b9a73e5f24c286460f292ddc5fb4084e86f3c5fb
[people/teissler/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi
1 #!/usr/bin/perl
2 ###############################################################################
3 # #
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2007-2013 IPFire Team info@ipfire.org #
6 # #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
11 # #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
16 # #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
19 # #
20 ###############################################################################
21
22 use Net::DNS;
23 use File::Copy;
24 use File::Temp qw/ tempfile tempdir /;
25 use strict;
26 use Sort::Naturally;
27 # enable only the following on debugging purpose
28 #use warnings;
29 #use CGI::Carp 'fatalsToBrowser';
30
31 require '/var/ipfire/general-functions.pl';
32 require "${General::swroot}/lang.pl";
33 require "${General::swroot}/header.pl";
34 require "${General::swroot}/countries.pl";
35
36 #workaround to suppress a warning when a variable is used only once
37 my @dummy = ( ${Header::colourgreen}, ${Header::colourblue} );
38 undef (@dummy);
39
40 ###
41 ### Initialize variables
42 ###
43 my $sleepDelay = 4; # after a call to ipsecctrl S or R, wait this delay (seconds) before reading status
44 # (let the ipsec do its job)
45 my %netsettings=();
46 our %cgiparams=();
47 our %vpnsettings=();
48 my %checked=();
49 my %confighash=();
50 my %cahash=();
51 my %selected=();
52 my $warnmessage = '';
53 my $errormessage = '';
54
55 my %color = ();
56 my %mainsettings = ();
57 &General::readhash("${General::swroot}/main/settings", \%mainsettings);
58 &General::readhash("/srv/web/ipfire/html/themes/".$mainsettings{'THEME'}."/include/colors.txt", \%color);
59
60 &General::readhash("${General::swroot}/ethernet/settings", \%netsettings);
61
62 my $green_cidr = &General::ipcidr("$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}");
63 my $blue_cidr = "# Blue not defined";
64 if (&Header::blue_used() && $netsettings{'BLUE_DEV'}) {
65 $blue_cidr = &General::ipcidr("$netsettings{'BLUE_NETADDRESS'}/$netsettings{'BLUE_NETMASK'}");
66 }
67 my $orange_cidr = "# Orange not defined";
68 if (&Header::orange_used() && $netsettings{'ORANGE_DEV'}) {
69 $orange_cidr = &General::ipcidr("$netsettings{'ORANGE_NETADDRESS'}/$netsettings{'ORANGE_NETMASK'}");
70 }
71
72 $cgiparams{'ENABLED'} = 'off';
73 $cgiparams{'EDIT_ADVANCED'} = 'off';
74 $cgiparams{'ACTION'} = '';
75 $cgiparams{'CA_NAME'} = '';
76 $cgiparams{'KEY'} = '';
77 $cgiparams{'TYPE'} = '';
78 $cgiparams{'ADVANCED'} = '';
79 $cgiparams{'NAME'} = '';
80 $cgiparams{'LOCAL_SUBNET'} = '';
81 $cgiparams{'REMOTE_SUBNET'} = '';
82 $cgiparams{'REMOTE'} = '';
83 $cgiparams{'LOCAL_ID'} = '';
84 $cgiparams{'REMOTE_ID'} = '';
85 $cgiparams{'REMARK'} = '';
86 $cgiparams{'PSK'} = '';
87 $cgiparams{'CERT_NAME'} = '';
88 $cgiparams{'CERT_EMAIL'} = '';
89 $cgiparams{'CERT_OU'} = '';
90 $cgiparams{'CERT_ORGANIZATION'} = '';
91 $cgiparams{'CERT_CITY'} = '';
92 $cgiparams{'CERT_STATE'} = '';
93 $cgiparams{'CERT_COUNTRY'} = '';
94 $cgiparams{'SUBJECTALTNAME'} = '';
95 $cgiparams{'CERT_PASS1'} = '';
96 $cgiparams{'CERT_PASS2'} = '';
97 $cgiparams{'ROOTCERT_HOSTNAME'} = '';
98 $cgiparams{'ROOTCERT_COUNTRY'} = '';
99 $cgiparams{'P12_PASS'} = '';
100 $cgiparams{'ROOTCERT_ORGANIZATION'} = '';
101 $cgiparams{'ROOTCERT_HOSTNAME'} = '';
102 $cgiparams{'ROOTCERT_EMAIL'} = '';
103 $cgiparams{'ROOTCERT_OU'} = '';
104 $cgiparams{'ROOTCERT_CITY'} = '';
105 $cgiparams{'ROOTCERT_STATE'} = '';
106 $cgiparams{'RW_NET'} = '';
107 $cgiparams{'DPD_DELAY'} = '30';
108 $cgiparams{'DPD_TIMEOUT'} = '120';
109 &Header::getcgihash(\%cgiparams, {'wantfile' => 1, 'filevar' => 'FH'});
110
111 ###
112 ### Useful functions
113 ###
114 sub valid_dns_host {
115 my $hostname = $_[0];
116 unless ($hostname) { return "No hostname"};
117 my $res = new Net::DNS::Resolver;
118 my $query = $res->search("$hostname");
119 if ($query) {
120 foreach my $rr ($query->answer) {
121 ## Potential bug - we are only looking at A records:
122 return 0 if $rr->type eq "A";
123 }
124 } else {
125 return $res->errorstring;
126 }
127 }
128 ###
129 ### Just return true is one interface is vpn enabled
130 ###
131 sub vpnenabled {
132 return ($vpnsettings{'ENABLED'} eq 'on');
133 }
134 ###
135 ### old version: maintain serial number to one, without explication.
136 ### this : let the counter go, so that each cert is numbered.
137 ###
138 sub cleanssldatabase
139 {
140 if (open(FILE, ">${General::swroot}/certs/serial")) {
141 print FILE "01";
142 close FILE;
143 }
144 if (open(FILE, ">${General::swroot}/certs/index.txt")) {
145 print FILE "";
146 close FILE;
147 }
148 unlink ("${General::swroot}/certs/index.txt.old");
149 unlink ("${General::swroot}/certs/serial.old");
150 unlink ("${General::swroot}/certs/01.pem");
151 }
152 sub newcleanssldatabase
153 {
154 if (! -s "${General::swroot}/certs/serial" ) {
155 open(FILE, ">${General::swroot}/certs/serial");
156 print FILE "01";
157 close FILE;
158 }
159 if (! -s ">${General::swroot}/certs/index.txt") {
160 system ("touch ${General::swroot}/certs/index.txt");
161 }
162 unlink ("${General::swroot}/certs/index.txt.old");
163 unlink ("${General::swroot}/certs/serial.old");
164 # unlink ("${General::swroot}/certs/01.pem"); numbering evolves. Wrong place to delete
165 }
166
167 ###
168 ### Call openssl and return errormessage if any
169 ###
170 sub callssl ($) {
171 my $opt = shift;
172 my $retssl = `/usr/bin/openssl $opt 2>&1`; #redirect stderr
173 my $ret = '';
174 foreach my $line (split (/\n/, $retssl)) {
175 &General::log("ipsec", "$line") if (0); # 1 for verbose logging
176 $ret .= '<br>'.$line if ( $line =~ /error|unknown/ );
177 }
178 if ($ret) {
179 $ret= &Header::cleanhtml($ret);
180 }
181 return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ;
182 }
183 ###
184 ### Obtain a CN from given cert
185 ###
186 sub getCNfromcert ($) {
187 #&General::log("ipsec", "Extracting name from $_[0]...");
188 my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
189 $temp =~ /Subject:.*CN=(.*)[\n]/;
190 $temp = $1;
191 $temp =~ s+/Email+, E+;
192 $temp =~ s/ ST=/ S=/;
193 $temp =~ s/,//g;
194 $temp =~ s/\'//g;
195 return $temp;
196 }
197 ###
198 ### Obtain Subject from given cert
199 ###
200 sub getsubjectfromcert ($) {
201 #&General::log("ipsec", "Extracting subject from $_[0]...");
202 my $temp = `/usr/bin/openssl x509 -text -in $_[0]`;
203 $temp =~ /Subject: (.*)[\n]/;
204 $temp = $1;
205 $temp =~ s+/Email+, E+;
206 $temp =~ s/ ST=/ S=/;
207 return $temp;
208 }
209 ###
210 ### Combine local subnet and connection name to make a unique name for each connection section
211 ### (this sub is not used now)
212 ###
213 sub makeconnname ($) {
214 my $conn = shift;
215 my $subnet = shift;
216
217 $subnet =~ /^(.*?)\/(.*?)$/; # $1=IP $2=mask
218 my $ip = unpack('N', &Socket::inet_aton($1));
219 if (length ($2) > 2) {
220 my $mm = unpack('N', &Socket::inet_aton($2));
221 while ( ($mm & 1)==0 ) {
222 $ip >>= 1;
223 $mm >>= 1;
224 };
225 } else {
226 $ip >>= (32 - $2);
227 }
228 return sprintf ("%s-%X", $conn, $ip);
229 }
230 ###
231 ### Write a config file.
232 ###
233 ###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and
234 ### the side is always defined as 'left'.
235 ### configihash[14]: 'VHOST' is allowed
236 ###
237
238 sub writeipsecfiles {
239 my %lconfighash = ();
240 my %lvpnsettings = ();
241 &General::readhasharray("${General::swroot}/vpn/config", \%lconfighash);
242 &General::readhash("${General::swroot}/vpn/settings", \%lvpnsettings);
243
244 open(CONF, ">${General::swroot}/vpn/ipsec.conf") or die "Unable to open ${General::swroot}/vpn/ipsec.conf: $!";
245 open(SECRETS, ">${General::swroot}/vpn/ipsec.secrets") or die "Unable to open ${General::swroot}/vpn/ipsec.secrets: $!";
246 flock CONF, 2;
247 flock SECRETS, 2;
248 print CONF "version 2\n\n";
249 print CONF "conn %default\n";
250 print CONF "\tkeyingtries=%forever\n";
251 print CONF "\n";
252
253 # Add user includes to config file
254 print CONF "include /etc/ipsec.user.conf\n";
255 print CONF "\n";
256
257 print SECRETS "include /etc/ipsec.user.secrets\n";
258
259 if (-f "${General::swroot}/certs/hostkey.pem") {
260 print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n"
261 }
262 my $last_secrets = ''; # old the less specifics connections
263
264 foreach my $key (keys %lconfighash) {
265 next if ($lconfighash{$key}[0] ne 'on');
266
267 #remote peer is not set? => use '%any'
268 $lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq '');
269
270 my $localside;
271 if ($lconfighash{$key}[26] eq 'BLUE') {
272 $localside = $netsettings{'BLUE_ADDRESS'};
273 } elsif ($lconfighash{$key}[26] eq 'GREEN') {
274 $localside = $netsettings{'GREEN_ADDRESS'};
275 } elsif ($lconfighash{$key}[26] eq 'ORANGE') {
276 $localside = $netsettings{'ORANGE_ADDRESS'};
277 } else { # it is RED
278 $localside = $lvpnsettings{'VPN_IP'};
279 }
280
281 print CONF "conn $lconfighash{$key}[1]\n";
282 print CONF "\tleft=$localside\n";
283 my $cidr_net=&General::ipcidr($lconfighash{$key}[8]);
284 print CONF "\tleftsubnet=$cidr_net\n";
285 print CONF "\tleftfirewall=yes\n";
286 print CONF "\tlefthostaccess=yes\n";
287
288 print CONF "\tright=$lconfighash{$key}[10]\n";
289 if ($lconfighash{$key}[3] eq 'net') {
290 my $cidr_net=&General::ipcidr($lconfighash{$key}[11]);
291 print CONF "\trightsubnet=$cidr_net\n";
292 } elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed for roadwarriors?
293 print CONF "\trightsubnet=vhost:%no,%priv\n";
294 }
295
296 # Local Cert and Remote Cert (unless auth is DN dn-auth)
297 if ($lconfighash{$key}[4] eq 'cert') {
298 print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n";
299 print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn');
300 }
301
302 # Local and Remote IDs
303 print CONF "\tleftid=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]);
304 print CONF "\trightid=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]);
305
306 # Is PFS enabled?
307 my $pfs = $lconfighash{$key}[28] eq 'on' ? 'on' : 'off';
308
309 # Algorithms
310 if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) {
311 print CONF "\tike=";
312 my @encs = split('\|', $lconfighash{$key}[18]);
313 my @ints = split('\|', $lconfighash{$key}[19]);
314 my @groups = split('\|', $lconfighash{$key}[20]);
315 my $comma = 0;
316 foreach my $i (@encs) {
317 foreach my $j (@ints) {
318 foreach my $k (@groups) {
319 if ($comma != 0) { print CONF ","; } else { $comma = 1; }
320
321 my @l = split("", $k);
322 if ($l[0] eq "e") {
323 shift @l;
324 print CONF "$i-$j-ecp".join("", @l);
325 } else {
326 print CONF "$i-$j-modp$k";
327 }
328 }
329 }
330 }
331 if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
332 print CONF "!\n";
333 } else {
334 print CONF "\n";
335 }
336 }
337 if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
338 print CONF "\tesp=";
339 my @encs = split('\|', $lconfighash{$key}[21]);
340 my @ints = split('\|', $lconfighash{$key}[22]);
341 my @groups = split('\|', $lconfighash{$key}[20]);
342 my $comma = 0;
343 foreach my $i (@encs) {
344 foreach my $j (@ints) {
345 my $modp = "";
346 if ($pfs eq "on") {
347 foreach my $k (@groups) {
348 if ($comma != 0) { print CONF ","; } else { $comma = 1; }
349 if ($pfs eq "on") {
350 my @l = split("", $k);
351 if ($l[0] eq "e") {
352 $modp = "";
353 } else {
354 $modp = "-modp$k";
355 }
356 } else {
357 $modp = "";
358 }
359 print CONF "$i-$j$modp";
360 }
361 } else {
362 if ($comma != 0) { print CONF ","; } else { $comma = 1; }
363 print CONF "$i-$j";
364 }
365 }
366 }
367 if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms?
368 print CONF "!\n";
369 } else {
370 print CONF "\n";
371 }
372 }
373
374 # IKE V1 or V2
375 if (! $lconfighash{$key}[29]) {
376 $lconfighash{$key}[29] = "ikev1";
377 }
378 print CONF "\tkeyexchange=$lconfighash{$key}[29]\n";
379
380 # Lifetimes
381 print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]);
382 print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]);
383
384 # Compression
385 print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on');
386
387 # Dead Peer Detection
388 print CONF "\tdpddelay=$lconfighash{$key}[30]\n";
389 print CONF "\tdpdtimeout=$lconfighash{$key}[31]\n";
390 print CONF "\tdpdaction=$lconfighash{$key}[27]\n";
391
392 # Build Authentication details: LEFTid RIGHTid : PSK psk
393 my $psk_line;
394 if ($lconfighash{$key}[4] eq 'psk') {
395 $psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ;
396 $psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; #remoteid or remote address?
397 $psk_line .= " : PSK '$lconfighash{$key}[5]'\n";
398 # if the line contains %any, it is less specific than two IP or ID, so move it at end of file.
399 if ($psk_line =~ /%any/) {
400 $last_secrets .= $psk_line;
401 } else {
402 print SECRETS $psk_line;
403 }
404 print CONF "\tauthby=secret\n";
405 } else {
406 print CONF "\tauthby=rsasig\n";
407 print CONF "\tleftrsasigkey=%cert\n";
408 print CONF "\trightrsasigkey=%cert\n";
409 }
410
411 # Automatically start only if a net-to-net connection
412 if ($lconfighash{$key}[3] eq 'host') {
413 print CONF "\tauto=add\n";
414 print CONF "\trightsourceip=$lvpnsettings{'RW_NET'}\n";
415 } else {
416 print CONF "\tauto=start\n";
417 }
418 print CONF "\n";
419 }#foreach key
420 print SECRETS $last_secrets if ($last_secrets);
421 close(CONF);
422 close(SECRETS);
423 }
424
425 # Hook to regenerate the configuration files.
426 if ($ENV{"REMOTE_ADDR"} eq "") {
427 writeipsecfiles();
428 exit(0);
429 }
430
431 ###
432 ### Save main settings
433 ###
434 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cgiparams{'KEY'} eq '') {
435 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
436 unless (&General::validfqdn($cgiparams{'VPN_IP'}) || &General::validip($cgiparams{'VPN_IP'})
437 || $cgiparams{'VPN_IP'} eq '%defaultroute' ) {
438 $errormessage = $Lang::tr{'invalid input for hostname'};
439 goto SAVE_ERROR;
440 }
441
442 unless ($cgiparams{'VPN_DELAYED_START'} =~ /^[0-9]{1,3}$/ ) { #allow 0-999 seconds !
443 $errormessage = $Lang::tr{'invalid time period'};
444 goto SAVE_ERROR;
445 }
446
447 if ( $cgiparams{'RW_NET'} ne '' and !&General::validipandmask($cgiparams{'RW_NET'}) ) {
448 $errormessage = $Lang::tr{'urlfilter invalid ip or mask error'};
449 goto SAVE_ERROR;
450 }
451
452 $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'};
453 $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'};
454 $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'};
455 $vpnsettings{'RW_NET'} = $cgiparams{'RW_NET'};
456 &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
457 &writeipsecfiles();
458 if (&vpnenabled) {
459 system('/usr/local/bin/ipsecctrl', 'S');
460 } else {
461 system('/usr/local/bin/ipsecctrl', 'D');
462 }
463 sleep $sleepDelay;
464 SAVE_ERROR:
465 ###
466 ### Reset all step 2
467 ###
468 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') {
469 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
470
471 foreach my $key (keys %confighash) {
472 if ($confighash{$key}[4] eq 'cert') {
473 delete $confighash{$key};
474 }
475 }
476 while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) {
477 unlink $file
478 }
479 &cleanssldatabase();
480 if (open(FILE, ">${General::swroot}/vpn/caconfig")) {
481 print FILE "";
482 close FILE;
483 }
484 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
485 &writeipsecfiles();
486 system('/usr/local/bin/ipsecctrl', 'R');
487 sleep $sleepDelay;
488
489 ###
490 ### Reset all step 1
491 ###
492 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) {
493 &Header::showhttpheaders();
494 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
495 &Header::openbigbox('100%', 'left', '', '');
496 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
497 print <<END
498 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
499 <table width='100%'>
500 <tr>
501 <td align='center'>
502 <input type='hidden' name='AREUSURE' value='yes' />
503 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
504 $Lang::tr{'resetting the vpn configuration will remove the root ca, the host certificate and all certificate based connections'}</td>
505 </tr><tr>
506 <td align='center'>
507 <input type='submit' name='ACTION' value='$Lang::tr{'remove x509'}' />
508 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
509 </tr>
510 </table>
511 </form>
512 END
513 ;
514 &Header::closebox();
515 &Header::closebigbox();
516 &Header::closepage();
517 exit (0);
518
519 ###
520 ### Upload CA Certificate
521 ###
522 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload ca certificate'}) {
523 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
524
525 if ($cgiparams{'CA_NAME'} !~ /^[a-zA-Z0-9]+$/) {
526 $errormessage = $Lang::tr{'name must only contain characters'};
527 goto UPLOADCA_ERROR;
528 }
529
530 if (length($cgiparams{'CA_NAME'}) >60) {
531 $errormessage = $Lang::tr{'name too long'};
532 goto VPNCONF_ERROR;
533 }
534
535 if ($cgiparams{'CA_NAME'} eq 'ca') {
536 $errormessage = $Lang::tr{'name is invalid'};
537 goto UPLOAD_CA_ERROR;
538 }
539
540 # Check if there is no other entry with this name
541 foreach my $key (keys %cahash) {
542 if ($cahash{$key}[0] eq $cgiparams{'CA_NAME'}) {
543 $errormessage = $Lang::tr{'a ca certificate with this name already exists'};
544 goto UPLOADCA_ERROR;
545 }
546 }
547
548 if (ref ($cgiparams{'FH'}) ne 'Fh') {
549 $errormessage = $Lang::tr{'there was no file upload'};
550 goto UPLOADCA_ERROR;
551 }
552 # Move uploaded ca to a temporary file
553 (my $fh, my $filename) = tempfile( );
554 if (copy ($cgiparams{'FH'}, $fh) != 1) {
555 $errormessage = $!;
556 goto UPLOADCA_ERROR;
557 }
558 my $temp = `/usr/bin/openssl x509 -text -in $filename`;
559 if ($temp !~ /CA:TRUE/i) {
560 $errormessage = $Lang::tr{'not a valid ca certificate'};
561 unlink ($filename);
562 goto UPLOADCA_ERROR;
563 } else {
564 move($filename, "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
565 if ($? ne 0) {
566 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
567 unlink ($filename);
568 goto UPLOADCA_ERROR;
569 }
570 }
571
572 my $key = &General::findhasharraykey (\%cahash);
573 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
574 $cahash{$key}[1] = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"));
575 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
576
577 system('/usr/local/bin/ipsecctrl', 'R');
578 sleep $sleepDelay;
579
580 UPLOADCA_ERROR:
581
582 ###
583 ### Display ca certificate
584 ###
585 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show ca certificate'}) {
586 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
587
588 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem") {
589 &Header::showhttpheaders();
590 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
591 &Header::openbigbox('100%', 'left', '', '');
592 &Header::openbox('100%', 'left', "$Lang::tr{'ca certificate'}:");
593 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
594 $output = &Header::cleanhtml($output,"y");
595 print "<pre>$output</pre>\n";
596 &Header::closebox();
597 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
598 &Header::closebigbox();
599 &Header::closepage();
600 exit(0);
601 } else {
602 $errormessage = $Lang::tr{'invalid key'};
603 }
604
605 ###
606 ### Export ca certificate to browser
607 ###
608 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) {
609 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
610
611 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
612 print "Content-Type: application/force-download\n";
613 print "Content-Type: application/octet-stream\r\n";
614 print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n";
615 print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`;
616 exit(0);
617 } else {
618 $errormessage = $Lang::tr{'invalid key'};
619 }
620
621 ###
622 ### Remove ca certificate (step 2)
623 ###
624 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'} && $cgiparams{'AREUSURE'} eq 'yes') {
625 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
626 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
627
628 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
629 foreach my $key (keys %confighash) {
630 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
631 if ($test =~ /: OK/) {
632 # Delete connection
633 system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled);
634 unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem");
635 unlink ("${General::swroot}/certs/$confighash{$key}[1].p12");
636 delete $confighash{$key};
637 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
638 &writeipsecfiles();
639 }
640 }
641 unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
642 delete $cahash{$cgiparams{'KEY'}};
643 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
644 system('/usr/local/bin/ipsecctrl', 'R');
645 sleep $sleepDelay;
646 } else {
647 $errormessage = $Lang::tr{'invalid key'};
648 }
649 ###
650 ### Remove ca certificate (step 1)
651 ###
652 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove ca certificate'}) {
653 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
654 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
655
656 my $assignedcerts = 0;
657 if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) {
658 foreach my $key (keys %confighash) {
659 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`;
660 if ($test =~ /: OK/) {
661 $assignedcerts++;
662 }
663 }
664 if ($assignedcerts) {
665 &Header::showhttpheaders();
666 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
667 &Header::openbigbox('100%', 'left', '', '');
668 &Header::openbox('100%', 'left', $Lang::tr{'are you sure'});
669 print <<END
670 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
671 <table width='100%'>
672 <tr>
673 <td align='center'>
674 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
675 <input type='hidden' name='AREUSURE' value='yes' /></td>
676 </tr><tr>
677 <td align='center'>
678 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>
679 $Lang::tr{'connections are associated with this ca. deleting the ca will delete these connections as well.'}</td>
680 </tr><tr>
681 <td align='center'>
682 <input type='submit' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
683 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></td>
684 </tr>
685 </table>
686 </form>
687 END
688 ;
689 &Header::closebox();
690 &Header::closebigbox();
691 &Header::closepage();
692 exit (0);
693 } else {
694 unlink ("${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem");
695 delete $cahash{$cgiparams{'KEY'}};
696 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
697 system('/usr/local/bin/ipsecctrl', 'R');
698 sleep $sleepDelay;
699 }
700 } else {
701 $errormessage = $Lang::tr{'invalid key'};
702 }
703
704 ###
705 ### Display root certificate
706 ###
707 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'} ||
708 $cgiparams{'ACTION'} eq $Lang::tr{'show host certificate'}) {
709 my $output;
710 &Header::showhttpheaders();
711 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
712 &Header::openbigbox('100%', 'left', '', '');
713 if ($cgiparams{'ACTION'} eq $Lang::tr{'show root certificate'}) {
714 &Header::openbox('100%', 'left', "$Lang::tr{'root certificate'}:");
715 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/ca/cacert.pem`;
716 } else {
717 &Header::openbox('100%', 'left', "$Lang::tr{'host certificate'}:");
718 $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/hostcert.pem`;
719 }
720 $output = &Header::cleanhtml($output,"y");
721 print "<pre>$output</pre>\n";
722 &Header::closebox();
723 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
724 &Header::closebigbox();
725 &Header::closepage();
726 exit(0);
727
728 ###
729 ### Export root certificate to browser
730 ###
731 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download root certificate'}) {
732 if ( -f "${General::swroot}/ca/cacert.pem" ) {
733 print "Content-Type: application/force-download\n";
734 print "Content-Disposition: attachment; filename=cacert.pem\r\n\r\n";
735 print `/usr/bin/openssl x509 -in ${General::swroot}/ca/cacert.pem`;
736 exit(0);
737 }
738 ###
739 ### Export host certificate to browser
740 ###
741 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download host certificate'}) {
742 if ( -f "${General::swroot}/certs/hostcert.pem" ) {
743 print "Content-Type: application/force-download\n";
744 print "Content-Disposition: attachment; filename=hostcert.pem\r\n\r\n";
745 print `/usr/bin/openssl x509 -in ${General::swroot}/certs/hostcert.pem`;
746 exit(0);
747 }
748 ###
749 ### Form for generating/importing the caroot+host certificate
750 ###
751 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
752 $cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
753
754 if (-f "${General::swroot}/ca/cacert.pem") {
755 $errormessage = $Lang::tr{'valid root certificate already exists'};
756 goto ROOTCERT_SKIP;
757 }
758
759 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
760 # fill in initial values
761 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
762 if (-e "${General::swroot}/red/active" && open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
763 my $ipaddr = <IPADDR>;
764 close IPADDR;
765 chomp ($ipaddr);
766 $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
767 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
768 $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
769 }
770 }
771 $cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
772 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
773 &General::log("ipsec", "Importing from p12...");
774
775 if (ref ($cgiparams{'FH'}) ne 'Fh') {
776 $errormessage = $Lang::tr{'there was no file upload'};
777 goto ROOTCERT_ERROR;
778 }
779
780 # Move uploaded certificate request to a temporary file
781 (my $fh, my $filename) = tempfile( );
782 if (copy ($cgiparams{'FH'}, $fh) != 1) {
783 $errormessage = $!;
784 goto ROOTCERT_ERROR;
785 }
786
787 # Extract the CA certificate from the file
788 &General::log("ipsec", "Extracting caroot from p12...");
789 if (open(STDIN, "-|")) {
790 my $opt = " pkcs12 -cacerts -nokeys";
791 $opt .= " -in $filename";
792 $opt .= " -out /tmp/newcacert";
793 $errormessage = &callssl ($opt);
794 } else { #child
795 print "$cgiparams{'P12_PASS'}\n";
796 exit (0);
797 }
798
799 # Extract the Host certificate from the file
800 if (!$errormessage) {
801 &General::log("ipsec", "Extracting host cert from p12...");
802 if (open(STDIN, "-|")) {
803 my $opt = " pkcs12 -clcerts -nokeys";
804 $opt .= " -in $filename";
805 $opt .= " -out /tmp/newhostcert";
806 $errormessage = &callssl ($opt);
807 } else { #child
808 print "$cgiparams{'P12_PASS'}\n";
809 exit (0);
810 }
811 }
812
813 # Extract the Host key from the file
814 if (!$errormessage) {
815 &General::log("ipsec", "Extracting private key from p12...");
816 if (open(STDIN, "-|")) {
817 my $opt = " pkcs12 -nocerts -nodes";
818 $opt .= " -in $filename";
819 $opt .= " -out /tmp/newhostkey";
820 $errormessage = &callssl ($opt);
821 } else { #child
822 print "$cgiparams{'P12_PASS'}\n";
823 exit (0);
824 }
825 }
826
827 if (!$errormessage) {
828 &General::log("ipsec", "Moving cacert...");
829 move("/tmp/newcacert", "${General::swroot}/ca/cacert.pem");
830 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
831 }
832
833 if (!$errormessage) {
834 &General::log("ipsec", "Moving host cert...");
835 move("/tmp/newhostcert", "${General::swroot}/certs/hostcert.pem");
836 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
837 }
838
839 if (!$errormessage) {
840 &General::log("ipsec", "Moving private key...");
841 move("/tmp/newhostkey", "${General::swroot}/certs/hostkey.pem");
842 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
843 }
844
845 #cleanup temp files
846 unlink ($filename);
847 unlink ('/tmp/newcacert');
848 unlink ('/tmp/newhostcert');
849 unlink ('/tmp/newhostkey');
850 if ($errormessage) {
851 unlink ("${General::swroot}/ca/cacert.pem");
852 unlink ("${General::swroot}/certs/hostcert.pem");
853 unlink ("${General::swroot}/certs/hostkey.pem");
854 goto ROOTCERT_ERROR;
855 }
856
857 # Create empty CRL cannot be done because we don't have
858 # the private key for this CAROOT
859 # IPFire can only import certificates
860
861 &General::log("ipsec", "p12 import completed!");
862 &cleanssldatabase();
863 goto ROOTCERT_SUCCESS;
864
865 } elsif ($cgiparams{'ROOTCERT_COUNTRY'} ne '') {
866
867 # Validate input since the form was submitted
868 if ($cgiparams{'ROOTCERT_ORGANIZATION'} eq ''){
869 $errormessage = $Lang::tr{'organization cant be empty'};
870 goto ROOTCERT_ERROR;
871 }
872 if (length($cgiparams{'ROOTCERT_ORGANIZATION'}) >60) {
873 $errormessage = $Lang::tr{'organization too long'};
874 goto ROOTCERT_ERROR;
875 }
876 if ($cgiparams{'ROOTCERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
877 $errormessage = $Lang::tr{'invalid input for organization'};
878 goto ROOTCERT_ERROR;
879 }
880 if ($cgiparams{'ROOTCERT_HOSTNAME'} eq ''){
881 $errormessage = $Lang::tr{'hostname cant be empty'};
882 goto ROOTCERT_ERROR;
883 }
884 unless (&General::validfqdn($cgiparams{'ROOTCERT_HOSTNAME'}) || &General::validip($cgiparams{'ROOTCERT_HOSTNAME'})) {
885 $errormessage = $Lang::tr{'invalid input for hostname'};
886 goto ROOTCERT_ERROR;
887 }
888 if ($cgiparams{'ROOTCERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'ROOTCERT_EMAIL'}))) {
889 $errormessage = $Lang::tr{'invalid input for e-mail address'};
890 goto ROOTCERT_ERROR;
891 }
892 if (length($cgiparams{'ROOTCERT_EMAIL'}) > 40) {
893 $errormessage = $Lang::tr{'e-mail address too long'};
894 goto ROOTCERT_ERROR;
895 }
896 if ($cgiparams{'ROOTCERT_OU'} ne '' && $cgiparams{'ROOTCERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
897 $errormessage = $Lang::tr{'invalid input for department'};
898 goto ROOTCERT_ERROR;
899 }
900 if ($cgiparams{'ROOTCERT_CITY'} ne '' && $cgiparams{'ROOTCERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
901 $errormessage = $Lang::tr{'invalid input for city'};
902 goto ROOTCERT_ERROR;
903 }
904 if ($cgiparams{'ROOTCERT_STATE'} ne '' && $cgiparams{'ROOTCERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
905 $errormessage = $Lang::tr{'invalid input for state or province'};
906 goto ROOTCERT_ERROR;
907 }
908 if ($cgiparams{'ROOTCERT_COUNTRY'} !~ /^[A-Z]*$/) {
909 $errormessage = $Lang::tr{'invalid input for country'};
910 goto ROOTCERT_ERROR;
911 }
912 #the exact syntax is a list comma separated of
913 # email:any-validemail
914 # URI: a uniform resource indicator
915 # DNS: a DNS domain name
916 # RID: a registered OBJECT IDENTIFIER
917 # IP: an IP address
918 # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
919
920 if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
921 $errormessage = $Lang::tr{'vpn altname syntax'};
922 goto VPNCONF_ERROR;
923 }
924
925 # Copy the cgisettings to vpnsettings and save the configfile
926 $vpnsettings{'ROOTCERT_ORGANIZATION'} = $cgiparams{'ROOTCERT_ORGANIZATION'};
927 $vpnsettings{'ROOTCERT_HOSTNAME'} = $cgiparams{'ROOTCERT_HOSTNAME'};
928 $vpnsettings{'ROOTCERT_EMAIL'} = $cgiparams{'ROOTCERT_EMAIL'};
929 $vpnsettings{'ROOTCERT_OU'} = $cgiparams{'ROOTCERT_OU'};
930 $vpnsettings{'ROOTCERT_CITY'} = $cgiparams{'ROOTCERT_CITY'};
931 $vpnsettings{'ROOTCERT_STATE'} = $cgiparams{'ROOTCERT_STATE'};
932 $vpnsettings{'ROOTCERT_COUNTRY'} = $cgiparams{'ROOTCERT_COUNTRY'};
933 &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings);
934
935 # Replace empty strings with a .
936 (my $ou = $cgiparams{'ROOTCERT_OU'}) =~ s/^\s*$/\./;
937 (my $city = $cgiparams{'ROOTCERT_CITY'}) =~ s/^\s*$/\./;
938 (my $state = $cgiparams{'ROOTCERT_STATE'}) =~ s/^\s*$/\./;
939
940 # Create the CA certificate
941 if (!$errormessage) {
942 &General::log("ipsec", "Creating cacert...");
943 if (open(STDIN, "-|")) {
944 my $opt = " req -x509 -nodes -rand /proc/interrupts:/proc/net/rt_cache";
945 $opt .= " -days 999999";
946 $opt .= " -newkey rsa:2048";
947 $opt .= " -keyout ${General::swroot}/private/cakey.pem";
948 $opt .= " -out ${General::swroot}/ca/cacert.pem";
949
950 $errormessage = &callssl ($opt);
951 } else { #child
952 print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
953 print "$state\n";
954 print "$city\n";
955 print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
956 print "$ou\n";
957 print "$cgiparams{'ROOTCERT_ORGANIZATION'} CA\n";
958 print "$cgiparams{'ROOTCERT_EMAIL'}\n";
959 exit (0);
960 }
961 }
962
963 # Create the Host certificate request
964 if (!$errormessage) {
965 &General::log("ipsec", "Creating host cert...");
966 if (open(STDIN, "-|")) {
967 my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
968 $opt .= " -newkey rsa:1024";
969 $opt .= " -keyout ${General::swroot}/certs/hostkey.pem";
970 $opt .= " -out ${General::swroot}/certs/hostreq.pem";
971 $errormessage = &callssl ($opt);
972 } else { #child
973 print "$cgiparams{'ROOTCERT_COUNTRY'}\n";
974 print "$state\n";
975 print "$city\n";
976 print "$cgiparams{'ROOTCERT_ORGANIZATION'}\n";
977 print "$ou\n";
978 print "$cgiparams{'ROOTCERT_HOSTNAME'}\n";
979 print "$cgiparams{'ROOTCERT_EMAIL'}\n";
980 print ".\n";
981 print ".\n";
982 exit (0);
983 }
984 }
985
986 # Sign the host certificate request
987 if (!$errormessage) {
988 &General::log("ipsec", "Self signing host cert...");
989
990 #No easy way for specifying the contain of subjectAltName without writing a config file...
991 my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
992 print $fh <<END
993 basicConstraints=CA:FALSE
994 nsComment="OpenSSL Generated Certificate"
995 subjectKeyIdentifier=hash
996 authorityKeyIdentifier=keyid,issuer:always
997 extendedKeyUsage = serverAuth
998 END
999 ;
1000 print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
1001 close ($fh);
1002
1003 my $opt = " ca -days 999999";
1004 $opt .= " -batch -notext";
1005 $opt .= " -in ${General::swroot}/certs/hostreq.pem";
1006 $opt .= " -out ${General::swroot}/certs/hostcert.pem";
1007 $opt .= " -extfile $v3extname";
1008 $errormessage = &callssl ($opt);
1009 unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed
1010 unlink ($v3extname);
1011 }
1012
1013 # Create an empty CRL
1014 if (!$errormessage) {
1015 &General::log("ipsec", "Creating emptycrl...");
1016 my $opt = " ca -gencrl";
1017 $opt .= " -out ${General::swroot}/crls/cacrl.pem";
1018 $errormessage = &callssl ($opt);
1019 }
1020
1021 # Successfully build CA / CERT!
1022 if (!$errormessage) {
1023 &cleanssldatabase();
1024 goto ROOTCERT_SUCCESS;
1025 }
1026
1027 #Cleanup
1028 unlink ("${General::swroot}/ca/cacert.pem");
1029 unlink ("${General::swroot}/certs/hostkey.pem");
1030 unlink ("${General::swroot}/certs/hostcert.pem");
1031 unlink ("${General::swroot}/crls/cacrl.pem");
1032 &cleanssldatabase();
1033 }
1034
1035 ROOTCERT_ERROR:
1036 &Header::showhttpheaders();
1037 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1038 &Header::openbigbox('100%', 'left', '', $errormessage);
1039 if ($errormessage) {
1040 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
1041 print "<class name='base'>$errormessage";
1042 print "&nbsp;</class>";
1043 &Header::closebox();
1044 }
1045 &Header::openbox('100%', 'left', "$Lang::tr{'generate root/host certificates'}:");
1046 print <<END
1047 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
1048 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
1049 <tr><td width='40%' class='base'>$Lang::tr{'organization name'}:</td>
1050 <td width='60%' class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_ORGANIZATION' value='$cgiparams{'ROOTCERT_ORGANIZATION'}' size='32' /></td></tr>
1051 <tr><td class='base'>$Lang::tr{'ipfires hostname'}:</td>
1052 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_HOSTNAME' value='$cgiparams{'ROOTCERT_HOSTNAME'}' size='32' /></td></tr>
1053 <tr><td class='base'>$Lang::tr{'your e-mail'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1054 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_EMAIL' value='$cgiparams{'ROOTCERT_EMAIL'}' size='32' /></td></tr>
1055 <tr><td class='base'>$Lang::tr{'your department'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1056 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_OU' value='$cgiparams{'ROOTCERT_OU'}' size='32' /></td></tr>
1057 <tr><td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1058 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_CITY' value='$cgiparams{'ROOTCERT_CITY'}' size='32' /></td></tr>
1059 <tr><td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1060 <td class='base' nowrap='nowrap'><input type='text' name='ROOTCERT_STATE' value='$cgiparams{'ROOTCERT_STATE'}' size='32' /></td></tr>
1061 <tr><td class='base'>$Lang::tr{'country'}:</td>
1062 <td class='base'><select name='ROOTCERT_COUNTRY'>
1063 END
1064 ;
1065 foreach my $country (sort keys %{Countries::countries}) {
1066 print "<option value='$Countries::countries{$country}'";
1067 if ( $Countries::countries{$country} eq $cgiparams{'ROOTCERT_COUNTRY'} ) {
1068 print " selected='selected'";
1069 }
1070 print ">$country</option>";
1071 }
1072 print <<END
1073 </select></td></tr>
1074 <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*) <img src='/blob.gif' alt='*' /></td>
1075 <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr>
1076 <tr><td>&nbsp;</td>
1077 <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
1078 <tr><td class='base' colspan='2' align='left'>
1079 <b><font color='${Header::colourred}'>$Lang::tr{'capswarning'}</font></b>:
1080 $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'}
1081 </td></tr>
1082 <tr><td colspan='2'><hr /></td></tr>
1083 <tr><td class='base' nowrap='nowrap'>$Lang::tr{'upload p12 file'}:</td>
1084 <td nowrap='nowrap'><input type='file' name='FH' size='32' /></td></tr>
1085 <tr><td class='base'>$Lang::tr{'pkcs12 file password'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
1086 <td class='base' nowrap='nowrap'><input type='password' name='P12_PASS' value='$cgiparams{'P12_PASS'}' size='32' /></td></tr>
1087 <tr><td>&nbsp;</td>
1088 <td><input type='submit' name='ACTION' value='$Lang::tr{'upload p12 file'}' /></td></tr>
1089 <tr><td class='base' colspan='2' align='left'>
1090 <img src='/blob.gif' alt='*' />&nbsp;$Lang::tr{'this field may be blank'}</td></tr>
1091 </table></form>
1092 END
1093 ;
1094 &Header::closebox();
1095 &Header::closebigbox();
1096 &Header::closepage();
1097 exit(0);
1098
1099 ROOTCERT_SUCCESS:
1100 if (&vpnenabled) {
1101 system('/usr/local/bin/ipsecctrl', 'S');
1102 sleep $sleepDelay;
1103 }
1104 ROOTCERT_SKIP:
1105 ###
1106 ### Export PKCS12 file to browser
1107 ###
1108 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download pkcs12 file'}) {
1109 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1110 print "Content-Type: application/force-download\n";
1111 print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . ".p12\r\n";
1112 print "Content-Type: application/octet-stream\r\n\r\n";
1113 print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12`;
1114 exit (0);
1115
1116 ###
1117 ### Display certificate
1118 ###
1119 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show certificate'}) {
1120 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1121
1122 if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1123 &Header::showhttpheaders();
1124 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1125 &Header::openbigbox('100%', 'left', '', '');
1126 &Header::openbox('100%', 'left', "$Lang::tr{'cert'}:");
1127 my $output = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1128 $output = &Header::cleanhtml($output,"y");
1129 print "<pre>$output</pre>\n";
1130 &Header::closebox();
1131 print "<div align='center'><a href='/cgi-bin/vpnmain.cgi'>$Lang::tr{'back'}</a></div>";
1132 &Header::closebigbox();
1133 &Header::closepage();
1134 exit(0);
1135 }
1136
1137 ###
1138 ### Export Certificate to browser
1139 ###
1140 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) {
1141 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1142
1143 if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") {
1144 print "Content-Type: application/force-download\n";
1145 print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n";
1146 print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`;
1147 exit (0);
1148 }
1149
1150 ###
1151 ### Enable/Disable connection
1152 ###
1153 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) {
1154
1155 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1156 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1157
1158 if ($confighash{$cgiparams{'KEY'}}) {
1159 if ($confighash{$cgiparams{'KEY'}}[0] eq 'off') {
1160 $confighash{$cgiparams{'KEY'}}[0] = 'on';
1161 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1162 &writeipsecfiles();
1163 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled);
1164 } else {
1165 system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
1166 $confighash{$cgiparams{'KEY'}}[0] = 'off';
1167 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1168 &writeipsecfiles();
1169 }
1170 sleep $sleepDelay;
1171 } else {
1172 $errormessage = $Lang::tr{'invalid key'};
1173 }
1174
1175 ###
1176 ### Restart connection
1177 ###
1178 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) {
1179 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1180 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1181
1182 if ($confighash{$cgiparams{'KEY'}}) {
1183 if (&vpnenabled) {
1184 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
1185 sleep $sleepDelay;
1186 }
1187 } else {
1188 $errormessage = $Lang::tr{'invalid key'};
1189 }
1190
1191 ###
1192 ### Remove connection
1193 ###
1194 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove'}) {
1195 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1196 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1197
1198 if ($confighash{$cgiparams{'KEY'}}) {
1199 system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled);
1200 unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem");
1201 unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12");
1202 delete $confighash{$cgiparams{'KEY'}};
1203 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1204 &writeipsecfiles();
1205 } else {
1206 $errormessage = $Lang::tr{'invalid key'};
1207 }
1208
1209 ###
1210 ### Choose between adding a host-net or net-net connection
1211 ###
1212 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') {
1213 &Header::showhttpheaders();
1214 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1215 &Header::openbigbox('100%', 'left', '', '');
1216 &Header::openbox('100%', 'left', $Lang::tr{'connection type'});
1217 print <<END
1218 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
1219 <b>$Lang::tr{'connection type'}:</b><br />
1220 <table>
1221 <tr><td><input type='radio' name='TYPE' value='host' checked='checked' /></td>
1222 <td class='base'>$Lang::tr{'host to net vpn'}</td>
1223 </tr><tr>
1224 <td><input type='radio' name='TYPE' value='net' /></td>
1225 <td class='base'>$Lang::tr{'net to net vpn'}</td>
1226 </tr><tr>
1227 <td align='center' colspan='2'><input type='submit' name='ACTION' value='$Lang::tr{'add'}' /></td>
1228 </tr>
1229 </table></form>
1230 END
1231 ;
1232 &Header::closebox();
1233 &Header::closebigbox();
1234 &Header::closepage();
1235 exit (0);
1236 ###
1237 ### Adding/Editing/Saving a connection
1238 ###
1239 } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) ||
1240 ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) ||
1241 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) {
1242
1243 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
1244 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
1245 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
1246
1247 if ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) {
1248 if (! $confighash{$cgiparams{'KEY'}}[0]) {
1249 $errormessage = $Lang::tr{'invalid key'};
1250 goto VPNCONF_END;
1251 }
1252 $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0];
1253 $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1];
1254 $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3];
1255 $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4];
1256 $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5];
1257 #$cgiparams{'free'} = $confighash{$cgiparams{'KEY'}}[6];
1258 $cgiparams{'LOCAL_ID'} = $confighash{$cgiparams{'KEY'}}[7];
1259 $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8];
1260 $cgiparams{'REMOTE_ID'} = $confighash{$cgiparams{'KEY'}}[9];
1261 $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10];
1262 $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11];
1263 $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25];
1264 $cgiparams{'DPD_ACTION'} = $confighash{$cgiparams{'KEY'}}[27];
1265 $cgiparams{'IKE_VERSION'} = $confighash{$cgiparams{'KEY'}}[29];
1266 $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
1267 $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
1268 $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
1269 $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16];
1270 $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
1271 $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
1272 $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
1273 $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
1274 $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
1275 $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
1276 $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
1277 $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
1278 $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30];
1279 $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31];
1280
1281 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
1282 $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
1283 if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
1284 $errormessage = $Lang::tr{'connection type is invalid'};
1285 goto VPNCONF_ERROR;
1286 }
1287
1288 if ($cgiparams{'NAME'} !~ /^[a-zA-Z0-9]+$/) {
1289 $errormessage = $Lang::tr{'name must only contain characters'};
1290 goto VPNCONF_ERROR;
1291 }
1292
1293 if ($cgiparams{'NAME'} =~ /^(host|01|block|private|clear|packetdefault)$/) {
1294 $errormessage = $Lang::tr{'name is invalid'};
1295 goto VPNCONF_ERROR;
1296 }
1297
1298 if (length($cgiparams{'NAME'}) >60) {
1299 $errormessage = $Lang::tr{'name too long'};
1300 goto VPNCONF_ERROR;
1301 }
1302
1303 # Check if there is no other entry with this name
1304 if (! $cgiparams{'KEY'}) { #only for add
1305 foreach my $key (keys %confighash) {
1306 if ($confighash{$key}[1] eq $cgiparams{'NAME'}) {
1307 $errormessage = $Lang::tr{'a connection with this name already exists'};
1308 goto VPNCONF_ERROR;
1309 }
1310 }
1311 }
1312
1313 if (($cgiparams{'TYPE'} eq 'net') && (! $cgiparams{'REMOTE'})) {
1314 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
1315 goto VPNCONF_ERROR;
1316 }
1317
1318 if ($cgiparams{'REMOTE'}) {
1319 if (($cgiparams{'REMOTE'} ne '%any') && (! &General::validip($cgiparams{'REMOTE'}))) {
1320 if (! &General::validfqdn ($cgiparams{'REMOTE'})) {
1321 $errormessage = $Lang::tr{'invalid input for remote host/ip'};
1322 goto VPNCONF_ERROR;
1323 } else {
1324 if (&valid_dns_host($cgiparams{'REMOTE'})) {
1325 $warnmessage = "$Lang::tr{'check vpn lr'} $cgiparams{'REMOTE'}. $Lang::tr{'dns check failed'}";
1326 }
1327 }
1328 }
1329 }
1330
1331 unless (&General::validipandmask($cgiparams{'LOCAL_SUBNET'})) {
1332 $errormessage = $Lang::tr{'local subnet is invalid'};
1333 goto VPNCONF_ERROR;
1334 }
1335
1336 # Allow only one roadwarrior/psk without remote IP-address
1337 if ($cgiparams{'REMOTE'} eq '' && $cgiparams{'AUTH'} eq 'psk') {
1338 foreach my $key (keys %confighash) {
1339 if ( ($cgiparams{'KEY'} ne $key) &&
1340 ($confighash{$key}[4] eq 'psk') &&
1341 ($confighash{$key}[10] eq '') ) {
1342 $errormessage = $Lang::tr{'you can only define one roadwarrior connection when using pre-shared key authentication'};
1343 goto VPNCONF_ERROR;
1344 }
1345 }
1346 }
1347 if (($cgiparams{'TYPE'} eq 'net') && (! &General::validipandmask($cgiparams{'REMOTE_SUBNET'}))) {
1348 $errormessage = $Lang::tr{'remote subnet is invalid'};
1349 goto VPNCONF_ERROR;
1350 }
1351
1352 if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) {
1353 $errormessage = $Lang::tr{'invalid input'};
1354 goto VPNCONF_ERROR;
1355 }
1356 if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) {
1357 $errormessage = $Lang::tr{'invalid input'};
1358 goto VPNCONF_ERROR;
1359 }
1360
1361 # Allow nothing or a string (DN,FDQN,) beginning with @
1362 # with no comma but slashes between RID eg @O=FR/C=Paris/OU=myhome/CN=franck
1363 if ( ($cgiparams{'LOCAL_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
1364 ($cgiparams{'REMOTE_ID'} !~ /^(|[\w.-]*@[\w. =*\/-]+|\d+\.\d+\.\d+\.\d+)$/) ||
1365 (($cgiparams{'REMOTE_ID'} eq $cgiparams{'LOCAL_ID'}) && ($cgiparams{'LOCAL_ID'} ne ''))
1366 ) {
1367 $errormessage = $Lang::tr{'invalid local-remote id'} . '<br />' .
1368 'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*<br />' .
1369 'FQDN: @ipfire.org<br />' .
1370 'USER_FQDN: info@ipfire.org<br />' .
1371 'IPV4_ADDR: 123.123.123.123';
1372 goto VPNCONF_ERROR;
1373 }
1374 # If Auth is DN, verify existance of Remote ID.
1375 if ( $cgiparams{'REMOTE_ID'} eq '' && (
1376 $cgiparams{'AUTH'} eq 'auth-dn'|| # while creation
1377 $confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing
1378 $errormessage = $Lang::tr{'vpn missing remote id'};
1379 goto VPNCONF_ERROR;
1380 }
1381
1382 #temporary disabled (BUG 10294)
1383 # if ($cgiparams{'TYPE'} eq 'net'){
1384 # $errormessage=&General::checksubnets($cgiparams{'NAME'},$cgiparams{'REMOTE_SUBNET'});
1385 # if ($errormessage ne ''){
1386 # goto VPNCONF_ERROR;
1387 # }
1388 #
1389 # }
1390 if ($cgiparams{'AUTH'} eq 'psk') {
1391 if (! length($cgiparams{'PSK'}) ) {
1392 $errormessage = $Lang::tr{'pre-shared key is too short'};
1393 goto VPNCONF_ERROR;
1394 }
1395 if ($cgiparams{'PSK'} =~ /'/) {
1396 $cgiparams{'PSK'} =~ tr/'/ /;
1397 $errormessage = $Lang::tr{'invalid characters found in pre-shared key'};
1398 goto VPNCONF_ERROR;
1399 }
1400 } elsif ($cgiparams{'AUTH'} eq 'certreq') {
1401 if ($cgiparams{'KEY'}) {
1402 $errormessage = $Lang::tr{'cant change certificates'};
1403 goto VPNCONF_ERROR;
1404 }
1405 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1406 $errormessage = $Lang::tr{'there was no file upload'};
1407 goto VPNCONF_ERROR;
1408 }
1409
1410 # Move uploaded certificate request to a temporary file
1411 (my $fh, my $filename) = tempfile( );
1412 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1413 $errormessage = $!;
1414 goto VPNCONF_ERROR;
1415 }
1416
1417 # Sign the certificate request
1418 &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}...");
1419 my $opt = " ca -days 999999";
1420 $opt .= " -batch -notext";
1421 $opt .= " -in $filename";
1422 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1423
1424 if ( $errormessage = &callssl ($opt) ) {
1425 unlink ($filename);
1426 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1427 &cleanssldatabase();
1428 goto VPNCONF_ERROR;
1429 } else {
1430 unlink ($filename);
1431 &cleanssldatabase();
1432 }
1433
1434 $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1435 if ($cgiparams{'CERT_NAME'} eq '') {
1436 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
1437 goto VPNCONF_ERROR;
1438 }
1439 } elsif ($cgiparams{'AUTH'} eq 'pkcs12') {
1440 &General::log("ipsec", "Importing from p12...");
1441
1442 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1443 $errormessage = $Lang::tr{'there was no file upload'};
1444 goto ROOTCERT_ERROR;
1445 }
1446
1447 # Move uploaded certificate request to a temporary file
1448 (my $fh, my $filename) = tempfile( );
1449 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1450 $errormessage = $!;
1451 goto ROOTCERT_ERROR;
1452 }
1453
1454 # Extract the CA certificate from the file
1455 &General::log("ipsec", "Extracting caroot from p12...");
1456 if (open(STDIN, "-|")) {
1457 my $opt = " pkcs12 -cacerts -nokeys";
1458 $opt .= " -in $filename";
1459 $opt .= " -out /tmp/newcacert";
1460 $errormessage = &callssl ($opt);
1461 } else { #child
1462 print "$cgiparams{'P12_PASS'}\n";
1463 exit (0);
1464 }
1465
1466 # Extract the Host certificate from the file
1467 if (!$errormessage) {
1468 &General::log("ipsec", "Extracting host cert from p12...");
1469 if (open(STDIN, "-|")) {
1470 my $opt = " pkcs12 -clcerts -nokeys";
1471 $opt .= " -in $filename";
1472 $opt .= " -out /tmp/newhostcert";
1473 $errormessage = &callssl ($opt);
1474 } else { #child
1475 print "$cgiparams{'P12_PASS'}\n";
1476 exit (0);
1477 }
1478 }
1479
1480 if (!$errormessage) {
1481 &General::log("ipsec", "Moving cacert...");
1482 #If CA have new subject, add it to our list of CA
1483 my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert'));
1484 my @names;
1485 foreach my $x (keys %cahash) {
1486 $casubject='' if ($cahash{$x}[1] eq $casubject);
1487 unshift (@names,$cahash{$x}[0]);
1488 }
1489 if ($casubject) { # a new one!
1490 my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`;
1491 if ($temp !~ /CA:TRUE/i) {
1492 $errormessage = $Lang::tr{'not a valid ca certificate'};
1493 } else {
1494 #compute a name for it
1495 my $idx=0;
1496 while (grep(/Imported-$idx/, @names) ) {$idx++};
1497 $cgiparams{'CA_NAME'}="Imported-$idx";
1498 $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert'));
1499 move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
1500 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
1501 if (!$errormessage) {
1502 my $key = &General::findhasharraykey (\%cahash);
1503 $cahash{$key}[0] = $cgiparams{'CA_NAME'};
1504 $cahash{$key}[1] = $casubject;
1505 &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash);
1506 system('/usr/local/bin/ipsecctrl', 'R');
1507 }
1508 }
1509 }
1510 }
1511 if (!$errormessage) {
1512 &General::log("ipsec", "Moving host cert...");
1513 move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1514 $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0);
1515 }
1516
1517 #cleanup temp files
1518 unlink ($filename);
1519 unlink ('/tmp/newcacert');
1520 unlink ('/tmp/newhostcert');
1521 if ($errormessage) {
1522 unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem");
1523 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1524 goto VPNCONF_ERROR;
1525 }
1526 &General::log("ipsec", "p12 import completed!");
1527 } elsif ($cgiparams{'AUTH'} eq 'certfile') {
1528 if ($cgiparams{'KEY'}) {
1529 $errormessage = $Lang::tr{'cant change certificates'};
1530 goto VPNCONF_ERROR;
1531 }
1532 if (ref ($cgiparams{'FH'}) ne 'Fh') {
1533 $errormessage = $Lang::tr{'there was no file upload'};
1534 goto VPNCONF_ERROR;
1535 }
1536 # Move uploaded certificate to a temporary file
1537 (my $fh, my $filename) = tempfile( );
1538 if (copy ($cgiparams{'FH'}, $fh) != 1) {
1539 $errormessage = $!;
1540 goto VPNCONF_ERROR;
1541 }
1542
1543 # Verify the certificate has a valid CA and move it
1544 &General::log("ipsec", "Validating imported cert against our known CA...");
1545 my $validca = 1; #assume ok
1546 my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`;
1547 if ($test !~ /: OK/) {
1548 my $validca = 0;
1549 foreach my $key (keys %cahash) {
1550 $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`;
1551 if ($test =~ /: OK/) {
1552 $validca = 1;
1553 last;
1554 }
1555 }
1556 }
1557 if (! $validca) {
1558 $errormessage = $Lang::tr{'certificate does not have a valid ca associated with it'};
1559 unlink ($filename);
1560 goto VPNCONF_ERROR;
1561 } else {
1562 move($filename, "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1563 if ($? ne 0) {
1564 $errormessage = "$Lang::tr{'certificate file move failed'}: $!";
1565 unlink ($filename);
1566 goto VPNCONF_ERROR;
1567 }
1568 }
1569
1570 $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1571 if ($cgiparams{'CERT_NAME'} eq '') {
1572 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1573 $errormessage = $Lang::tr{'could not retrieve common name from certificate'};
1574 goto VPNCONF_ERROR;
1575 }
1576 } elsif ($cgiparams{'AUTH'} eq 'certgen') {
1577 if ($cgiparams{'KEY'}) {
1578 $errormessage = $Lang::tr{'cant change certificates'};
1579 goto VPNCONF_ERROR;
1580 }
1581 # Validate input since the form was submitted
1582 if (length($cgiparams{'CERT_NAME'}) >60) {
1583 $errormessage = $Lang::tr{'name too long'};
1584 goto VPNCONF_ERROR;
1585 }
1586 if ($cgiparams{'CERT_NAME'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
1587 $errormessage = $Lang::tr{'invalid input for name'};
1588 goto VPNCONF_ERROR;
1589 }
1590 if ($cgiparams{'CERT_EMAIL'} ne '' && (! &General::validemail($cgiparams{'CERT_EMAIL'}))) {
1591 $errormessage = $Lang::tr{'invalid input for e-mail address'};
1592 goto VPNCONF_ERROR;
1593 }
1594 if (length($cgiparams{'CERT_EMAIL'}) > 40) {
1595 $errormessage = $Lang::tr{'e-mail address too long'};
1596 goto VPNCONF_ERROR;
1597 }
1598 if ($cgiparams{'CERT_OU'} ne '' && $cgiparams{'CERT_OU'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1599 $errormessage = $Lang::tr{'invalid input for department'};
1600 goto VPNCONF_ERROR;
1601 }
1602 if (length($cgiparams{'CERT_ORGANIZATION'}) >60) {
1603 $errormessage = $Lang::tr{'organization too long'};
1604 goto VPNCONF_ERROR;
1605 }
1606 if ($cgiparams{'CERT_ORGANIZATION'} !~ /^[a-zA-Z0-9 ,\.\-_]+$/) {
1607 $errormessage = $Lang::tr{'invalid input for organization'};
1608 goto VPNCONF_ERROR;
1609 }
1610 if ($cgiparams{'CERT_CITY'} ne '' && $cgiparams{'CERT_CITY'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1611 $errormessage = $Lang::tr{'invalid input for city'};
1612 goto VPNCONF_ERROR;
1613 }
1614 if ($cgiparams{'CERT_STATE'} ne '' && $cgiparams{'CERT_STATE'} !~ /^[a-zA-Z0-9 ,\.\-_]*$/) {
1615 $errormessage = $Lang::tr{'invalid input for state or province'};
1616 goto VPNCONF_ERROR;
1617 }
1618 if ($cgiparams{'CERT_COUNTRY'} !~ /^[A-Z]*$/) {
1619 $errormessage = $Lang::tr{'invalid input for country'};
1620 goto VPNCONF_ERROR;
1621 }
1622 #the exact syntax is a list comma separated of
1623 # email:any-validemail
1624 # URI: a uniform resource indicator
1625 # DNS: a DNS domain name
1626 # RID: a registered OBJECT IDENTIFIER
1627 # IP: an IP address
1628 # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
1629
1630 if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
1631 $errormessage = $Lang::tr{'vpn altname syntax'};
1632 goto VPNCONF_ERROR;
1633 }
1634
1635 if (length($cgiparams{'CERT_PASS1'}) < 5) {
1636 $errormessage = $Lang::tr{'password too short'};
1637 goto VPNCONF_ERROR;
1638 }
1639 if ($cgiparams{'CERT_PASS1'} ne $cgiparams{'CERT_PASS2'}) {
1640 $errormessage = $Lang::tr{'passwords do not match'};
1641 goto VPNCONF_ERROR;
1642 }
1643
1644 # Replace empty strings with a .
1645 (my $ou = $cgiparams{'CERT_OU'}) =~ s/^\s*$/\./;
1646 (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
1647 (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
1648
1649 # Create the Host certificate request
1650 &General::log("ipsec", "Creating a cert...");
1651
1652 if (open(STDIN, "-|")) {
1653 my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache";
1654 $opt .= " -newkey rsa:1024";
1655 $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
1656 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
1657
1658 if ( $errormessage = &callssl ($opt) ) {
1659 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1660 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1661 goto VPNCONF_ERROR;
1662 }
1663 } else { #child
1664 print "$cgiparams{'CERT_COUNTRY'}\n";
1665 print "$state\n";
1666 print "$city\n";
1667 print "$cgiparams{'CERT_ORGANIZATION'}\n";
1668 print "$ou\n";
1669 print "$cgiparams{'CERT_NAME'}\n";
1670 print "$cgiparams{'CERT_EMAIL'}\n";
1671 print ".\n";
1672 print ".\n";
1673 exit (0);
1674 }
1675
1676 # Sign the host certificate request
1677 &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
1678
1679 #No easy way for specifying the contain of subjectAltName without writing a config file...
1680 my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX');
1681 print $fh <<END
1682 basicConstraints=CA:FALSE
1683 nsComment="OpenSSL Generated Certificate"
1684 subjectKeyIdentifier=hash
1685 authorityKeyIdentifier=keyid,issuer:always
1686 END
1687 ;
1688 print $fh "subjectAltName=$cgiparams{'SUBJECTALTNAME'}" if ($cgiparams{'SUBJECTALTNAME'});
1689 close ($fh);
1690
1691 my $opt = " ca -days 999999 -batch -notext";
1692 $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}req.pem";
1693 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1694 $opt .= " -extfile $v3extname";
1695
1696 if ( $errormessage = &callssl ($opt) ) {
1697 unlink ($v3extname);
1698 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1699 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1700 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1701 &cleanssldatabase();
1702 goto VPNCONF_ERROR;
1703 } else {
1704 unlink ($v3extname);
1705 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem");
1706 &cleanssldatabase();
1707 }
1708
1709 # Create the pkcs12 file
1710 &General::log("ipsec", "Packing a pkcs12 file...");
1711 $opt = " pkcs12 -export";
1712 $opt .= " -inkey ${General::swroot}/certs/$cgiparams{'NAME'}key.pem";
1713 $opt .= " -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem";
1714 $opt .= " -name \"$cgiparams{'NAME'}\"";
1715 $opt .= " -passout pass:$cgiparams{'CERT_PASS1'}";
1716 $opt .= " -certfile ${General::swroot}/ca/cacert.pem";
1717 $opt .= " -caname \"$vpnsettings{'ROOTCERT_ORGANIZATION'} CA\"";
1718 $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}.p12";
1719
1720 if ( $errormessage = &callssl ($opt) ) {
1721 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1722 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem");
1723 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}.p12");
1724 goto VPNCONF_ERROR;
1725 } else {
1726 unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem");
1727 }
1728 } elsif ($cgiparams{'AUTH'} eq 'cert') {
1729 ;# Nothing, just editing
1730 } elsif ($cgiparams{'AUTH'} eq 'auth-dn') {
1731 $cgiparams{'CERT_NAME'} = '%auth-dn'; # a special value saying 'no cert file'
1732 } else {
1733 $errormessage = $Lang::tr{'invalid input for authentication method'};
1734 goto VPNCONF_ERROR;
1735 }
1736
1737 # 1)Error message here is not accurate.
1738 # 2)Test is superfluous, openswan can reference same cert multiple times
1739 # 3)Present since initial version (1.3.2.11), it isn't a bug correction
1740 # Check if there is no other entry with this certificate name
1741 #if ((! $cgiparams{'KEY'}) && ($cgiparams{'AUTH'} ne 'psk') && ($cgiparams{'AUTH'} ne 'auth-dn')) {
1742 # foreach my $key (keys %confighash) {
1743 # if ($confighash{$key}[2] eq $cgiparams{'CERT_NAME'}) {
1744 # $errormessage = $Lang::tr{'a connection with this common name already exists'};
1745 # goto VPNCONF_ERROR;
1746 # }
1747 # }
1748 #}
1749 # Save the config
1750
1751 my $key = $cgiparams{'KEY'};
1752 if (! $key) {
1753 $key = &General::findhasharraykey (\%confighash);
1754 foreach my $i (0 .. 31) { $confighash{$key}[$i] = "";}
1755 }
1756 $confighash{$key}[0] = $cgiparams{'ENABLED'};
1757 $confighash{$key}[1] = $cgiparams{'NAME'};
1758 if ((! $cgiparams{'KEY'}) && $cgiparams{'AUTH'} ne 'psk') {
1759 $confighash{$key}[2] = $cgiparams{'CERT_NAME'};
1760 }
1761 $confighash{$key}[3] = $cgiparams{'TYPE'};
1762 if ($cgiparams{'AUTH'} eq 'psk') {
1763 $confighash{$key}[4] = 'psk';
1764 $confighash{$key}[5] = $cgiparams{'PSK'};
1765 } else {
1766 $confighash{$key}[4] = 'cert';
1767 }
1768 if ($cgiparams{'TYPE'} eq 'net') {
1769 $confighash{$key}[11] = $cgiparams{'REMOTE_SUBNET'};
1770 }
1771 $confighash{$key}[7] = $cgiparams{'LOCAL_ID'};
1772 $confighash{$key}[8] = $cgiparams{'LOCAL_SUBNET'};
1773 $confighash{$key}[9] = $cgiparams{'REMOTE_ID'};
1774 $confighash{$key}[10] = $cgiparams{'REMOTE'};
1775 $confighash{$key}[25] = $cgiparams{'REMARK'};
1776 $confighash{$key}[26] = ""; # Formerly INTERFACE
1777 $confighash{$key}[27] = $cgiparams{'DPD_ACTION'};
1778 $confighash{$key}[29] = $cgiparams{'IKE_VERSION'};
1779
1780 #dont forget advanced value
1781 $confighash{$key}[18] = $cgiparams{'IKE_ENCRYPTION'};
1782 $confighash{$key}[19] = $cgiparams{'IKE_INTEGRITY'};
1783 $confighash{$key}[20] = $cgiparams{'IKE_GROUPTYPE'};
1784 $confighash{$key}[16] = $cgiparams{'IKE_LIFETIME'};
1785 $confighash{$key}[21] = $cgiparams{'ESP_ENCRYPTION'};
1786 $confighash{$key}[22] = $cgiparams{'ESP_INTEGRITY'};
1787 $confighash{$key}[23] = $cgiparams{'ESP_GROUPTYPE'};
1788 $confighash{$key}[17] = $cgiparams{'ESP_KEYLIFE'};
1789 $confighash{$key}[12] = 'off'; # $cgiparams{'AGGRMODE'};
1790 $confighash{$key}[13] = $cgiparams{'COMPRESSION'};
1791 $confighash{$key}[24] = $cgiparams{'ONLY_PROPOSED'};
1792 $confighash{$key}[28] = $cgiparams{'PFS'};
1793 $confighash{$key}[14] = $cgiparams{'VHOST'};
1794 $confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'};
1795 $confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
1796
1797 #free unused fields!
1798 $confighash{$key}[6] = 'off';
1799 $confighash{$key}[15] = 'off';
1800
1801 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
1802 &writeipsecfiles();
1803 if (&vpnenabled) {
1804 system('/usr/local/bin/ipsecctrl', 'S', $key);
1805 sleep $sleepDelay;
1806 }
1807 if ($cgiparams{'EDIT_ADVANCED'} eq 'on') {
1808 $cgiparams{'KEY'} = $key;
1809 $cgiparams{'ACTION'} = $Lang::tr{'advanced'};
1810 }
1811 goto VPNCONF_END;
1812 } else { # add new connection
1813 $cgiparams{'ENABLED'} = 'on';
1814 if ( ! -f "${General::swroot}/private/cakey.pem" ) {
1815 $cgiparams{'AUTH'} = 'psk';
1816 } elsif ( ! -f "${General::swroot}/ca/cacert.pem") {
1817 $cgiparams{'AUTH'} = 'certfile';
1818 } else {
1819 $cgiparams{'AUTH'} = 'certgen';
1820 }
1821 $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}";
1822 $cgiparams{'CERT_EMAIL'} = $vpnsettings{'ROOTCERT_EMAIL'};
1823 $cgiparams{'CERT_OU'} = $vpnsettings{'ROOTCERT_OU'};
1824 $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'};
1825 $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'};
1826 $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'};
1827 $cgiparams{'CERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'};
1828
1829 # choose appropriate dpd action
1830 if ($cgiparams{'TYPE'} eq 'host') {
1831 $cgiparams{'DPD_ACTION'} = 'clear';
1832 } else {
1833 $cgiparams{'DPD_ACTION'} = 'restart';
1834 }
1835
1836 # Default IKE Version to v2
1837 if (!$cgiparams{'IKE_VERSION'}) {
1838 $cgiparams{'IKE_VERSION'} = 'ikev2';
1839 }
1840
1841 # ID are empty
1842 $cgiparams{'LOCAL_ID'} = '';
1843 $cgiparams{'REMOTE_ID'} = '';
1844
1845 #use default advanced value
1846 $cgiparams{'IKE_ENCRYPTION'} = 'aes256|aes192|aes128|3des'; #[18];
1847 $cgiparams{'IKE_INTEGRITY'} = 'sha2_256|sha|md5'; #[19];
1848 $cgiparams{'IKE_GROUPTYPE'} = '4096|3072|2048|1536|1024'; #[20];
1849 $cgiparams{'IKE_LIFETIME'} = '3'; #[16];
1850 $cgiparams{'ESP_ENCRYPTION'} = 'aes256|aes192|aes128|3des'; #[21];
1851 $cgiparams{'ESP_INTEGRITY'} = 'sha2_256|sha1|md5'; #[22];
1852 $cgiparams{'ESP_GROUPTYPE'} = ''; #[23];
1853 $cgiparams{'ESP_KEYLIFE'} = '1'; #[17];
1854 $cgiparams{'COMPRESSION'} = 'on'; #[13];
1855 $cgiparams{'ONLY_PROPOSED'} = 'off'; #[24];
1856 $cgiparams{'PFS'} = 'on'; #[28];
1857 $cgiparams{'VHOST'} = 'on'; #[14];
1858 }
1859
1860 VPNCONF_ERROR:
1861 $checked{'ENABLED'}{'off'} = '';
1862 $checked{'ENABLED'}{'on'} = '';
1863 $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = "checked='checked'";
1864
1865 $checked{'EDIT_ADVANCED'}{'off'} = '';
1866 $checked{'EDIT_ADVANCED'}{'on'} = '';
1867 $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = "checked='checked'";
1868
1869 $checked{'AUTH'}{'psk'} = '';
1870 $checked{'AUTH'}{'certreq'} = '';
1871 $checked{'AUTH'}{'certgen'} = '';
1872 $checked{'AUTH'}{'certfile'} = '';
1873 $checked{'AUTH'}{'pkcs12'} = '';
1874 $checked{'AUTH'}{'auth-dn'} = '';
1875 $checked{'AUTH'}{$cgiparams{'AUTH'}} = "checked='checked'";
1876
1877 $selected{'DPD_ACTION'}{'clear'} = '';
1878 $selected{'DPD_ACTION'}{'hold'} = '';
1879 $selected{'DPD_ACTION'}{'restart'} = '';
1880 $selected{'DPD_ACTION'}{$cgiparams{'DPD_ACTION'}} = "selected='selected'";
1881
1882 $selected{'IKE_VERSION'}{'ikev1'} = '';
1883 $selected{'IKE_VERSION'}{'ikev2'} = '';
1884 $selected{'IKE_VERSION'}{$cgiparams{'IKE_VERSION'}} = "selected='selected'";
1885
1886 &Header::showhttpheaders();
1887 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
1888 &Header::openbigbox('100%', 'left', '', $errormessage);
1889 if ($errormessage) {
1890 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
1891 print "<class name='base'>$errormessage";
1892 print "&nbsp;</class>";
1893 &Header::closebox();
1894 }
1895
1896 if ($warnmessage) {
1897 &Header::openbox('100%', 'left', "$Lang::tr{'warning messages'}:");
1898 print "<class name='base'>$warnmessage";
1899 print "&nbsp;</class>";
1900 &Header::closebox();
1901 }
1902
1903 print "<form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>";
1904 print<<END
1905 <input type='hidden' name='TYPE' value='$cgiparams{'TYPE'}' />
1906 <input type='hidden' name='IKE_ENCRYPTION' value='$cgiparams{'IKE_ENCRYPTION'}' />
1907 <input type='hidden' name='IKE_INTEGRITY' value='$cgiparams{'IKE_INTEGRITY'}' />
1908 <input type='hidden' name='IKE_GROUPTYPE' value='$cgiparams{'IKE_GROUPTYPE'}' />
1909 <input type='hidden' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' />
1910 <input type='hidden' name='ESP_ENCRYPTION' value='$cgiparams{'ESP_ENCRYPTION'}' />
1911 <input type='hidden' name='ESP_INTEGRITY' value='$cgiparams{'ESP_INTEGRITY'}' />
1912 <input type='hidden' name='ESP_GROUPTYPE' value='$cgiparams{'ESP_GROUPTYPE'}' />
1913 <input type='hidden' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' />
1914 <input type='hidden' name='COMPRESSION' value='$cgiparams{'COMPRESSION'}' />
1915 <input type='hidden' name='ONLY_PROPOSED' value='$cgiparams{'ONLY_PROPOSED'}' />
1916 <input type='hidden' name='PFS' value='$cgiparams{'PFS'}' />
1917 <input type='hidden' name='VHOST' value='$cgiparams{'VHOST'}' />
1918 END
1919 ;
1920 if ($cgiparams{'KEY'}) {
1921 print "<input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />";
1922 print "<input type='hidden' name='AUTH' value='$cgiparams{'AUTH'}' />";
1923 }
1924
1925 &Header::openbox('100%', 'left', "$Lang::tr{'connection'}:");
1926 print "<table width='100%'>";
1927 print "<tr><td width='25%' class='boldbase'>$Lang::tr{'name'}:</td>";
1928 if ($cgiparams{'KEY'}) {
1929 print "<td width='25%' class='base'><input type='hidden' name='NAME' value='$cgiparams{'NAME'}' /><b>$cgiparams{'NAME'}</b></td>";
1930 } else {
1931 print "<td width='25%'><input type='text' name='NAME' value='$cgiparams{'NAME'}' size='30' /></td>";
1932 }
1933 print "<td>$Lang::tr{'enabled'}</td><td><input type='checkbox' name='ENABLED' $checked{'ENABLED'}{'on'} /></td></tr>";
1934 print '</tr><td><br /></td><tr>';
1935
1936 my $disabled;
1937 my $blob;
1938 if ($cgiparams{'TYPE'} eq 'host') {
1939 $disabled = "disabled='disabled'";
1940 $blob = "<img src='/blob.gif' alt='*' />";
1941 };
1942
1943 print <<END
1944 <tr>
1945 <td class='boldbase'>$Lang::tr{'remote host/ip'}:&nbsp;$blob</td>
1946 <td>
1947 <input type='text' name='REMOTE' value='$cgiparams{'REMOTE'}' size='30' />
1948 </td>
1949 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'remote subnet'}</td>
1950 <td>
1951 <input $disabled type='text' name='REMOTE_SUBNET' value='$cgiparams{'REMOTE_SUBNET'}' size='30' />
1952 </td>
1953 </tr>
1954 <tr>
1955 <td class='boldbase' nowrap='nowrap'>$Lang::tr{'local subnet'}</td>
1956 <td colspan='3'>
1957 <input type='text' name='LOCAL_SUBNET' value='$cgiparams{'LOCAL_SUBNET'}' size='30' />
1958 </td>
1959 </tr>
1960 <tr>
1961 <td class='boldbase'>$Lang::tr{'vpn local id'}:<br />($Lang::tr{'eg'} <tt>&#64;xy.example.com</tt>)</td>
1962 <td><input type='text' name='LOCAL_ID' value='$cgiparams{'LOCAL_ID'}' /></td>
1963 <td class='boldbase'>$Lang::tr{'vpn remote id'}:</td>
1964 <td><input type='text' name='REMOTE_ID' value='$cgiparams{'REMOTE_ID'}' /></td>
1965 </tr><tr>
1966 </tr><td><br /></td><tr>
1967 <td>$Lang::tr{'vpn keyexchange'}:</td>
1968 <td><select name='IKE_VERSION'>
1969 <option value='ikev2' $selected{'IKE_VERSION'}{'ikev2'}>IKEv2</option>
1970 <option value='ikev1' $selected{'IKE_VERSION'}{'ikev1'}>IKEv1</option>
1971 </select>
1972 </td>
1973 <td>$Lang::tr{'dpd action'}:</td>
1974 <td><select name='DPD_ACTION'>
1975 <option value='clear' $selected{'DPD_ACTION'}{'clear'}>clear</option>
1976 <option value='hold' $selected{'DPD_ACTION'}{'hold'}>hold</option>
1977 <option value='restart' $selected{'DPD_ACTION'}{'restart'}>restart</option>
1978 </select>
1979 </td>
1980 </tr><tr>
1981 <td class='boldbase'>$Lang::tr{'remark title'}&nbsp;<img src='/blob.gif' alt='*' /></td>
1982 <td colspan='3'><input type='text' name='REMARK' value='$cgiparams{'REMARK'}' size='55' maxlength='50' /></td>
1983 </tr>
1984 END
1985 ;
1986 if (!$cgiparams{'KEY'}) {
1987 print "<tr><td colspan='3'><input type='checkbox' name='EDIT_ADVANCED' $checked{'EDIT_ADVANCED'}{'on'} /> $Lang::tr{'edit advanced settings when done'}</td></tr>";
1988 }
1989 print "</table>";
1990 &Header::closebox();
1991
1992 if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') {
1993 &Header::openbox('100%', 'left', $Lang::tr{'authentication'});
1994 print <<END
1995 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
1996 <tr><td class='base' width='50%'>$Lang::tr{'use a pre-shared key'}</td>
1997 <td class='base' width='50%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td>
1998 </tr>
1999 </table>
2000 END
2001 ;
2002 &Header::closebox();
2003 } elsif (! $cgiparams{'KEY'}) {
2004 my $cakeydisabled = ( ! -f "${General::swroot}/private/cakey.pem" ) ? "disabled='disabled'" : '';
2005 $cgiparams{'CERT_NAME'} = $Lang::tr{'vpn no full pki'} if ($cakeydisabled);
2006 my $cacrtdisabled = ( ! -f "${General::swroot}/ca/cacert.pem" ) ? "disabled='disabled'" : '';
2007
2008 &Header::openbox('100%', 'left', $Lang::tr{'authentication'});
2009 print <<END
2010 <table width='100%' cellpadding='0' cellspacing='5' border='0'>
2011 <tr><td width='5%'><input type='radio' name='AUTH' value='psk' $checked{'AUTH'}{'psk'} /></td>
2012 <td class='base' width='55%'>$Lang::tr{'use a pre-shared key'}</td>
2013 <td class='base' width='40%'><input type='password' name='PSK' size='30' value='$cgiparams{'PSK'}' /></td></tr>
2014 <tr><td colspan='3' bgcolor='#000000'></td></tr>
2015 <tr><td><input type='radio' name='AUTH' value='certreq' $checked{'AUTH'}{'certreq'} $cakeydisabled /></td>
2016 <td class='base'><hr />$Lang::tr{'upload a certificate request'}</td>
2017 <td class='base' rowspan='3' valign='middle'><input type='file' name='FH' size='30' $cacrtdisabled /></td></tr>
2018 <tr><td><input type='radio' name='AUTH' value='certfile' $checked{'AUTH'}{'certfile'} $cacrtdisabled /></td>
2019 <td class='base'>$Lang::tr{'upload a certificate'}</td></tr>
2020 <tr><td><input type='radio' name='AUTH' value='pkcs12' $cacrtdisabled /></td>
2021 <td class='base'>$Lang::tr{'upload p12 file'} $Lang::tr{'pkcs12 file password'}:<input type='password' name='P12_PASS'/></td></tr>
2022 <tr><td><input type='radio' name='AUTH' value='auth-dn' $checked{'AUTH'}{'auth-dn'} $cacrtdisabled /></td>
2023 <td class='base'><hr />$Lang::tr{'vpn auth-dn'}</td></tr>
2024 <tr><td colspan='3' bgcolor='#000000'></td></tr>
2025 <tr><td><input type='radio' name='AUTH' value='certgen' $checked{'AUTH'}{'certgen'} $cakeydisabled /></td>
2026 <td class='base'><hr />$Lang::tr{'generate a certificate'}</td><td>&nbsp;</td></tr>
2027 <tr><td>&nbsp;</td>
2028 <td class='base'>$Lang::tr{'users fullname or system hostname'}:</td>
2029 <td class='base' nowrap='nowrap'><input type='text' name='CERT_NAME' value='$cgiparams{'CERT_NAME'}' size='32' $cakeydisabled /></td></tr>
2030 <tr><td>&nbsp;</td>
2031 <td class='base'>$Lang::tr{'users email'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2032 <td class='base' nowrap='nowrap'><input type='text' name='CERT_EMAIL' value='$cgiparams{'CERT_EMAIL'}' size='32' $cakeydisabled /></td></tr>
2033 <tr><td>&nbsp;</td>
2034 <td class='base'>$Lang::tr{'users department'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2035 <td class='base' nowrap='nowrap'><input type='text' name='CERT_OU' value='$cgiparams{'CERT_OU'}' size='32' $cakeydisabled /></td></tr>
2036 <tr><td>&nbsp;</td>
2037 <td class='base'>$Lang::tr{'organization name'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2038 <td class='base' nowrap='nowrap'><input type='text' name='CERT_ORGANIZATION' value='$cgiparams{'CERT_ORGANIZATION'}' size='32' $cakeydisabled /></td></tr>
2039 <tr><td>&nbsp;</td>
2040 <td class='base'>$Lang::tr{'city'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2041 <td class='base' nowrap='nowrap'><input type='text' name='CERT_CITY' value='$cgiparams{'CERT_CITY'}' size='32' $cakeydisabled /></td></tr>
2042 <tr><td>&nbsp;</td>
2043 <td class='base'>$Lang::tr{'state or province'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2044 <td class='base' nowrap='nowrap'><input type='text' name='CERT_STATE' value='$cgiparams{'CERT_STATE'}' size='32' $cakeydisabled /></td></tr>
2045 <tr><td>&nbsp;</td>
2046 <td class='base'>$Lang::tr{'country'}:</td>
2047 <td class='base'><select name='CERT_COUNTRY' $cakeydisabled>
2048 END
2049 ;
2050 foreach my $country (sort keys %{Countries::countries}) {
2051 print "\t\t\t<option value='$Countries::countries{$country}'";
2052 if ( $Countries::countries{$country} eq $cgiparams{'CERT_COUNTRY'} ) {
2053 print " selected='selected'";
2054 }
2055 print ">$country</option>\n";
2056 }
2057 print <<END
2058 </select></td></tr>
2059
2060 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)<img src='/blob.gif' alt='*' /></td>
2061 <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' $cakeydisabled /></td></tr>
2062 <tr><td>&nbsp;</td>
2063 <td class='base'>$Lang::tr{'pkcs12 file password'}:</td>
2064 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS1' value='$cgiparams{'CERT_PASS1'}' size='32' $cakeydisabled /></td></tr>
2065 <tr><td>&nbsp;</td><td class='base'>$Lang::tr{'pkcs12 file password'}:($Lang::tr{'confirmation'})</td>
2066 <td class='base' nowrap='nowrap'><input type='password' name='CERT_PASS2' value='$cgiparams{'CERT_PASS2'}' size='32' $cakeydisabled /></td></tr>
2067 </table>
2068 END
2069 ;
2070 &Header::closebox();
2071 }
2072
2073 print "<div align='center'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' />";
2074 if ($cgiparams{'KEY'}) {
2075 print "<input type='submit' name='ACTION' value='$Lang::tr{'advanced'}' />";
2076 }
2077 print "<input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' /></div></form>";
2078 &Header::closebigbox();
2079 &Header::closepage();
2080 exit (0);
2081
2082 VPNCONF_END:
2083 }
2084
2085 ###
2086 ### Advanced settings
2087 ###
2088 if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
2089 ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq 'yes')) {
2090 &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings);
2091 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
2092 if (! $confighash{$cgiparams{'KEY'}}) {
2093 $errormessage = $Lang::tr{'invalid key'};
2094 goto ADVANCED_END;
2095 }
2096
2097 if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
2098 # I didn't read any incompatibilities here....
2099 #if ($cgiparams{'VHOST'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
2100 # $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
2101 # goto ADVANCED_ERROR;
2102 #}
2103 my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
2104 if ($#temp < 0) {
2105 $errormessage = $Lang::tr{'invalid input'};
2106 goto ADVANCED_ERROR;
2107 }
2108 foreach my $val (@temp) {
2109 if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
2110 $errormessage = $Lang::tr{'invalid input'};
2111 goto ADVANCED_ERROR;
2112 }
2113 }
2114 @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
2115 if ($#temp < 0) {
2116 $errormessage = $Lang::tr{'invalid input'};
2117 goto ADVANCED_ERROR;
2118 }
2119 foreach my $val (@temp) {
2120 if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha|md5|aesxcbc)$/) {
2121 $errormessage = $Lang::tr{'invalid input'};
2122 goto ADVANCED_ERROR;
2123 }
2124 }
2125 @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
2126 if ($#temp < 0) {
2127 $errormessage = $Lang::tr{'invalid input'};
2128 goto ADVANCED_ERROR;
2129 }
2130 foreach my $val (@temp) {
2131 if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192)$/) {
2132 $errormessage = $Lang::tr{'invalid input'};
2133 goto ADVANCED_ERROR;
2134 }
2135 }
2136 if ($cgiparams{'IKE_LIFETIME'} !~ /^\d+$/) {
2137 $errormessage = $Lang::tr{'invalid input for ike lifetime'};
2138 goto ADVANCED_ERROR;
2139 }
2140 if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
2141 $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
2142 goto ADVANCED_ERROR;
2143 }
2144 @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
2145 if ($#temp < 0) {
2146 $errormessage = $Lang::tr{'invalid input'};
2147 goto ADVANCED_ERROR;
2148 }
2149 foreach my $val (@temp) {
2150 if ($val !~ /^(aes256|aes192|aes128|3des|camellia256|camellia192|camellia128)$/) {
2151 $errormessage = $Lang::tr{'invalid input'};
2152 goto ADVANCED_ERROR;
2153 }
2154 }
2155 @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
2156 if ($#temp < 0) {
2157 $errormessage = $Lang::tr{'invalid input'};
2158 goto ADVANCED_ERROR;
2159 }
2160 foreach my $val (@temp) {
2161 if ($val !~ /^(sha2_512|sha2_384|sha2_256|sha1|md5|aesxcbc)$/) {
2162 $errormessage = $Lang::tr{'invalid input'};
2163 goto ADVANCED_ERROR;
2164 }
2165 }
2166 if ($cgiparams{'ESP_GROUPTYPE'} ne '' &&
2167 $cgiparams{'ESP_GROUPTYPE'} !~ /^ecp(192|224|256|384|512)(bp)?$/ &&
2168 $cgiparams{'ESP_GROUPTYPE'} !~ /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) {
2169 $errormessage = $Lang::tr{'invalid input'};
2170 goto ADVANCED_ERROR;
2171 }
2172
2173 if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) {
2174 $errormessage = $Lang::tr{'invalid input for esp keylife'};
2175 goto ADVANCED_ERROR;
2176 }
2177 if ($cgiparams{'ESP_KEYLIFE'} < 1 || $cgiparams{'ESP_KEYLIFE'} > 24) {
2178 $errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'};
2179 goto ADVANCED_ERROR;
2180 }
2181
2182 if (
2183 ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
2184 ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
2185 ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
2186 ($cgiparams{'VHOST'} !~ /^(|on|off)$/)
2187 ){
2188 $errormessage = $Lang::tr{'invalid input'};
2189 goto ADVANCED_ERROR;
2190 }
2191
2192 $confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
2193 $confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
2194 $confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'};
2195 $confighash{$cgiparams{'KEY'}}[16] = $cgiparams{'IKE_LIFETIME'};
2196 $confighash{$cgiparams{'KEY'}}[21] = $cgiparams{'ESP_ENCRYPTION'};
2197 $confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
2198 $confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
2199 $confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
2200 $confighash{$cgiparams{'KEY'}}[12] = 'off'; #$cgiparams{'AGGRMODE'};
2201 $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
2202 $confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
2203 $confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
2204 $confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'VHOST'};
2205 $confighash{$cgiparams{'KEY'}}[30] = $cgiparams{'DPD_TIMEOUT'};
2206 $confighash{$cgiparams{'KEY'}}[31] = $cgiparams{'DPD_DELAY'};
2207 &General::writehasharray("${General::swroot}/vpn/config", \%confighash);
2208 &writeipsecfiles();
2209 if (&vpnenabled) {
2210 system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
2211 sleep $sleepDelay;
2212 }
2213 goto ADVANCED_END;
2214 } else {
2215 $cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
2216 $cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
2217 $cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
2218 $cgiparams{'IKE_LIFETIME'} = $confighash{$cgiparams{'KEY'}}[16];
2219 $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21];
2220 $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
2221 $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
2222 $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
2223 $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
2224 $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
2225 $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
2226 $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
2227 $cgiparams{'DPD_TIMEOUT'} = $confighash{$cgiparams{'KEY'}}[30];
2228 $cgiparams{'DPD_DELAY'} = $confighash{$cgiparams{'KEY'}}[31];
2229
2230 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net' || $confighash{$cgiparams{'KEY'}}[10]) {
2231 $cgiparams{'VHOST'} = 'off';
2232 }
2233 }
2234
2235 ADVANCED_ERROR:
2236 $checked{'IKE_ENCRYPTION'}{'aes256'} = '';
2237 $checked{'IKE_ENCRYPTION'}{'aes192'} = '';
2238 $checked{'IKE_ENCRYPTION'}{'aes128'} = '';
2239 $checked{'IKE_ENCRYPTION'}{'3des'} = '';
2240 $checked{'IKE_ENCRYPTION'}{'camellia256'} = '';
2241 $checked{'IKE_ENCRYPTION'}{'camellia192'} = '';
2242 $checked{'IKE_ENCRYPTION'}{'camellia128'} = '';
2243 my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
2244 foreach my $key (@temp) {$checked{'IKE_ENCRYPTION'}{$key} = "selected='selected'"; }
2245 $checked{'IKE_INTEGRITY'}{'sha2_512'} = '';
2246 $checked{'IKE_INTEGRITY'}{'sha2_384'} = '';
2247 $checked{'IKE_INTEGRITY'}{'sha2_256'} = '';
2248 $checked{'IKE_INTEGRITY'}{'sha'} = '';
2249 $checked{'IKE_INTEGRITY'}{'md5'} = '';
2250 $checked{'IKE_INTEGRITY'}{'aesxcbc'} = '';
2251 @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
2252 foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
2253 $checked{'IKE_GROUPTYPE'}{'768'} = '';
2254 $checked{'IKE_GROUPTYPE'}{'1024'} = '';
2255 $checked{'IKE_GROUPTYPE'}{'1536'} = '';
2256 $checked{'IKE_GROUPTYPE'}{'2048'} = '';
2257 $checked{'IKE_GROUPTYPE'}{'3072'} = '';
2258 $checked{'IKE_GROUPTYPE'}{'4096'} = '';
2259 $checked{'IKE_GROUPTYPE'}{'6144'} = '';
2260 $checked{'IKE_GROUPTYPE'}{'8192'} = '';
2261 @temp = split('\|', $cgiparams{'IKE_GROUPTYPE'});
2262 foreach my $key (@temp) {$checked{'IKE_GROUPTYPE'}{$key} = "selected='selected'"; }
2263
2264 # 768 is not supported by strongswan
2265 $checked{'IKE_GROUPTYPE'}{'768'} = '';
2266
2267 $checked{'ESP_ENCRYPTION'}{'aes256'} = '';
2268 $checked{'ESP_ENCRYPTION'}{'aes192'} = '';
2269 $checked{'ESP_ENCRYPTION'}{'aes128'} = '';
2270 $checked{'ESP_ENCRYPTION'}{'3des'} = '';
2271 $checked{'ESP_ENCRYPTION'}{'camellia256'} = '';
2272 $checked{'ESP_ENCRYPTION'}{'camellia192'} = '';
2273 $checked{'ESP_ENCRYPTION'}{'camellia128'} = '';
2274 @temp = split('\|', $cgiparams{'ESP_ENCRYPTION'});
2275 foreach my $key (@temp) {$checked{'ESP_ENCRYPTION'}{$key} = "selected='selected'"; }
2276 $checked{'ESP_INTEGRITY'}{'sha2_512'} = '';
2277 $checked{'ESP_INTEGRITY'}{'sha2_384'} = '';
2278 $checked{'ESP_INTEGRITY'}{'sha2_256'} = '';
2279 $checked{'ESP_INTEGRITY'}{'sha1'} = '';
2280 $checked{'ESP_INTEGRITY'}{'md5'} = '';
2281 $checked{'ESP_INTEGRITY'}{'aesxcbc'} = '';
2282 @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
2283 foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
2284 $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
2285
2286 $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
2287 $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
2288 $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
2289 $checked{'VHOST'} = $cgiparams{'VHOST'} eq 'on' ? "checked='checked'" : '' ;
2290
2291 &Header::showhttpheaders();
2292 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2293 &Header::openbigbox('100%', 'left', '', $errormessage);
2294
2295 if ($errormessage) {
2296 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
2297 print "<class name='base'>$errormessage";
2298 print "&nbsp;</class>";
2299 &Header::closebox();
2300 }
2301
2302 if ($warnmessage) {
2303 &Header::openbox('100%', 'left', $Lang::tr{'warning messages'});
2304 print "<class name='base'>$warnmessage";
2305 print "&nbsp;</class>";
2306 &Header::closebox();
2307 }
2308
2309 &Header::openbox('100%', 'left', "$Lang::tr{'advanced'}:");
2310 print <<EOF
2311 <form method='post' enctype='multipart/form-data' action='$ENV{'SCRIPT_NAME'}'>
2312 <input type='hidden' name='ADVANCED' value='yes' />
2313 <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
2314
2315 <table width='100%'>
2316 <thead>
2317 <tr>
2318 <th></th>
2319 <th>IKE</th>
2320 <th>ESP</th>
2321 </tr>
2322 </thead>
2323 <tbody>
2324 <tr>
2325 <td class='boldbase'>$Lang::tr{'encryption'}</td>
2326 <td class='boldbase'>
2327 <select name='IKE_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
2328 <option value='aes256' $checked{'IKE_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
2329 <option value='aes192' $checked{'IKE_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
2330 <option value='aes128' $checked{'IKE_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
2331 <option value='3des' $checked{'IKE_ENCRYPTION'}{'3des'}>3DES</option>
2332 <option value='camellia256' $checked{'IKE_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
2333 <option value='camellia192' $checked{'IKE_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
2334 <option value='camellia128' $checked{'IKE_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
2335 </select>
2336 </td>
2337 <td class='boldbase'>
2338 <select name='ESP_ENCRYPTION' multiple='multiple' size='6' style='width: 100%'>
2339 <option value='aes256' $checked{'ESP_ENCRYPTION'}{'aes256'}>AES (256 bit)</option>
2340 <option value='aes192' $checked{'ESP_ENCRYPTION'}{'aes192'}>AES (192 bit)</option>
2341 <option value='aes128' $checked{'ESP_ENCRYPTION'}{'aes128'}>AES (128 bit)</option>
2342 <option value='3des' $checked{'ESP_ENCRYPTION'}{'3des'}>3DES</option>
2343 <option value='camellia256' $checked{'ESP_ENCRYPTION'}{'camellia256'}>Camellia (256 bit)</option>
2344 <option value='camellia192' $checked{'ESP_ENCRYPTION'}{'camellia192'}>Camellia (192 bit)</option>
2345 <option value='camellia128' $checked{'ESP_ENCRYPTION'}{'camellia128'}>Camellia (128 bit)</option>
2346 </select>
2347 </td>
2348 </tr>
2349
2350 <tr>
2351 <td class='boldbase'>$Lang::tr{'integrity'}</td>
2352 <td class='boldbase'>
2353 <select name='IKE_INTEGRITY' multiple='multiple' size='6' style='width: 100%'>
2354 <option value='sha2_512' $checked{'IKE_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
2355 <option value='sha2_384' $checked{'IKE_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
2356 <option value='sha2_256' $checked{'IKE_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
2357 <option value='sha' $checked{'IKE_INTEGRITY'}{'sha'}>SHA1</option>
2358 <option value='md5' $checked{'IKE_INTEGRITY'}{'md5'}>MD5</option>
2359 <option value='aesxcbc' $checked{'IKE_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
2360 </select>
2361 </td>
2362 <td class='boldbase'>
2363 <select name='ESP_INTEGRITY' multiple='multiple' size='6' style='width: 100%'>
2364 <option value='sha2_512' $checked{'ESP_INTEGRITY'}{'sha2_512'}>SHA2 512 bit</option>
2365 <option value='sha2_384' $checked{'ESP_INTEGRITY'}{'sha2_384'}>SHA2 384 bit</option>
2366 <option value='sha2_256' $checked{'ESP_INTEGRITY'}{'sha2_256'}>SHA2 256 bit</option>
2367 <option value='sha1' $checked{'ESP_INTEGRITY'}{'sha1'}>SHA1</option>
2368 <option value='md5' $checked{'ESP_INTEGRITY'}{'md5'}>MD5</option>
2369 <option value='aesxcbc' $checked{'ESP_INTEGRITY'}{'aesxcbc'}>AES XCBC</option>
2370 </select>
2371 </td>
2372 </tr>
2373 <tr>
2374 <td class='boldbase'>$Lang::tr{'lifetime'}</td>
2375 <td class='boldbase'>
2376 <input type='text' name='IKE_LIFETIME' value='$cgiparams{'IKE_LIFETIME'}' size='5' /> $Lang::tr{'hours'}
2377 </td>
2378 <td class='boldbase'>
2379 <input type='text' name='ESP_KEYLIFE' value='$cgiparams{'ESP_KEYLIFE'}' size='5' /> $Lang::tr{'hours'}
2380 </td>
2381 </tr>
2382 <tr>
2383 <td class='boldbase'>$Lang::tr{'grouptype'}</td>
2384 <td class='boldbase'>
2385 <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
2386 <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
2387 <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
2388 <option value='e256' $checked{'IKE_GROUPTYPE'}{'e256'}>ECP-256 (NIST)</option>
2389 <option value='e224' $checked{'IKE_GROUPTYPE'}{'e224'}>ECP-224 (NIST)</option>
2390 <option value='e192' $checked{'IKE_GROUPTYPE'}{'e192'}>ECP-192 (NIST)</option>
2391 <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
2392 <option value='e384bp' $checked{'IKE_GROUPTYPE'}{'e384bp'}>ECP-384 (Brainpool)</option>
2393 <option value='e256bp' $checked{'IKE_GROUPTYPE'}{'e256bp'}>ECP-256 (Brainpool)</option>
2394 <option value='e224bp' $checked{'IKE_GROUPTYPE'}{'e224bp'}>ECP-224 (Brainpool)</option>
2395 <option value='8192' $checked{'IKE_GROUPTYPE'}{'8192'}>MODP-8192</option>
2396 <option value='6144' $checked{'IKE_GROUPTYPE'}{'6144'}>MODP-6144</option>
2397 <option value='4096' $checked{'IKE_GROUPTYPE'}{'4096'}>MODP-4096</option>
2398 <option value='3072' $checked{'IKE_GROUPTYPE'}{'3072'}>MODP-3072</option>
2399 <option value='2048s256' $checked{'IKE_GROUPTYPE'}{'2048s256'}>MODP-2048/256</option>
2400 <option value='2048s224' $checked{'IKE_GROUPTYPE'}{'2048s224'}>MODP-2048/224</option>
2401 <option value='2048s160' $checked{'IKE_GROUPTYPE'}{'2048s160'}>MODP-2048/160</option>
2402 <option value='2048' $checked{'IKE_GROUPTYPE'}{'2048'}>MODP-2048</option>
2403 <option value='1536' $checked{'IKE_GROUPTYPE'}{'1536'}>MODP-1536</option>
2404 <option value='1024' $checked{'IKE_GROUPTYPE'}{'1024'}>MODP-1024</option>
2405 </select>
2406 </td>
2407 <td></td>
2408 </tr>
2409 </tbody>
2410 </table>
2411
2412 <hr>
2413
2414 <table width="100%">
2415 <tr>
2416 <td colspan='2'>
2417 <label>
2418 <input type='checkbox' name='ONLY_PROPOSED' $checked{'ONLY_PROPOSED'} />
2419 IKE+ESP: $Lang::tr{'use only proposed settings'}</td>
2420 </label>
2421 </td>
2422 </tr>
2423 <tr>
2424 <td colspan='2'>
2425 <label>
2426 <input type='checkbox' name='PFS' $checked{'PFS'} />
2427 $Lang::tr{'pfs yes no'}
2428 </label>
2429 </td>
2430 </tr>
2431 <tr>
2432 <td colspan='2'>
2433 <label>
2434 <input type='checkbox' name='COMPRESSION' $checked{'COMPRESSION'} />
2435 $Lang::tr{'vpn payload compression'}
2436 </label>
2437 </td>
2438 </tr>
2439 <tr>
2440 <td width='20%'>
2441 <label>
2442 $Lang::tr{'dpd timeout'}
2443 </label>
2444 </td>
2445 <td>
2446 <input type='text' name='DPD_TIMEOUT' size='5' value='$cgiparams{'DPD_TIMEOUT'}' />
2447 </td>
2448 </tr>
2449 <tr>
2450 <td width='20%'>
2451 <label>
2452 $Lang::tr{'dpd delay'}
2453 </label>
2454 </td>
2455 <td>
2456 <input type='text' name='DPD_DELAY' size='5' value='$cgiparams{'DPD_DELAY'}' />
2457 </td>
2458 </tr>
2459 EOF
2460 ;
2461 if ($confighash{$cgiparams{'KEY'}}[3] eq 'net') {
2462 print "<tr><td><input type='hidden' name='VHOST' value='off' /></td></tr>";
2463 } elsif ($confighash{$cgiparams{'KEY'}}[10]) {
2464 print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} disabled='disabled' />";
2465 print " $Lang::tr{'vpn vhost'}</label></td></tr>";
2466 } else {
2467 print "<tr><td><label><input type='checkbox' name='VHOST' $checked{'VHOST'} />";
2468 print " $Lang::tr{'vpn vhost'}</label></td></tr>";
2469 }
2470
2471 print <<EOF;
2472 <tr>
2473 <td align='right' colspan='2'>
2474 <input type='submit' name='ACTION' value='$Lang::tr{'save'}' />
2475 <input type='submit' name='ACTION' value='$Lang::tr{'cancel'}' />
2476 </td>
2477 </tr>
2478 </table></form>
2479 EOF
2480
2481 &Header::closebox();
2482 &Header::closebigbox();
2483 &Header::closepage();
2484 exit(0);
2485
2486 ADVANCED_END:
2487 }
2488
2489 ###
2490 ### Default status page
2491 ###
2492 %cgiparams = ();
2493 %cahash = ();
2494 %confighash = ();
2495 &General::readhash("${General::swroot}/vpn/settings", \%cgiparams);
2496 &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
2497 &General::readhasharray("${General::swroot}/vpn/config", \%confighash);
2498 $cgiparams{'CA_NAME'} = '';
2499
2500 my @status = `/usr/local/bin/ipsecctrl I 2>/dev/null`;
2501
2502 # suggest a default name for this side
2503 if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") {
2504 if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) {
2505 my $ipaddr = <IPADDR>;
2506 close IPADDR;
2507 chomp ($ipaddr);
2508 $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
2509 if ($cgiparams{'VPN_IP'} eq '') {
2510 $cgiparams{'VPN_IP'} = $ipaddr;
2511 }
2512 }
2513 }
2514 # no IP found, use %defaultroute
2515 $cgiparams{'VPN_IP'} ='%defaultroute' if ($cgiparams{'VPN_IP'} eq '');
2516
2517 $cgiparams{'VPN_DELAYED_START'} = 0 if (! defined ($cgiparams{'VPN_DELAYED_START'}));
2518 $checked{'ENABLED'} = $cgiparams{'ENABLED'} eq 'on' ? "checked='checked'" : '';
2519
2520 &Header::showhttpheaders();
2521 &Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
2522 &Header::openbigbox('100%', 'left', '', $errormessage);
2523
2524 if ($errormessage) {
2525 &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
2526 print "<class name='base'>$errormessage\n";
2527 print "&nbsp;</class>\n";
2528 &Header::closebox();
2529 }
2530
2531 &Header::openbox('100%', 'left', $Lang::tr{'global settings'});
2532 print <<END
2533 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2534 <table width='100%'>
2535 <tr>
2536 <td width='20%' class='base' nowrap='nowrap'>$Lang::tr{'vpn red name'}:</td>
2537 <td width='20%'><input type='text' name='VPN_IP' value='$cgiparams{'VPN_IP'}' /></td>
2538 <td width='20%' class='base'>$Lang::tr{'enabled'}<input type='checkbox' name='ENABLED' $checked{'ENABLED'} /></td>
2539 </tr>
2540 END
2541 ;
2542 print <<END
2543 <tr>
2544 <td class='base' nowrap='nowrap'>$Lang::tr{'vpn delayed start'}:&nbsp;<img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' /></td>
2545 <td ><input type='text' name='VPN_DELAYED_START' value='$cgiparams{'VPN_DELAYED_START'}' /></td>
2546 </tr>
2547 <tr>
2548 <td class='base' nowrap='nowrap'>$Lang::tr{'host to net vpn'}:&nbsp;<img src='/blob.gif' alt='*' /></td>
2549 <td ><input type='text' name='RW_NET' value='$cgiparams{'RW_NET'}' /></td>
2550 </tr>
2551 </table>
2552 <hr />
2553 <table width='100%'>
2554 <tr>
2555 <td class='base' valign='top'><img src='/blob.gif' alt='*' /></td>
2556 <td width='70%' class='base' valign='top'>$Lang::tr{'this field may be blank'}</td>
2557 </tr>
2558 <tr>
2559 <td class='base' valign='top' nowrap='nowrap'><img src='/blob.gif' alt='*' /><img src='/blob.gif' alt='*' />&nbsp;</td>
2560 <td class='base'> <font class='base'>$Lang::tr{'vpn delayed start help'}</font></td>
2561 <td width='30%' align='center' class='base'><input type='submit' name='ACTION' value='$Lang::tr{'save'}' /></td>
2562 </tr>
2563 </table>
2564 END
2565 ;
2566 print "</form>";
2567 &Header::closebox();
2568
2569 &Header::openbox('100%', 'left', $Lang::tr{'connection status and controlc'});
2570 print <<END
2571 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
2572 <tr>
2573 <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
2574 <td width='22%' class='boldbase' align='center'><b>$Lang::tr{'type'}</b></td>
2575 <td width='23%' class='boldbase' align='center'><b>$Lang::tr{'common name'}</b></td>
2576 <td width='30%' class='boldbase' align='center'><b>$Lang::tr{'remark'}</b></td>
2577 <td width='10%' class='boldbase' align='center'><b>$Lang::tr{'status'}</b></td>
2578 <td class='boldbase' align='center' colspan='6'><b>$Lang::tr{'action'}</b></td>
2579 </tr>
2580 END
2581 ;
2582 my $id = 0;
2583 my $gif;
2584 foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) {
2585 if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; }
2586
2587 if ($id % 2) {
2588 print "<tr bgcolor='$color{'color20'}'>\n";
2589 } else {
2590 print "<tr bgcolor='$color{'color22'}'>\n";
2591 }
2592 print "<td align='center' nowrap='nowrap'>$confighash{$key}[1]</td>";
2593 print "<td align='center' nowrap='nowrap'>" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ") $confighash{$key}[29]</td>";
2594 if ($confighash{$key}[2] eq '%auth-dn') {
2595 print "<td align='left' nowrap='nowrap'>$confighash{$key}[9]</td>";
2596 } elsif ($confighash{$key}[4] eq 'cert') {
2597 print "<td align='left' nowrap='nowrap'>$confighash{$key}[2]</td>";
2598 } else {
2599 print "<td align='left'>&nbsp;</td>";
2600 }
2601 print "<td align='center'>$confighash{$key}[25]</td>";
2602 # get real state
2603 my $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourred}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
2604 foreach my $line (@status) {
2605 if (($line =~ /\"$confighash{$key}[1]\".*IPsec SA established/) ||
2606 ($line =~ /$confighash{$key}[1]\{.*INSTALLED/))
2607 {
2608 $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourgreen}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsopen'}</font></b></td></tr></table>";
2609 }
2610 }
2611 # move to blueif really down
2612 if ($confighash{$key}[0] eq 'off' && $active =~ /${Header::colourred}/ ) {
2613 $active = "<table cellpadding='2' cellspacing='0' bgcolor='${Header::colourblue}' width='100%'><tr><td align='center'><b><font color='#FFFFFF'>$Lang::tr{'capsclosed'}</font></b></td></tr></table>";
2614 }
2615 print <<END
2616 <td align='center'>$active</td>
2617 <td align='center'>
2618 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2619 <input type='image' name='$Lang::tr{'restart'}' src='/images/reload.gif' alt='$Lang::tr{'restart'}' title='$Lang::tr{'restart'}' />
2620 <input type='hidden' name='ACTION' value='$Lang::tr{'restart'}' />
2621 <input type='hidden' name='KEY' value='$key' />
2622 </form>
2623 </td>
2624 END
2625 ;
2626 if (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
2627 print <<END
2628 <td align='center'>
2629 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2630 <input type='image' name='$Lang::tr{'show certificate'}' src='/images/info.gif' alt='$Lang::tr{'show certificate'}' title='$Lang::tr{'show certificate'}' />
2631 <input type='hidden' name='ACTION' value='$Lang::tr{'show certificate'}' />
2632 <input type='hidden' name='KEY' value='$key' />
2633 </form>
2634 </td>
2635 END
2636 ; } else {
2637 print "<td width='2%'>&nbsp;</td>";
2638 }
2639 if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/certs/$confighash{$key}[1].p12") {
2640 print <<END
2641 <td align='center'>
2642 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2643 <input type='image' name='$Lang::tr{'download pkcs12 file'}' src='/images/floppy.gif' alt='$Lang::tr{'download pkcs12 file'}' title='$Lang::tr{'download pkcs12 file'}' />
2644 <input type='hidden' name='ACTION' value='$Lang::tr{'download pkcs12 file'}' />
2645 <input type='hidden' name='KEY' value='$key' />
2646 </form>
2647 </td>
2648 END
2649 ; } elsif (($confighash{$key}[4] eq 'cert') && ($confighash{$key}[2] ne '%auth-dn')) {
2650 print <<END
2651 <td align='center'>
2652 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2653 <input type='image' name='$Lang::tr{'download certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download certificate'}' title='$Lang::tr{'download certificate'}' />
2654 <input type='hidden' name='ACTION' value='$Lang::tr{'download certificate'}' />
2655 <input type='hidden' name='KEY' value='$key' />
2656 </form>
2657 </td>
2658 END
2659 ; } else {
2660 print "<td width='2%'>&nbsp;</td>";
2661 }
2662 print <<END
2663 <td align='center'>
2664 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2665 <input type='image' name='$Lang::tr{'toggle enable disable'}' src='/images/$gif' alt='$Lang::tr{'toggle enable disable'}' title='$Lang::tr{'toggle enable disable'}' />
2666 <input type='hidden' name='ACTION' value='$Lang::tr{'toggle enable disable'}' />
2667 <input type='hidden' name='KEY' value='$key' />
2668 </form>
2669 </td>
2670
2671 <td align='center'>
2672 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2673 <input type='hidden' name='ACTION' value='$Lang::tr{'edit'}' />
2674 <input type='image' name='$Lang::tr{'edit'}' src='/images/edit.gif' alt='$Lang::tr{'edit'}' title='$Lang::tr{'edit'}' />
2675 <input type='hidden' name='KEY' value='$key' />
2676 </form>
2677 </td>
2678 <td align='center' >
2679 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2680 <input type='hidden' name='ACTION' value='$Lang::tr{'remove'}' />
2681 <input type='image' name='$Lang::tr{'remove'}' src='/images/delete.gif' alt='$Lang::tr{'remove'}' title='$Lang::tr{'remove'}' />
2682 <input type='hidden' name='KEY' value='$key' />
2683 </form>
2684 </td>
2685 </tr>
2686 END
2687 ;
2688 $id++;
2689 }
2690 print "</table>";
2691
2692 # If the config file contains entries, print Key to action icons
2693 if ( $id ) {
2694 print <<END
2695 <table>
2696 <tr>
2697 <td class='boldbase'>&nbsp; <b>$Lang::tr{'legend'}:</b></td>
2698 <td>&nbsp; <img src='/images/on.gif' alt='$Lang::tr{'click to disable'}' /></td>
2699 <td class='base'>$Lang::tr{'click to disable'}</td>
2700 <td>&nbsp; &nbsp; <img src='/images/info.gif' alt='$Lang::tr{'show certificate'}' /></td>
2701 <td class='base'>$Lang::tr{'show certificate'}</td>
2702 <td>&nbsp; &nbsp; <img src='/images/edit.gif' alt='$Lang::tr{'edit'}' /></td>
2703 <td class='base'>$Lang::tr{'edit'}</td>
2704 <td>&nbsp; &nbsp; <img src='/images/delete.gif' alt='$Lang::tr{'remove'}' /></td>
2705 <td class='base'>$Lang::tr{'remove'}</td>
2706 </tr>
2707 <tr>
2708 <td>&nbsp; </td>
2709 <td>&nbsp; <img src='/images/off.gif' alt='?OFF' /></td>
2710 <td class='base'>$Lang::tr{'click to enable'}</td>
2711 <td>&nbsp; &nbsp; <img src='/images/floppy.gif' alt='?FLOPPY' /></td>
2712 <td class='base'>$Lang::tr{'download certificate'}</td>
2713 <td>&nbsp; &nbsp; <img src='/images/reload.gif' alt='?RELOAD'/></td>
2714 <td class='base'>$Lang::tr{'restart'}</td>
2715 </tr>
2716 </table>
2717 END
2718 ;
2719 }
2720
2721 print <<END
2722 <table width='100%'>
2723 <tr><td align='center' colspan='9'>
2724 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2725 <input type='submit' name='ACTION' value='$Lang::tr{'add'}' />
2726 </form>
2727 </td></tr>
2728 </table>
2729 END
2730 ;
2731 &Header::closebox();
2732
2733 &Header::openbox('100%', 'left', "$Lang::tr{'certificate authorities'}:");
2734 print <<EOF
2735 <table width='100%' border='0' cellspacing='1' cellpadding='0'>
2736 <tr>
2737 <td width='25%' class='boldbase' align='center'><b>$Lang::tr{'name'}</b></td>
2738 <td width='65%' class='boldbase' align='center'><b>$Lang::tr{'subject'}</b></td>
2739 <td width='10%' class='boldbase' colspan='3' align='center'><b>$Lang::tr{'action'}</b></td>
2740 </tr>
2741 EOF
2742 ;
2743 if (-f "${General::swroot}/ca/cacert.pem") {
2744 my $casubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/ca/cacert.pem"));
2745
2746 print <<END
2747 <tr bgcolor='$color{'color22'}'>
2748 <td class='base'>$Lang::tr{'root certificate'}</td>
2749 <td class='base'>$casubject</td>
2750 <td width='3%' align='center'>
2751 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2752 <input type='hidden' name='ACTION' value='$Lang::tr{'show root certificate'}' />
2753 <input type='image' name='$Lang::tr{'edit'}' src='/images/info.gif' alt='$Lang::tr{'show root certificate'}' title='$Lang::tr{'show root certificate'}' />
2754 </form>
2755 </td>
2756 <td width='3%' align='center'>
2757 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2758 <input type='image' name='$Lang::tr{'download root certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download root certificate'}' title='$Lang::tr{'download root certificate'}' />
2759 <input type='hidden' name='ACTION' value='$Lang::tr{'download root certificate'}' />
2760 </form>
2761 </td>
2762 <td width='4%'>&nbsp;</td></tr>
2763 END
2764 ;
2765 } else {
2766 # display rootcert generation buttons
2767 print <<END
2768 <tr bgcolor='$color{'color22'}'>
2769 <td class='base'>$Lang::tr{'root certificate'}:</td>
2770 <td class='base'>$Lang::tr{'not present'}</td>
2771 <td colspan='3'>&nbsp;</td></tr>
2772 END
2773 ;
2774 }
2775
2776 if (-f "${General::swroot}/certs/hostcert.pem") {
2777 my $hostsubject = &Header::cleanhtml(getsubjectfromcert ("${General::swroot}/certs/hostcert.pem"));
2778
2779 print <<END
2780 <tr bgcolor='$color{'color20'}'>
2781 <td class='base'>$Lang::tr{'host certificate'}</td>
2782 <td class='base'>$hostsubject</td>
2783 <td width='3%' align='center'>
2784 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2785 <input type='hidden' name='ACTION' value='$Lang::tr{'show host certificate'}' />
2786 <input type='image' name='$Lang::tr{'show host certificate'}' src='/images/info.gif' alt='$Lang::tr{'show host certificate'}' title='$Lang::tr{'show host certificate'}' />
2787 </form>
2788 </td>
2789 <td width='3%' align='center'>
2790 <form method='post' action='$ENV{'SCRIPT_NAME'}'>
2791 <input type='image' name='$Lang::tr{'download host certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download host certificate'}' title='$Lang::tr{'download host certificate'}' />
2792 <input type='hidden' name='ACTION' value='$Lang::tr{'download host certificate'}' />
2793 </form>
2794 </td>
2795 <td width='4%'>&nbsp;</td></tr>
2796 END
2797 ;
2798 } else {
2799 # Nothing
2800 print <<END
2801 <tr bgcolor='$color{'color20'}'>
2802 <td width='25%' class='base'>$Lang::tr{'host certificate'}:</td>
2803 <td class='base'>$Lang::tr{'not present'}</td>
2804 <td colspan='3'>&nbsp;</td></tr>
2805 END
2806 ;
2807 }
2808
2809 my $rowcolor = 0;
2810 if (keys %cahash > 0) {
2811 foreach my $key (keys %cahash) {
2812 if ($rowcolor++ % 2) {
2813 print "<tr bgcolor='$color{'color20'}'>\n";
2814 } else {
2815 print "<tr bgcolor='$color{'color22'}'>\n";
2816 }
2817 print "<td class='base'>$cahash{$key}[0]</td>\n";
2818 print "<td class='base'>$cahash{$key}[1]</td>\n";
2819 print <<END
2820 <td align='center'>
2821 <form method='post' name='cafrm${key}a' action='$ENV{'SCRIPT_NAME'}'>
2822 <input type='image' name='$Lang::tr{'show ca certificate'}' src='/images/info.gif' alt='$Lang::tr{'show ca certificate'}' title='$Lang::tr{'show ca certificate'}' />
2823 <input type='hidden' name='ACTION' value='$Lang::tr{'show ca certificate'}' />
2824 <input type='hidden' name='KEY' value='$key' />
2825 </form>
2826 </td>
2827 <td align='center'>
2828 <form method='post' name='cafrm${key}b' action='$ENV{'SCRIPT_NAME'}'>
2829 <input type='image' name='$Lang::tr{'download ca certificate'}' src='/images/floppy.gif' alt='$Lang::tr{'download ca certificate'}' title='$Lang::tr{'download ca certificate'}' />
2830 <input type='hidden' name='ACTION' value='$Lang::tr{'download ca certificate'}' />
2831 <input type='hidden' name='KEY' value='$key' />
2832 </form>
2833 </td>
2834 <td align='center'>
2835 <form method='post' name='cafrm${key}c' action='$ENV{'SCRIPT_NAME'}'>
2836 <input type='hidden' name='ACTION' value='$Lang::tr{'remove ca certificate'}' />
2837 <input type='image' name='$Lang::tr{'remove ca certificate'}' src='/images/delete.gif' alt='$Lang::tr{'remove ca certificate'}' title='$Lang::tr{'remove ca certificate'}' />
2838 <input type='hidden' name='KEY' value='$key' />
2839 </form>
2840 </td>