         }
1454         # Create Diffie Hellmann Parameter
1455         system('/usr/bin/openssl', 'dhparam', '-rand', '/proc/interrupts:/proc/net/rt_cache',
1456                '-out', "${General::swroot}/ovpn/ca/dh1024.pem",
1457                '1024' );
1458         if ($?) {
1459             $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
1460             unlink ("${General::swroot}/ovpn/certs/serverkey.pem");
1461             unlink ("${General::swroot}/ovpn/certs/servercert.pem");
1462             unlink ("${General::swroot}/ovpn/ca/cacert.pem");
1463             unlink ("${General::swroot}/ovpn/crls/cacrl.pem");
1464             unlink ("${General::swroot}/ovpn/ca/dh1024.pem");
1465             &cleanssldatabase();
1466             goto ROOTCERT_ERROR;
1467 #       } else {
1468 #           &cleanssldatabase();
1469         }
1470         goto ROOTCERT_SUCCESS;
1471     }
1472     ROOTCERT_ERROR:
1473     if ($cgiparams{'ACTION'} ne '') {
1474         &Header::showhttpheaders();
1475         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1476         &Header::openbigbox('100%', 'LEFT', '', '');
1477         if ($errormessage) {
1478             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1479             print "<class name='base'>$errormessage";
1480             print "&nbsp;</class>";
1481             &Header::closebox();
1482         }
1483         &Header::openbox('100%', 'LEFT', "$Lang::tr{'generate root/host certificates'}:");
1484         print <<END
1485         <form method='post' enctype='multipart/form-data'>
1486         <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1487         <tr><td width='30%' class='base'>$Lang::tr{'organization name'}:</td>
1488             <td width='35%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td>
1489             <td width='35%' colspan='2'>&nbsp;</td></tr>
1490         <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1491             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td>
1492             <td colspan='2'>&nbsp;</td></tr>
1493         <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1494             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td>
1495             <td colspan='2'>&nbsp;</td></tr>
1496         <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1497             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td>
1498             <td colspan='2'>&nbsp;</td></tr>
1499         <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1500             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td>
1501             <td colspan='2'>&nbsp;</td></tr>
1502         <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt'*' /></td>
1503             <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td>
1504             <td colspan='2'>&nbsp;</td></tr>
1505         <tr><td class='base'>$Lang::tr{'country'}:</td>
1506             <td class='base'><select name='ROOTCERT_COUNTRY'>
1507
1508 END
1509         ;
1510         foreach my $country (sort keys %{Countries::countries}) {
1511             print "<option value='$Countries::countries{$country}'";
1512             if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1513                 print " selected='selected'";
1514             }
1515             print ">$country</option>";
1516         }
1517         print <<END
1518             </select></td>
1519             <td colspan='2'>&nbsp;</td></tr>
1520         <tr><td>&nbsp;</td>
1521             <td><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /></td>
1522             <td>&nbsp;</td><td>&nbsp;</td></tr>
1523         <tr><td class='base' colspan='4' align='left'>
1524             <img src='/blob.gif' valign='top' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1525         <tr><td class='base' colspan='4' align='left'>
1526             <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1527             $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1528         </td></tr>
1529         <tr><td colspan='4' bgcolor='#000000'><img src='/images/null.gif' width='1' height='1' border='0' /></td></tr>
1530         <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1531             <td nowrap='nowrap'><input type='file' name='FH' size='32'></td>
1532             <td colspan='2'>&nbsp;</td></tr>
1533         <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' ></td>
1534             <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td>
1535             <td colspan='2'>&nbsp;</td></tr>
1536         <tr><td>&nbsp;</td>
1537             <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td>
1538             <td colspan='2'>&nbsp;</td></tr>
1539         <tr><td class='base' colspan='4' align='left'>
1540             <img src='/blob.gif' valign='top' al='*' >&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1541         </form></table>
1542 END
1543         ;
1544         &Header::closebox();
1545
1546         &Header::closebigbox();
1547         &Header::closepage();
1548         exit(0)
1549     }
1550
1551     ROOTCERT_SUCCESS:
1552     system ("chmod 600 ${General::swroot}/ovpn/certs/serverkey.pem");
1553 #    if ($vpnsettings{'ENABLED'} eq 'on' ||
1554 #       $vpnsettings{'ENABLE_BLUE'} eq 'on') {
1555 #       system('/usr/local/bin/ipsecctrl', 'S');
1556 #    }
1557
1558 ###
1559 ### Enable/Disable connection
1560 ###
1561
1562 ###
1563 # m.a.d net2net
1564 ###
1565
1566 }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1567
1568     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1569     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1570 #    my $n2nactive = '';
1571     my $n2nactive = `/bin/ps ax|grep $confighash{$cgiparams{'KEY'}}[1]|grep -v grep|awk \'{print \$1}\'`;
1572
1573     if ($confighash{$cgiparams{'KEY'}}) {
1574
1575
1576         if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1577             $confighash{$cgiparams{'KEY'}}[0] = 'on';
1578             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1579
1580      if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1581                  system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
1582           }
1583
1584   } else {
1585
1586             $confighash{$cgiparams{'KEY'}}[0] = 'off';
1587       &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1588
1589           if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1590                     if ($n2nactive ne ''){
1591                     system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
1592            }
1593
1594           } else {
1595                   $errormessage = $Lang::tr{'invalid key'};
1596           }
1597       }
1598   }
1599
1600 ###
1601 ### Download OpenVPN client package
1602 ###
1603
1604
1605 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'dl client arch'}) {
1606     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1607     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1608     my $file = '';
1609     my $clientovpn = '';
1610     my @fileholder;
1611     my $tempdir = tempdir( CLEANUP => 1 );
1612     my $zippath = "$tempdir/";
1613
1614 ###
1615 # m.a.d net2net
1616 ###
1617
1618 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
1619
1620         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-Client.zip";
1621         my $zippathname = "$zippath$zipname";
1622         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1].conf";
1623         my @ovsubnettemp =  split(/\./,$confighash{$cgiparams{'KEY'}}[27]);
1624         my $ovsubnet =  "$ovsubnettemp[0].$ovsubnettemp[1].$ovsubnettemp[2]";
1625         my $tunmtu = '';
1626         my @remsubnet = split(/\//,$confighash{$cgiparams{'KEY'}}[8]);
1627         my $n2nfragment = '';
1628
1629     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1630     flock CLIENTCONF, 2;
1631
1632     my $zip = Archive::Zip->new();
1633    print CLIENTCONF "# IPFire n2n Open VPN Client Config by ummeegge und m.a.d\n";
1634    print CLIENTCONF "# \n";
1635    print CLIENTCONF "# User Security\n";
1636    print CLIENTCONF "user nobody\n";
1637    print CLIENTCONF "group nobody\n";
1638    print CLIENTCONF "persist-tun\n";
1639    print CLIENTCONF "persist-key\n";
1640    print CLIENTCONF "script-security 2\n";
1641    print CLIENTCONF "# IP/DNS for remote Server Gateway\n";
1642    print CLIENTCONF "remote $vpnsettings{'VPN_IP'}\n";
1643    print CLIENTCONF "float\n";
1644    print CLIENTCONF "# IP adresses of the VPN Subnet\n";
1645    print CLIENTCONF "ifconfig $ovsubnet.2 $ovsubnet.1\n";
1646    print CLIENTCONF "# Server Gateway Network\n";
1647    print CLIENTCONF "route $remsubnet[0] $remsubnet[1]\n";
1648    print CLIENTCONF "# tun Device\n";
1649    print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\n";
1650    print CLIENTCONF "# Port and Protokoll\n";
1651    print CLIENTCONF "port $confighash{$cgiparams{'KEY'}}[29]\n";
1652
1653    if ($confighash{$cgiparams{'KEY'}}[28] eq 'tcp') {
1654    print CLIENTCONF "proto tcp-client\n";
1655    print CLIENTCONF "# Packet size\n";
1656    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1400'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1657    print CLIENTCONF "tun-mtu $tunmtu\n";
1658    }
1659
1660    if ($confighash{$cgiparams{'KEY'}}[28] eq 'udp') {
1661    print CLIENTCONF "proto udp\n";
1662    print CLIENTCONF "# Paketsize\n";
1663    if ($confighash{$cgiparams{'KEY'}}[31] eq '') {$tunmtu = '1500'} else {$tunmtu = $confighash{$cgiparams{'KEY'}}[31]};
1664    print CLIENTCONF "tun-mtu $tunmtu\n";
1665    if ($confighash{$cgiparams{'KEY'}}[24] ne '') {print CLIENTCONF "fragment $confighash{$cgiparams{'KEY'}}[24]\n";}
1666    if ($confighash{$cgiparams{'KEY'}}[23] eq 'on') {print CLIENTCONF "mssfix\n";}
1667    }
1668    print CLIENTCONF "ns-cert-type server\n";
1669    print CLIENTCONF "# Auth. Client\n";
1670    print CLIENTCONF "tls-client\n";
1671    print CLIENTCONF "# Cipher\n";
1672    print CLIENTCONF "cipher AES-256-CBC\n";
1673     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1674          print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1675      $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1676    }
1677     if ($confighash{$cgiparams{'KEY'}}[30] eq 'on') {
1678    print CLIENTCONF "# Enable Compression\n";
1679    print CLIENTCONF "comp-lzo\r\n";
1680      }
1681    print CLIENTCONF "# Debug Level\n";
1682    print CLIENTCONF "verb 3\n";
1683    print CLIENTCONF "# Tunnel check\n";
1684    print CLIENTCONF "keepalive 10 60\n";
1685    print CLIENTCONF "# Start as daemon\n";
1686    print CLIENTCONF "daemon $confighash{$cgiparams{'KEY'}}[1]n2n\n";
1687    print CLIENTCONF "writepid /var/run/$confighash{$cgiparams{'KEY'}}[1]n2n.pid\n";
1688    print CLIENTCONF "# Activate Management Interface and Port\n";
1689    if ($confighash{$cgiparams{'KEY'}}[22] eq '') {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[29]\n"}
1690     else {print CLIENTCONF "management localhost $confighash{$cgiparams{'KEY'}}[22]\n"};
1691    print CLIENTCONF "# remsub $confighash{$cgiparams{'KEY'}}[11]\n";
1692
1693
1694     close(CLIENTCONF);
1695
1696     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1697     my $status = $zip->writeToFileNamed($zippathname);
1698
1699     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1700     @fileholder = <DLFILE>;
1701     print "Content-Type:application/x-download\n";
1702     print "Content-Disposition:attachment;filename=$zipname\n\n";
1703     print @fileholder;
1704     exit (0);
1705 }
1706 else
1707 {
1708         my $zipname = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.zip";
1709         my $zippathname = "$zippath$zipname";
1710         $clientovpn = "$confighash{$cgiparams{'KEY'}}[1]-TO-IPFire.ovpn";
1711
1712 ###
1713 # m.a.d net2net
1714 ###
1715
1716     open(CLIENTCONF, ">$tempdir/$clientovpn") or die "Unable to open tempfile: $!";
1717     flock CLIENTCONF, 2;
1718
1719     my $zip = Archive::Zip->new();
1720
1721     print CLIENTCONF "#OpenVPN Server conf\r\n";
1722     print CLIENTCONF "tls-client\r\n";
1723     print CLIENTCONF "client\r\n";
1724     print CLIENTCONF "dev $vpnsettings{'DDEVICE'}\r\n";
1725     print CLIENTCONF "proto $vpnsettings{'DPROTOCOL'}\r\n";
1726     print CLIENTCONF "$vpnsettings{'DDEVICE'}-mtu $vpnsettings{'DMTU'}\r\n";
1727     if ( $vpnsettings{'ENABLED'} eq 'on'){
1728         print CLIENTCONF "remote $vpnsettings{'VPN_IP'} $vpnsettings{'DDEST_PORT'}\r\n";
1729         if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1730             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Blue interface\r\n";
1731             print CLIENTCONF ";remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1732         }
1733         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1734             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1735             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1736         }
1737     } elsif ( $vpnsettings{'ENABLED_BLUE'} eq 'on' && (&haveBlueNet())){
1738         print CLIENTCONF "remote $netsettings{'BLUE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1739         if ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1740             print CLIENTCONF "#Coment the above line and uncoment the next line, if you want to connect on the Orange interface\r\n";
1741             print CLIENTCONF ";remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1742         }
1743     } elsif ( $vpnsettings{'ENABLED_ORANGE'} eq 'on' && (&haveOrangeNet())){
1744         print CLIENTCONF "remote $netsettings{'ORANGE_ADDRESS'} $vpnsettings{'DDEST_PORT'}\r\n";
1745     }
1746
1747     if ($confighash{$cgiparams{'KEY'}}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12") {
1748         print CLIENTCONF "pkcs12 $confighash{$cgiparams{'KEY'}}[1].p12\r\n";
1749         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n";
1750     } else {
1751         print CLIENTCONF "ca cacert.pem\r\n";
1752         print CLIENTCONF "cert $confighash{$cgiparams{'KEY'}}[1]cert.pem\r\n";
1753         print CLIENTCONF "key $confighash{$cgiparams{'KEY'}}[1].key\r\n";
1754         $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem")  or die "Can't add file cacert.pem\n";
1755         $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
1756     }
1757     print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n";
1758     if ($vpnsettings{DCOMPLZO} eq 'on') {
1759         print CLIENTCONF "comp-lzo\r\n";
1760     }
1761     print CLIENTCONF "verb 3\r\n";
1762     print CLIENTCONF "ns-cert-type server\r\n";
1763     print CLIENTCONF "tls-remote $vpnsettings{ROOTCERT_HOSTNAME}\r\n";
1764     if ($vpnsettings{MSSFIX} eq 'on') {
1765         print CLIENTCONF "mssfix\r\n";
1766     }
1767     if ($vpnsettings{FRAGMENT} ne '' && $vpnsettings{DPROTOCOL} ne 'tcp' ) {
1768         print CLIENTCONF "fragment $vpnsettings{'FRAGMENT'}\r\n";
1769     }
1770     close(CLIENTCONF);
1771
1772     $zip->addFile( "$tempdir/$clientovpn", $clientovpn) or die "Can't add file $clientovpn\n";
1773     my $status = $zip->writeToFileNamed($zippathname);
1774
1775     open(DLFILE, "<$zippathname") or die "Unable to open $zippathname: $!";
1776     @fileholder = <DLFILE>;
1777     print "Content-Type:application/x-download\n";
1778     print "Content-Disposition:attachment;filename=$zipname\n\n";
1779     print @fileholder;
1780     exit (0);
1781    }
1782
1783
1784
1785 ###
1786 ### Remove connection
1787 ###
1788
1789
1790 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1791     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
1792     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1793
1794     if ($confighash{$cgiparams{'KEY'}}) {
1795 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
1796 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
1797 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
1798 #       }
1799 #
1800         my $temp = `/usr/bin/openssl ca -revoke ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1801
1802 ###
1803 # m.a.d net2net
1804 ###
1805
1806  if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
1807
1808         my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
1809   my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1810   unlink ($certfile) or die "Removing $certfile fail: $!";
1811   unlink ($conffile) or die "Removing $conffile fail: $!";
1812   rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
1813
1814 }
1815
1816   unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1817         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1818         delete $confighash{$cgiparams{'KEY'}};
1819         my $temp2 = `/usr/bin/openssl ca -gencrl -out ${General::swroot}/ovpn/crls/cacrl.pem -config ${General::swroot}/ovpn/openssl/ovpn.cnf`;
1820         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1821         #&writeserverconf();
1822     } else {
1823         $errormessage = $Lang::tr{'invalid key'};
1824     }
1825
1826
1827 ###
1828 ### Download PKCS12 file
1829 ###
1830 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1831     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1832
1833     print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1834     print "Content-Type: application/octet-stream\r\n\r\n";
1835     print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1836     exit (0);
1837
1838 ###
1839 ### Display certificate
1840 ###
1841 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1842     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1843
1844     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1845         &Header::showhttpheaders();
1846         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1847         &Header::openbigbox('100%', 'LEFT', '', '');
1848         &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate'}:");
1849         my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1850         $output = &Header::cleanhtml($output,"y");
1851         print "<pre>$output</pre>\n";
1852         &Header::closebox();
1853         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1854         &Header::closebigbox();
1855         &Header::closepage();
1856         exit(0);
1857     }
1858 ###
1859 ### Display Certificate Revoke List
1860 ###
1861 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show crl'}) {
1862 #    &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
1863
1864     if ( -f "${General::swroot}/ovpn/crls/cacrl.pem") {
1865         &Header::showhttpheaders();
1866         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1867         &Header::openbigbox('100%', 'LEFT', '', '');
1868         &Header::openbox('100%', 'LEFT', "$Lang::tr{'crl'}:");
1869         my $output = `/usr/bin/openssl crl -text -noout -in ${General::swroot}/ovpn/crls/cacrl.pem`;
1870         $output = &Header::cleanhtml($output,"y");
1871         print "<pre>$output</pre>\n";
1872         &Header::closebox();
1873         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1874         &Header::closebigbox();
1875         &Header::closepage();
1876         exit(0);
1877     }
1878
1879 ###
1880 ### Advanced Server Settings
1881 ###
1882
1883 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'advanced server'}) {
1884     %cgiparams = ();
1885     %cahash = ();
1886     %confighash = ();
1887     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
1888     read_routepushfile;
1889
1890 #    if ($cgiparams{'CLIENT2CLIENT'} eq '') {
1891 #       $cgiparams{'CLIENT2CLIENT'} =  'on';
1892 #    }
1893 ADV_ERROR:
1894     if ($cgiparams{'MAX_CLIENTS'} eq '') {
1895         $cgiparams{'MAX_CLIENTS'} =  '100';
1896     }
1897
1898     if ($cgiparams{'KEEPALIVE_1'} eq '') {
1899         $cgiparams{'KEEPALIVE_1'} =  '10';
1900     }
1901     if ($cgiparams{'KEEPALIVE_2'} eq '') {
1902         $cgiparams{'KEEPALIVE_2'} =  '60';
1903     }
1904     if ($cgiparams{'LOG_VERB'} eq '') {
1905         $cgiparams{'LOG_VERB'} =  '3';
1906     }
1907     $checked{'CLIENT2CLIENT'}{'off'} = '';
1908     $checked{'CLIENT2CLIENT'}{'on'} = '';
1909     $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED';
1910     $checked{'REDIRECT_GW_DEF1'}{'off'} = '';
1911     $checked{'REDIRECT_GW_DEF1'}{'on'} = '';
1912     $checked{'REDIRECT_GW_DEF1'}{$cgiparams{'REDIRECT_GW_DEF1'}} = 'CHECKED';
1913     $selected{'ENGINES'}{$cgiparams{'ENGINES'}} = 'SELECTED';
1914     $checked{'MSSFIX'}{'off'} = '';
1915     $checked{'MSSFIX'}{'on'} = '';
1916     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
1917     $selected{'LOG_VERB'}{'1'} = '';
1918     $selected{'LOG_VERB'}{'2'} = '';
1919     $selected{'LOG_VERB'}{'3'} = '';
1920     $selected{'LOG_VERB'}{'4'} = '';
1921     $selected{'LOG_VERB'}{'5'} = '';
1922     $selected{'LOG_VERB'}{'6'} = '';
1923     $selected{'LOG_VERB'}{'7'} = '';
1924     $selected{'LOG_VERB'}{'8'} = '';
1925     $selected{'LOG_VERB'}{'9'} = '';
1926     $selected{'LOG_VERB'}{'10'} = '';
1927     $selected{'LOG_VERB'}{'11'} = '';
1928     $selected{'LOG_VERB'}{'0'} = '';
1929     $selected{'LOG_VERB'}{$cgiparams{'LOG_VERB'}} = 'SELECTED';
1930
1931
1932
1933     &Header::showhttpheaders();
1934     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
1935     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
1936     if ($errormessage) {
1937         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
1938         print "<class name='base'>$errormessage\n";
1939         print "&nbsp;</class>\n";
1940         &Header::closebox();
1941     }
1942     &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'});
1943     print <<END
1944     <form method='post' enctype='multipart/form-data'>
1945     <table width='100%'>
1946     <tr>
1947         <td colspan='4'><b>$Lang::tr{'dhcp-options'}</b></td>
1948     </tr>
1949     <tr>
1950         <td width='25%'></td> <td width='20%'> </td><td width='25%'> </td><td width='30%'></td>
1951     </tr>
1952     <tr>
1953         <td class='base'>Domain</td>
1954         <td><input type='TEXT' name='DHCP_DOMAIN' value='$cgiparams{'DHCP_DOMAIN'}' size='30' /></td>
1955     </tr>
1956     <tr>
1957         <td class='base'>DNS</td>
1958         <td><input type='TEXT' name='DHCP_DNS' value='$cgiparams{'DHCP_DNS'}' size='30' /></td>
1959     </tr>
1960     <tr>
1961         <td class='base'>WINS</td>
1962         <td><input type='TEXT' name='DHCP_WINS' value='$cgiparams{'DHCP_WINS'}' size='30' /></td>
1963        </tr>
1964     <tr>
1965         <td colspan='4'><b>$Lang::tr{'ovpn routes push options'}</b></td>
1966     </tr>
1967     <tr>
1968         <td class='base'>$Lang::tr{'ovpn routes push'}</td>
1969   <td colspan='2'>
1970        <textarea name='ROUTES_PUSH' cols='26' rows='6' wrap='off'>
1971 END
1972 ;
1973
1974 if ($cgiparams{'ROUTES_PUSH'} ne '')
1975 {
1976         print $cgiparams{'ROUTES_PUSH'};
1977 }
1978
1979 print <<END
1980 </textarea></td>
1981 </tr>
1982     </tr>
1983 </table>
1984 <hr size='1'>
1985     <table width='100%'>
1986     <tr>
1987         <td class'base'><b>$Lang::tr{'misc-options'}</b></td>
1988     </tr>
1989     <tr>
1990         <td width='20%'></td> <td width='15%'> </td><td width='15%'> </td><td width='50%'></td>
1991     </tr>
1992     <tr>
1993         <td class='base'>Client-To-Client</td>
1994         <td><input type='checkbox' name='CLIENT2CLIENT' $checked{'CLIENT2CLIENT'}{'on'} /></td>
1995     </tr>
1996     <tr>
1997         <td class='base'>Redirect-Gateway def1</td>
1998         <td><input type='checkbox' name='REDIRECT_GW_DEF1' $checked{'REDIRECT_GW_DEF1'}{'on'} /></td>
1999     </tr>
2000     <tr>
2001         <td class='base'>Max-Clients</td>
2002         <td><input type='text' name='MAX_CLIENTS' value='$cgiparams{'MAX_CLIENTS'}' size='10' /></td>
2003     </tr>
2004         <tr>
2005           <td class='base'>Keppalive <br />
2006             (ping/ping-restart)</td>
2007           <td><input type='TEXT' name='KEEPALIVE_1' value='$cgiparams{'KEEPALIVE_1'}' size='10' /></td>
2008           <td><input type='TEXT' name='KEEPALIVE_2' value='$cgiparams{'KEEPALIVE_2'}' size='10' /></td>
2009     </tr>
2010         <tr>
2011           <td class='base'>fragment <br></td>
2012           <td><input type='TEXT' name='FRAGMENT' value='$cgiparams{'FRAGMENT'}' size='10' /></td>
2013         <td>Default: <span class="base">1300</span></td>
2014       </tr>
2015         <tr>
2016           <td class='base'>mssfix</td>
2017           <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
2018           <td>Default: on</td>
2019           </tr>
2020 </table>
2021
2022 <!--
2023 <hr size='1'>
2024     <table width='100%'>
2025     <tr>
2026  <td class'base'><b>Crypto-Engines</b></td>
2027     </tr>
2028     <tr>
2029         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2030     </tr>
2031     <tr><td class='base'>Engines:</td>
2032         <td><select name='ENGINES'><option value="none" $selected{'ENGINES'}{'none'}>none</option>
2033                                     <option value="cryptodev" $selected{'ENGINES'}{'cryptodev'}>cryptodev</option>
2034                                     <option value="padlock" $selected{'ENGINES'}{'padlock'}>padlock</option>
2035                         </select>
2036                 </td>
2037 </table>
2038 -->
2039 <hr size='1'>
2040     <table width='100%'>
2041     <tr>
2042         <td class'base'><b>$Lang::tr{'log-options'}</b></td>
2043     </tr>
2044     <tr>
2045         <td width='15%'></td> <td width='30%'> </td><td width='25%'> </td><td width='30%'></td>
2046     </tr>
2047
2048     <tr><td class='base'>VERB</td>
2049         <td><select name='LOG_VERB'><option value='1'  $selected{'LOG_VERB'}{'1'}>1</option>
2050                                     <option value='2'  $selected{'LOG_VERB'}{'2'}>2</option>
2051                                     <option value='3'  $selected{'LOG_VERB'}{'3'}>3</option>
2052                                     <option value='4'  $selected{'LOG_VERB'}{'4'}>4</option>
2053                                     <option value='5'  $selected{'LOG_VERB'}{'5'}>5</option>
2054                                     <option value='6'  $selected{'LOG_VERB'}{'6'}>6</option>
2055                                     <option value='7'  $selected{'LOG_VERB'}{'7'}>7</option>
2056                                     <option value='8'  $selected{'LOG_VERB'}{'8'}>8</option>
2057                                     <option value='9'  $selected{'LOG_VERB'}{'9'}>9</option>
2058                                     <option value='10' $selected{'LOG_VERB'}{'10'}>10</option>
2059                                     <option value='11' $selected{'LOG_VERB'}{'11'}>11</option>
2060                                     <option value='0'  $selected{'LOG_VERB'}{'0'}>0</option></select></td>
2061 </table>
2062 <hr size='1'>
2063 <table width='100%'>
2064 <tr>
2065     <td>&nbsp;</td>
2066     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'save-adv-options'}' /></td>
2067     <td allign='center'><input type='submit' name='ACTION' value='$Lang::tr{'cancel-adv-options'}' /></td>
2068     <td>&nbsp;</td>
2069 </tr>
2070 </table>
2071 </form>
2072 END
2073 ;
2074
2075     &Header::closebox();
2076 #    print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2077     &Header::closebigbox();
2078     &Header::closepage();
2079     exit(0);
2080
2081 ###
2082 ### Openvpn Connections Statistics
2083 ###
2084 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ovpn con stat'}) {
2085         &Header::showhttpheaders();
2086         &Header::openpage($Lang::tr{'ovpn con stat'}, 1, '');
2087         &Header::openbigbox('100%', 'LEFT', '', '');
2088     &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'});
2089
2090 #
2091 #       <td><b>$Lang::tr{'protocol'}</b></td>
2092 # protocol temp removed
2093     print <<END
2094     <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2095     <tr>
2096         <td><b>$Lang::tr{'common name'}</b></td>
2097         <td><b>$Lang::tr{'real address'}</b></td>
2098         <td><b>$Lang::tr{'virtual address'}</b></td>
2099         <td><b>$Lang::tr{'loged in at'}</b></td>
2100         <td><b>$Lang::tr{'bytes sent'}</b></td>
2101         <td><b>$Lang::tr{'bytes received'}</b></td>
2102         <td><b>$Lang::tr{'last activity'}</b></td>
2103     </tr>
2104 END
2105 ;
2106         my $filename = "/var/log/ovpnserver.log";
2107         open(FILE, $filename) or die 'Unable to open config file.';
2108         my @current = <FILE>;
2109         close(FILE);
2110         my @users =();
2111         my $status;
2112         my $uid = 0;
2113         my $cn;
2114         my @match = ();
2115         my $proto = "udp";
2116         my $address;
2117         my %userlookup = ();
2118         foreach my $line (@current)
2119         {
2120             chomp($line);
2121             if ( $line =~ /^Updated,(.+)/){
2122                 @match = split( /^Updated,(.+)/, $line);
2123                 $status = $match[1];
2124             }
2125 #gian
2126             if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
2127                 @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
2128                 if ($match[1] ne "Common Name") {
2129                     $cn = $match[1];
2130                     $userlookup{$match[2]} = $uid;
2131                     $users[$uid]{'CommonName'} = $match[1];
2132                     $users[$uid]{'RealAddress'} = $match[2];
2133                     $users[$uid]{'BytesReceived'} = &sizeformat($match[3]);
2134                     $users[$uid]{'BytesSent'} = &sizeformat($match[4]);
2135                     $users[$uid]{'Since'} = $match[5];
2136                     $users[$uid]{'Proto'} = $proto;
2137                     $uid++;
2138                 }
2139             }
2140             if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) {
2141                 @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line);
2142                 if ($match[1] ne "Virtual Address") {
2143                     $address = $match[3];
2144                     #find the uid in the lookup table
2145                     $uid = $userlookup{$address};
2146                     $users[$uid]{'VirtualAddress'} = $match[1];
2147                     $users[$uid]{'LastRef'} = $match[4];
2148                 }
2149             }
2150         }
2151         my $user2 = @users;
2152         if ($user2 >= 1){
2153             for (my $idx = 1; $idx <= $user2; $idx++){
2154                                                 if ($idx % 2) {
2155                                         print "<tr bgcolor='$color{'color20'}'>\n";
2156                                 } else {
2157                                         print "<tr bgcolor='$color{'color22'}'>\n";
2158                                                 }
2159                                                 print "<td align='left'>$users[$idx-1]{'CommonName'}</td>";
2160                                                 print "<td align='left'>$users[$idx-1]{'RealAddress'}</td>";
2161                                                 print "<td align='left'>$users[$idx-1]{'VirtualAddress'}</td>";
2162                                                 print "<td align='left'>$users[$idx-1]{'Since'}</td>";
2163                                                 print "<td align='left'>$users[$idx-1]{'BytesSent'}</td>";
2164                                                 print "<td align='left'>$users[$idx-1]{'BytesReceived'}</td>";
2165                                                 print "<td align='left'>$users[$idx-1]{'LastRef'}</td>";
2166 #                       print "<td align='left'>$users[$idx-1]{'Proto'}</td>";
2167             }
2168         }
2169
2170         print "</table>";
2171         print <<END
2172         <table width='100%' border='0' cellpadding='2' cellspacing='0'>
2173         <tr><td></td></tr>
2174         <tr><td></td></tr>
2175         <tr><td></td></tr>
2176         <tr><td></td></tr>
2177         <tr><td align='center' >$Lang::tr{'the statistics were last updated at'} <b>$status</b></td></tr>
2178         </table>
2179 END
2180 ;
2181         &Header::closebox();
2182         print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2183         &Header::closebigbox();
2184         &Header::closepage();
2185         exit(0);
2186
2187 ###
2188 ### Download Certificate
2189 ###
2190 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
2191     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2192
2193     if ( -f "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
2194         print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n";
2195         print "Content-Type: application/octet-stream\r\n\r\n";
2196         print `/bin/cat ${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
2197         exit (0);
2198     }
2199
2200 ###
2201 ### Enable/Disable connection
2202 ###
2203
2204 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
2205
2206     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2207     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2208
2209     if ($confighash{$cgiparams{'KEY'}}) {
2210            if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
2211             $confighash{$cgiparams{'KEY'}}[0] = 'on';
2212             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2213             #&writeserverconf();
2214 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2215 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2216 #               system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2217 #           }
2218         } else {
2219             $confighash{$cgiparams{'KEY'}}[0] = 'off';
2220 #           if ($vpnsettings{'ENABLED'} eq 'on' ||
2221 #               $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2222 #               system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2223 #           }
2224             &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2225             #&writeserverconf();
2226         }
2227     } else {
2228         $errormessage = $Lang::tr{'invalid key'};
2229     }
2230
2231 ###
2232 ### Restart connection
2233 ###
2234 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
2235     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2236     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2237
2238     if ($confighash{$cgiparams{'KEY'}}) {
2239 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2240 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2241 #           system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2242 #       }
2243     } else {
2244         $errormessage = $Lang::tr{'invalid key'};
2245     }
2246
2247 ###
2248 ### Remove connection
2249 ###
2250 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
2251     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2252     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2253
2254     if ($confighash{$cgiparams{'KEY'}}) {
2255 #       if ($vpnsettings{'ENABLED'} eq 'on' ||
2256 #           $vpnsettings{'ENABLED_BLUE'} eq 'on') {
2257 #           system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'});
2258 #       }
2259         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
2260         unlink ("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2261         delete $confighash{$cgiparams{'KEY'}};
2262         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2263         #&writeserverconf();
2264     } else {
2265         $errormessage = $Lang::tr{'invalid key'};
2266     }
2267 #test33
2268
2269 ###
2270 ### Choose between adding a host-net or net-net connection
2271 ###
2272
2273 ###
2274 # m.a.d net2net
2275 ###
2276
2277 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
2278         &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2279         &Header::showhttpheaders();
2280         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2281         &Header::openbigbox('100%', 'LEFT', '', '');
2282         &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'});
2283
2284 if ( -s "${General::swroot}/ovpn/settings") {
2285
2286         print <<END
2287             <b>$Lang::tr{'connection type'}:</b><br />
2288             <table><form method='post' ENCTYPE="multipart/form-data">
2289             <tr><td><input type='radio' name='TYPE' value='host' checked /></td>
2290                 <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2291             <tr><td><input type='radio' name='TYPE' value='net' /></td>
2292                 <td class='base'>$Lang::tr{'net to net vpn'}</td></tr>
2293                 <tr><td><input type='radio' name='TYPE' value='net2net' /></td>
2294                 <td class='base'>$Lang::tr{'net to net vpn'} (Upload Client Package)</td></tr>
2295           <tr><td>&nbsp;</td><td class='base'><input type='file' name='FH' size='30'></td></tr>
2296           <tr><td>&nbsp;</td><td>Import Connection Name <img src='/blob.gif' /></td></tr>
2297     <tr><td>&nbsp;</td><td class='base'><input type='text' name='n2nname' size='30'><td class='base'>Default : Client Packagename</td></td></tr>
2298           <tr><td colspan='3'><hr /></td></tr>
2299     <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2300           <tr><td>&nbsp;</td></tr>
2301           <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
2302             </form></table>
2303 END
2304         ;
2305
2306 } else {
2307         print <<END
2308                     <b>$Lang::tr{'connection type'}:</b><br />
2309             <table><form method='post' ENCTYPE="multipart/form-data">
2310             <tr><td><input type='radio' name='TYPE' value='host' checked /></td> <td class='base'>$Lang::tr{'host to net vpn'}</td></tr>
2311             <tr><td align='center'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td></tr>
2312             </form></table>
2313 END
2314         ;
2315
2316 }
2317
2318         &Header::closebox();
2319         &Header::closebigbox();
2320         &Header::closepage();
2321         exit (0);
2322
2323 ###
2324 # m.a.d net2net
2325 ###
2326
2327 }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){
2328
2329         my @firen2nconf;
2330         my @confdetails;
2331         my $uplconffilename ='';
2332         my $uplconffilename2 ='';
2333         my $uplp12name = '';
2334         my $uplp12name2 = '';
2335         my @rem_subnet;
2336         my @rem_subnet2;
2337         my @tmposupnet3;
2338         my $key;
2339         my @n2nname;
2340
2341         &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2342
2343 # Check if a file is uploaded
2344
2345         if (ref ($cgiparams{'FH'}) ne 'Fh') {
2346                 $errormessage = $Lang::tr{'there was no file upload'};
2347                 goto N2N_ERROR;
2348     }
2349
2350 # Move uploaded IPfire n2n package to temporary file
2351
2352     (my $fh, my $filename) = tempfile( );
2353     if (copy ($cgiparams{'FH'}, $fh) != 1) {
2354                 $errormessage = $!;
2355                 goto N2N_ERROR;
2356     }
2357
2358         my $zip = Archive::Zip->new();
2359         my $zipName = $filename;
2360         my $status = $zip->read( $zipName );
2361         if ($status != AZ_OK) {
2362                 $errormessage = "Read of $zipName failed\n";
2363                 goto N2N_ERROR;
2364         }
2365
2366         my $tempdir = tempdir( CLEANUP => 1 );
2367         my @files = $zip->memberNames();
2368         for(@files) {
2369         $zip->extractMemberWithoutPaths($_,"$tempdir/$_");
2370         }
2371         my $countfiles = @files;
2372
2373 # Check if we have not more then 2 files
2374
2375         if ( $countfiles == 2){
2376                 foreach (@files){
2377                         if ( $_ =~ /.conf$/){
2378                                 $uplconffilename = $_;
2379                         }
2380                         if ( $_ =~ /.p12$/){
2381                                 $uplp12name = $_;
2382                         }
2383                 }
2384                 if (($uplconffilename eq '') || ($uplp12name eq '')){
2385                         $errormessage = "Either no *.conf or no *.p12 file found\n";
2386                         goto N2N_ERROR;
2387                 }
2388
2389                 open(FILE, "$tempdir/$uplconffilename") or die 'Unable to open*.conf file';
2390                 @firen2nconf = <FILE>;
2391                 close (FILE);
2392                 chomp(@firen2nconf);
2393
2394         } else {
2395
2396                 $errormessage = "Filecount does not match only 2 files are allowed\n";
2397                 goto N2N_ERROR;
2398         }
2399
2400 ###
2401 # m.a.d net2net
2402 ###
2403
2404  if ($cgiparams{'n2nname'} ne ''){
2405
2406   $uplconffilename2 = "$cgiparams{'n2nname'}.conf";
2407   $uplp12name2 = "$cgiparams{'n2nname'}.p12";
2408   $n2nname[0] = $cgiparams{'n2nname'};
2409   my @n2nname2 = split(/\./,$uplconffilename);
2410   $n2nname2[0] =~ s/\n|\r//g;
2411   my $input1 = "${General::swroot}/ovpn/certs/$uplp12name";
2412         my $output1 = "${General::swroot}/ovpn/certs/$uplp12name2";
2413         my $input2 = "$n2nname2[0]n2n";
2414   my $output2 = "$n2nname[0]n2n";
2415   my $filename = "$tempdir/$uplconffilename";
2416   open(FILE, "< $filename") or die 'Unable to open config file.';
2417         my @current = <FILE>;
2418         close(FILE);
2419         foreach (@current) {s/$input1/$output1/g;}
2420         foreach (@current) {s/$input2/$output2/g;}
2421   open (OUT, "> $filename") || die 'Unable to open config file.';
2422   print OUT @current;
2423   close OUT;
2424
2425     }else{
2426     $uplconffilename2 =  $uplconffilename;
2427     $uplp12name2 = $uplp12name;
2428     @n2nname = split(/\./,$uplconffilename);
2429     $n2nname[0] =~ s/\n|\r//g;
2430    }
2431     unless(-d "${General::swroot}/ovpn/n2nconf/"){mkdir "${General::swroot}/ovpn/n2nconf", 0755 or die "Unable to create dir $!";}
2432     unless(-d "${General::swroot}/ovpn/n2nconf/$n2nname[0]"){mkdir "${General::swroot}/ovpn/n2nconf/$n2nname[0]", 0770 or die "Unable to create dir $!";}
2433
2434         move("$tempdir/$uplconffilename", "${General::swroot}/ovpn/n2nconf/$n2nname[0]/$uplconffilename2");
2435
2436         if ($? ne 0) {
2437             $errormessage = "*.conf move failed: $!";
2438             unlink ($filename);
2439             goto N2N_ERROR;
2440         }
2441
2442         move("$tempdir/$uplp12name", "${General::swroot}/ovpn/certs/$uplp12name2");
2443         chmod 0600, "${General::swroot}/ovpn/certs/$uplp12name";
2444
2445         if ($? ne 0) {
2446             $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2447             unlink ($filename);
2448             goto N2N_ERROR;
2449         }
2450
2451 my $complzoactive;
2452 my $mssfixactive;
2453 my $n2nfragment;
2454 my @n2nproto2 = split(/ /, (grep { /^proto/ } @firen2nconf)[0]);
2455 my @n2nproto = split(/-/, $n2nproto2[1]);
2456 my @n2nport = split(/ /, (grep { /^port/ } @firen2nconf)[0]);
2457 my @n2ntunmtu = split(/ /, (grep { /^tun-mtu/ } @firen2nconf)[0]);
2458 my @n2ncomplzo = grep { /^comp-lzo/ } @firen2nconf;
2459 if ($n2ncomplzo[0] =~ /comp-lzo/){$complzoactive = "on";} else {$complzoactive = "off";}
2460 my @n2nmssfix  = grep { /^mssfix/ } @firen2nconf;
2461 if ($n2nmssfix[0] =~ /mssfix/){$mssfixactive = "on";} else {$mssfixactive = "off";}
2462 #my @n2nmssfix = split(/ /, (grep { /^mssfix/ } @firen2nconf)[0]);
2463 my @n2nfragment = split(/ /, (grep { /^fragment/ } @firen2nconf)[0]);
2464 my @n2nremote = split(/ /, (grep { /^remote/ } @firen2nconf)[0]);
2465 my @n2novpnsuball = split(/ /, (grep { /^ifconfig/ } @firen2nconf)[0]);
2466 my @n2novpnsub =  split(/\./,$n2novpnsuball[1]);
2467 my @n2nremsub = split(/ /, (grep { /^route/ } @firen2nconf)[0]);
2468 my @n2nmgmt =  split(/ /, (grep { /^management/ } @firen2nconf)[0]);
2469 my @n2nlocalsub  = split(/ /, (grep { /^# remsub/ } @firen2nconf)[0]);
2470
2471
2472 ###
2473 # m.a.d delete CR and LF from arrays for this chomp doesnt work
2474 ###
2475
2476 $n2nremote[1] =~ s/\n|\r//g;
2477 $n2novpnsub[0] =~ s/\n|\r//g;
2478 $n2novpnsub[1] =~ s/\n|\r//g;
2479 $n2novpnsub[2] =~ s/\n|\r//g;
2480 $n2nproto[0] =~ s/\n|\r//g;
2481 $n2nport[1] =~ s/\n|\r//g;
2482 $n2ntunmtu[1] =~ s/\n|\r//g;
2483 $n2nremsub[1] =~ s/\n|\r//g;
2484 $n2nremsub[2] =~ s/\n|\r//g;
2485 $n2nlocalsub[2] =~ s/\n|\r//g;
2486 $n2nfragment[1] =~ s/\n|\r//g;
2487 $n2nmgmt[2] =~ s/\n|\r//g;
2488 chomp ($complzoactive);
2489 chomp ($mssfixactive);
2490
2491 ###
2492 # m.a.d net2net
2493 ###
2494
2495 ###
2496 # Check if there is no other entry with this name
2497 ###
2498
2499         foreach my $dkey (keys %confighash) {
2500                 if ($confighash{$dkey}[1] eq $n2nname[0]) {
2501                         $errormessage = $Lang::tr{'a connection with this name already exists'};
2502                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2503             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2504       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2505                         goto N2N_ERROR;
2506                 }
2507         }
2508
2509 ###
2510 # Check if OpenVPN Subnet is valid
2511 ###
2512
2513 foreach my $dkey (keys %confighash) {
2514                 if ($confighash{$dkey}[27] eq "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0") {
2515                         $errormessage = 'The OpenVPN Subnet is already in use';
2516                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2517             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2518       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2519                         goto N2N_ERROR;
2520                 }
2521         }
2522
2523 ###
2524 # Check im Dest Port is vaild
2525 ###
2526
2527 foreach my $dkey (keys %confighash) {
2528                 if ($confighash{$dkey}[29] eq $n2nport[1] ) {
2529                         $errormessage = 'The OpenVPN Port is already in use';
2530                         unlink ("${General::swroot}/ovpn/n2nconf/$n2nname[0]/$n2nname[0].conf") or die "Removing Configfile fail: $!";
2531             unlink ("${General::swroot}/ovpn/certs/$n2nname[0].p12") or die "Removing Certfile fail: $!";
2532       rmdir ("${General::swroot}/ovpn/n2nconf/$n2nname[0]") || die "Removing Directory fail: $!";
2533                         goto N2N_ERROR;
2534                 }
2535         }
2536
2537
2538
2539   $key = &General::findhasharraykey (\%confighash);
2540
2541         foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
2542         $confighash{$key}[0] = 'off';
2543         $confighash{$key}[1] = $n2nname[0];
2544   $confighash{$key}[2] = $n2nname[0];
2545         $confighash{$key}[3] = 'net';
2546         $confighash{$key}[4] = 'cert';
2547         $confighash{$key}[6] = 'client';
2548         $confighash{$key}[8] =  $n2nlocalsub[2];
2549   $confighash{$key}[10] = $n2nremote[1];
2550   $confighash{$key}[11] = "$n2nremsub[1]/$n2nremsub[2]";
2551         $confighash{$key}[22] = $n2nmgmt[2];
2552   $confighash{$key}[23] = $mssfixactive;
2553         $confighash{$key}[24] = $n2nfragment[1];
2554   $confighash{$key}[25] = 'IPFire n2n Client';
2555         $confighash{$key}[26] = 'red';
2556   $confighash{$key}[27] = "$n2novpnsub[0].$n2novpnsub[1].$n2novpnsub[2].0/255.255.255.0";
2557   $confighash{$key}[28] = $n2nproto[0];
2558   $confighash{$key}[29] = $n2nport[1];
2559   $confighash{$key}[30] = $complzoactive;
2560   $confighash{$key}[31] = $n2ntunmtu[1];
2561
2562
2563   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2564
2565   N2N_ERROR:
2566
2567         &Header::showhttpheaders();
2568         &Header::openpage('Validate imported configuration', 1, '');
2569         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
2570         if ($errormessage) {
2571             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
2572             print "<class name='base'>$errormessage";
2573             print "&nbsp;</class>";
2574             &Header::closebox();
2575
2576         } else
2577   {
2578                 &Header::openbox('100%', 'LEFT', 'import ipfire net2net config');
2579         }
2580         if ($errormessage eq ''){
2581                 print <<END
2582                 <!-- ipfire net2net config gui -->
2583                 <table width='100%'>
2584                 <tr><td width='25%'>&nbsp;</td><td width='25%'>&nbsp;</td></tr>
2585     <tr><td class='boldbase'>$Lang::tr{'name'}:</td><td><b>$n2nname[0]</b></td></tr>
2586     <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2587                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td><td><b>$confighash{$key}[6]</b></td></tr>
2588                 <tr><td class='boldbase' nowrap='nowrap'>Remote Host </td><td><b>$confighash{$key}[10]</b></td></tr>
2589                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td><td><b>$confighash{$key}[8]</b></td></tr>
2590                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td><td><b>$confighash{$key}[11]</b></td></tr>
2591                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td><td><b>$confighash{$key}[27]</b></td></tr>
2592                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td><td><b>$confighash{$key}[28]</b></td></tr>
2593                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'destination port'}:</td><td><b>$confighash{$key}[29]</b></td></tr>
2594                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td><td><b>$confighash{$key}[30]</b></td></tr>
2595                 <tr><td class='boldbase' nowrap='nowrap'>MSSFIX </td><td><b>$confighash{$key}[23]</b></td></tr>
2596                 <tr><td class='boldbase' nowrap='nowrap'>Fragment </td><td><b>$confighash{$key}[24]</b></td></tr>
2597                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}</td><td><b>$confighash{$key}[31]</b></td></tr>
2598                 <tr><td class='boldbase' nowrap='nowrap'>Management Port </td><td><b>$confighash{$key}[22]</b></td></tr>
2599                 <tr><td>&nbsp;</td><td>&nbsp;</td></tr>
2600     </table>
2601 END
2602 ;
2603                 &Header::closebox();
2604         }
2605
2606         if ($errormessage) {
2607                 print "<div align='center'><a href='/cgi-bin/ovpnmain.cgi'>$Lang::tr{'back'}</a></div>";
2608         } else {
2609                 print "<div align='center'><form method='post' ENCTYPE='multipart/form-data'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' />";
2610                 print "<input type='hidden' name='TYPE' value='net2netakn' />";
2611                 print "<input type='hidden' name='KEY' value='$key' />";
2612                 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2613         }
2614         &Header::closebigbox();
2615         &Header::closepage();
2616         exit(0);
2617
2618
2619 ##
2620 ### Accept IPFire n2n Package Settings
2621 ###
2622
2623   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2624
2625 ###
2626 ### Discard and Rollback IPFire n2n Package Settings
2627 ###
2628
2629   }  elsif (($cgiparams{'ACTION'} eq $Lang::tr{'cancel'}) && ($cgiparams{'TYPE'} eq 'net2netakn')){
2630
2631      &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2632
2633 if ($confighash{$cgiparams{'KEY'}}) {
2634
2635      my $conffile = glob("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]/$confighash{$cgiparams{'KEY'}}[1].conf");
2636      my $certfile = glob("${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
2637      unlink ($certfile) or die "Removing $certfile fail: $!";
2638      unlink ($conffile) or die "Removing $conffile fail: $!";
2639      rmdir ("${General::swroot}/ovpn/n2nconf/$confighash{$cgiparams{'KEY'}}[1]") || die "Kann Verzeichnis nicht loeschen: $!";
2640      delete $confighash{$cgiparams{'KEY'}};
2641     &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2642
2643      } else {
2644                 $errormessage = $Lang::tr{'invalid key'};
2645    }
2646
2647
2648 ###
2649 # m.a.d net2net
2650 ###
2651
2652
2653 ###
2654 ### Adding a new connection
2655 ###
2656 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
2657          ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
2658          ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
2659
2660     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
2661     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
2662     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
2663
2664     if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
2665         if (! $confighash{$cgiparams{'KEY'}}[0]) {
2666             $errormessage = $Lang::tr{'invalid key'};
2667             goto VPNCONF_END;
2668         }
2669         $cgiparams{'ENABLED'}   = $confighash{$cgiparams{'KEY'}}[0];
2670         $cgiparams{'NAME'}      = $confighash{$cgiparams{'KEY'}}[1];
2671         $cgiparams{'TYPE'}      = $confighash{$cgiparams{'KEY'}}[3];
2672         $cgiparams{'AUTH'}      = $confighash{$cgiparams{'KEY'}}[4];
2673         $cgiparams{'PSK'}       = $confighash{$cgiparams{'KEY'}}[5];
2674         $cgiparams{'SIDE'}      = $confighash{$cgiparams{'KEY'}}[6];
2675         $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
2676   $cgiparams{'REMOTE'}  = $confighash{$cgiparams{'KEY'}}[10];
2677   $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
2678 # n2n m.a.d new fields
2679   $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22];
2680   $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23];
2681   $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24];
2682         $cgiparams{'REMARK'}    = $confighash{$cgiparams{'KEY'}}[25];
2683         $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26];
2684 #new fields
2685         $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27];
2686         $cgiparams{'PROTOCOL'}    = $confighash{$cgiparams{'KEY'}}[28];
2687         $cgiparams{'DEST_PORT'}   = $confighash{$cgiparams{'KEY'}}[29];
2688         $cgiparams{'COMPLZO'}     = $confighash{$cgiparams{'KEY'}}[30];
2689         $cgiparams{'MTU'}         = $confighash{$cgiparams{'KEY'}}[31];
2690
2691 #new fields
2692 #ab hiere error uebernehmen
2693
2694     } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2695         $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
2696
2697   if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
2698             $errormessage = $Lang::tr{'connection type is invalid'};
2699             if ($cgiparams{'TYPE'} eq 'net') {
2700       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2701             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2702       }
2703             goto VPNCONF_ERROR;
2704         }
2705
2706
2707         if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
2708             $errormessage = $Lang::tr{'name must only contain characters'};
2709       if ($cgiparams{'TYPE'} eq 'net') {
2710       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2711             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2712       }
2713       goto VPNCONF_ERROR;
2714   }
2715
2716         if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
2717             $errormessage = $Lang::tr{'name is invalid'};
2718             if ($cgiparams{'TYPE'} eq 'net') {
2719       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2720             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2721       }
2722             goto VPNCONF_ERROR;
2723         }
2724
2725         if (length($cgiparams{'NAME'}) >60) {
2726             $errormessage = $Lang::tr{'name too long'};
2727             if ($cgiparams{'TYPE'} eq 'net') {
2728       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2729             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2730       }
2731             goto VPNCONF_ERROR;
2732         }
2733
2734 ###
2735 # m.a.d net2net
2736 ###
2737
2738 if ($cgiparams{'TYPE'} eq 'net') {
2739
2740     if ($cgiparams{'DEST_PORT'} eq  $vpnsettings{'DDEST_PORT'}) {
2741                         $errormessage = $Lang::tr{'openvpn destination port used'};
2742                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2743             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2744       goto VPNCONF_ERROR;
2745                 }
2746
2747     if ($cgiparams{'DEST_PORT'} eq  '') {
2748                         $errormessage = $Lang::tr{'openvpn destination port used'};
2749                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2750             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2751       goto VPNCONF_ERROR;
2752                 }
2753
2754     if ($cgiparams{'OVPN_SUBNET'} eq  $vpnsettings{'DOVPN_SUBNET'}) {
2755                         $errormessage = $Lang::tr{'openvpn subnet is used'};
2756                         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2757             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2758                         goto VPNCONF_ERROR;
2759                 }
2760
2761           if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'MSSFIX'} eq 'on')) {
2762             $errormessage = $Lang::tr{'openvpn mssfix allowed with udp'};
2763             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2764             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2765             goto VPNCONF_ERROR;
2766     }
2767
2768     if (($cgiparams{'PROTOCOL'} eq 'tcp') && ($cgiparams{'FRAGMENT'} ne '')) {
2769             $errormessage = $Lang::tr{'openvpn fragment allowed with udp'};
2770             unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2771             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2772             goto VPNCONF_ERROR;
2773     }
2774
2775     if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'}))  {
2776                   $errormessage = $Lang::tr{'openvpn prefix local subnet'};
2777                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2778             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2779                   goto VPNCONF_ERROR;
2780                 }
2781
2782     if ( &validdotmask ($cgiparams{'OVPN_SUBNET'}))  {
2783                   $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'};
2784                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2785             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2786                   goto VPNCONF_ERROR;
2787                 }
2788
2789     if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'}))  {
2790                   $errormessage = $Lang::tr{'openvpn prefix remote subnet'};
2791                   unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2792             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2793                   goto VPNCONF_ERROR;
2794                 }
2795
2796     if ($cgiparams{'OVPN_MGMT'} eq  '') {
2797                         $cgiparams{'OVPN_MGMT'} = $cgiparams{'DEST_PORT'};
2798                 }
2799
2800 }
2801
2802 #       if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) {
2803 #           $errormessage = $Lang::tr{'ipfire side is invalid'};
2804 #           goto VPNCONF_ERROR;
2805 #       }
2806
2807         # Check if there is no other entry with this name
2808         if (! $cgiparams{'KEY'}) {
2809             foreach my $key (keys %confighash) {
2810                 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
2811                     $errormessage = $Lang::tr{'a connection with this name already exists'};
2812                     if ($cgiparams{'TYPE'} eq 'net') {
2813         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2814               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2815         }
2816                     goto VPNCONF_ERROR;
2817                 }
2818             }
2819         }
2820
2821         if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
2822             $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2823             if ($cgiparams{'TYPE'} eq 'net') {
2824       unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2825             rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2826       }
2827             goto VPNCONF_ERROR;
2828         }
2829
2830         if ($cgiparams{'REMOTE'}) {
2831             if (! &General::validip($cgiparams{'REMOTE'})) {
2832                 if (! &General::validfqdn ($cgiparams{'REMOTE'}))  {
2833                     $errormessage = $Lang::tr{'invalid input for remote host/ip'};
2834                     if ($cgiparams{'TYPE'} eq 'net') {
2835         unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2836               rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2837         }
2838                     goto VPNCONF_ERROR;
2839                 } else {
2840                     if (&valid_dns_host($cgiparams{'REMOTE'})) {
2841                         $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
2842                         if ($cgiparams{'TYPE'} eq 'net') {
2843
2844       }
2845                     }
2846                 }
2847             }
2848         }
2849         if ($cgiparams{'TYPE'} ne 'host') {
2850             unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
2851                     $errormessage = $Lang::tr{'local subnet is invalid'};
2852                     if ($cgiparams{'TYPE'} eq 'net') {
2853               unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2854                     rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2855               }
2856                         goto VPNCONF_ERROR;}
2857         }
2858         # Check if there is no other entry without IP-address and PSK
2859         if ($cgiparams{'REMOTE'} eq '') {
2860             foreach my $key (keys %confighash) {
2861                 if(($cgiparams{'KEY'} ne $key) &&
2862                    ($confighash{$key}[4] eq 'psk' || $cgiparams{'AUTH'} eq 'psk') &&
2863                     $confighash{$key}[10] eq '') {
2864                         $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
2865                         goto VPNCONF_ERROR;
2866                 }
2867             }
2868         }
2869         if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
2870                 $errormessage = $Lang::tr{'remote subnet is invalid'};
2871                 unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!";
2872                       rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!";
2873                 goto VPNCONF_ERROR;
2874         }
2875
2876         if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
2877             $errormessage = $Lang::tr{'invalid input'};
2878             goto VPNCONF_ERROR;
2879         }
2880         if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
2881             $errormessage = $Lang::tr{'invalid input'};
2882             goto VPNCONF_ERROR;
2883         }
2884
2885 #fixplausi
2886         if ($cgiparams{'AUTH'} eq 'psk')  {
2887 #           if (! length($cgiparams{'PSK'}) ) {
2888 #               $errormessage = $Lang::tr{'pre-shared key is too short'};
2889 #               goto VPNCONF_ERROR;
2890 #           }
2891 #           if ($cgiparams{'PSK'} =~ /['",&]/) {
2892 #               $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
2893 #               goto VPNCONF_ERROR;
2894 #           }
2895         } elsif ($cgiparams{'AUTH'} eq 'certreq') {
2896             if ($cgiparams{'KEY'}) {
2897                 $errormessage = $Lang::tr{'cant change certificates'};
2898                 goto VPNCONF_ERROR;
2899             }
2900             if (ref ($cgiparams{'FH'}) ne 'Fh') {
2901                 $errormessage = $Lang::tr{'there was no file upload'};
2902                 goto VPNCONF_ERROR;
2903             }
2904
2905             # Move uploaded certificate request to a temporary file
2906             (my $fh, my $filename) = tempfile( );
2907             if (copy ($cgiparams{'FH'}, $fh) != 1) {
2908                 $errormessage = $!;
2909                 goto VPNCONF_ERROR;
2910             }
2911
2912             # Sign the certificate request and move it
2913             # Sign the host certificate request
2914             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
2915                 '-batch', '-notext',
2916                 '-in', $filename,
2917                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
2918                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
2919             if ($?) {
2920                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
2921                 unlink ($filename);
2922                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2923                 &newcleanssldatabase();
2924                 goto VPNCONF_ERROR;
2925             } else {
2926                 unlink ($filename);
2927                 &deletebackupcert();
2928             }
2929
2930             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2931             $temp =~ /Subject:.*CN=(.*)[\n]/;
2932             $temp = $1;
2933             $temp =~ s+/Email+, E+;
2934             $temp =~ s/ ST=/ S=/;
2935             $cgiparams{'CERT_NAME'} = $temp;
2936             $cgiparams{'CERT_NAME'} =~ s/,//g;
2937             $cgiparams{'CERT_NAME'} =~ s/\'//g;
2938             if ($cgiparams{'CERT_NAME'} eq '') {
2939                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2940                 goto VPNCONF_ERROR;
2941             }
2942         } elsif ($cgiparams{'AUTH'} eq 'certfile') {
2943             if ($cgiparams{'KEY'}) {
2944                 $errormessage = $Lang::tr{'cant change certificates'};
2945                 goto VPNCONF_ERROR;
2946             }
2947             if (ref ($cgiparams{'FH'}) ne 'Fh') {
2948                 $errormessage = $Lang::tr{'there was no file upload'};
2949                 goto VPNCONF_ERROR;
2950             }
2951             # Move uploaded certificate to a temporary file
2952             (my $fh, my $filename) = tempfile( );
2953             if (copy ($cgiparams{'FH'}, $fh) != 1) {
2954                 $errormessage = $!;
2955                 goto VPNCONF_ERROR;
2956             }
2957
2958             # Verify the certificate has a valid CA and move it
2959             my $validca = 0;
2960             my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/cacert.pem $filename`;
2961             if ($test =~ /: OK/) {
2962                 $validca = 1;
2963             } else {
2964                 foreach my $key (keys %cahash) {
2965                     $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ovpn/ca/$cahash{$key}[0]cert.pem $filename`;
2966                     if ($test =~ /: OK/) {
2967                         $validca = 1;
2968                     }
2969                 }
2970             }
2971             if (! $validca) {
2972                 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
2973                 unlink ($filename);
2974                 goto VPNCONF_ERROR;
2975             } else {
2976                 move($filename, "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2977                 if ($? ne 0) {
2978                     $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
2979                     unlink ($filename);
2980                     goto VPNCONF_ERROR;
2981                 }
2982             }
2983
2984             my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem`;
2985             $temp =~ /Subject:.*CN=(.*)[\n]/;
2986             $temp = $1;
2987             $temp =~ s+/Email+, E+;
2988             $temp =~ s/ ST=/ S=/;
2989             $cgiparams{'CERT_NAME'} = $temp;
2990             $cgiparams{'CERT_NAME'} =~ s/,//g;
2991             $cgiparams{'CERT_NAME'} =~ s/\'//g;
2992             if ($cgiparams{'CERT_NAME'} eq '') {
2993                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
2994                 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
2995                 goto VPNCONF_ERROR;
2996             }
2997         } elsif ($cgiparams{'AUTH'} eq 'certgen') {
2998             if ($cgiparams{'KEY'}) {
2999                 $errormessage = $Lang::tr{'cant change certificates'};
3000                 goto VPNCONF_ERROR;
3001             }
3002             # Validate input since the form was submitted
3003             if (length($cgiparams{'CERT_NAME'}) >60) {
3004                 $errormessage = $Lang::tr{'name too long'};
3005                 goto VPNCONF_ERROR;
3006             }
3007             if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3008                 $errormessage = $Lang::tr{'invalid input for name'};
3009                 goto VPNCONF_ERROR;
3010             }
3011             if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
3012                 $errormessage = $Lang::tr{'invalid input for e-mail address'};
3013                 goto VPNCONF_ERROR;
3014             }
3015             if (length($cgiparams{'CERT_EMAIL'}) > 40) {
3016                 $errormessage = $Lang::tr{'e-mail address too long'};
3017                 goto VPNCONF_ERROR;
3018             }
3019             if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3020                 $errormessage = $Lang::tr{'invalid input for department'};
3021                 goto VPNCONF_ERROR;
3022             }
3023             if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
3024                 $errormessage = $Lang::tr{'organization too long'};
3025                 goto VPNCONF_ERROR;
3026             }
3027             if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
3028                 $errormessage = $Lang::tr{'invalid input for organization'};
3029                 goto VPNCONF_ERROR;
3030             }
3031             if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3032                 $errormessage = $Lang::tr{'invalid input for city'};
3033                 goto VPNCONF_ERROR;
3034             }
3035             if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
3036                 $errormessage = $Lang::tr{'invalid input for state or province'};
3037                 goto VPNCONF_ERROR;
3038             }
3039             if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
3040                 $errormessage = $Lang::tr{'invalid input for country'};
3041                 goto VPNCONF_ERROR;
3042             }
3043             if ($cgiparams{'CERT_PASS1'} ne '' && $cgiparams{'CERT_PASS2'} ne ''){
3044                 if (length($cgiparams{'CERT_PASS1'}) < 5) {
3045                     $errormessage = $Lang::tr{'password too short'};
3046                     goto VPNCONF_ERROR;
3047                 }
3048             }
3049             if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
3050                 $errormessage = $Lang::tr{'passwords do not match'};
3051                 goto VPNCONF_ERROR;
3052             }
3053
3054             # Replace empty strings with a .
3055             (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
3056             (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
3057             (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
3058
3059             # Create the Host certificate request client
3060             my $pid = open(OPENSSL, "|-");
3061             $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;};
3062             if ($pid) { # parent
3063                 print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n";
3064                 print OPENSSL "$state\n";
3065                 print OPENSSL "$city\n";
3066                 print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n";
3067                 print OPENSSL "$ou\n";
3068                 print OPENSSL "$cgiparams{'CERT_NAME'}\n";
3069                 print OPENSSL "$cgiparams{'CERT_EMAIL'}\n";
3070                 print OPENSSL ".\n";
3071                 print OPENSSL ".\n";
3072                 close (OPENSSL);
3073                 if ($?) {
3074                     $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3075                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}key.pem");
3076                     unlink ("${General::swroot}ovpn/certs/$cgiparams{'NAME'}req.pem");
3077                     goto VPNCONF_ERROR;
3078                 }
3079             } else {    # child
3080                 unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache',
3081                         '-newkey', 'rsa:1024',
3082                         '-keyout', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3083                         '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3084                         '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf")) {
3085                     $errormessage = "$Lang::tr{'cant start openssl'}: $!";
3086                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3087                     unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3088                     goto VPNCONF_ERROR;
3089                 }
3090             }
3091
3092             # Sign the host certificate request
3093             system('/usr/bin/openssl', 'ca', '-days', "$cgiparams{'DAYS_VALID'}",
3094                 '-batch', '-notext',
3095                 '-in',  "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem",
3096                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3097                 '-config',"${General::swroot}/ovpn/openssl/ovpn.cnf");
3098             if ($?) {
3099                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3100                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3101                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3102                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3103                 &newcleanssldatabase();
3104                 goto VPNCONF_ERROR;
3105             } else {
3106                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem");
3107                 &deletebackupcert();
3108             }
3109
3110             # Create the pkcs12 file
3111             system('/usr/bin/openssl', 'pkcs12', '-export',
3112                 '-inkey', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem",
3113                 '-in', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem",
3114                 '-name', $cgiparams{'NAME'},
3115                 '-passout', "pass:$cgiparams{'CERT_PASS1'}",
3116                 '-certfile', "${General::swroot}/ovpn/ca/cacert.pem",
3117                 '-caname', "$vpnsettings{'ROOTCERT_ORGANIZATION'} CA",
3118                 '-out', "${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3119             if ($?) {
3120                 $errormessage = "$Lang::tr{'openssl produced an error'}: $?";
3121                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3122                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem");
3123                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12");
3124                 goto VPNCONF_ERROR;
3125             } else {
3126                 unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem");
3127             }
3128         } elsif ($cgiparams{'AUTH'} eq 'cert') {
3129             ;# Nothing, just editing
3130         } else {
3131             $errormessage = $Lang::tr{'invalid input for authentication method'};
3132             goto VPNCONF_ERROR;
3133         }
3134
3135         # Check if there is no other entry with this common name
3136         if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk')) {
3137             foreach my $key (keys %confighash) {
3138                 if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
3139                     $errormessage = $Lang::tr{'a connection with this common name already exists'};
3140                     goto VPNCONF_ERROR;
3141                 }
3142             }
3143         }
3144
3145         # Save the config
3146         my $key = $cgiparams{'KEY'};
3147         if (! $key) {
3148             $key = &General::findhasharraykey (\%confighash);
3149             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3150         }
3151         $confighash{$key}[0] = $cgiparams{'ENABLED'};
3152         $confighash{$key}[1] = $cgiparams{'NAME'};
3153         if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
3154             $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
3155         }
3156         $confighash{$key}[3] = $cgiparams{'TYPE'};
3157         if ($cgiparams{'AUTH'} eq 'psk') {
3158             $confighash{$key}[4] = 'psk';
3159             $confighash{$key}[5] = $cgiparams{'PSK'};
3160         } else {
3161             $confighash{$key}[4] = 'cert';
3162         }
3163         if ($cgiparams{'TYPE'} eq 'net') {
3164             $confighash{$key}[6] = $cgiparams{'SIDE'};
3165             $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
3166         }
3167         $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
3168         $confighash{$key}[10] = $cgiparams{'REMOTE'};
3169   if ($cgiparams{'OVPN_MGMT'} eq '') {
3170   $confighash{$key}[22] = $confighash{$key}[29];
3171   } else {
3172   $confighash{$key}[22] = $cgiparams{'OVPN_MGMT'};
3173   }
3174   $confighash{$key}[23] = $cgiparams{'MSSFIX'};
3175   $confighash{$key}[24] = $cgiparams{'FRAGMENT'};
3176         $confighash{$key}[25] = $cgiparams{'REMARK'};
3177         $confighash{$key}[26] = $cgiparams{'INTERFACE'};
3178 # new fields
3179         $confighash{$key}[27] = $cgiparams{'OVPN_SUBNET'};
3180         $confighash{$key}[28] = $cgiparams{'PROTOCOL'};
3181         $confighash{$key}[29] = $cgiparams{'DEST_PORT'};
3182         $confighash{$key}[30] = $cgiparams{'COMPLZO'};
3183         $confighash{$key}[31] = $cgiparams{'MTU'};
3184 # new fileds
3185         &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3186
3187 ###
3188 # m.a.d n2n begin
3189 ###
3190
3191         if ($cgiparams{'TYPE'} eq 'net') {
3192
3193         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3194   system('/usr/local/bin/openvpnctrl', '-kn2n', $confighash{$cgiparams{'KEY'}}[1]);
3195
3196   &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3197         my $key = $cgiparams{'KEY'};
3198         if (! $key) {
3199             $key = &General::findhasharraykey (\%confighash);
3200             foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
3201             }
3202   $confighash{$key}[0] = 'on';
3203   &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3204
3205   system('/usr/local/bin/openvpnctrl', '-sn2n', $confighash{$cgiparams{'KEY'}}[1]);
3206          }
3207   }
3208
3209 ###
3210 # m.a.d n2n end
3211 ###
3212
3213         if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
3214             $cgiparams{'KEY'} = $key;
3215             $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
3216         }
3217         goto VPNCONF_END;
3218     } else {
3219         $cgiparams{'ENABLED'} = 'on';
3220 ###
3221 # m.a.d n2n begin
3222 ###
3223         $cgiparams{'MSSFIX'} = 'on';
3224         $cgiparams{'FRAGMENT'} = '1300';
3225 ###
3226 # m.a.d n2n end
3227 ###
3228         $cgiparams{'SIDE'} = 'left';
3229         if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) {
3230             $cgiparams{'AUTH'} = 'psk';
3231         } elsif ( ! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3232             $cgiparams{'AUTH'} = 'certfile';
3233         } else {
3234             $cgiparams{'AUTH'} = 'certgen';
3235         }
3236         $cgiparams{'LOCAL_SUBNET'}      ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
3237         $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
3238         $cgiparams{'CERT_CITY'}         = $vpnsettings{'ROOTCERT_CITY'};
3239         $cgiparams{'CERT_STATE'}        = $vpnsettings{'ROOTCERT_STATE'};
3240         $cgiparams{'CERT_COUNTRY'}      = $vpnsettings{'ROOTCERT_COUNTRY'};
3241     }
3242
3243     VPNCONF_ERROR:
3244     $checked{'ENABLED'}{'off'} = '';
3245     $checked{'ENABLED'}{'on'} = '';
3246     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3247     $checked{'ENABLED_BLUE'}{'off'} = '';
3248     $checked{'ENABLED_BLUE'}{'on'} = '';
3249     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3250     $checked{'ENABLED_ORANGE'}{'off'} = '';
3251     $checked{'ENABLED_ORANGE'}{'on'} = '';
3252     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3253
3254
3255     $checked{'EDIT_ADVANCED'}{'off'} = '';
3256     $checked{'EDIT_ADVANCED'}{'on'} = '';
3257     $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED';
3258
3259     $selected{'SIDE'}{'server'} = '';
3260     $selected{'SIDE'}{'client'} = '';
3261     $selected{'SIDE'}{$cgiparams{'SIDE'}} = 'SELECTED';
3262
3263     $selected{'PROTOCOL'}{'udp'} = '';
3264     $selected{'PROTOCOL'}{'tcp'} = '';
3265     $selected{'PROTOCOL'}{$cgiparams{'PROTOCOL'}} = 'SELECTED';
3266
3267
3268     $checked{'AUTH'}{'psk'} = '';
3269     $checked{'AUTH'}{'certreq'} = '';
3270     $checked{'AUTH'}{'certgen'} = '';
3271     $checked{'AUTH'}{'certfile'} = '';
3272     $checked{'AUTH'}{$cgiparams{'AUTH'}} = 'CHECKED';
3273
3274     $selected{'INTERFACE'}{$cgiparams{'INTERFACE'}} = 'SELECTED';
3275
3276     $checked{'COMPLZO'}{'off'} = '';
3277     $checked{'COMPLZO'}{'on'} = '';
3278     $checked{'COMPLZO'}{$cgiparams{'COMPLZO'}} = 'CHECKED';
3279
3280     $checked{'MSSFIX'}{'off'} = '';
3281     $checked{'MSSFIX'}{'on'} = '';
3282     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3283
3284
3285     if (1) {
3286         &Header::showhttpheaders();
3287         &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
3288         &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3289         if ($errormessage) {
3290             &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3291             print "<class name='base'>$errormessage";
3292             print "&nbsp;</class>";
3293             &Header::closebox();
3294         }
3295
3296         if ($warnmessage) {
3297             &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:");
3298             print "<class name='base'>$warnmessage";
3299             print "&nbsp;</class>";
3300             &Header::closebox();
3301         }
3302
3303         print "<form method='post' enctype='multipart/form-data'>";
3304         print "<input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />";
3305
3306         if ($cgiparams{'KEY'}) {
3307             print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
3308             print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
3309         }
3310
3311         &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:");
3312         print "<table width='100%'>\n";
3313         print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>";
3314         if ($cgiparams{'TYPE'} eq 'host') {
3315             if ($cgiparams{'KEY'}) {
3316                 print "<td width='35%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>\n";
3317             } else {
3318                 print "<td width='35%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' size='30' /></td>";
3319             }
3320 #           print "<tr><td>$Lang::tr{'interface'}</td>";
3321 #           print "<td><select name='INTERFACE'>";
3322 #           print "<option value='RED' $selected{'INTERFACE'}{'RED'}>RED</option>";
3323 #           if ($netsettings{'BLUE_DEV'} ne '') {
3324 #               print "<option value='BLUE' $selected{'INTERFACE'}{'BLUE'}>BLUE</option>";
3325 #           }
3326 #           print "<option value='GREEN' $selected{'INTERFACE'}{'GREEN'}>GREEN</option>";
3327 #           print "<option value='ORANGE' $selected{'INTERFACE'}{'ORANGE'}>ORANGE</option>";
3328 #           print "</select></td></tr>";
3329 #           print <<END
3330         } else {
3331             print "<input type='hidden' name='INTERFACE' value='red' />";
3332             if ($cgiparams{'KEY'}) {
3333                 print "<td width='25%' class='base' nowrap='nowrap'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' />$cgiparams{'NAME'}</td>";
3334             } else {
3335                 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' maxlength='20' /></td>";
3336             }
3337             print <<END
3338                     <td width='25%'>&nbsp;</td>
3339                     <td width='25%'>&nbsp;</td></tr>
3340                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'Act as'}</td>
3341                     <td><select name='SIDE'><option value='server' $selected{'SIDE'}{'server'}>$Lang::tr{'openvpn server'}</option>
3342                                             <option value='client' $selected{'SIDE'}{'client'}>$Lang::tr{'openvpn client'}</option></select></td>
3343                     <td class='boldbase'>$Lang::tr{'remote host/ip'}:</td>
3344                     <td><input type='TEXT' name='REMOTE' value='$cgiparams{'REMOTE'}' /></td></tr>
3345                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
3346                     <td><input type='TEXT' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' /></td>
3347                     <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
3348                     <td><input type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' /></td></tr>
3349                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn subnet'}</td>
3350                     <td><input type='TEXT' name='OVPN_SUBNET' value='$cgiparams{'OVPN_SUBNET'}' /></td></tr>
3351                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3352
3353      <td><select name='PROTOCOL'><option value='udp' $selected{'PROTOCOL'}{'udp'}>UDP</option>
3354                                                 <option value='tcp' $selected{'PROTOCOL'}{'tcp'}>TCP</option></select></td>
3355
3356         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3357                     <td><input type='TEXT' name='DEST_PORT' value='$cgiparams{'DEST_PORT'}' size='5' /></td></tr>
3358                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'} &nbsp;<img src='/blob.gif'</td>
3359                     <td><input type='checkbox' name='COMPLZO' $checked{'COMPLZO'}{'on'} /></td>
3360
3361                       <tr><td class='boldbase' nowrap='nowrap'>mssfix &nbsp;<img src='/blob.gif' /></td>
3362                     <td><input type='checkbox' name='MSSFIX' $checked{'MSSFIX'}{'on'} /></td>
3363         <td>$Lang::tr{'openvpn default'}: <span class="base">on</span></td>
3364
3365           <tr><td class='boldbase' nowrap='nowrap'>fragment &nbsp;<img src='/blob.gif' /></td>
3366                     <td><input type='TEXT' name='FRAGMENT' VALUE='$cgiparams{'FRAGMENT'}'size='5' /></td>
3367                     <td>$Lang::tr{'openvpn default'}: <span class="base">1300</span></td>
3368
3369                 <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;<img src='/blob.gif' /></td>
3370                     <td> <input type='TEXT' name='MTU' VALUE='$cgiparams{'MTU'}'size='5' /></td>
3371         <td colspan='2'>$Lang::tr{'openvpn default'}: udp/tcp <span class="base">1500/1400</span></td>
3372
3373         <tr><td class='boldbase' nowrap='nowrap'>Management Port&nbsp;<img src='/blob.gif' /></td>
3374                     <td> <input type='TEXT' name='OVPN_MGMT' VALUE='$cgiparams{'OVPN_MGMT'}'size='5' /></td>
3375         <td colspan='2'>$Lang::tr{'openvpn default'}: <span class="base">$Lang::tr{'destination port'}</span></td>
3376
3377 END
3378             ;
3379         }
3380
3381         print "<tr><td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' /></td>";
3382         print "<td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td></tr>";
3383
3384         if ($cgiparams{'TYPE'} eq 'host') {
3385
3386       print "<tr><td>$Lang::tr{'enabled'} <input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>\n";
3387          }
3388
3389 #           if ($cgiparams{'KEY'}) {
3390 #               print "<td colspan='3'>&nbsp;</td></tr></table>";
3391 #           } else {
3392 #               print "<td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</tr></table>";
3393 #           }
3394 #       }else{
3395             print "<td colspan='3'>&nbsp;</td></tr></table>";
3396 #       }
3397
3398
3399
3400         &Header::closebox();
3401
3402         if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
3403         #    &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3404         #    print <<END
3405         #    <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3406         #    <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
3407         #       <td class='base' width='50%'><input type='text' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
3408         #    </table>
3409 END
3410         #    ;
3411         #    &Header::closebox();
3412         } elsif (! $cgiparams{'KEY'}) {
3413             my $disabled='';
3414             my $cakeydisabled='';
3415             my $cacrtdisabled='';
3416             if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cakeydisabled = "disabled='disabled'" } else { $cakeydisabled = "" };
3417             if ( ! -f "${General::swroot}/ovpn/ca/cacert.pem" ) { $cacrtdisabled = "disabled='disabled'" } else { $cacrtdisabled = "" };
3418             &Header::openbox('100%', 'LEFT', $Lang::tr{'authentication'});
3419
3420
3421  if ($cgiparams{'TYPE'} eq 'host') {
3422
3423 print <<END
3424             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3425
3426             <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td><td class='base'>$Lang::tr{'upload a certificate request'}</td><td class='base' rowspan='2'><input type='file' name='FH' size='30' $cacrtdisabled></td></tr>
3427             <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td><td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
3428             <tr><td colspan='3'>&nbsp;</td></tr>
3429       <tr><td colspan='3'><hr /></td></tr>
3430       <tr><td colspan='3'>&nbsp;</td></tr>
3431             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3432             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3433             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3434             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3435             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3436             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3437             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3438             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3439 END
3440 ;
3441
3442 ###
3443 # m.a.d net2net
3444 ###
3445
3446 } else {
3447
3448 print <<END
3449             <table width='100%' cellpadding='0' cellspacing='5' border='0'>
3450
3451             <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td><td class='base'>$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
3452             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users fullname or system hostname'}:</td><td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' SIZE='32' $cakeydisabled /></td></tr>
3453             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' SIZE='32' $cakeydisabled /></td></tr>
3454             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' SIZE='32' $cakeydisabled /></td></tr>
3455             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' SIZE='32' $cakeydisabled /></td></tr>
3456             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif'></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' SIZE='32' $cakeydisabled /></td></tr>
3457             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' /></td><td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' SIZE='32' $cakeydisabled /></td></tr>
3458             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'country'}:</td><td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
3459
3460
3461 END
3462 ;
3463
3464 }
3465
3466 ###
3467 # m.a.d net2net
3468 ###
3469
3470             foreach my $country (sort keys %{Countries::countries}) {
3471                 print "<option value='$Countries::countries{$country}'";
3472                 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
3473                     print " selected='selected'";
3474                 }
3475                 print ">$country</option>";
3476             }
3477 ###
3478 # m.a.d net2net
3479 ###
3480
3481 if ($cgiparams{'TYPE'} eq 'host') {
3482             print <<END
3483             </select></td></tr>
3484
3485         <td>&nbsp;</td><td class='base'>$Lang::tr{'valid till'} (days):</td>
3486         <td class='base' nowrap='nowrap'><input type='text' name='DAYS_VALID' value='$cgiparams{'DAYS_VALID'}' size='32' $cakeydisabled /></td></tr>
3487    <tr><td>&nbsp;</td>
3488                 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
3489                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
3490             <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:<BR>($Lang::tr{'confirmation'})</td>
3491                 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
3492      <tr><td colspan='3'>&nbsp;</td></tr>
3493      <tr><td colspan='3'><hr /></td></tr>
3494      <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
3495      </table>
3496 END
3497 }else{
3498             print <<END
3499             </select></td></tr>
3500    <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3501          <tr><td>&nbsp;</td><td>&nbsp;</td><td>&nbsp;</td></tr>
3502          <tr><td colspan='3'><hr /></td></tr>
3503          <tr><td class='base' colspan='3' align='left'><img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
3504        </table>
3505
3506 END
3507 }
3508
3509 ###
3510 # m.a.d net2net
3511 ###
3512             ;
3513             &Header::closebox();
3514         }
3515
3516         print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
3517         if ($cgiparams{'KEY'}) {
3518 #           print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
3519         }
3520         print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
3521         &Header::closebigbox();
3522         &Header::closepage();
3523         exit (0);
3524     }
3525     VPNCONF_END:
3526 }
3527
3528 #    SETTINGS_ERROR:
3529 ###
3530 ### Default status page
3531 ###
3532     %cgiparams = ();
3533     %cahash = ();
3534     %confighash = ();
3535     &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams);
3536     &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash);
3537     &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash);
3538
3539     my @status = `/bin/cat /var/log/ovpnserver.log`;
3540
3541     if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
3542         if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
3543             my $ipaddr = <IPADDR>;
3544             close IPADDR;
3545             chomp ($ipaddr);
3546             $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
3547             if ($cgiparams{'VPN_IP'} eq '') {
3548                 $cgiparams{'VPN_IP'} = $ipaddr;
3549             }
3550         }
3551     }
3552
3553 #default setzen
3554     if ($cgiparams{'DCIPHER'} eq '') {
3555         $cgiparams{'DCIPHER'} =  'BF-CBC';
3556     }
3557 #    if ($cgiparams{'DCOMPLZO'} eq '') {
3558 #       $cgiparams{'DCOMPLZO'} =  'on';
3559 #    }
3560     if ($cgiparams{'DDEST_PORT'} eq '') {
3561         $cgiparams{'DDEST_PORT'} =  '1194';
3562     }
3563     if ($cgiparams{'DMTU'} eq '') {
3564         $cgiparams{'DMTU'} =  '1400';
3565     }
3566     if ($cgiparams{'DOVPN_SUBNET'} eq '') {
3567         $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0';
3568     }
3569
3570     $checked{'ENABLED'}{'off'} = '';
3571     $checked{'ENABLED'}{'on'} = '';
3572     $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED';
3573     $checked{'ENABLED_BLUE'}{'off'} = '';
3574     $checked{'ENABLED_BLUE'}{'on'} = '';
3575     $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED';
3576     $checked{'ENABLED_ORANGE'}{'off'} = '';
3577     $checked{'ENABLED_ORANGE'}{'on'} = '';
3578     $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED';
3579     $selected{'DDEVICE'}{'tun'} = '';
3580     $selected{'DDEVICE'}{'tap'} = '';
3581     $selected{'DDEVICE'}{$cgiparams{'DDEVICE'}} = 'SELECTED';
3582
3583     $selected{'DPROTOCOL'}{'udp'} = '';
3584     $selected{'DPROTOCOL'}{'tcp'} = '';
3585     $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED';
3586
3587     $selected{'DCIPHER'}{'DES-CBC'} = '';
3588     $selected{'DCIPHER'}{'DES-EDE-CBC'} = '';
3589     $selected{'DCIPHER'}{'DES-EDE3-CBC'} = '';
3590     $selected{'DCIPHER'}{'DESX-CBC'} = '';
3591     $selected{'DCIPHER'}{'RC2-CBC'} = '';
3592     $selected{'DCIPHER'}{'RC2-40-CBC'} = '';
3593     $selected{'DCIPHER'}{'RC2-64-CBC'} = '';
3594     $selected{'DCIPHER'}{'BF-CBC'} = '';
3595     $selected{'DCIPHER'}{'CAST5-CBC'} = '';
3596     $selected{'DCIPHER'}{'AES-128-CBC'} = '';
3597     $selected{'DCIPHER'}{'AES-192-CBC'} = '';
3598     $selected{'DCIPHER'}{'AES-256-CBC'} = '';
3599     $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED';
3600     $checked{'DCOMPLZO'}{'off'} = '';
3601     $checked{'DCOMPLZO'}{'on'} = '';
3602     $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED';
3603 # m.a.d
3604     $checked{'MSSFIX'}{'off'} = '';
3605     $checked{'MSSFIX'}{'on'} = '';
3606     $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED';
3607 #new settings
3608     &Header::showhttpheaders();
3609     &Header::openpage($Lang::tr{'status ovpn'}, 1, '');
3610     &Header::openbigbox('100%', 'LEFT', '', $errormessage);
3611
3612     if ($errormessage) {
3613         &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
3614         print "<class name='base'>$errormessage\n";
3615         print "&nbsp;</class>\n";
3616         &Header::closebox();
3617     }
3618
3619     my $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'stopped'}</font></b></td></tr></table>";
3620     my $srunning = "no";
3621     my $activeonrun = "";
3622     if ( -e "/var/run/openvpn.pid"){
3623         $sactive = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='50%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'running'}</font></b></td></tr></table>";
3624         $srunning ="yes";
3625         $activeonrun = "";
3626     } else {
3627         $activeonrun = "disabled='disabled'";
3628     }
3629     &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'});
3630     print <<END
3631     <table width='100%'>
3632     <form method='post'>
3633     <td width='25%'>&nbsp;</td>
3634     <td width='25%'>&nbsp;</td>
3635     <td width='25%'>&nbsp;</td></tr>
3636     <tr><td class='boldbase'>$Lang::tr{'ovpn server status'}</td>
3637     <td align='left'>$sactive</td>
3638     <tr><td class='boldbase'>$Lang::tr{'ovpn on red'}</td>
3639         <td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td>
3640 END
3641 ;
3642     if (&haveBlueNet()) {
3643         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on blue'}</td>";
3644         print "<td><input type='checkbox' name='ENABLED_BLUE' $checked{'ENABLED_BLUE'}{'on'} /></td>";
3645     }
3646     if (&haveOrangeNet()) {
3647         print "<tr><td class='boldbase'>$Lang::tr{'ovpn on orange'}</td>";
3648         print "<td><input type='checkbox' name='ENABLED_ORANGE' $checked{'ENABLED_ORANGE'}{'on'} /></td>";
3649     }
3650     print <<END
3651     <tr><td class='base' nowrap='nowrap' colspan='2'>$Lang::tr{'local vpn hostname/ip'}:<br /><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' size='30' /></td>
3652         <td class='boldbase' nowrap='nowrap' colspan='2'>$Lang::tr{'ovpn subnet'}<br /><input type='TEXT' name='DOVPN_SUBNET' value='$cgiparams{'DOVPN_SUBNET'}' size='30' /></td></tr>
3653     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'ovpn device'}</td>
3654         <td><select name='DDEVICE' ><option value='tun' $selected{'DDEVICE'}{'tun'}>TUN</option>
3655                                 <!-- this is still not working
3656                                     <option value='tap' $selected{'DDEVICE'}{'tap'}>TAP</option></select>--> </td>
3657     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'protocol'}</td>
3658         <td><select name='DPROTOCOL'><option value='udp' $selected{'DPROTOCOL'}{'udp'}>UDP</option>
3659                                     <option value='tcp' $selected{'DPROTOCOL'}{'tcp'}>TCP</option></select></td>
3660         <td class='boldbase'>$Lang::tr{'destination port'}:</td>
3661         <td><input type='TEXT' name='DDEST_PORT' value='$cgiparams{'DDEST_PORT'}' size='5' /></td></tr>
3662     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'MTU'}&nbsp;</td>
3663         <td> <input type='TEXT' name='DMTU' VALUE='$cgiparams{'DMTU'}'size='5' /></TD>
3664     <tr><td class='boldbase' nowrap='nowrap'>$Lang::tr{'comp-lzo'}</td>
3665         <td><input type='checkbox' name='DCOMPLZO' $checked{'DCOMPLZO'}{'on'} /></td>
3666         <td class='boldbase' nowrap='nowrap'>$Lang::tr{'cipher'}</td>
3667         <td><select name='DCIPHER'><option value='DES-CBC' $selected{'DCIPHER'}{'DES-CBC'}>DES-CBC</option>
3668                                    <option value='DES-EDE-CBC' $selected{'DCIPHER'}{'DES-EDE-CBC'}>DES-EDE-CBC</option>
3669                                    <option value='DES-EDE3-CBC' $selected{'DCIPHER'}{'DES-EDE3-CBC'}>DES-EDE3-CBC</option>
3670                                    <option value='DESX-CBC' $selected{'DCIPHER'}{'DESX-CBC'}>DESX-CBC</option>
3671                                    <option value='RC2-CBC' $selected{'DCIPHER'}{'RC2-CBC'}>RC2-CBC</option>
3672                                    <option value='RC2-40-CBC' $selected{'DCIPHER'}{'RC2-40-CBC'}>RC2-40-CBC</option>
3673                                    <option value='RC2-64-CBC' $selected{'DCIPHER'}{'RC2-64-CBC'}>RC2-64-CBC</option>
3674                                    <option value='BF-CBC' $selected{'DCIPHER'}{'BF-CBC'}>BF-CBC</option>
3675                                    <option value='CAST5-CBC' $selected{'DCIPHER'}{'CAST5-CBC'}>CAST5-CBC</option>
3676                                    <option value='AES-128-CBC' $selected{'DCIPHER'}{'AES-128-CBC'}>AES-128-CBC</option>
3677                                    <option value='AES-192-CBC' $selected{'DCIPHER'}{'AES-192-CBC'}>AES-192-CBC</option>
3678                                    <option value='AES-256-CBC' $selected{'DCIPHER'}{'AES-256-CBC'}>AES-256-CBC</option></select></td>
3679 END
3680 ;
3681
3682     if ( $srunning eq "yes" ) {
3683         print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' disabled='disabled' /></td>";
3684         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' disabled='disabled'/></td>";
3685         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'stop ovpn server'}' /></td>";
3686         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3687     } else{
3688         print "<tr><td align='left'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>";
3689         print "<td><input type='submit' name='ACTION' value='$Lang::tr{'advanced server'}' /></td>";
3690         if (( -e "${General::swroot}/ovpn/ca/cacert.pem" &&
3691              -e "${General::swroot}/ovpn/ca/dh1024.pem" &&
3692              -e "${General::swroot}/ovpn/certs/servercert.pem" &&
3693              -e "${General::swroot}/ovpn/certs/serverkey.pem") &&
3694             (( $cgiparams{'ENABLED'} eq 'on') ||
3695             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3696             ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){
3697             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' /></td>";
3698             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' /></td></tr>";
3699         } else {
3700             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'start ovpn server'}' disabled='disabled' /></td>";
3701             print "<td><input type='submit' name='ACTION' value='$Lang::tr{'restart ovpn server'}' disabled='disabled' /></td></tr>";
3702         }
3703     }
3704     print "</form></table>";
3705     &Header::closebox();
3706     &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}:");
3707     print <<EOF#'
3708     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3709     <tr>
3710         <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3711         <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
3712         <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
3713     </tr>
3714 EOF
3715     ;
3716     if (-f "${General::swroot}/ovpn/ca/cacert.pem") {
3717         my $casubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/ca/cacert.pem`;
3718         $casubject    =~ /Subject: (.*)[\n]/;
3719         $casubject    = $1;
3720         $casubject    =~ s+/Email+, E+;
3721         $casubject    =~ s/ ST=/ S=/;
3722
3723         print <<END
3724         <tr bgcolor='$color{'color22'}'>
3725         <td class='base'>$Lang::tr{'root certificate'}</td>
3726         <td class='base'>$casubject</td>
3727         <form method='post' name='frmrootcrta'><td width='3%' align='center'>
3728             <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
3729             <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' width='20' height='20' border='0' />
3730         </td></form>
3731         <form method='post' name='frmrootcrtb'><td width='3%' align='center'>
3732             <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' border='0' />
3733             <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
3734         </td></form>
3735         <td width='4%'>&nbsp;</td></tr>
3736 END
3737         ;
3738     } else {
3739         # display rootcert generation buttons
3740         print <<END
3741         <tr bgcolor='$color{'color22'}'>
3742         <td class='base'>$Lang::tr{'root certificate'}:</td>
3743         <td class='base'>$Lang::tr{'not present'}</td>
3744         <td colspan='3'>&nbsp;</td></tr>
3745 END
3746         ;
3747     }
3748
3749     if (-f "${General::swroot}/ovpn/certs/servercert.pem") {
3750         my $hostsubject = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
3751         $hostsubject    =~ /Subject: (.*)[\n]/;
3752         $hostsubject    = $1;
3753         $hostsubject    =~ s+/Email+, E+;
3754         $hostsubject    =~ s/ ST=/ S=/;
3755
3756         print <<END
3757         <tr bgcolor='$color{'color20'}'>
3758         <td class='base'>$Lang::tr{'host certificate'}</td>
3759         <td class='base'>$hostsubject</td>
3760         <form method='post' name='frmhostcrta'><td width='3%' align='center'>
3761             <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
3762             <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' width='20' height='20' border='0' />
3763         </td></form>
3764         <form method='post' name='frmhostcrtb'><td width='3%' align='center'>
3765             <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' border='0' />
3766             <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
3767         </td></form>
3768         <td width='4%'>&nbsp;</td></tr>
3769 END
3770         ;
3771     } else {
3772         # Nothing
3773         print <<END
3774         <tr bgcolor='$color{'color20'}'>
3775         <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
3776         <td class='base'>$Lang::tr{'not present'}</td>
3777         </td><td colspan='3'>&nbsp;</td></tr>
3778 END
3779         ;
3780     }
3781
3782     if (! -f "${General::swroot}/ovpn/ca/cacert.pem") {
3783         print "<tr><td colspan='5' align='center'><form method='post'>";
3784         print "<input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' />";
3785         print "</form></td></tr>\n";
3786     }
3787
3788     if (keys %cahash > 0) {
3789         foreach my $key (keys %cahash) {
3790             if (($key + 1) % 2) {
3791                 print "<tr bgcolor='$color{'color20'}'>\n";
3792             } else {
3793                 print "<tr bgcolor='$color{'color22'}'>\n";
3794             }
3795             print "<td class='base'>$cahash{$key}[0]</td>\n";
3796             print "<td class='base'>$cahash{$key}[1]</td>\n";
3797             print <<END
3798             <form method='post' name='cafrm${key}a'><td align='center'>
3799                 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' border='0' />
3800                 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
3801                 <input type='hidden' name='KEY' value='$key' />
3802             </td></form>
3803             <form method='post' name='cafrm${key}b'><td align='center'>
3804                 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' border='0' />
3805                 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
3806                 <input type='hidden' name='KEY' value='$key' />
3807             </td></form>
3808             <form method='post' name='cafrm${key}c'><td align='center'>
3809                 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
3810                 <input type='image'  name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' width='20' height='20' border='0' />
3811                 <input type='hidden' name='KEY' value='$key' />
3812             </td></form></tr>
3813 END
3814             ;
3815         }
3816     }
3817
3818     print "</table>";
3819
3820     # If the file contains entries, print Key to action icons
3821     if ( -f "${General::swroot}/ovpn/ca/cacert.pem") {
3822     print <<END
3823     <table>
3824     <tr>
3825         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
3826         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
3827         <td class='base'>$Lang::tr{'show certificate'}</td>
3828         <td>&nbsp; &nbsp; <img src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' /></td>
3829         <td class='base'>$Lang::tr{'download certificate'}</td>
3830     </tr>
3831     </table>
3832 END
3833     ;
3834     }
3835     print <<END
3836     <form method='post' enctype='multipart/form-data'>
3837     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3838     <tr><td class='base' nowrap='nowrap'>$Lang::tr{'ca name'}:</td>
3839     <td nowrap='nowrap'><input type='text' name='CA_NAME' value='$cgiparams{'CA_NAME'}' size='15' />
3840     <td nowrap='nowrap'><input type='file' name='FH' size='30' /></td>
3841     <td nowrap='nowrap'><input type='submit' name='ACTION' value='$Lang::tr{'upload ca certificate'}' /><br /><input type='submit' name='ACTION' value='$Lang::tr{'show crl'}' /></td>
3842     </tr></table></form>
3843 END
3844     ;
3845
3846     &Header::closebox();
3847     if ( $srunning eq "yes" ) {
3848         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' disabled='disabled' /></div></form>\n";
3849     }else{
3850         print "<div align='center'><form method='post'><input type='submit' name='ACTION' value='$Lang::tr{'reset'}' /></div></form>\n";
3851     }
3852     if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) {
3853
3854 ###
3855 # m.a.d net2net
3856 #<td width='25%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b><br /><img src='/images/null.gif' width='125' height='1' border='0' alt='L2089' /></td>
3857 ###
3858
3859     &Header::openbox('100%', 'LEFT', $Lang::tr{'Client status and controlc' });
3860     print <<END
3861
3862
3863     <table width='100%' border='0' cellspacing='1' cellpadding='0'>
3864 <tr>
3865     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
3866     <td width='15%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
3867     <td width='18%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></td>
3868     <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'valid till'}</b></td>
3869     <td width='20%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
3870     <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
3871     <td width='5%' class='boldbase' colspan='6' align='center'><b>$Lang::tr{'action'}</b></td>
3872 </tr>
3873 END
3874         ;
3875         my $id = 0;
3876         my $gif;
3877          foreach my $key (sort { uc($confighash{$a}[1]) cmp uc($confighash{$b}[1]) } keys %confighash) {
3878         if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
3879
3880         if ($id % 2) {
3881             print "<tr bgcolor='$color{'color20'}'>\n";
3882         } else {
3883             print "<tr bgcolor='$color{'color22'}'>\n";
3884         }
3885         print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
3886         print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")</td>";
3887         if ($confighash{$key}[4] eq 'cert') {
3888             print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
3889         } else {
3890             print "<td align='left'>&nbsp;</td>";
3891         }
3892         my $cavalid = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem`;
3893         $cavalid    =~ /Not After : (.*)[\n]/;
3894         $cavalid    = $1;
3895         print "<td align='center'>$cavalid</td>";
3896         print "<td align='center'>$confighash{$key}[25]</td>";
3897
3898         my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3899
3900         if ($confighash{$key}[0] eq 'off') {
3901          $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
3902         } else {
3903
3904 ###
3905 # m.a.d net2net
3906 ###
3907
3908        if ($confighash{$key}[3] eq 'net') {
3909
3910         if (-e "/var/run/$confighash{$key}[1]n2n.pid") {
3911           my @output = "";
3912           my @tustate = "";
3913           my $tport = $confighash{$key}[22];
3914           my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport);
3915           if ($tport ne '') {
3916           $tnet->open('127.0.0.1');
3917           @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/');
3918           @tustate = split(/\,/, $output[1]);
3919 ###
3920 #CONNECTING    -- OpenVPN's initial state.
3921 #WAIT          -- (Client only) Waiting for initial response from server.
3922 #AUTH          -- (Client only) Authenticating with server.
3923 #GET_CONFIG    -- (Client only) Downloading configuration options from server.
3924 #ASSIGN_IP     -- Assigning IP address to virtual network interface.
3925 #ADD_ROUTES    -- Adding routes to system.
3926 #CONNECTED     -- Initialization Sequence Completed.
3927 #RECONNECTING  -- A restart has occurred.
3928 #EXITING       -- A graceful exit is in progress.
3929 ####
3930
3931         if ( $tustate[1] eq 'CONNECTED') {
3932           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></tr></td></table>";
3933                           } else {
3934           $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$tustate[1]</font></b></td></tr></table>";
3935            }
3936            }
3937            }
3938         }       else {
3939
3940                 my $cn;
3941             my @match = ();
3942           foreach my $line (@status) {
3943                 chomp($line);
3944                 if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) {
3945                     @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line);
3946                     if ($match[1] ne "Common Name") {
3947                         $cn = $match[1];
3948                     }
3949                 $cn =~ s/[_]/ /g;
3950                     if ($cn eq "$confighash{$key}[2]") {
3951                         $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
3952                     }
3953    }
3954
3955         }
3956 }
3957 }
3958
3959
3960         my $disable_clientdl = "disabled='disabled'";
3961         if (( $cgiparams{'ENABLED'} eq 'on') ||
3962             ( $cgiparams{'ENABLED_BLUE'} eq 'on') ||
3963             ( $cgiparams{'ENABLED_ORANGE'} eq 'on')){
3964             $disable_clientdl = "";
3965         }
3966         print <<END
3967         <td align='center'>$active</td>
3968
3969         <form method='post' name='frm${key}a'><td align='center'>
3970             <input type='image'  name='$Lang::tr{'dl client arch'}' $disable_clientdl src='/images/openvpn.png' alt='$Lang::tr{'dl client arch'}' title='$Lang::tr{'dl client arch'}' border='0' />
3971             <input type='hidden' name='ACTION' value='$Lang::tr{'dl client arch'}' $disable_clientdl />
3972             <input type='hidden' name='KEY' value='$key' $disable_clientdl />
3973         </td></form>
3974 END
3975         ;
3976         if ($confighash{$key}[4] eq 'cert') {
3977             print <<END
3978             <form method='post' name='frm${key}b'><td align='center'>
3979                 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' border='0' />
3980                 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
3981                 <input type='hidden' name='KEY' value='$key' />
3982             </td></form>
3983 END
3984         ; } else {
3985             print "<td>&nbsp;</td>";
3986         }
3987         if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") {
3988             print <<END
3989             <form method='post' name='frm${key}c'><td align='center'>
3990                 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/media-floppy.png' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' border='0' />
3991                 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
3992                 <input type='hidden' name='KEY' value='$key' />
3993             </td></form>
3994 END
3995         ; } elsif ($confighash{$key}[4] eq 'cert') {
3996             print <<END
3997             <form method='post' name='frm${key}c'><td align='center'>
3998                 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/media-floppy.png' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' border='0' />
3999                 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
4000                 <input type='hidden' name='KEY' value='$key' />
4001             </td></form>
4002 END
4003         ; } else {
4004             print "<td>&nbsp;</td>";
4005         }
4006         print <<END
4007         <form method='post' name='frm${key}d'><td align='center'>
4008             <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' border='0' />
4009             <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
4010             <input type='hidden' name='KEY' value='$key' />
4011         </td></form>
4012
4013         <form method='post' name='frm${key}e'><td align='center'>
4014             <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
4015             <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' width='20' height='20' border='0'/>
4016             <input type='hidden' name='KEY' value='$key' />
4017         </td></form>
4018         <form method='post' name='frm${key}f'><td align='center'>
4019             <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
4020             <input type='image'  name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' width='20' height='20' border='0' />
4021             <input type='hidden' name='KEY' value='$key' />
4022         </td></form>
4023         </tr>
4024 END
4025         ;
4026         $id++;
4027     }
4028     ;
4029
4030     # If the config file contains entries, print Key to action icons
4031     if ( $id ) {
4032     print <<END
4033     <table>
4034     <tr>
4035         <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
4036         <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
4037         <td class='base'>$Lang::tr{'click to disable'}</td>
4038         <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
4039         <td class='base'>$Lang::tr{'show certificate'}</td>
4040         <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
4041         <td class='base'>$Lang::tr{'edit'}</td>
4042         <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
4043         <td class='base'>$Lang::tr{'remove'}</td>
4044     </tr>
4045     <tr>
4046         <td>&nbsp; </td>
4047         <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
4048         <td class='base'>$Lang::tr{'click to enable'}</td>
4049         <td> <img src='/images/media-floppy.png' alt='?FLOPPY' /></td>
4050         <td class='base'>$Lang::tr{'download certificate'}</td>
4051         <td> <img src='/images/openvpn.png' alt='?RELOAD'/></td>
4052         <td class='base'>$Lang::tr{'dl client arch'}</td>
4053     </tr>
4054     </table>
4055 END
4056     ;
4057     }
4058
4059     print <<END
4060     <table width='100%'>
4061     <form method='post'>
4062     <tr><td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
4063         <td width='50%' ><input type='submit' name='ACTION' value='$Lang::tr{'ovpn con stat'}' $activeonrun /></td></tr>
4064     </form>
4065     </table>
4066 END
4067     ;
4068     &Header::closebox();
4069 }
4070 &Header::closepage();
4071
4072
4073