IPsec: Fix and enhance DPD configuration.
[people/teissler/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2013 IPFire Team info@ipfire.org #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21
22 use Net::DNS;
23 use File::Copy;
24 use File::Temp qw/ tempfile tempdir /;
25 use strict;
26 use Sort::Naturally;
27 # enable only the following on debugging purpose
28 #use warnings;
29 #use CGI::Carp 'fatalsToBrowser';
30
31 require '/var/ipfire/general-functions.pl';
32 require "${General::swroot}/lang.pl";
33 require "${General::swroot}/header.pl";
34 require "${General::swroot}/countries.pl";
35
36 #workaround to suppress a warning when a variable is used only once
37 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
38 undef (@dummy);
39
40 ###
41 ### Initialize variables
42 ###
43 my $sleepDelay = 4; # after a call to ipsecctrl S or R, wait this delay (seconds) before reading status
44 # (let the ipsec do its job)
45 my %netsettings=();
46 our %cgiparams=();
47 our %vpnsettings=();
48 my %checked=();
49 my %confighash=();
50 my %cahash=();
51 my %selected=();
52 my $warnmessage = '';
53 my $errormessage = '';
54
55 my %color = ();
56 my %mainsettings = ();
57 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
58 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
59
60 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
61
62 my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}");
63 my $blue_cidr = "# Blue not defined";
64 if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
65 $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}");
66 }
67 my $orange_cidr = "# Orange not defined";
68 if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
69 $orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}");
70 }
71
72 $cgiparams{'ENABLED'} = 'off';
73 $cgiparams{'EDIT_ADVANCED'} = 'off';
74 $cgiparams{'ACTION'} = '';
75 $cgiparams{'CA_NAME'} = '';
76 $cgiparams{'KEY'} = '';
77 $cgiparams{'TYPE'} = '';
78 $cgiparams{'ADVANCED'} = '';
79 $cgiparams{'NAME'} = '';
80 $cgiparams{'LOCAL_SUBNET'} = '';
81 $cgiparams{'REMOTE_SUBNET'} = '';
82 $cgiparams{'REMOTE'} = '';
83 $cgiparams{'LOCAL_ID'} = '';
84 $cgiparams{'REMOTE_ID'} = '';
85 $cgiparams{'REMARK'} = '';
86 $cgiparams{'PSK'} = '';
87 $cgiparams{'CERT_NAME'} = '';
88 $cgiparams{'CERT_EMAIL'} = '';
89 $cgiparams{'CERT_OU'} = '';
90 $cgiparams{'CERT_ORGANIZATION'} = '';
91 $cgiparams{'CERT_CITY'} = '';
92 $cgiparams{'CERT_STATE'} = '';
93 $cgiparams{'CERT_COUNTRY'} = '';
94 $cgiparams{'SUBJECTALTNAME'} = '';
95 $cgiparams{'CERT_PASS1'} = '';
96 $cgiparams{'CERT_PASS2'} = '';
97 $cgiparams{'ROOTCERT_HOSTNAME'} = '';
98 $cgiparams{'ROOTCERT_COUNTRY'} = '';
99 $cgiparams{'P12_PASS'} = '';
100 $cgiparams{'ROOTCERT_ORGANIZATION'} = '';
101 $cgiparams{'ROOTCERT_HOSTNAME'} = '';
102 $cgiparams{'ROOTCERT_EMAIL'} = '';
103 $cgiparams{'ROOTCERT_OU'} = '';
104 $cgiparams{'ROOTCERT_CITY'} = '';
105 $cgiparams{'ROOTCERT_STATE'} = '';
106 $cgiparams{'RW_NET'} = '';
107 $cgiparams{'DPD_DELAY'} = '30';
108 $cgiparams{'DPD_TIMEOUT'} = '120';
109 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
110
111 ###
112 ### Useful functions
113 ###
114 sub valid_dns_host {
115 my $hostname = $_[0];
116 unless ($hostname) { return "No hostname"};
117 my $res = new Net::DNS::Resolver;
118 my $query = $res->search("$hostname");
119 if ($query) {
120 foreach my $rr ($query->answer) {
121 ## Potential bug - we are only looking at A records:
122 return 0 if $rr->type eq "A";
123 }
124 } else {
125 return $res->errorstring;
126 }
127 }
128 ###
129 ### Just return true is one interface is vpn enabled
130 ###
131 sub vpnenabled {
132 return ($vpnsettings{'ENABLED'} eq 'on');
133 }
134 ###
135 ### old version: maintain serial number to one, without explication.
136 ### this : let the counter go, so that each cert is numbered.
137 ###
138 sub cleanssldatabase
139 {
140 if (open(FILE, ">${General::swroot}/certs/serial")) {
141 print FILE "01";
142 close FILE;
143 }
144 if (open(FILE, ">${General::swroot}/certs/index.txt")) {
145 print FILE "";
146 close FILE;
147 }
148 unlink ("${General::swroot}/certs/index.txt.old");
149 unlink ("${General::swroot}/certs/serial.old");
150 unlink ("${General::swroot}/certs/01.pem");
151 }
152 sub newcleanssldatabase
153 {
154 if (! -s "${General::swroot}/certs/serial" ) {
155 open(FILE, ">${General::swroot}/certs/serial");
156 print FILE "01";
157 close FILE;
158 }
159 if (! -s ">${General::swroot}/certs/index.txt") {
160 system ("touch ${General::swroot}/certs/index.txt");
161 }
162 unlink ("${General::swroot}/certs/index.txt.old");
163 unlink ("${General::swroot}/certs/serial.old");
164 # unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete
165 }
166
167 ###
168 ### Call openssl and return errormessage if any
169 ###
170 sub callssl ($) {
171 my $opt = shift;
172 my $retssl = `/usr/bin/openssl $opt 2>&1`; #redirect stderr
173 my $ret = '';
174 foreach my $line (split (/\n/, $retssl)) {
175 &General::log("ipsec", "$line") if (0); # 1 for verbose logging
176 $ret .= '<br>'.$line if ( $line =~ /error|unknown/ );
177 }
178 if ($ret) {
179 $ret= &Header::cleanhtml($ret);
180 }
181 return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ;
182 }
183 ###
184 ### Obtain a CN from given cert
185 ###
186 sub getCNfromcert ($) {
187 #&General::log("ipsec", "Extracting name from $_[0]...");
188 my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
189 $temp =~ /Subject:.*CN=(.*)[\n]/;
190 $temp = $1;
191 $temp =~ s+/Email+, E+;
192 $temp =~ s/ ST=/ S=/;
193 $temp =~ s/,//g;
194 $temp =~ s/\'//g;
195 return $temp;
196 }
197 ###
198 ### Obtain Subject from given cert
199 ###
200 sub getsubjectfromcert ($) {
201 #&General::log("ipsec", "Extracting subject from $_[0]...");
202 my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
203 $temp =~ /Subject: (.*)[\n]/;
204 $temp = $1;
205 $temp =~ s+/Email+, E+;
206 $temp =~ s/ ST=/ S=/;
207 return $temp;
208 }
209 ###
210 ### Combine local subnet and connection name to make a unique name for each connection section
211 ### (this sub is not used now)
212 ###
213 sub makeconnname ($) {
214 my $conn = shift;
215 my $subnet = shift;
216
217 $subnet =~ /^(.*?)\/(.*?)$/; # $1=IP $2=mask
218 my $ip = unpack('N', &Socket::inet_aton($1));
219 if (length ($2) > 2) {
220 my $mm = unpack('N', &Socket::inet_aton($2));
221 while ( ($mm & 1)==0 ) {
222 $ip >>= 1;
223 $mm >>= 1;
224 };
225 } else {
226 $ip >>= (32 - $2);
227 }
228 return sprintf ("%s-%X", $conn, $ip);
229 }
230 ###
231 ### Write a config file.
232 ###
233 ###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and
234 ### the side is always defined as 'left'.
235 ### configihash[14]: 'VHOST' is allowed
236 ###
237
238 sub writeipsecfiles {
239 my %lconfighash = ();
240 my %lvpnsettings = ();
241 &General::readhasharray("${General::swroot}/vpn/config", \%lconfighash);
242 &General::readhash("${General::swroot}/vpn/settings", \%lvpnsettings);
243
244 open(CONF, ">${General::swroot}/vpn/ipsec.conf") or die "Unable to open ${General::swroot}/vpn/ipsec.conf: $!";
245 open(SECRETS, ">${General::swroot}/vpn/ipsec.secrets") or die "Unable to open ${General::swroot}/vpn/ipsec.secrets: $!";
246 flock CONF, 2;
247 flock SECRETS, 2;
248 print CONF "version 2\n\n";
249 print CONF "conn %default\n";
250 print CONF "\tkeyingtries=%forever\n";
251 print CONF "\n";
252
253 # Add user includes to config file
254 print CONF "include /etc/ipsec.user.conf\n";
255 print CONF "\n";
256
257 print SECRETS "include /etc/ipsec.user.secrets\n";
258
259 if (-f "${General::swroot}/certs/hostkey.pem") {
260 print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n"
261 }
262 my $last_secrets = ''; # old the less specifics connections
263
264 foreach my $key (keys %lconfighash) {
265 next if ($lconfighash{$key}[0] ne 'on');
266
267 #remote peer is not set? => use '%any'
268 $lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq '');
269
270 my $localside;
271 if ($lconfighash{$key}[26] eq 'BLUE') {
272 $localside = $netsettings{'BLUE_ADDRESS'};
273 } elsif ($lconfighash{$key}[26] eq 'GREEN') {
274 $localside = $netsettings{'GREEN_ADDRESS'};
275 } elsif ($lconfighash{$key}[26] eq 'ORANGE') {
276 $localside = $netsettings{'ORANGE_ADDRESS'};
277 } else { # it is RED
278 $localside = $lvpnsettings{'VPN_IP'};
279 }
280
281 print CONF "conn $lconfighash{$key}[1]\n";
282 print CONF "\tleft=$localside\n";
283 my $cidr_net=&General::ipcidr($lconfighash{$key}[8]);
284 print CONF "\tleftsubnet=$cidr_net\n";
285 print CONF "\tleftfirewall=yes\n";
286 print CONF "\tlefthostaccess=yes\n";
287
288 print CONF "\tright=$lconfighash{$key}[10]\n";
289 if ($lconfighash{$key}[3] eq 'net') {
290 my $cidr_net=&General::ipcidr($lconfighash{$key}[11]);
291 print CONF "\trightsubnet=$cidr_net\n";
292 } elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed for roadwarriors?
293 print CONF "\trightsubnet=vhost:%no,%priv\n";
294 }
295
296 # Local Cert and Remote Cert (unless auth is DN dn-auth)
297 if ($lconfighash{$key}[4] eq 'cert') {
298 print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n";
299 print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn');
300 }
301
302 # Local and Remote IDs
303 print CONF "\tleftid=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]);
304 print CONF "\trightid=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]);
305
306 # Is PFS enabled?
307 my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
308
309 # Algorithms
310 if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) {
311 print CONF "\tike=";
312 my @encs = split('\|', $lconfighash{$key}[18]);
313 my @ints = split('\|', $lconfighash{$key}[19]);
314 my @groups = split('\|', $lconfighash{$key}[20]);
315 my $comma = 0;
316 foreach my $i (@encs) {
317 foreach my $j (@ints) {
318 foreach my $k (@groups) {
319 if ($comma != 0) { print CONF ","; } else { $comma = 1; }
320
321 my @l = split("", $k);
322 if ($l[0] eq "e") {
323 shift @l;
324 print CONF "$i-$j-ecp".join("", @l);
325 } else {
326 print CONF "$i-$j-modp$k";
327 }
328 }
329 }
330 }
331 if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
332 print CONF "!\n";
333 } else {
334 print CONF "\n";
335 }
336 }
337 if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
338 print CONF "\tesp=";
339 my @encs = split('\|', $lconfighash{$key}[21]);
340 my @ints = split('\|', $lconfighash{$key}[22]);
341 my @groups = split('\|', $lconfighash{$key}[20]);
342 my $comma = 0;
343 foreach my $i (@encs) {
344 foreach my $j (@ints) {
345 my $modp = "";
346 if ($pfs eq "on") {
347 foreach my $k (@groups) {
348 if ($comma != 0) { print CONF ","; } else { $comma = 1; }
349 if ($pfs eq "on") {
350 my @l = split("", $k);
351 if ($l[0] eq "e") {
352 $modp = "";
353 } else {
354 $modp = "-modp$k";
355 }
356 } else {
357 $modp = "";
358 }
359 print CONF "$i-$j$modp";
360 }
361 } else {
362 if ($comma != 0) { print CONF ","; } else { $comma = 1; }
363 print CONF "$i-$j";
364 }
365 }
366 }
367 if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
368 print CONF "!\n";
369 } else {
370 print CONF "\n";
371 }
372 }
373
374 # IKE V1 or V2
375 if (! $lconfighash{$key}[29]) {
376 $lconfighash{$key}[29] = "ikev1";
377 }
378 print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
379
380 # Lifetimes
381 print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
382 print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
383
384 # Compression
385 print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on');
386
387 # Dead Peer Detection
388 print CONF "\tdpdaction=$lconfighash{$key}[27]\n";
389
390 my $dpddelay = $lconfighash{$key}[30];
391 if (!$dpddelay) {
392 $dpddelay = 30;
393 }
394 print CONF "\tdpddelay=$dpddelay\n";
395 my $dpdtimeout = $lconfighash{$key}[31];
396 if (!$dpdtimeout) {
397 $dpdtimeout = 120;
398 }
399 print CONF "\tdpdtimeout=$dpdtimeout\n";
400
401 # Build Authentication details: LEFTid RIGHTid : PSK psk
402 my $psk_line;
403 if ($lconfighash{$key}[4] eq 'psk') {
404 $psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ;
405 $psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; #remoteid or remote address?
406 $psk_line .= " : PSK '$lconfighash{$key}[5]'\n";
407 # if the line contains %any, it is less specific than two IP or ID, so move it at end of file.
408 if ($psk_line =~ /%any/) {
409 $last_secrets .= $psk_line;
410 } else {
411 print SECRETS $psk_line;
412 }
413 print CONF "\tauthby=secret\n";
414 } else {
415 print CONF "\tauthby=rsasig\n";
416 print CONF "\tleftrsasigkey=%cert\n";
417 print CONF "\trightrsasigkey=%cert\n";
418 }
419
420 # Automatically start only if a net-to-net connection
421 if ($lconfighash{$key}[3] eq 'host') {
422 print CONF "\tauto=add\n";
423 print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n";
424 } else {
425 print CONF "\tauto=start\n";
426 }
427 print CONF "\n";
428 }#foreach key
429 print SECRETS $last_secrets if ($last_secrets);
430 close(CONF);
431 close(SECRETS);
432 }
433
434 # Hook to regenerate the configuration files.
435 if ($ENV{"REMOTE_ADDR"} eq "") {
436 writeipsecfiles();
437 exit(0);
438 }
439
440 ###
441 ### Save main settings
442 ###
443 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
444 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
445 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})
446 || $cgiparams{'VPN_IP'} eq '%defaultroute' ) {
447 $errormessage = $Lang::tr{'invalid input for hostname'};
448 goto SAVE_ERROR;
449 }
450
451 unless ($cgiparams{'VPN_DELAYED_START'} =~ /^[0-9]{1,3}$/ ) { #allow 0-999 seconds !
452 $errormessage = $Lang::tr{'invalid time period'};
453 goto SAVE_ERROR;
454 }
455
456 if ( $cgiparams{'RW_NET'} ne '' and !&General::validipandmask($cgiparams{'RW_NET'}) ) {
457 $errormessage = $Lang::tr{'urlfilter invalid ip or mask error'};
458 goto SAVE_ERROR;
459 }
460
461 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
462 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
463 $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'};
464 $vpnsettings{'RW_NET'} = $cgiparams{'RW_NET'};
465 &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
466 &writeipsecfiles();
467 if (&vpnenabled) {
468 system('/usr/local/bin/ipsecctrl', 'S');
469 } else {
470 system('/usr/local/bin/ipsecctrl', 'D');
471 }
472 sleep $sleepDelay;
473 SAVE_ERROR:
474 ###
475 ### Reset all step 2
476 ###
477 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
478 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
479
480 foreach my $key (keys %confighash) {
481 if ($confighash{$key}[4] eq 'cert') {
482 delete $confighash{$key};
483 }
484 }
485 while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) {
486 unlink $file
487 }
488 &cleanssldatabase();
489 if (open(FILE, ">${General::swroot}/vpn/caconfig")) {
490 print FILE "";
491 close FILE;
492 }
493 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
494 &writeipsecfiles();
495 system('/usr/local/bin/ipsecctrl', 'R');
496 sleep $sleepDelay;
497
498 ###
499 ### Reset all step 1
500 ###
501 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
502 &Header::showhttpheaders();
503 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
504 &Header::openbigbox('100%', 'left', '', '');
505 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
506 print <<END
507 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
508 <table width='100%'>
509 <tr>
510 <td align='center'>
511 <input type='hidden' name='AREUSURE' value='yes' />
512 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
513 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
514 </tr><tr>
515 <td align='center'>
516 <input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
517 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
518 </tr>
519 </table>
520 </form>
521 END
522 ;
523 &Header::closebox();
524 &Header::closebigbox();
525 &Header::closepage();
526 exit (0);
527
528 ###
529 ### Upload CA Certificate
530 ###
531 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
532 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
533
534 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
535 $errormessage = $Lang::tr{'name must only contain characters'};
536 goto UPLOADCA_ERROR;
537 }
538
539 if (length($cgiparams{'CA_NAME'}) >60) {
540 $errormessage = $Lang::tr{'name too long'};
541 goto VPNCONF_ERROR;
542 }
543
544 if ($cgiparams{'CA_NAME'} eq 'ca') {
545 $errormessage = $Lang::tr{'name is invalid'};
546 goto UPLOAD_CA_ERROR;
547 }
548
549 # Check if there is no other entry with this name
550 foreach my $key (keys %cahash) {
551 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
552 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
553 goto UPLOADCA_ERROR;
554 }
555 }
556
557 if (ref ($cgiparams{'FH'}) ne 'Fh') {
558 $errormessage = $Lang::tr{'there was no file upload'};
559 goto UPLOADCA_ERROR;
560 }
561 # Move uploaded ca to a temporary file
562 (my $fh, my $filename) = tempfile( );
563 if (copy ($cgiparams{'FH'}, $fh) != 1) {
564 $errormessage = $!;
565 goto UPLOADCA_ERROR;
566 }
567 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
568 if ($temp !~ /CA:TRUE/i) {
569 $errormessage = $Lang::tr{'not a valid ca certificate'};
570 unlink ($filename);
571 goto UPLOADCA_ERROR;
572 } else {
573 move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
574 if ($? ne 0) {
575 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
576 unlink ($filename);
577 goto UPLOADCA_ERROR;
578 }
579 }
580
581 my $key = &General::findhasharraykey (\%cahash);
582 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
583 $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
584 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
585
586 system('/usr/local/bin/ipsecctrl', 'R');
587 sleep $sleepDelay;
588
589 UPLOADCA_ERROR:
590
591 ###
592 ### Display ca certificate
593 ###
594 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
595 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
596
597 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
598 &Header::showhttpheaders();
599 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
600 &Header::openbigbox('100%', 'left', '', '');
601 &Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
602 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
603 $output = &Header::cleanhtml($output,"y");
604 print "<pre>$output</pre>\n";
605 &Header::closebox();
606 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
607 &Header::closebigbox();
608 &Header::closepage();
609 exit(0);
610 } else {
611 $errormessage = $Lang::tr{'invalid key'};
612 }
613
614 ###
615 ### Export ca certificate to browser
616 ###
617 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
618 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
619
620 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
621 print "Content-Type: application/force-download\n";
622 print "Content-Type: application/octet-stream\r\n";
623 print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
624 print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
625 exit(0);
626 } else {
627 $errormessage = $Lang::tr{'invalid key'};
628 }
629
630 ###
631 ### Remove ca certificate (step 2)
632 ###
633 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
634 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
635 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
636
637 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
638 foreach my $key (keys %confighash) {
639 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
640 if ($test =~ /: OK/) {
641 # Delete connection
642 system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
643 unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
644 unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
645 delete $confighash{$key};
646 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
647 &writeipsecfiles();
648 }
649 }
650 unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
651 delete $cahash{$cgiparams{'KEY'}};
652 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
653 system('/usr/local/bin/ipsecctrl', 'R');
654 sleep $sleepDelay;
655 } else {
656 $errormessage = $Lang::tr{'invalid key'};
657 }
658 ###
659 ### Remove ca certificate (step 1)
660 ###
661 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
662 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
663 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
664
665 my $assignedcerts = 0;
666 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
667 foreach my $key (keys %confighash) {
668 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
669 if ($test =~ /: OK/) {
670 $assignedcerts++;
671 }
672 }
673 if ($assignedcerts) {
674 &Header::showhttpheaders();
675 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
676 &Header::openbigbox('100%', 'left', '', '');
677 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
678 print <<END
679 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
680 <table width='100%'>
681 <tr>
682 <td align='center'>
683 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
684 <input type='hidden' name='AREUSURE' value='yes' /></td>
685 </tr><tr>
686 <td align='center'>
687 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>
688 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}</td>
689 </tr><tr>
690 <td align='center'>
691 <input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
692 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
693 </tr>
694 </table>
695 </form>
696 END
697 ;
698 &Header::closebox();
699 &Header::closebigbox();
700 &Header::closepage();
701 exit (0);
702 } else {
703 unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
704 delete $cahash{$cgiparams{'KEY'}};
705 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
706 system('/usr/local/bin/ipsecctrl', 'R');
707 sleep $sleepDelay;
708 }
709 } else {
710 $errormessage = $Lang::tr{'invalid key'};
711 }
712
713 ###
714 ### Display root certificate
715 ###
716 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
717 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
718 my $output;
719 &Header::showhttpheaders();
720 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
721 &Header::openbigbox('100%', 'left', '', '');
722 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
723 &Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
724 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
725 } else {
726 &Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
727 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
728 }
729 $output = &Header::cleanhtml($output,"y");
730 print "<pre>$output</pre>\n";
731 &Header::closebox();
732 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
733 &Header::closebigbox();
734 &Header::closepage();
735 exit(0);
736
737 ###
738 ### Export root certificate to browser
739 ###
740 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
741 if ( -f "${General::swroot}/ca/cacert.pem" ) {
742 print "Content-Type: application/force-download\n";
743 print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
744 print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
745 exit(0);
746 }
747 ###
748 ### Export host certificate to browser
749 ###
750 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
751 if ( -f "${General::swroot}/certs/hostcert.pem" ) {
752 print "Content-Type: application/force-download\n";
753 print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
754 print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
755 exit(0);
756 }
757 ###
758 ### Form for generating/importing the caroot+host certificate
759 ###
760 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
761 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
762
763 if (-f "${General::swroot}/ca/cacert.pem") {
764 $errormessage = $Lang::tr{'valid root certificate already exists'};
765 goto ROOTCERT_SKIP;
766 }
767
768 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
769 # fill in initial values
770 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
771 if (-e "${General::swroot}/red/active" && open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
772 my $ipaddr = <IPADDR>;
773 close IPADDR;
774 chomp ($ipaddr);
775 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
776 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
777 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
778 }
779 }
780 $cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
781 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
782 &General::log("ipsec", "Importing from p12...");
783
784 if (ref ($cgiparams{'FH'}) ne 'Fh') {
785 $errormessage = $Lang::tr{'there was no file upload'};
786 goto ROOTCERT_ERROR;
787 }
788
789 # Move uploaded certificate request to a temporary file
790 (my $fh, my $filename) = tempfile( );
791 if (copy ($cgiparams{'FH'}, $fh) != 1) {
792 $errormessage = $!;
793 goto ROOTCERT_ERROR;
794 }
795
796 # Extract the CA certificate from the file
797 &General::log("ipsec", "Extracting caroot from p12...");
798 if (open(STDIN, "-|")) {
799 my $opt = " pkcs12 -cacerts -nokeys";
800 $opt .= " -in $filename";
801 $opt .= " -out /tmp/newcacert";
802 $errormessage = &callssl ($opt);
803 } else { #child
804 print "$cgiparams{'P12_PASS'}\n";
805 exit (0);
806 }
807
808 # Extract the Host certificate from the file
809 if (!$errormessage) {
810 &General::log("ipsec", "Extracting host cert from p12...");
811 if (open(STDIN, "-|")) {
812 my $opt = " pkcs12 -clcerts -nokeys";
813 $opt .= " -in $filename";
814 $opt .= " -out /tmp/newhostcert";
815 $errormessage = &callssl ($opt);
816 } else { #child
817 print "$cgiparams{'P12_PASS'}\n";
818 exit (0);
819 }
820 }
821
822 # Extract the Host key from the file
823 if (!$errormessage) {
824 &General::log("ipsec", "Extracting private key from p12...");
825 if (open(STDIN, "-|")) {
826 my $opt = " pkcs12 -nocerts -nodes";
827 $opt .= " -in $filename";
828 $opt .= " -out /tmp/newhostkey";
829 $errormessage = &callssl ($opt);
830 } else { #child
831 print "$cgiparams{'P12_PASS'}\n";
832 exit (0);
833 }
834 }
835
836 if (!$errormessage) {
837 &General::log("ipsec", "Moving cacert...");
838 move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem");
839 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
840 }
841
842 if (!$errormessage) {
843 &General::log("ipsec", "Moving host cert...");
844 move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem");
845 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
846 }
847
848 if (!$errormessage) {
849 &General::log("ipsec", "Moving private key...");
850 move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem");
851 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
852 }
853
854 #cleanup temp files
855 unlink ($filename);
856 unlink ('/tmp/newcacert');
857 unlink ('/tmp/newhostcert');
858 unlink ('/tmp/newhostkey');
859 if ($errormessage) {
860 unlink ("${General::swroot}/ca/cacert.pem");
861 unlink ("${General::swroot}/certs/hostcert.pem");
862 unlink ("${General::swroot}/certs/hostkey.pem");
863 goto ROOTCERT_ERROR;
864 }
865
866 # Create empty CRL cannot be done because we don't have
867 # the private key for this CAROOT
868 # IPFire can only import certificates
869
870 &General::log("ipsec", "p12 import completed!");
871 &cleanssldatabase();
872 goto ROOTCERT_SUCCESS;
873
874 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
875
876 # Validate input since the form was submitted
877 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
878 $errormessage = $Lang::tr{'organization cant be empty'};
879 goto ROOTCERT_ERROR;
880 }
881 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
882 $errormessage = $Lang::tr{'organization too long'};
883 goto ROOTCERT_ERROR;
884 }
885 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
886 $errormessage = $Lang::tr{'invalid input for organization'};
887 goto ROOTCERT_ERROR;
888 }
889 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
890 $errormessage = $Lang::tr{'hostname cant be empty'};
891 goto ROOTCERT_ERROR;
892 }
893 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
894 $errormessage = $Lang::tr{'invalid input for hostname'};
895 goto ROOTCERT_ERROR;
896 }
897 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
898 $errormessage = $Lang::tr{'invalid input for e-mail address'};
899 goto ROOTCERT_ERROR;
900 }
901 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
902 $errormessage = $Lang::tr{'e-mail address too long'};
903 goto ROOTCERT_ERROR;
904 }
905 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
906 $errormessage = $Lang::tr{'invalid input for department'};
907 goto ROOTCERT_ERROR;
908 }
909 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
910 $errormessage = $Lang::tr{'invalid input for city'};
911 goto ROOTCERT_ERROR;
912 }
913 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
914 $errormessage = $Lang::tr{'invalid input for state or province'};
915 goto ROOTCERT_ERROR;
916 }
917 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
918 $errormessage = $Lang::tr{'invalid input for country'};
919 goto ROOTCERT_ERROR;
920 }
921 #the exact syntax is a list comma separated of
922 # email:any-validemail
923 # URI: a uniform resource indicator
924 # DNS: a DNS domain name
925 # RID: a registered OBJECT IDENTIFIER
926 # IP: an IP address
927 # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
928
929 if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
930 $errormessage = $Lang::tr{'vpn altname syntax'};
931 goto VPNCONF_ERROR;
932 }
933
934 # Copy the cgisettings to vpnsettings and save the configfile
935 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
936 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
937 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
938 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
939 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
940 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
941 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
942 &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
943
944 # Replace empty strings with a .
945 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
946 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
947 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
948
949 # Create the CA certificate
950 if (!$errormessage) {
951 &General::log("ipsec", "Creating cacert...");
952 if (open(STDIN, "-|")) {
953 my $opt = " req -x509 -nodes -rand /proc/interrupts:/proc/net/rt_cache";
954 $opt .= " -days 999999";
955 $opt .= " -newkey rsa:2048";
956 $opt .= " -keyout ${General::swroot}/private/cakey.pem";
957 $opt .= " -out ${General::swroot}/ca/cacert.pem";
958
959 $errormessage = &callssl ($opt);
960 } else { #child
961 print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
962 print "$state\n";
963 print "$city\n";
964 print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
965 print "$ou\n";
966 print "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
967 print "$cgiparams{'ROOTCERT_EMAIL'}\n";
968 exit (0);
969 }
970 }
971
972 # Create the Host certificate request
973 if (!$errormessage) {
974 &General::log("ipsec", "Creating host cert...");
975 if (open(STDIN, "-|")) {
976 my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
977 $opt .= " -newkey rsa:1024";
978 $opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
979 $opt .= " -out ${General::swroot}/certs/hostreq.pem";
980 $errormessage = &callssl ($opt);
981 } else { #child
982 print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
983 print "$state\n";
984 print "$city\n";
985 print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
986 print "$ou\n";
987 print "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
988 print "$cgiparams{'ROOTCERT_EMAIL'}\n";
989 print ".\n";
990 print ".\n";
991 exit (0);
992 }
993 }
994
995 # Sign the host certificate request
996 if (!$errormessage) {
997 &General::log("ipsec", "Self signing host cert...");
998
999 #No easy way for specifying the contain of subjectAltName without writing a config file...
1000 my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
1001 print $fh <<END
1002 basicConstraints=CA:FALSE
1003 nsComment="OpenSSL Generated Certificate"
1004 subjectKeyIdentifier=hash
1005 authorityKeyIdentifier=keyid,issuer:always
1006 extendedKeyUsage = serverAuth
1007 END
1008 ;
1009 print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
1010 close ($fh);
1011
1012 my $opt = " ca -days 999999";
1013 $opt .= " -batch -notext";
1014 $opt .= " -in ${General::swroot}/certs/hostreq.pem";
1015 $opt .= " -out ${General::swroot}/certs/hostcert.pem";
1016 $opt .= " -extfile $v3extname";
1017 $errormessage = &callssl ($opt);
1018 unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed
1019 unlink ($v3extname);
1020 }
1021
1022 # Create an empty CRL
1023 if (!$errormessage) {
1024 &General::log("ipsec", "Creating emptycrl...");
1025 my $opt = " ca -gencrl";
1026 $opt .= " -out ${General::swroot}/crls/cacrl.pem";
1027 $errormessage = &callssl ($opt);
1028 }
1029
1030 # Successfully build CA / CERT!
1031 if (!$errormessage) {
1032 &cleanssldatabase();
1033 goto ROOTCERT_SUCCESS;
1034 }
1035
1036 #Cleanup
1037 unlink ("${General::swroot}/ca/cacert.pem");
1038 unlink ("${General::swroot}/certs/hostkey.pem");
1039 unlink ("${General::swroot}/certs/hostcert.pem");
1040 unlink ("${General::swroot}/crls/cacrl.pem");
1041 &cleanssldatabase();
1042 }
1043
1044 ROOTCERT_ERROR:
1045 &Header::showhttpheaders();
1046 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1047 &Header::openbigbox('100%', 'left', '', $errormessage);
1048 if ($errormessage) {
1049 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
1050 print "<class name='base'>$errormessage";
1051 print "&nbsp;</class>";
1052 &Header::closebox();
1053 }
1054 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
1055 print <<END
1056 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
1057 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1058 <tr><td width='40%' class='base'>$Lang::tr{'organization name'}:</td>
1059 <td width='60%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td></tr>
1060 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1061 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td></tr>
1062 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1063 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td></tr>
1064 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1065 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td></tr>
1066 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1067 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td></tr>
1068 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1069 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td></tr>
1070 <tr><td class='base'>$Lang::tr{'country'}:</td>
1071 <td class='base'><select name='ROOTCERT_COUNTRY'>
1072 END
1073 ;
1074 foreach my $country (sort keys %{Countries::countries}) {
1075 print "<option value='$Countries::countries{$country}'";
1076 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1077 print " selected='selected'";
1078 }
1079 print ">$country</option>";
1080 }
1081 print <<END
1082 </select></td></tr>
1083 <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*) <img src='/blob.gif' alt='*' /></td>
1084 <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr>
1085 <tr><td>&nbsp;</td>
1086 <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
1087 <tr><td class='base' colspan='2' align='left'>
1088 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1089 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1090 </td></tr>
1091 <tr><td colspan='2'><hr /></td></tr>
1092 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1093 <td nowrap='nowrap'><input type='file' name='FH' size='32' /></td></tr>
1094 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1095 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td></tr>
1096 <tr><td>&nbsp;</td>
1097 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td></tr>
1098 <tr><td class='base' colspan='2' align='left'>
1099 <img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1100 </table></form>
1101 END
1102 ;
1103 &Header::closebox();
1104 &Header::closebigbox();
1105 &Header::closepage();
1106 exit(0);
1107
1108 ROOTCERT_SUCCESS:
1109 if (&vpnenabled) {
1110 system('/usr/local/bin/ipsecctrl', 'S');
1111 sleep $sleepDelay;
1112 }
1113 ROOTCERT_SKIP:
1114 ###
1115 ### Export PKCS12 file to browser
1116 ###
1117 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1118 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1119 print "Content-Type: application/force-download\n";
1120 print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1121 print "Content-Type: application/octet-stream\r\n\r\n";
1122 print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1123 exit (0);
1124
1125 ###
1126 ### Display certificate
1127 ###
1128 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1129 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1130
1131 if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1132 &Header::showhttpheaders();
1133 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1134 &Header::openbigbox('100%', 'left', '', '');
1135 &Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
1136 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1137 $output = &Header::cleanhtml($output,"y");
1138 print "<pre>$output</pre>\n";
1139 &Header::closebox();
1140 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1141 &Header::closebigbox();
1142 &Header::closepage();
1143 exit(0);
1144 }
1145
1146 ###
1147 ### Export Certificate to browser
1148 ###
1149 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
1150 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1151
1152 if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1153 print "Content-Type: application/force-download\n";
1154 print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
1155 print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1156 exit (0);
1157 }
1158
1159 ###
1160 ### Enable/Disable connection
1161 ###
1162 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1163
1164 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1165 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1166
1167 if ($confighash{$cgiparams{'KEY'}}) {
1168 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1169 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1170 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1171 &writeipsecfiles();
1172 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
1173 } else {
1174 system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
1175 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1176 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1177 &writeipsecfiles();
1178 }
1179 sleep $sleepDelay;
1180 } else {
1181 $errormessage = $Lang::tr{'invalid key'};
1182 }
1183
1184 ###
1185 ### Restart connection
1186 ###
1187 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
1188 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1189 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1190
1191 if ($confighash{$cgiparams{'KEY'}}) {
1192 if (&vpnenabled) {
1193 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
1194 sleep $sleepDelay;
1195 }
1196 } else {
1197 $errormessage = $Lang::tr{'invalid key'};
1198 }
1199
1200 ###
1201 ### Remove connection
1202 ###
1203 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1204 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1205 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1206
1207 if ($confighash{$cgiparams{'KEY'}}) {
1208 system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
1209 unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1210 unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1211 delete $confighash{$cgiparams{'KEY'}};
1212 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1213 &writeipsecfiles();
1214 } else {
1215 $errormessage = $Lang::tr{'invalid key'};
1216 }
1217
1218 ###
1219 ### Choose between adding a host-net or net-net connection
1220 ###
1221 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
1222 &Header::showhttpheaders();
1223 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1224 &Header::openbigbox('100%', 'left', '', '');
1225 &Header::openbox('100%', 'left', $Lang::tr{'connection type'});
1226 print <<END
1227 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
1228 <b>$Lang::tr{'connection type'}:</b><br />
1229 <table>
1230 <tr><td><input type='radio' name='TYPE' value='host' checked='checked' /></td>
1231 <td class='base'>$Lang::tr{'host to net vpn'}</td>
1232 </tr><tr>
1233 <td><input type='radio' name='TYPE' value='net' /></td>
1234 <td class='base'>$Lang::tr{'net to net vpn'}</td>
1235 </tr><tr>
1236 <td align='center' colspan='2'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
1237 </tr>
1238 </table></form>
1239 END
1240 ;
1241 &Header::closebox();
1242 &Header::closebigbox();
1243 &Header::closepage();
1244 exit (0);
1245 ###
1246 ### Adding/Editing/Saving a connection
1247 ###
1248 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
1249 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
1250 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
1251
1252 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1253 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
1254 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1255
1256 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
1257 if (! $confighash{$cgiparams{'KEY'}}[0]) {
1258 $errormessage = $Lang::tr{'invalid key'};
1259 goto VPNCONF_END;
1260 }
1261 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
1262 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
1263 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
1264 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
1265 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
1266 #$cgiparams{'free'} = $confighash{$cgiparams{'KEY'}}[6];
1267 $cgiparams{'LOCAL_ID'} = $confighash{$cgiparams{'KEY'}}[7];
1268 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
1269 $cgiparams{'REMOTE_ID'} = $confighash{$cgiparams{'KEY'}}[9];
1270 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
1271 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
1272 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
1273 $cgiparams{'DPD_ACTION'} = $confighash{$cgiparams{'KEY'}}[27];
1274 $cgiparams{'IKE_VERSION'} = $confighash{$cgiparams{'KEY'}}[29];
1275 $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
1276 $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
1277 $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
1278 $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16];
1279 $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
1280 $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
1281 $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
1282 $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
1283 $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
1284 $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
1285 $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
1286 $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
1287 $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30];
1288 $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31];
1289
1290 if (!$cgiparams{'DPD_DELAY'}) {
1291 $cgiparams{'DPD_DELAY'} = 30;
1292 }
1293
1294 if (!$cgiparams{'DPD_TIMEOUT'}) {
1295 $cgiparams{'DPD_TIMEOUT'} = 120;
1296 }
1297
1298 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
1299 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
1300 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
1301 $errormessage = $Lang::tr{'connection type is invalid'};
1302 goto VPNCONF_ERROR;
1303 }
1304
1305 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
1306 $errormessage = $Lang::tr{'name must only contain characters'};
1307 goto VPNCONF_ERROR;
1308 }
1309
1310 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
1311 $errormessage = $Lang::tr{'name is invalid'};
1312 goto VPNCONF_ERROR;
1313 }
1314
1315 if (length($cgiparams{'NAME'}) >60) {
1316 $errormessage = $Lang::tr{'name too long'};
1317 goto VPNCONF_ERROR;
1318 }
1319
1320 # Check if there is no other entry with this name
1321 if (! $cgiparams{'KEY'}) { #only for add
1322 foreach my $key (keys %confighash) {
1323 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
1324 $errormessage = $Lang::tr{'a connection with this name already exists'};
1325 goto VPNCONF_ERROR;
1326 }
1327 }
1328 }
1329
1330 if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
1331 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
1332 goto VPNCONF_ERROR;
1333 }
1334
1335 if ($cgiparams{'REMOTE'}) {
1336 if (($cgiparams{'REMOTE'} ne '%any') && (! &General::validip($cgiparams{'REMOTE'}))) {
1337 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
1338 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
1339 goto VPNCONF_ERROR;
1340 } else {
1341 if (&valid_dns_host($cgiparams{'REMOTE'})) {
1342 $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
1343 }
1344 }
1345 }
1346 }
1347
1348 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
1349 $errormessage = $Lang::tr{'local subnet is invalid'};
1350 goto VPNCONF_ERROR;
1351 }
1352
1353 # Allow only one roadwarrior/psk without remote IP-address
1354 if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') {
1355 foreach my $key (keys %confighash) {
1356 if ( ($cgiparams{'KEY'} ne $key) &&
1357 ($confighash{$key}[4] eq 'psk') &&
1358 ($confighash{$key}[10] eq '') ) {
1359 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
1360 goto VPNCONF_ERROR;
1361 }
1362 }
1363 }
1364 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
1365 $errormessage = $Lang::tr{'remote subnet is invalid'};
1366 goto VPNCONF_ERROR;
1367 }
1368
1369 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1370 $errormessage = $Lang::tr{'invalid input'};
1371 goto VPNCONF_ERROR;
1372 }
1373 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
1374 $errormessage = $Lang::tr{'invalid input'};
1375 goto VPNCONF_ERROR;
1376 }
1377
1378 # Allow nothing or a string (DN,FDQN,) beginning with @
1379 # with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
1380 if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
1381 ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
1382 (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
1383 ) {
1384 $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
1385 'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
1386 'FQDN: @ipfire.org<br />' .
1387 'USER_FQDN: info@ipfire.org<br />' .
1388 'IPV4_ADDR: 123.123.123.123';
1389 goto VPNCONF_ERROR;
1390 }
1391 # If Auth is DN, verify existance of Remote ID.
1392 if ( $cgiparams{'REMOTE_ID'} eq '' && (
1393 $cgiparams{'AUTH'} eq 'auth-dn'|| # while creation
1394 $confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing
1395 $errormessage = $Lang::tr{'vpn missing remote id'};
1396 goto VPNCONF_ERROR;
1397 }
1398
1399 #temporary disabled (BUG 10294)
1400 # if ($cgiparams{'TYPE'} eq 'net'){
1401 # $errormessage=&General::checksubnets($cgiparams{'NAME'},$cgiparams{'REMOTE_SUBNET'});
1402 # if ($errormessage ne ''){
1403 # goto VPNCONF_ERROR;
1404 # }
1405 #
1406 # }
1407 if ($cgiparams{'AUTH'} eq 'psk') {
1408 if (! length($cgiparams{'PSK'}) ) {
1409 $errormessage = $Lang::tr{'pre-shared key is too short'};
1410 goto VPNCONF_ERROR;
1411 }
1412 if ($cgiparams{'PSK'} =~ /'/) {
1413 $cgiparams{'PSK'} =~ tr/'/ /;
1414 $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
1415 goto VPNCONF_ERROR;
1416 }
1417 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
1418 if ($cgiparams{'KEY'}) {
1419 $errormessage = $Lang::tr{'cant change certificates'};
1420 goto VPNCONF_ERROR;
1421 }
1422 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1423 $errormessage = $Lang::tr{'there was no file upload'};
1424 goto VPNCONF_ERROR;
1425 }
1426
1427 # Move uploaded certificate request to a temporary file
1428 (my $fh, my $filename) = tempfile( );
1429 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1430 $errormessage = $!;
1431 goto VPNCONF_ERROR;
1432 }
1433
1434 # Sign the certificate request
1435 &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
1436 my $opt = " ca -days 999999";
1437 $opt .= " -batch -notext";
1438 $opt .= " -in $filename";
1439 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1440
1441 if ( $errormessage = &callssl ($opt) ) {
1442 unlink ($filename);
1443 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1444 &cleanssldatabase();
1445 goto VPNCONF_ERROR;
1446 } else {
1447 unlink ($filename);
1448 &cleanssldatabase();
1449 }
1450
1451 $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1452 if ($cgiparams{'CERT_NAME'} eq '') {
1453 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
1454 goto VPNCONF_ERROR;
1455 }
1456 } elsif ($cgiparams{'AUTH'} eq 'pkcs12') {
1457 &General::log("ipsec", "Importing from p12...");
1458
1459 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1460 $errormessage = $Lang::tr{'there was no file upload'};
1461 goto ROOTCERT_ERROR;
1462 }
1463
1464 # Move uploaded certificate request to a temporary file
1465 (my $fh, my $filename) = tempfile( );
1466 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1467 $errormessage = $!;
1468 goto ROOTCERT_ERROR;
1469 }
1470
1471 # Extract the CA certificate from the file
1472 &General::log("ipsec", "Extracting caroot from p12...");
1473 if (open(STDIN, "-|")) {
1474 my $opt = " pkcs12 -cacerts -nokeys";
1475 $opt .= " -in $filename";
1476 $opt .= " -out /tmp/newcacert";
1477 $errormessage = &callssl ($opt);
1478 } else { #child
1479 print "$cgiparams{'P12_PASS'}\n";
1480 exit (0);
1481 }
1482
1483 # Extract the Host certificate from the file
1484 if (!$errormessage) {
1485 &General::log("ipsec", "Extracting host cert from p12...");
1486 if (open(STDIN, "-|")) {
1487 my $opt = " pkcs12 -clcerts -nokeys";
1488 $opt .= " -in $filename";
1489 $opt .= " -out /tmp/newhostcert";
1490 $errormessage = &callssl ($opt);
1491 } else { #child
1492 print "$cgiparams{'P12_PASS'}\n";
1493 exit (0);
1494 }
1495 }
1496
1497 if (!$errormessage) {
1498 &General::log("ipsec", "Moving cacert...");
1499 #If CA have new subject, add it to our list of CA
1500 my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert'));
1501 my @names;
1502 foreach my $x (keys %cahash) {
1503 $casubject='' if ($cahash{$x}[1] eq $casubject);
1504 unshift (@names,$cahash{$x}[0]);
1505 }
1506 if ($casubject) { # a new one!
1507 my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
1508 if ($temp !~ /CA:TRUE/i) {
1509 $errormessage = $Lang::tr{'not a valid ca certificate'};
1510 } else {
1511 #compute a name for it
1512 my $idx=0;
1513 while (grep(/Imported-$idx/, @names) ) {$idx++};
1514 $cgiparams{'CA_NAME'}="Imported-$idx";
1515 $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert'));
1516 move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
1517 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
1518 if (!$errormessage) {
1519 my $key = &General::findhasharraykey (\%cahash);
1520 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1521 $cahash{$key}[1] = $casubject;
1522 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
1523 system('/usr/local/bin/ipsecctrl', 'R');
1524 }
1525 }
1526 }
1527 }
1528 if (!$errormessage) {
1529 &General::log("ipsec", "Moving host cert...");
1530 move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1531 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
1532 }
1533
1534 #cleanup temp files
1535 unlink ($filename);
1536 unlink ('/tmp/newcacert');
1537 unlink ('/tmp/newhostcert');
1538 if ($errormessage) {
1539 unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
1540 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1541 goto VPNCONF_ERROR;
1542 }
1543 &General::log("ipsec", "p12 import completed!");
1544 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
1545 if ($cgiparams{'KEY'}) {
1546 $errormessage = $Lang::tr{'cant change certificates'};
1547 goto VPNCONF_ERROR;
1548 }
1549 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1550 $errormessage = $Lang::tr{'there was no file upload'};
1551 goto VPNCONF_ERROR;
1552 }
1553 # Move uploaded certificate to a temporary file
1554 (my $fh, my $filename) = tempfile( );
1555 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1556 $errormessage = $!;
1557 goto VPNCONF_ERROR;
1558 }
1559
1560 # Verify the certificate has a valid CA and move it
1561 &General::log("ipsec", "Validating imported cert against our known CA...");
1562 my $validca = 1; #assume ok
1563 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
1564 if ($test !~ /: OK/) {
1565 my $validca = 0;
1566 foreach my $key (keys %cahash) {
1567 $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
1568 if ($test =~ /: OK/) {
1569 $validca = 1;
1570 last;
1571 }
1572 }
1573 }
1574 if (! $validca) {
1575 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
1576 unlink ($filename);
1577 goto VPNCONF_ERROR;
1578 } else {
1579 move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1580 if ($? ne 0) {
1581 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1582 unlink ($filename);
1583 goto VPNCONF_ERROR;
1584 }
1585 }
1586
1587 $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1588 if ($cgiparams{'CERT_NAME'} eq '') {
1589 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1590 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
1591 goto VPNCONF_ERROR;
1592 }
1593 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
1594 if ($cgiparams{'KEY'}) {
1595 $errormessage = $Lang::tr{'cant change certificates'};
1596 goto VPNCONF_ERROR;
1597 }
1598 # Validate input since the form was submitted
1599 if (length($cgiparams{'CERT_NAME'}) >60) {
1600 $errormessage = $Lang::tr{'name too long'};
1601 goto VPNCONF_ERROR;
1602 }
1603 if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
1604 $errormessage = $Lang::tr{'invalid input for name'};
1605 goto VPNCONF_ERROR;
1606 }
1607 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
1608 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1609 goto VPNCONF_ERROR;
1610 }
1611 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
1612 $errormessage = $Lang::tr{'e-mail address too long'};
1613 goto VPNCONF_ERROR;
1614 }
1615 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1616 $errormessage = $Lang::tr{'invalid input for department'};
1617 goto VPNCONF_ERROR;
1618 }
1619 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
1620 $errormessage = $Lang::tr{'organization too long'};
1621 goto VPNCONF_ERROR;
1622 }
1623 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
1624 $errormessage = $Lang::tr{'invalid input for organization'};
1625 goto VPNCONF_ERROR;
1626 }
1627 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1628 $errormessage = $Lang::tr{'invalid input for city'};
1629 goto VPNCONF_ERROR;
1630 }
1631 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1632 $errormessage = $Lang::tr{'invalid input for state or province'};
1633 goto VPNCONF_ERROR;
1634 }
1635 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
1636 $errormessage = $Lang::tr{'invalid input for country'};
1637 goto VPNCONF_ERROR;
1638 }
1639 #the exact syntax is a list comma separated of
1640 # email:any-validemail
1641 # URI: a uniform resource indicator
1642 # DNS: a DNS domain name
1643 # RID: a registered OBJECT IDENTIFIER
1644 # IP: an IP address
1645 # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
1646
1647 if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
1648 $errormessage = $Lang::tr{'vpn altname syntax'};
1649 goto VPNCONF_ERROR;
1650 }
1651
1652 if (length($cgiparams{'CERT_PASS1'}) < 5) {
1653 $errormessage = $Lang::tr{'password too short'};
1654 goto VPNCONF_ERROR;
1655 }
1656 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
1657 $errormessage = $Lang::tr{'passwords do not match'};
1658 goto VPNCONF_ERROR;
1659 }
1660
1661 # Replace empty strings with a .
1662 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
1663 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
1664 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
1665
1666 # Create the Host certificate request
1667 &General::log("ipsec", "Creating a cert...");
1668
1669 if (open(STDIN, "-|")) {
1670 my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
1671 $opt .= " -newkey rsa:1024";
1672 $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
1673 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
1674
1675 if ( $errormessage = &callssl ($opt) ) {
1676 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1677 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1678 goto VPNCONF_ERROR;
1679 }
1680 } else { #child
1681 print "$cgiparams{'CERT_COUNTRY'}\n";
1682 print "$state\n";
1683 print "$city\n";
1684 print "$cgiparams{'CERT_ORGANIZATION'}\n";
1685 print "$ou\n";
1686 print "$cgiparams{'CERT_NAME'}\n";
1687 print "$cgiparams{'CERT_EMAIL'}\n";
1688 print ".\n";
1689 print ".\n";
1690 exit (0);
1691 }
1692
1693 # Sign the host certificate request
1694 &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
1695
1696 #No easy way for specifying the contain of subjectAltName without writing a config file...
1697 my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
1698 print $fh <<END
1699 basicConstraints=CA:FALSE
1700 nsComment="OpenSSL Generated Certificate"
1701 subjectKeyIdentifier=hash
1702 authorityKeyIdentifier=keyid,issuer:always
1703 END
1704 ;
1705 print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
1706 close ($fh);
1707
1708 my $opt = " ca -days 999999 -batch -notext";
1709 $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
1710 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1711 $opt .= " -extfile $v3extname";
1712
1713 if ( $errormessage = &callssl ($opt) ) {
1714 unlink ($v3extname);
1715 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1716 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1717 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1718 &cleanssldatabase();
1719 goto VPNCONF_ERROR;
1720 } else {
1721 unlink ($v3extname);
1722 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1723 &cleanssldatabase();
1724 }
1725
1726 # Create the pkcs12 file
1727 &General::log("ipsec", "Packing a pkcs12 file...");
1728 $opt = " pkcs12 -export";
1729 $opt .= " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
1730 $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1731 $opt .= " -name \"$cgiparams{'NAME'}\"";
1732 $opt .= " -passout pass:$cgiparams{'CERT_PASS1'}";
1733 $opt .= " -certfile ${General::swroot}/ca/cacert.pem";
1734 $opt .= " -caname \"$vpnsettings{'ROOTCERT_ORGANIZATION'} CA\"";
1735 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}.p12";
1736
1737 if ( $errormessage = &callssl ($opt) ) {
1738 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1739 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1740 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}.p12");
1741 goto VPNCONF_ERROR;
1742 } else {
1743 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1744 }
1745 } elsif ($cgiparams{'AUTH'} eq 'cert') {
1746 ;# Nothing, just editing
1747 } elsif ($cgiparams{'AUTH'} eq 'auth-dn') {
1748 $cgiparams{'CERT_NAME'} = '%auth-dn'; # a special value saying 'no cert file'
1749 } else {
1750 $errormessage = $Lang::tr{'invalid input for authentication method'};
1751 goto VPNCONF_ERROR;
1752 }
1753
1754 # 1)Error message here is not accurate.
1755 # 2)Test is superfluous, openswan can reference same cert multiple times
1756 # 3)Present since initial version (1.3.2.11), it isn't a bug correction
1757 # Check if there is no other entry with this certificate name
1758 #if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk') && ($cgiparams{'AUTH'} ne 'auth-dn')) {
1759 # foreach my $key (keys %confighash) {
1760 # if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
1761 # $errormessage = $Lang::tr{'a connection with this common name already exists'};
1762 # goto VPNCONF_ERROR;
1763 # }
1764 # }
1765 #}
1766 # Save the config
1767
1768 my $key = $cgiparams{'KEY'};
1769 if (! $key) {
1770 $key = &General::findhasharraykey (\%confighash);
1771 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
1772 }
1773 $confighash{$key}[0] = $cgiparams{'ENABLED'};
1774 $confighash{$key}[1] = $cgiparams{'NAME'};
1775 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
1776 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
1777 }
1778 $confighash{$key}[3] = $cgiparams{'TYPE'};
1779 if ($cgiparams{'AUTH'} eq 'psk') {
1780 $confighash{$key}[4] = 'psk';
1781 $confighash{$key}[5] = $cgiparams{'PSK'};
1782 } else {
1783 $confighash{$key}[4] = 'cert';
1784 }
1785 if ($cgiparams{'TYPE'} eq 'net') {
1786 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
1787 }
1788 $confighash{$key}[7] = $cgiparams{'LOCAL_ID'};
1789 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
1790 $confighash{$key}[9] = $cgiparams{'REMOTE_ID'};
1791 $confighash{$key}[10] = $cgiparams{'REMOTE'};
1792 $confighash{$key}[25] = $cgiparams{'REMARK'};
1793 $confighash{$key}[26] = ""; # Formerly INTERFACE
1794 $confighash{$key}[27] = $cgiparams{'DPD_ACTION'};
1795 $confighash{$key}[29] = $cgiparams{'IKE_VERSION'};
1796
1797 #dont forget advanced value
1798 $confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'};
1799 $confighash{$key}[19] = $cgiparams{'IKE_INTEGRITY'};
1800 $confighash{$key}[20] = $cgiparams{'IKE_GROUPTYPE'};
1801 $confighash{$key}[16] = $cgiparams{'IKE_LIFETIME'};
1802 $confighash{$key}[21] = $cgiparams{'ESP_ENCRYPTION'};
1803 $confighash{$key}[22] = $cgiparams{'ESP_INTEGRITY'};
1804 $confighash{$key}[23] = $cgiparams{'ESP_GROUPTYPE'};
1805 $confighash{$key}[17] = $cgiparams{'ESP_KEYLIFE'};
1806 $confighash{$key}[12] = 'off'; # $cgiparams{'AGGRMODE'};
1807 $confighash{$key}[13] = $cgiparams{'COMPRESSION'};
1808 $confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'};
1809 $confighash{$key}[28] = $cgiparams{'PFS'};
1810 $confighash{$key}[14] = $cgiparams{'VHOST'};
1811 $confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'};
1812 $confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
1813
1814 #free unused fields!
1815 $confighash{$key}[6] = 'off';
1816 $confighash{$key}[15] = 'off';
1817
1818 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1819 &writeipsecfiles();
1820 if (&vpnenabled) {
1821 system('/usr/local/bin/ipsecctrl', 'S', $key);
1822 sleep $sleepDelay;
1823 }
1824 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
1825 $cgiparams{'KEY'} = $key;
1826 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
1827 }
1828 goto VPNCONF_END;
1829 } else { # add new connection
1830 $cgiparams{'ENABLED'} = 'on';
1831 if ( ! -f "${General::swroot}/private/cakey.pem" ) {
1832 $cgiparams{'AUTH'} = 'psk';
1833 } elsif ( ! -f "${General::swroot}/ca/cacert.pem") {
1834 $cgiparams{'AUTH'} = 'certfile';
1835 } else {
1836 $cgiparams{'AUTH'} = 'certgen';
1837 }
1838 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
1839 $cgiparams{'CERT_EMAIL'} = $vpnsettings{'ROOTCERT_EMAIL'};
1840 $cgiparams{'CERT_OU'} = $vpnsettings{'ROOTCERT_OU'};
1841 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
1842 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
1843 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
1844 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
1845
1846 # choose appropriate dpd action
1847 if ($cgiparams{'TYPE'} eq 'host') {
1848 $cgiparams{'DPD_ACTION'} = 'clear';
1849 } else {
1850 $cgiparams{'DPD_ACTION'} = 'restart';
1851 }
1852
1853 if (!$cgiparams{'DPD_DELAY'}) {
1854 $cgiparams{'DPD_DELAY'} = 30;
1855 }
1856
1857 if (!$cgiparams{'DPD_TIMEOUT'}) {
1858 $cgiparams{'DPD_TIMEOUT'} = 120;
1859 }
1860
1861 # Default IKE Version to v2
1862 if (!$cgiparams{'IKE_VERSION'}) {
1863 $cgiparams{'IKE_VERSION'} = 'ikev2';
1864 }
1865
1866 # ID are empty
1867 $cgiparams{'LOCAL_ID'} = '';
1868 $cgiparams{'REMOTE_ID'} = '';
1869
1870 #use default advanced value
1871 $cgiparams{'IKE_ENCRYPTION'} = 'aes256|aes192|aes128|3des'; #[18];
1872 $cgiparams{'IKE_INTEGRITY'} = 'sha2_256|sha|md5'; #[19];
1873 $cgiparams{'IKE_GROUPTYPE'} = '4096|3072|2048|1536|1024'; #[20];
1874 $cgiparams{'IKE_LIFETIME'} = '3'; #[16];
1875 $cgiparams{'ESP_ENCRYPTION'} = 'aes256|aes192|aes128|3des'; #[21];
1876 $cgiparams{'ESP_INTEGRITY'} = 'sha2_256|sha1|md5'; #[22];
1877 $cgiparams{'ESP_GROUPTYPE'} = ''; #[23];
1878 $cgiparams{'ESP_KEYLIFE'} = '1'; #[17];
1879 $cgiparams{'COMPRESSION'} = 'on'; #[13];
1880 $cgiparams{'ONLY_PROPOSED'} = 'off'; #[24];
1881 $cgiparams{'PFS'} = 'on'; #[28];
1882 $cgiparams{'VHOST'} = 'on'; #[14];
1883 }
1884
1885 VPNCONF_ERROR:
1886 $checked{'ENABLED'}{'off'} = '';
1887 $checked{'ENABLED'}{'on'} = '';
1888 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
1889
1890 $checked{'EDIT_ADVANCED'}{'off'} = '';
1891 $checked{'EDIT_ADVANCED'}{'on'} = '';
1892 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = "checked='checked'";
1893
1894 $checked{'AUTH'}{'psk'} = '';
1895 $checked{'AUTH'}{'certreq'} = '';
1896 $checked{'AUTH'}{'certgen'} = '';
1897 $checked{'AUTH'}{'certfile'} = '';
1898 $checked{'AUTH'}{'pkcs12'} = '';
1899 $checked{'AUTH'}{'auth-dn'} = '';
1900 $checked{'AUTH'}{$cgiparams{'AUTH'}} = "checked='checked'";
1901
1902 $selected{'IKE_VERSION'}{'ikev1'} = '';
1903 $selected{'IKE_VERSION'}{'ikev2'} = '';
1904 $selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'";
1905
1906 &Header::showhttpheaders();
1907 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1908 &Header::openbigbox('100%', 'left', '', $errormessage);
1909 if ($errormessage) {
1910 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
1911 print "<class name='base'>$errormessage";
1912 print "&nbsp;</class>";
1913 &Header::closebox();
1914 }
1915
1916 if ($warnmessage) {
1917 &Header::openbox('100%', 'left', "$Lang::tr{'warning messages'}:");
1918 print "<class name='base'>$warnmessage";
1919 print "&nbsp;</class>";
1920 &Header::closebox();
1921 }
1922
1923 print "<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>";
1924 print<<END
1925 <input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />
1926 <input type='hidden' name='IKE_ENCRYPTION' value='$cgiparams{'IKE_ENCRYPTION'}' />
1927 <input type='hidden' name='IKE_INTEGRITY' value='$cgiparams{'IKE_INTEGRITY'}' />
1928 <input type='hidden' name='IKE_GROUPTYPE' value='$cgiparams{'IKE_GROUPTYPE'}' />
1929 <input type='hidden' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' />
1930 <input type='hidden' name='ESP_ENCRYPTION' value='$cgiparams{'ESP_ENCRYPTION'}' />
1931 <input type='hidden' name='ESP_INTEGRITY' value='$cgiparams{'ESP_INTEGRITY'}' />
1932 <input type='hidden' name='ESP_GROUPTYPE' value='$cgiparams{'ESP_GROUPTYPE'}' />
1933 <input type='hidden' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' />
1934 <input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' />
1935 <input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' />
1936 <input type='hidden' name='PFS' value='$cgiparams{'PFS'}' />
1937 <input type='hidden' name='VHOST' value='$cgiparams{'VHOST'}' />
1938 <input type='hidden' name='DPD_ACTION' value='$cgiparams{'DPD_ACTION'}' />
1939 <input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' />
1940 <input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' />
1941 END
1942 ;
1943 if ($cgiparams{'KEY'}) {
1944 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
1945 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
1946 }
1947
1948 &Header::openbox('100%', 'left', "$Lang::tr{'connection'}:");
1949 print "<table width='100%'>";
1950 print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>";
1951 if ($cgiparams{'KEY'}) {
1952 print "<td width='25%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' /><b>$cgiparams{'NAME'}</b></td>";
1953 } else {
1954 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' size='30' /></td>";
1955 }
1956 print "<td>$Lang::tr{'enabled'}</td><td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td></tr>";
1957 print '</tr><td><br /></td><tr>';
1958
1959 my $disabled;
1960 my $blob;
1961 if ($cgiparams{'TYPE'} eq 'host') {
1962 $disabled = "disabled='disabled'";
1963 $blob = "<img src='/blob.gif' alt='*' />";
1964 };
1965
1966 print <<END
1967 <tr>
1968 <td class='boldbase'>$Lang::tr{'remote host/ip'}:&nbsp;$blob</td>
1969 <td>
1970 <input type='text' name='REMOTE' value='$cgiparams{'REMOTE'}' size='30' />
1971 </td>
1972 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
1973 <td>
1974 <input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size='30' />
1975 </td>
1976 </tr>
1977 <tr>
1978 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
1979 <td colspan='3'>
1980 <input type='text' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' size='30' />
1981 </td>
1982 </tr>
1983 <tr>
1984 <td class='boldbase'>$Lang::tr{'vpn local id'}:<br />($Lang::tr{'eg'} <tt>&#64;xy.example.com</tt>)</td>
1985 <td><input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' /></td>
1986 <td class='boldbase'>$Lang::tr{'vpn remote id'}:</td>
1987 <td><input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' /></td>
1988 </tr><tr>
1989 </tr><td><br /></td><tr>
1990 <td>$Lang::tr{'vpn keyexchange'}:</td>
1991 <td><select name='IKE_VERSION'>
1992 <option value='ikev2' $selected{'IKE_VERSION'}{'ikev2'}>IKEv2</option>
1993 <option value='ikev1' $selected{'IKE_VERSION'}{'ikev1'}>IKEv1</option>
1994 </select>
1995 </td>
1996 <td colspan="2"></td>
1997 </tr><tr>
1998 <td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' alt='*' /></td>
1999 <td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td>
2000 </tr>
2001 END
2002 ;
2003 if (!$cgiparams{'KEY'}) {
2004 print "<tr><td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</td></tr>";
2005 }
2006 print "</table>";
2007 &Header::closebox();
2008
2009 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
2010 &Header::openbox('100%', 'left', $Lang::tr{'authentication'});
2011 print <<END
2012 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
2013 <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
2014 <td class='base' width='50%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td>
2015 </tr>
2016 </table>
2017 END
2018 ;
2019 &Header::closebox();
2020 } elsif (! $cgiparams{'KEY'}) {
2021 my $cakeydisabled = ( ! -f "${General::swroot}/private/cakey.pem" ) ? "disabled='disabled'" : '';
2022 $cgiparams{'CERT_NAME'} = $Lang::tr{'vpn no full pki'} if ($cakeydisabled);
2023 my $cacrtdisabled = ( ! -f "${General::swroot}/ca/cacert.pem" ) ? "disabled='disabled'" : '';
2024
2025 &Header::openbox('100%', 'left', $Lang::tr{'authentication'});
2026 print <<END
2027 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
2028 <tr><td width='5%'><input type='radio' name='AUTH' value='psk' $checked{'AUTH'}{'psk'} /></td>
2029 <td class='base' width='55%'>$Lang::tr{'use a pre-shared key'}</td>
2030 <td class='base' width='40%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
2031 <tr><td colspan='3' bgcolor='#000000'></td></tr>
2032 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td>
2033 <td class='base'><hr />$Lang::tr{'upload a certificate request'}</td>
2034 <td class='base' rowspan='3' valign='middle'><input type='file' name='FH' size='30' $cacrtdisabled /></td></tr>
2035 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td>
2036 <td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
2037 <tr><td><input type='radio' name='AUTH' value='pkcs12' $cacrtdisabled /></td>
2038 <td class='base'>$Lang::tr{'upload p12 file'} $Lang::tr{'pkcs12 file password'}:<input type='password' name='P12_PASS'/></td></tr>
2039 <tr><td><input type='radio' name='AUTH' value='auth-dn' $checked{'AUTH'}{'auth-dn'} $cacrtdisabled /></td>
2040 <td class='base'><hr />$Lang::tr{'vpn auth-dn'}</td></tr>
2041 <tr><td colspan='3' bgcolor='#000000'></td></tr>
2042 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td>
2043 <td class='base'><hr />$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
2044 <tr><td>&nbsp;</td>
2045 <td class='base'>$Lang::tr{'users fullname or system hostname'}:</td>
2046 <td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' size='32' $cakeydisabled /></td></tr>
2047 <tr><td>&nbsp;</td>
2048 <td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2049 <td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' size='32' $cakeydisabled /></td></tr>
2050 <tr><td>&nbsp;</td>
2051 <td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2052 <td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr>
2053 <tr><td>&nbsp;</td>
2054 <td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2055 <td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr>
2056 <tr><td>&nbsp;</td>
2057 <td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2058 <td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' size='32' $cakeydisabled /></td></tr>
2059 <tr><td>&nbsp;</td>
2060 <td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2061 <td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' size='32' $cakeydisabled /></td></tr>
2062 <tr><td>&nbsp;</td>
2063 <td class='base'>$Lang::tr{'country'}:</td>
2064 <td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
2065 END
2066 ;
2067 foreach my $country (sort keys %{Countries::countries}) {
2068 print "\t\t\t<option value='$Countries::countries{$country}'";
2069 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
2070 print " selected='selected'";
2071 }
2072 print ">$country</option>\n";
2073 }
2074 print <<END
2075 </select></td></tr>
2076
2077 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)<img src='/blob.gif' alt='*' /></td>
2078 <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' $cakeydisabled /></td></tr>
2079 <tr><td>&nbsp;</td>
2080 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
2081 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
2082 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:($Lang::tr{'confirmation'})</td>
2083 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
2084 </table>
2085 END
2086 ;
2087 &Header::closebox();
2088 }
2089
2090 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
2091 if ($cgiparams{'KEY'}) {
2092 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
2093 }
2094 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2095 &Header::closebigbox();
2096 &Header::closepage();
2097 exit (0);
2098
2099 VPNCONF_END:
2100 }
2101
2102 ###
2103 ### Advanced settings
2104 ###
2105 if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
2106 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq 'yes')) {
2107 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
2108 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
2109 if (! $confighash{$cgiparams{'KEY'}}) {
2110 $errormessage = $Lang::tr{'invalid key'};
2111 goto ADVANCED_END;
2112 }
2113
2114 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2115 # I didn't read any incompatibilities here....
2116 #if ($cgiparams{'VHOST'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
2117 # $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
2118 # goto ADVANCED_ERROR;
2119 #}
2120 my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
2121 if ($#temp < 0) {
2122 $errormessage = $Lang::tr{'invalid input'};
2123 goto ADVANCED_ERROR;
2124 }
2125 foreach my $val (@temp) {
2126 if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
2127 $errormessage = $Lang::tr{'invalid input'};
2128 goto ADVANCED_ERROR;
2129 }
2130 }
2131 @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
2132 if ($#temp < 0) {
2133 $errormessage = $Lang::tr{'invalid input'};
2134 goto ADVANCED_ERROR;
2135 }
2136 foreach my $val (@temp) {
2137 if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha|md5|aesxcbc)$/) {
2138 $errormessage = $Lang::tr{'invalid input'};
2139 goto ADVANCED_ERROR;
2140 }
2141 }
2142 @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
2143 if ($#temp < 0) {
2144 $errormessage = $Lang::tr{'invalid input'};
2145 goto ADVANCED_ERROR;
2146 }
2147 foreach my $val (@temp) {
2148 if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) {
2149 $errormessage = $Lang::tr{'invalid input'};
2150 goto ADVANCED_ERROR;
2151 }
2152 }
2153 if ($cgiparams{'IKE_LIFETIME'} !~ /^\d+$/) {
2154 $errormessage = $Lang::tr{'invalid input for ike lifetime'};
2155 goto ADVANCED_ERROR;
2156 }
2157 if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
2158 $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
2159 goto ADVANCED_ERROR;
2160 }
2161 @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
2162 if ($#temp < 0) {
2163 $errormessage = $Lang::tr{'invalid input'};
2164 goto ADVANCED_ERROR;
2165 }
2166 foreach my $val (@temp) {
2167 if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
2168 $errormessage = $Lang::tr{'invalid input'};
2169 goto ADVANCED_ERROR;
2170 }
2171 }
2172 @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
2173 if ($#temp < 0) {
2174 $errormessage = $Lang::tr{'invalid input'};
2175 goto ADVANCED_ERROR;
2176 }
2177 foreach my $val (@temp) {
2178 if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha1|md5|aesxcbc)$/) {
2179 $errormessage = $Lang::tr{'invalid input'};
2180 goto ADVANCED_ERROR;
2181 }
2182 }
2183 if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
2184 $cgiparams{'ESP_GROUPTYPE'} !~ /^ecp(192|224|256|384|512)(bp)?$/ &&
2185 $cgiparams{'ESP_GROUPTYPE'} !~ /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) {
2186 $errormessage = $Lang::tr{'invalid input'};
2187 goto ADVANCED_ERROR;
2188 }
2189
2190 if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
2191 $errormessage = $Lang::tr{'invalid input for esp keylife'};
2192 goto ADVANCED_ERROR;
2193 }
2194 if ($cgiparams{'ESP_KEYLIFE'} < 1 || $cgiparams{'ESP_KEYLIFE'} > 24) {
2195 $errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'};
2196 goto ADVANCED_ERROR;
2197 }
2198
2199 if (
2200 ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
2201 ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
2202 ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
2203 ($cgiparams{'VHOST'} !~ /^(|on|off)$/)
2204 ){
2205 $errormessage = $Lang::tr{'invalid input'};
2206 goto ADVANCED_ERROR;
2207 }
2208
2209 if ($cgiparams{'DPD_DELAY'} !~ /^\d+$/) {
2210 $errormessage = $Lang::tr{'invalid input for dpd delay'};
2211 goto ADVANCED_ERROR;
2212 }
2213
2214 if ($cgiparams{'DPD_TIMEOUT'} !~ /^\d+$/) {
2215 $errormessage = $Lang::tr{'invalid input for dpd timeout'};
2216 goto ADVANCED_ERROR;
2217 }
2218
2219 $confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
2220 $confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
2221 $confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'};
2222 $confighash{$cgiparams{'KEY'}}[16] = $cgiparams{'IKE_LIFETIME'};
2223 $confighash{$cgiparams{'KEY'}}[21] = $cgiparams{'ESP_ENCRYPTION'};
2224 $confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
2225 $confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
2226 $confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
2227 $confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'};
2228 $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
2229 $confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
2230 $confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
2231 $confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'VHOST'};
2232 $confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
2233 $confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
2234 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
2235 &writeipsecfiles();
2236 if (&vpnenabled) {
2237 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2238 sleep $sleepDelay;
2239 }
2240 goto ADVANCED_END;
2241 } else {
2242 $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
2243 $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
2244 $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
2245 $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16];
2246 $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
2247 $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
2248 $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
2249 $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
2250 $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
2251 $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
2252 $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
2253 $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
2254 $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30];
2255 $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31];
2256
2257 if (!$cgiparams{'DPD_DELAY'}) {
2258 $cgiparams{'DPD_DELAY'} = 30;
2259 }
2260
2261 if (!$cgiparams{'DPD_TIMEOUT'}) {
2262 $cgiparams{'DPD_TIMEOUT'} = 120;
2263 }
2264
2265 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net' || $confighash{$cgiparams{'KEY'}}[10]) {
2266 $cgiparams{'VHOST'} = 'off';
2267 }
2268 }
2269
2270 ADVANCED_ERROR:
2271 $checked{'IKE_ENCRYPTION'}{'aes256'} = '';
2272 $checked{'IKE_ENCRYPTION'}{'aes192'} = '';
2273 $checked{'IKE_ENCRYPTION'}{'aes128'} = '';
2274 $checked{'IKE_ENCRYPTION'}{'3des'} = '';
2275 $checked{'IKE_ENCRYPTION'}{'camellia256'} = '';
2276 $checked{'IKE_ENCRYPTION'}{'camellia192'} = '';
2277 $checked{'IKE_ENCRYPTION'}{'camellia128'} = '';
2278 my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
2279 foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; }
2280 $checked{'IKE_INTEGRITY'}{'sha2_512'} = '';
2281 $checked{'IKE_INTEGRITY'}{'sha2_384'} = '';
2282 $checked{'IKE_INTEGRITY'}{'sha2_256'} = '';
2283 $checked{'IKE_INTEGRITY'}{'sha'} = '';
2284 $checked{'IKE_INTEGRITY'}{'md5'} = '';
2285 $checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
2286 @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
2287 foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
2288 $checked{'IKE_GROUPTYPE'}{'768'} = '';
2289 $checked{'IKE_GROUPTYPE'}{'1024'} = '';
2290 $checked{'IKE_GROUPTYPE'}{'1536'} = '';
2291 $checked{'IKE_GROUPTYPE'}{'2048'} = '';
2292 $checked{'IKE_GROUPTYPE'}{'3072'} = '';
2293 $checked{'IKE_GROUPTYPE'}{'4096'} = '';
2294 $checked{'IKE_GROUPTYPE'}{'6144'} = '';
2295 $checked{'IKE_GROUPTYPE'}{'8192'} = '';
2296 @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
2297 foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; }
2298
2299 # 768 is not supported by strongswan
2300 $checked{'IKE_GROUPTYPE'}{'768'} = '';
2301
2302 $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
2303 $checked{'ESP_ENCRYPTION'}{'aes192'} = '';
2304 $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
2305 $checked{'ESP_ENCRYPTION'}{'3des'} = '';
2306 $checked{'ESP_ENCRYPTION'}{'camellia256'} = '';
2307 $checked{'ESP_ENCRYPTION'}{'camellia192'} = '';
2308 $checked{'ESP_ENCRYPTION'}{'camellia128'} = '';
2309 @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
2310 foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; }
2311 $checked{'ESP_INTEGRITY'}{'sha2_512'} = '';
2312 $checked{'ESP_INTEGRITY'}{'sha2_384'} = '';
2313 $checked{'ESP_INTEGRITY'}{'sha2_256'} = '';
2314 $checked{'ESP_INTEGRITY'}{'sha1'} = '';
2315 $checked{'ESP_INTEGRITY'}{'md5'} = '';
2316 $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
2317 @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
2318 foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
2319 $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
2320
2321 $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
2322 $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
2323 $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
2324 $checked{'VHOST'} = $cgiparams{'VHOST'} eq 'on' ? "checked='checked'" : '' ;
2325
2326 $selected{'DPD_ACTION'}{'clear'} = '';
2327 $selected{'DPD_ACTION'}{'hold'} = '';
2328 $selected{'DPD_ACTION'}{'restart'} = '';
2329 $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
2330
2331 &Header::showhttpheaders();
2332 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2333 &Header::openbigbox('100%', 'left', '', $errormessage);
2334
2335 if ($errormessage) {
2336 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
2337 print "<class name='base'>$errormessage";
2338 print "&nbsp;</class>";
2339 &Header::closebox();
2340 }
2341
2342 if ($warnmessage) {
2343 &Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
2344 print "<class name='base'>$warnmessage";
2345 print "&nbsp;</class>";
2346 &Header::closebox();
2347 }
2348
2349 &Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:");
2350 print <<EOF
2351 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
2352 <input type='hidden' name='ADVANCED' value='yes' />
2353 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
2354
2355 <table width='100%'>
2356 <thead>
2357 <tr>
2358 <th width="15%"></th>
2359 <th>IKE</th>
2360 <th>ESP</th>
2361 </tr>
2362 </thead>
2363 <tbody>
2364 <tr>
2365 <td class='boldbase' width="15%">$Lang::tr{'encryption'}</td>
2366 <td class='boldbase'>
2367 <select name='IKE_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
2368 <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
2369 <option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
2370 <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
2371 <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>3DES</option>
2372 <option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
2373 <option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
2374 <option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
2375 </select>
2376 </td>
2377 <td class='boldbase'>
2378 <select name='ESP_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
2379 <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
2380 <option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
2381 <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
2382 <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>3DES</option>
2383 <option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
2384 <option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
2385 <option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
2386 </select>
2387 </td>
2388 </tr>
2389
2390 <tr>
2391 <td class='boldbase' width="15%">$Lang::tr{'integrity'}</td>
2392 <td class='boldbase'>
2393 <select name='IKE_INTEGRITY' multiple='multiple' size='6' style='width: 100%'>
2394 <option value='sha2_512' $checked{'IKE_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
2395 <option value='sha2_384' $checked{'IKE_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
2396 <option value='sha2_256' $checked{'IKE_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
2397 <option value='sha' $checked{'IKE_INTEGRITY'}{'sha'}>SHA1</option>
2398 <option value='md5' $checked{'IKE_INTEGRITY'}{'md5'}>MD5</option>
2399 <option value='aesxcbc' $checked{'IKE_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
2400 </select>
2401 </td>
2402 <td class='boldbase'>
2403 <select name='ESP_INTEGRITY' multiple='multiple' size='6' style='width: 100%'>
2404 <option value='sha2_512' $checked{'ESP_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
2405 <option value='sha2_384' $checked{'ESP_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
2406 <option value='sha2_256' $checked{'ESP_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
2407 <option value='sha1' $checked{'ESP_INTEGRITY'}{'sha1'}>SHA1</option>
2408 <option value='md5' $checked{'ESP_INTEGRITY'}{'md5'}>MD5</option>
2409 <option value='aesxcbc' $checked{'ESP_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
2410 </select>
2411 </td>
2412 </tr>
2413 <tr>
2414 <td class='boldbase' width="15%">$Lang::tr{'lifetime'}</td>
2415 <td class='boldbase'>
2416 <input type='text' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' size='5' /> $Lang::tr{'hours'}
2417 </td>
2418 <td class='boldbase'>
2419 <input type='text' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' size='5' /> $Lang::tr{'hours'}
2420 </td>
2421 </tr>
2422 <tr>
2423 <td class='boldbase' width="15%">$Lang::tr{'grouptype'}</td>
2424 <td class='boldbase'>
2425 <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
2426 <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
2427 <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
2428 <option value='e256' $checked{'IKE_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
2429 <option value='e224' $checked{'IKE_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
2430 <option value='e192' $checked{'IKE_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
2431 <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
2432 <option value='e384bp' $checked{'IKE_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option>
2433 <option value='e256bp' $checked{'IKE_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option>
2434 <option value='e224bp' $checked{'IKE_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option>
2435 <option value='8192' $checked{'IKE_GROUPTYPE'}{'8192'}>MODP-8192</option>
2436 <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option>
2437 <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option>
2438 <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option>
2439 <option value='2048s256' $checked{'IKE_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
2440 <option value='2048s224' $checked{'IKE_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
2441 <option value='2048s160' $checked{'IKE_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>
2442 <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option>
2443 <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option>
2444 <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option>
2445 </select>
2446 </td>
2447 <td></td>
2448 </tr>
2449 </tbody>
2450 </table>
2451
2452 <br><br>
2453
2454 <h2>$Lang::tr{'dead peer detection'}</h2>
2455
2456 <table width="100%">
2457 <tr>
2458 <td width="15%">$Lang::tr{'dpd action'}:</td>
2459 <td>
2460 <select name='DPD_ACTION'>
2461 <option value='clear' $selected{'DPD_ACTION'}{'clear'}>clear</option>
2462 <option value='hold' $selected{'DPD_ACTION'}{'hold'}>hold</option>
2463 <option value='restart' $selected{'DPD_ACTION'}{'restart'}>restart</option>
2464 </select>
2465 </td>
2466 </tr>
2467 <tr>
2468 <td width="15%">$Lang::tr{'dpd timeout'}:</td>
2469 <td>
2470 <input type='text' name='DPD_TIMEOUT' size='5' value='$cgiparams{'DPD_TIMEOUT'}' />
2471 </td>
2472 </tr>
2473 <tr>
2474 <td width="15%">$Lang::tr{'dpd delay'}:</td>
2475 <td>
2476 <input type='text' name='DPD_DELAY' size='5' value='$cgiparams{'DPD_DELAY'}' />
2477 </td>
2478 </tr>
2479 </table>
2480
2481 <hr>
2482
2483 <table width="100%">
2484 <tr>
2485 <td>
2486 <label>
2487 <input type='checkbox' name='ONLY_PROPOSED' $checked{'ONLY_PROPOSED'} />
2488 IKE+ESP: $Lang::tr{'use only proposed settings'}</td>
2489 </label>
2490 </td>
2491 </tr>
2492 <tr>
2493 <td>
2494 <label>
2495 <input type='checkbox' name='PFS' $checked{'PFS'} />
2496 $Lang::tr{'pfs yes no'}
2497 </label>
2498 </td>
2499 </tr>
2500 <tr>
2501 <td>
2502 <label>
2503 <input type='checkbox' name='COMPRESSION' $checked{'COMPRESSION'} />
2504 $Lang::tr{'vpn payload compression'}
2505 </label>
2506 </td>
2507 </tr>
2508 EOF
2509 ;
2510 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2511 print "<tr><td><input type='hidden' name='VHOST' value='off' /></td></tr>";
2512 } elsif ($confighash{$cgiparams{'KEY'}}[10]) {
2513 print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} disabled='disabled' />";
2514 print " $Lang::tr{'vpn vhost'}</label></td></tr>";
2515 } else {
2516 print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} />";
2517 print " $Lang::tr{'vpn vhost'}</label></td></tr>";