From 4fbf17f4a10fbf2a0ddeae1aa436cf26f6b3a035 Mon Sep 17 00:00:00 2001 From: Adolf Belka Date: Sun, 15 Oct 2023 15:34:16 +0200 Subject: [PATCH] ovpnmain.cgi update branch for NCP etc Signed-off-by: Adolf Belka --- html/cgi-bin/ovpnmain.cgi | 844 ++++++++++++++++++++++++-------------- langs/en/cgi-bin/en.pl | 39 +- 2 files changed, 550 insertions(+), 333 deletions(-) diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi index eb89c50955..e480c8e2ad 100755 --- a/html/cgi-bin/ovpnmain.cgi +++ b/html/cgi-bin/ovpnmain.cgi @@ -79,6 +79,7 @@ my $name; my $col=""; my $local_serverconf = "${General::swroot}/ovpn/scripts/server.conf.local"; my $local_clientconf = "${General::swroot}/ovpn/scripts/client.conf.local"; +my @advcipherchar=(); my $dhparameter = "/etc/ssl/ffdhe4096.pem"; &General::readhash("${General::swroot}/ethernet/settings", \%netsettings); @@ -101,6 +102,7 @@ $cgiparams{'number'} = ''; $cgiparams{'DCIPHER'} = ''; $cgiparams{'DAUTH'} = ''; $cgiparams{'TLSAUTH'} = ''; +$cgiparams{'DATACIPHERS'} = ''; $routes_push_file = "${General::swroot}/ovpn/routes_push"; # Perform crypto and configration test &pkiconfigcheck; @@ -187,7 +189,7 @@ sub cleanssldatabase if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt")) { print FILE ""; close FILE; - } + }my @advcipherchar=(); if (open(FILE, ">${General::swroot}/ovpn/certs/index.txt.attr")) { print FILE ""; close FILE; @@ -252,6 +254,20 @@ sub pkiconfigcheck } } + # Warning if deprecated 64-bit-block ciphers or weak HMAC is in usage + if (-f "${General::swroot}/ovpn/server.conf") { + my $oldciphers = "${General::swroot}/ovpn/server.conf"; + open(FH, $oldciphers); + while(my $cipherstring = ) { + if ($cipherstring =~ /BF-CBC|CAST5-CBC|DESX-CBC|DES-EDE-CBC|DES-EDE3-CBC|SHA1/) { + my @tempcipherstring = split(" ", $cipherstring); + $cryptowarning = "
$Lang::tr{'ovpn warning algorithm'}: $tempcipherstring[1]
$Lang::tr{'ovpn warning 64 bit block cipher'}"; + goto CRYPTO_WARNING; + } + } + close(FH); + } + CRYPTO_WARNING: } @@ -329,15 +345,30 @@ sub writeserverconf { } print CONF "status-version 1\n"; print CONF "status /var/run/ovpnserver.log 30\n"; - print CONF "ncp-disable\n"; - print CONF "cipher $sovpnsettings{DCIPHER}\n"; - print CONF "auth $sovpnsettings{'DAUTH'}\n"; + print CONF "data-ciphers-fallback $sovpnsettings{DCIPHER}\n"; + + # Data channel encryption + # Set seperator for data ciphers + @advcipherchar = ($sovpnsettings{'DATACIPHERS'} =~ s/\|/:/g); + # Add also algorithm from --data-ciphers directive + if ($sovpnsettings{'DATACIPHERS'} ne '') { + print CONF "data-ciphers $sovpnsettings{'DATACIPHERS'}\n"; + } + + print CONF "auth $sovpnsettings{'DAUTH'}\n"; # Set TLSv2 as minimum print CONF "tls-version-min 1.2\n"; - if ($sovpnsettings{'TLSAUTH'} eq 'on') { - print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n"; - } + # TLS control channel authentication + if ($sovpnsettings{'TLSAUTH'} ne 'off') { + if ($sovpnsettings{'TLSAUTH'} eq 'on') { + print CONF "tls-auth ${General::swroot}/ovpn/certs/ta.key\n"; + } + if ($sovpnsettings{'TLSAUTH'} eq 'tls-crypt') { + print CONF "tls-crypt ${General::swroot}/ovpn/certs/tc.key\n"; + } + } + if ($sovpnsettings{DCOMPLZO} eq 'on') { print CONF "comp-lzo\n"; } @@ -795,62 +826,94 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'start ovpn server'} || ### if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); - #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too, - #DAN this value has to leave. -#new settings for daemon - $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'}; - $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'}; - $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'}; - $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'}; - $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'}; - $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'}; - $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'}; - $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'}; - $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'}; - $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'}; - $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'}; - $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'}; - my @temp=(); + &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); + $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'}; + $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'}; + $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'}; + $vpnsettings{'DATACIPHERS'} = $cgiparams{'DATACIPHERS'}; + $vpnsettings{'LOG_VERB'} = $cgiparams{'LOG_VERB'}; + $vpnsettings{'KEEPALIVE_1'} = $cgiparams{'KEEPALIVE_1'}; + $vpnsettings{'KEEPALIVE_2'} = $cgiparams{'KEEPALIVE_2'}; + $vpnsettings{'MAX_CLIENTS'} = $cgiparams{'MAX_CLIENTS'}; + $vpnsettings{'REDIRECT_GW_DEF1'} = $cgiparams{'REDIRECT_GW_DEF1'}; + $vpnsettings{'CLIENT2CLIENT'} = $cgiparams{'CLIENT2CLIENT'}; + $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'}; + $vpnsettings{'ADDITIONAL_CONFIGS'} = $cgiparams{'ADDITIONAL_CONFIGS'}; + $vpnsettings{'DHCP_DOMAIN'} = $cgiparams{'DHCP_DOMAIN'}; + $vpnsettings{'DHCP_DNS'} = $cgiparams{'DHCP_DNS'}; + $vpnsettings{'DHCP_WINS'} = $cgiparams{'DHCP_WINS'}; + $vpnsettings{'ROUTES_PUSH'} = $cgiparams{'ROUTES_PUSH'}; + my @temp=(); + + # --data-ciphers needs at least one cipher + if ($cgiparams{'DATACIPHERS'} eq '') { + $errormessage = $Lang::tr{'ovpn errmsg invalid data cipher input'}; + goto ADV_ENC_ERROR; + } - if ($cgiparams{'FRAGMENT'} eq '') { - delete $vpnsettings{'FRAGMENT'}; - } else { + # Create ta.key for tls-auth if not present + if ($cgiparams{'TLSAUTH'} eq 'on') { + if ( ! -e "${General::swroot}/ovpn/certs/ta.key") { + system('/usr/sbin/openvpn', '--genkey', '--secret', "${General::swroot}/ovpn/certs/ta.key"); + if ($?) { + $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; + goto ADV_ENC_ERROR; + } + } + } + + # Create tc.key for tls-crypt if not present + if ($cgiparams{'TLSAUTH'} eq 'tls-crypt') { + if ( ! -e "${General::swroot}/ovpn/certs/tc.key") { + system('/usr/sbin/openvpn', '--genkey', 'tls-crypt', "${General::swroot}/ovpn/certs/tc.key"); + if ($?) { + $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; + goto ADV_ENC_ERROR; + } + } + } + + if ($cgiparams{'FRAGMENT'} eq '') { + delete $vpnsettings{'FRAGMENT'}; + } else { if ($cgiparams{'FRAGMENT'} !~ /^[0-9]+$/) { - $errormessage = "Incorrect value, please insert only numbers."; - goto ADV_ERROR; - } else { - $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'}; - } - } + $errormessage = "Incorrect value, please insert only numbers."; + goto ADV_ERROR; + } else { + $vpnsettings{'FRAGMENT'} = $cgiparams{'FRAGMENT'}; + } + } - if ($cgiparams{'MSSFIX'} ne 'on') { - delete $vpnsettings{'MSSFIX'}; - } else { - $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'}; - } + if ($cgiparams{'MSSFIX'} ne 'on') { + delete $vpnsettings{'MSSFIX'}; + } else { + $vpnsettings{'MSSFIX'} = $cgiparams{'MSSFIX'}; + } - if ($cgiparams{'DHCP_DOMAIN'} ne ''){ - unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) { - $errormessage = $Lang::tr{'invalid input for dhcp domain'}; - goto ADV_ERROR; - } - } - if ($cgiparams{'DHCP_DNS'} ne ''){ - unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) { - $errormessage = $Lang::tr{'invalid input for dhcp dns'}; - goto ADV_ERROR; - } - } - if ($cgiparams{'DHCP_WINS'} ne ''){ - unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) { - $errormessage = $Lang::tr{'invalid input for dhcp wins'}; + if ($cgiparams{'DHCP_DOMAIN'} ne ''){ + unless (&General::validdomainname($cgiparams{'DHCP_DOMAIN'}) || &General::validip($cgiparams{'DHCP_DOMAIN'})) { + $errormessage = $Lang::tr{'invalid input for dhcp domain'}; goto ADV_ERROR; - } - } - if ($cgiparams{'ROUTES_PUSH'} ne ''){ - @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'}); - undef $vpnsettings{'ROUTES_PUSH'}; + } + } + + if ($cgiparams{'DHCP_DNS'} ne ''){ + unless (&General::validfqdn($cgiparams{'DHCP_DNS'}) || &General::validip($cgiparams{'DHCP_DNS'})) { + $errormessage = $Lang::tr{'invalid input for dhcp dns'}; + goto ADV_ERROR; + } + } + + if ($cgiparams{'DHCP_WINS'} ne ''){ + unless (&General::validfqdn($cgiparams{'DHCP_WINS'}) || &General::validip($cgiparams{'DHCP_WINS'})) { + $errormessage = $Lang::tr{'invalid input for dhcp wins'}; + goto ADV_ERROR; + } + } + + if ($cgiparams{'ROUTES_PUSH'} ne ''){ + @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'}); + undef $vpnsettings{'ROUTES_PUSH'}; foreach my $tmpip (@temp) { @@ -891,35 +954,39 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n"; } } - &write_routepushfile; - undef $vpnsettings{'ROUTES_PUSH'}; - } - else { - undef $vpnsettings{'ROUTES_PUSH'}; &write_routepushfile; - } - if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) { - $errormessage = $Lang::tr{'invalid input for max clients'}; - goto ADV_ERROR; - } - if ($cgiparams{'KEEPALIVE_1'} ne '') { - if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) { - $errormessage = $Lang::tr{'invalid input for keepalive 1'}; - goto ADV_ERROR; - } - } - if ($cgiparams{'KEEPALIVE_2'} ne ''){ - if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) { - $errormessage = $Lang::tr{'invalid input for keepalive 2'}; - goto ADV_ERROR; - } - } - if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){ - $errormessage = $Lang::tr{'invalid input for keepalive 1:2'}; - goto ADV_ERROR; - } - &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings); - &writeserverconf();#hier ok + undef $vpnsettings{'ROUTES_PUSH'}; + } else { + undef $vpnsettings{'ROUTES_PUSH'}; + &write_routepushfile; + } + + if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) { + $errormessage = $Lang::tr{'invalid input for max clients'}; + goto ADV_ERROR; + } + + if ($cgiparams{'KEEPALIVE_1'} ne '') { + if ($cgiparams{'KEEPALIVE_1'} !~ /^[0-9]+$/) { + $errormessage = $Lang::tr{'invalid input for keepalive 1'}; + goto ADV_ERROR; + } + } + + if ($cgiparams{'KEEPALIVE_2'} ne ''){ + if ($cgiparams{'KEEPALIVE_2'} !~ /^[0-9]+$/) { + $errormessage = $Lang::tr{'invalid input for keepalive 2'}; + goto ADV_ERROR; + } + } + + if ($cgiparams{'KEEPALIVE_2'} < ($cgiparams{'KEEPALIVE_1'} * 2)){ + $errormessage = $Lang::tr{'invalid input for keepalive 1:2'}; + goto ADV_ERROR; + } + + &General::writehash("${General::swroot}/ovpn/settings", \%vpnsettings); + &writeserverconf();#hier ok } ### @@ -970,7 +1037,7 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General if ($cgiparams{'PROTOCOL'} eq 'tcp') { print SERVERCONF "proto tcp4-server\n"; - print SERVERCONF "# Packet size\n"; + print SERVERCONF "# Packet size\n";&writeserverconf();#hier ok if ($cgiparams{'MTU'} eq '') {$tunmtu = '1400'} else {$tunmtu = $cgiparams{'MTU'}}; print SERVERCONF "tun-mtu $tunmtu\n"; } @@ -993,10 +1060,11 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General print SERVERCONF "# Cipher\n"; print SERVERCONF "cipher $cgiparams{'DCIPHER'}\n"; - # If GCM cipher is used, do not use --auth + # If AEAD cipher is used, do not use --auth if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') || ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') || - ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) { + ($cgiparams{'DCIPHER'} eq 'AES-128-GCM') || + ($cgiparams{'DCIPHER'} eq 'ChaCha20-Poly1305')) {&writeserverconf();#hier ok print SERVERCONF unless "# HMAC algorithm\n"; print SERVERCONF unless "auth $cgiparams{'DAUTH'}\n"; } else { @@ -1098,10 +1166,11 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General print CLIENTCONF "cipher $cgiparams{'DCIPHER'}\n"; print CLIENTCONF "pkcs12 ${General::swroot}/ovpn/certs/$cgiparams{'NAME'}.p12\r\n"; - # If GCM cipher is used, do not use --auth + # If AEAD cipher is used, do not use --auth if (($cgiparams{'DCIPHER'} eq 'AES-256-GCM') || ($cgiparams{'DCIPHER'} eq 'AES-192-GCM') || - ($cgiparams{'DCIPHER'} eq 'AES-128-GCM')) { + ($cgiparams{'DCIPHER'} eq 'AES-128-GCM') || + ($cgiparams{'DCIPHER'} eq 'ChaCha20-Poly1305')) { print CLIENTCONF unless "# HMAC algorithm\n"; print CLIENTCONF unless "auth $cgiparams{'DAUTH'}\n"; } else { @@ -1207,18 +1276,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg goto SETTINGS_ERROR; } - # Create ta.key for tls-auth if not presant - if ($cgiparams{'TLSAUTH'} eq 'on') { - if ( ! -e "${General::swroot}/ovpn/certs/ta.key") { - # This system call is safe, because all arguements are passed as an array. - system("/usr/sbin/openvpn", "--genkey", "secret", "${General::swroot}/ovpn/certs/ta.key"); - if ($?) { - $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; - goto SETTINGS_ERROR; - } - } - } - $vpnsettings{'ENABLED_BLUE'} = $cgiparams{'ENABLED_BLUE'}; $vpnsettings{'ENABLED_ORANGE'} =$cgiparams{'ENABLED_ORANGE'}; $vpnsettings{'ENABLED'} = $cgiparams{'ENABLED'}; @@ -1229,9 +1286,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'}; $vpnsettings{'DMTU'} = $cgiparams{'DMTU'}; $vpnsettings{'DCOMPLZO'} = $cgiparams{'DCOMPLZO'}; - $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'}; - $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'}; - $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'}; #wrtie enable if ( $vpnsettings{'ENABLED_BLUE'} eq 'on' ) { @@ -1596,18 +1650,36 @@ END ### Download tls-auth key ### }elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-auth key'}) { - if ( -f "${General::swroot}/ovpn/certs/ta.key" ) { - print "Content-Type: application/octet-stream\r\n"; - print "Content-Disposition: filename=ta.key\r\n\r\n"; + if ( -f "${General::swroot}/ovpn/certs/ta.key" ) { + print "Content-Type: application/octet-stream\r\n"; + print "Content-Disposition: filename=ta.key\r\n\r\n"; - open(FILE, "${General::swroot}/ovpn/certs/ta.key"); - my @tmp = ; - close(FILE); + open(FILE, "${General::swroot}/ovpn/certs/ta.key"); + my @tmp = ; + close(FILE); - print @tmp; + print @tmp; - exit(0); - } + exit(0); + } + +### +### Download tls-crypt key +### +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download tls-crypt key'}) { + if ( -f "${General::swroot}/ovpn/certs/tc.key" ) { + print "Content-Type: application/octet-stream\r\n"; + print "Content-Disposition: filename=tc.key\r\n\r\n"; + + open(FILE, "${General::swroot}/ovpn/certs/tc.key"); + my @tmp = ; + close(FILE); + + print @tmp; + + + exit(0); + } ### ### Form for generating a root certificate @@ -2144,10 +2216,11 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){ $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1].p12", "$confighash{$cgiparams{'KEY'}}[1].p12") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1].p12\n"; } - # If GCM cipher is used, do not use --auth + # If AEAD cipher is used, do not use --auth if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') || ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-192-GCM') || - ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM')) { + ($confighash{$cgiparams{'KEY'}}[40] eq 'AES-128-GCM') || + ($confighash{$cgiparams{'KEY'}}[40] eq 'ChaCha20-Poly1305')) { print CLIENTCONF unless "# HMAC algorithm\n"; print CLIENTCONF unless "auth $confighash{$cgiparams{'KEY'}}[39]\n"; } else { @@ -2291,16 +2364,32 @@ else $zip->addFile( "${General::swroot}/ovpn/ca/cacert.pem", "cacert.pem") or die "Can't add file cacert.pem\n"; $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n"; } - print CLIENTCONF "cipher $vpnsettings{DCIPHER}\r\n"; + + # Set seperator for --data-ciphers algorithms + @advcipherchar = ($vpnsettings{'DATACIPHERS'} =~ s/\|/:/g); + print CLIENTCONF "data-ciphers $vpnsettings{'DATACIPHERS'}\r\n"; + print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n"; - if ($vpnsettings{'TLSAUTH'} eq 'on') { - if ($cgiparams{'MODE'} eq 'insecure') { - print CLIENTCONF ";"; - } - print CLIENTCONF "tls-auth ta.key\r\n"; - $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n"; + # Comment TLS-Auth directive if 'insecure' mode has been choosen + if ($vpnsettings{'TLSAUTH'} eq 'on') { + if ($cgiparams{'MODE'} eq 'insecure') { + print CLIENTCONF ";"; + } + print CLIENTCONF "tls-auth ta.key\r\n"; + $zip->addFile( "${General::swroot}/ovpn/certs/ta.key", "ta.key") or die "Can't add file ta.key\n"; } + + # Comment TLS-Crypt directive if 'insecure' mode has been choosen + if ($vpnsettings{'TLSAUTH'} eq 'tls-crypt') { + if ($cgiparams{'MODE'} eq 'insecure') { + print CLIENTCONF ";"; + } + print CLIENTCONF "tls-crypt tc.key\r\n"; + $zip->addFile( "${General::swroot}/ovpn/certs/tc.key", "tc.key") or die "Can't add file tc.key\n"; + } + + if ($vpnsettings{DCOMPLZO} eq 'on') { print CLIENTCONF "comp-lzo\r\n"; } @@ -2372,7 +2461,19 @@ else print CLIENTCONF "\r\n\r\n"; close(FILE); - # TLS auth + # Print TLS-Crypt key to client.ovpn if 'insecure' has been selected + if ($vpnsettings{'TLSAUTH'} eq 'tls-crypt') { + open(FILE, "<${General::swroot}/ovpn/certs/tc.key"); + print CLIENTCONF "\r\n"; + while () { + chomp($_); + print CLIENTCONF "$_\r\n"; + } + print CLIENTCONF "\r\n\r\n"; + close(FILE); + } + + # Print TLS-Auth key to client.ovpn if 'insecure' has been selected if ($vpnsettings{'TLSAUTH'} eq 'on') { open(FILE, "<${General::swroot}/ovpn/certs/ta.key"); print CLIENTCONF "\r\n"; @@ -2611,6 +2712,28 @@ END &Header::closepage(); exit(0); } + +### +### Display tls-crypt key +### +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'show tls-crypt key'}) { + + if (! -e "${General::swroot}/ovpn/certs/tc.key") { + $errormessage = $Lang::tr{'not present'}; + } else { + &Header::showhttpheaders(); + &Header::openpage($Lang::tr{'ovpn'}, 1, ''); + &Header::openbigbox('100%', 'LEFT', '', ''); + &Header::openbox('100%', 'LEFT', "$Lang::tr{'tc key'}"); + my $output = `/bin/cat ${General::swroot}/ovpn/certs/tc.key`; + $output = &Header::cleanhtml($output,"y"); + print "
$output
\n"; + &Header::closebox(); + print ""; + &Header::closebigbox(); + &Header::closepage(); + exit(0); + } ### ### Display Certificate Revoke List @@ -2643,6 +2766,7 @@ END %cgiparams = (); %cahash = (); %confighash = (); + my @temp=(); my $disabled; &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams); read_routepushfile; @@ -2664,9 +2788,6 @@ ADV_ERROR: if ($cgiparams{'LOG_VERB'} eq '') { $cgiparams{'LOG_VERB'} = '3'; } - if ($cgiparams{'TLSAUTH'} eq '') { - $cgiparams{'TLSAUTH'} = 'off'; - } $checked{'CLIENT2CLIENT'}{'off'} = ''; $checked{'CLIENT2CLIENT'}{'on'} = ''; $checked{'CLIENT2CLIENT'}{$cgiparams{'CLIENT2CLIENT'}} = 'CHECKED'; @@ -2706,31 +2827,208 @@ ADV_ERROR: &Header::closebox(); } &Header::openbox('100%', 'LEFT', $Lang::tr{'advanced server'}); + + my $key = $cgiparams{'KEY'}; + if (! $key) { + $key = &General::findhasharraykey (\%confighash); + foreach my $i (39.. 45) { $confighash{$key}[$i] = ""; } + } + $confighash{$key}[39] = $cgiparams{'DAUTH'}; + $confighash{$key}[40] = $cgiparams{'DCIPHER'}; + $confighash{$key}[41] = $cgiparams{'TLSAUTH'}; + $confighash{$key}[42] = $cgiparams{'DATACIPHERS'}; + +ADV_ENC_ERROR: + + # Set default for hash message authentication code + if ($cgiparams{'DAUTH'} eq '') { + $cgiparams{'DAUTH'} = 'SHA512'; #[39]; + } + $checked{'DAUTH'}{'SHA3-512'} = ''; + $checked{'DAUTH'}{'SHA512'} = ''; + $checked{'DAUTH'}{'SHA384'} = ''; + $checked{'DAUTH'}{'SHA256'} = ''; + $checked{'DAUTH'}{'whirlpool'} = ''; + $checked{'DAUTH'}{'SHA1'} = ''; + @temp = split('\|', $cgiparams{'DAUTH'}); + foreach my $key (@temp) {$checked{'DAUTH'}{$key} = "selected='selected'"; } + + # Set default for TLS control authentication + if ($cgiparams{'TLSAUTH'} eq '') { + $cgiparams{'TLSAUTH'} = 'tls-crypt'; #[41] + } + $checked{'TLSAUTH'}{'on'} = ''; + $checked{'TLSAUTH'}{'off'} = ''; + $checked{'TLSAUTH'}{'tls-crypt'} = ''; + @temp = split('\|', $cgiparams{'TLSAUTH'}); + foreach my $key (@temp) {$checked{'TLSAUTH'}{$key} = "selected='selected'"; } + + # Set default for data-cipher-fallback (the old --cipher directive) + if ($cgiparams{'DCIPHER'} eq '') { + $cgiparams{'DCIPHER'} = 'AES-256-CBC'; #[40] + } + $checked{'DCIPHER'}{'AES-256-CBC'} = ''; + $checked{'DCIPHER'}{'AES-192-CBC'} = ''; + $checked{'DCIPHER'}{'AES-128-CBC'} = ''; + $checked{'DCIPHER'}{'CAMELLIA-256-CBC'} = ''; + $checked{'DCIPHER'}{'CAMELLIA-192-CBC'} = ''; + $checked{'DCIPHER'}{'CAMELLIA-128-CBC'} = ''; + $checked{'DCIPHER'}{'SEED-CBC'} = ''; + $checked{'DCIPHER'}{'DES-EDE3-CBC'} = ''; + $checked{'DCIPHER'}{'DESX-CBC'} = ''; + $checked{'DCIPHER'}{'DES-EDE-CBC'} = ''; + $checked{'DCIPHER'}{'BF-CBC'} = ''; + $checked{'DCIPHER'}{'CAST5-CBC'} = ''; + @temp = split('\|', $cgiparams{'DCIPHER'}); + foreach my $key (@temp) {$checked{'DCIPHER'}{$key} = "selected='selected'"; } + + # Set default data channel ciphers + if ($cgiparams{'DATACIPHERS'} eq '') { + $cgiparams{'DATACIPHERS'} = 'ChaCha20-Poly1305|AES-256-GCM'; #[42]; + } + $checked{'DATACIPHERS'}{'ChaCha20-Poly1305'} = ''; + $checked{'DATACIPHERS'}{'AES-256-GCM'} = ''; + $checked{'DATACIPHERS'}{'AES-192-GCM'} = ''; + $checked{'DATACIPHERS'}{'AES-128-GCM'} = ''; + @temp = split('\|', $cgiparams{'DATACIPHERS'}); + foreach my $key (@temp) {$checked{'DATACIPHERS'}{$key} = "selected='selected'"; } + + # Save settings and display default if not configured + if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) { + $confighash{$cgiparams{'KEY'}}[39] = $cgiparams{'DAUTH'}; + $confighash{$cgiparams{'KEY'}}[40] = $cgiparams{'DCIPHER'}; + $confighash{$cgiparams{'KEY'}}[41] = $cgiparams{'TLSAUTH'}; + $confighash{$cgiparams{'KEY'}}[42] = $cgiparams{'DATACIPHERS'}; + } else { + $cgiparams{'DAUTH'} = $vpnsettings{'DAUTH'}; + $cgiparams{'DCIPHER'} = $vpnsettings{'DCIPHER'}; + $cgiparams{'TLSAUTH'} = $vpnsettings{'TLSAUTH'}; + $cgiparams{'DATACIPHERS'} = $vpnsettings{'DATACIPHERS'}; + } + +ADV_ENC_ERROR: + + print< + + $Lang::tr{'ovpn advanced encryption'} + + +
+ + + + + + + + + + + + + + + + + + +
$Lang::tr{'ovpn data channel'}$Lang::tr{'ovpn data channel fallback'}
$Lang::tr{'ovpn data encryption'} + + + +
+ +

+ + + + $Lang::tr{'ovpn crypt options'} + + + + + + + + + + + + + + + + + + + +
$Lang::tr{'ovpn ha'}$Lang::tr{'ovpn tls auth'}
$Lang::tr{'ovpn data channel authentication'} + + + + +
+
+
+END +; + print < +
- - + + - - + + - - + + - - + + - + - - + + - - + +
$Lang::tr{'dhcp-options'}
Domain
DNS
WINS
$Lang::tr{'ovpn routes push options'}
$Lang::tr{'ovpn routes push'}
+
+ +
@@ -2801,18 +3102,20 @@ print <
$Lang::tr{'misc-options'}
+
- - - - - - - - - + + + + + + + + -
$Lang::tr{'log-options'}
VERB
$Lang::tr{'log-options'}
VERB
- + + +
END if ( -e "/var/run/openvpn.pid"){ print"
$Lang::tr{'attention'}:
- $Lang::tr{'server restart'}

+ $Lang::tr{'server restart'}

"; print< @@ -2870,7 +3173,6 @@ END &Header::closepage(); exit(0); - # A.Marx CCD Add,delete or edit CCD net } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} || @@ -3582,36 +3884,36 @@ if ($confighash{$cgiparams{'KEY'}}) { $errormessage = $Lang::tr{'invalid key'}; goto VPNCONF_END; } - $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0]; + $cgiparams{'ENABLED'} = $confighash{$cgiparams{'KEY'}}[0]; $cgiparams{'NAME'} = $confighash{$cgiparams{'KEY'}}[1]; $cgiparams{'TYPE'} = $confighash{$cgiparams{'KEY'}}[3]; - $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4]; + $cgiparams{'AUTH'} = $confighash{$cgiparams{'KEY'}}[4]; $cgiparams{'PSK'} = $confighash{$cgiparams{'KEY'}}[5]; $cgiparams{'SIDE'} = $confighash{$cgiparams{'KEY'}}[6]; $cgiparams{'LOCAL_SUBNET'} = $confighash{$cgiparams{'KEY'}}[8]; $cgiparams{'REMOTE'} = $confighash{$cgiparams{'KEY'}}[10]; - $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11]; - $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22]; - $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23]; - $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24]; + $cgiparams{'REMOTE_SUBNET'} = $confighash{$cgiparams{'KEY'}}[11]; + $cgiparams{'OVPN_MGMT'} = $confighash{$cgiparams{'KEY'}}[22]; + $cgiparams{'MSSFIX'} = $confighash{$cgiparams{'KEY'}}[23]; + $cgiparams{'FRAGMENT'} = $confighash{$cgiparams{'KEY'}}[24]; $cgiparams{'REMARK'} = $confighash{$cgiparams{'KEY'}}[25]; - $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26]; + $cgiparams{'INTERFACE'} = $confighash{$cgiparams{'KEY'}}[26]; $cgiparams{'OVPN_SUBNET'} = $confighash{$cgiparams{'KEY'}}[27]; - $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28]; - $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29]; - $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30]; - $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31]; - $cgiparams{'CHECK1'} = $confighash{$cgiparams{'KEY'}}[32]; + $cgiparams{'PROTOCOL'} = $confighash{$cgiparams{'KEY'}}[28]; + $cgiparams{'DEST_PORT'} = $confighash{$cgiparams{'KEY'}}[29]; + $cgiparams{'COMPLZO'} = $confighash{$cgiparams{'KEY'}}[30]; + $cgiparams{'MTU'} = $confighash{$cgiparams{'KEY'}}[31]; + $cgiparams{'CHECK1'} = $confighash{$cgiparams{'KEY'}}[32]; $name=$cgiparams{'CHECK1'} ; $cgiparams{$name} = $confighash{$cgiparams{'KEY'}}[33]; $cgiparams{'RG'} = $confighash{$cgiparams{'KEY'}}[34]; - $cgiparams{'CCD_DNS1'} = $confighash{$cgiparams{'KEY'}}[35]; - $cgiparams{'CCD_DNS2'} = $confighash{$cgiparams{'KEY'}}[36]; - $cgiparams{'CCD_WINS'} = $confighash{$cgiparams{'KEY'}}[37]; + $cgiparams{'CCD_DNS1'} = $confighash{$cgiparams{'KEY'}}[35]; + $cgiparams{'CCD_DNS2'} = $confighash{$cgiparams{'KEY'}}[36]; + $cgiparams{'CCD_WINS'} = $confighash{$cgiparams{'KEY'}}[37]; $cgiparams{'DAUTH'} = $confighash{$cgiparams{'KEY'}}[39]; - $cgiparams{'DCIPHER'} = $confighash{$cgiparams{'KEY'}}[40]; - $cgiparams{'TLSAUTH'} = $confighash{$cgiparams{'KEY'}}[41]; - $cgiparams{'OTP_STATE'} = $confighash{$cgiparams{'KEY'}}[43]; + $cgiparams{'DCIPHER'} = $confighash{$cgiparams{'KEY'}}[40]; + $cgiparams{'OTP_STATE'} = $confighash{$cgiparams{'KEY'}}[43]; + } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); @@ -4379,12 +4681,12 @@ if ($cgiparams{'TYPE'} eq 'net') { $confighash{$key}[41] = "no-pass"; } } - - $confighash{$key}[42] = 'HOTP/T30/6'; + + $confighash{$key}[42] = 'HOTP/T30/6'; $confighash{$key}[43] = $cgiparams{'OTP_STATE'}; if (($confighash{$key}[43] eq 'on') && ($confighash{$key}[44] eq '')) { my @otp_secret = &General::system_output("/usr/bin/openssl", "rand", "-hex", "20"); - chomp($otp_secret[0]); + chomp($otp_secret[0]); $confighash{$key}[44] = $otp_secret[0]; } elsif ($confighash{$key}[43] eq '') { $confighash{$key}[44] = ''; @@ -4562,38 +4864,6 @@ if ($cgiparams{'TYPE'} eq 'net') { $checked{'MSSFIX'}{'on'} = ''; $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED'; - $selected{'DCIPHER'}{'AES-256-GCM'} = ''; - $selected{'DCIPHER'}{'AES-192-GCM'} = ''; - $selected{'DCIPHER'}{'AES-128-GCM'} = ''; - $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = ''; - $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = ''; - $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = ''; - $selected{'DCIPHER'}{'AES-256-CBC'} = ''; - $selected{'DCIPHER'}{'AES-192-CBC'} = ''; - $selected{'DCIPHER'}{'AES-128-CBC'} = ''; - $selected{'DCIPHER'}{'DESX-CBC'} = ''; - $selected{'DCIPHER'}{'SEED-CBC'} = ''; - $selected{'DCIPHER'}{'DES-EDE3-CBC'} = ''; - $selected{'DCIPHER'}{'DES-EDE-CBC'} = ''; - $selected{'DCIPHER'}{'CAST5-CBC'} = ''; - $selected{'DCIPHER'}{'BF-CBC'} = ''; - $selected{'DCIPHER'}{'DES-CBC'} = ''; - # If no cipher has been chossen yet, select - # the old default (AES-256-CBC) for compatiblity reasons. - if ($cgiparams{'DCIPHER'} eq '') { - $cgiparams{'DCIPHER'} = 'AES-256-CBC'; - } - $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED'; - $selected{'DAUTH'}{'whirlpool'} = ''; - $selected{'DAUTH'}{'SHA512'} = ''; - $selected{'DAUTH'}{'SHA384'} = ''; - $selected{'DAUTH'}{'SHA256'} = ''; - $selected{'DAUTH'}{'SHA1'} = ''; - $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED'; - $checked{'TLSAUTH'}{'off'} = ''; - $checked{'TLSAUTH'}{'on'} = ''; - $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED'; - if (1) { &Header::showhttpheaders(); &Header::openpage($Lang::tr{'ovpn'}, 1, ''); @@ -4727,31 +4997,33 @@ if ($cgiparams{'TYPE'} eq 'net') { $Lang::tr{'cipher'} $Lang::tr{'ovpn ha'}: @@ -4767,7 +5039,7 @@ print< var disable_options = false; document.getElementById('n2ncipher').onchange = function () { - if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM")) { + if((this.value == "AES-256-GCM"||this.value == "AES-192-GCM"||this.value == "AES-128-GCM"||this.value == "CHACHA20-POLY1305")) { document.getElementById('n2nhmac').setAttribute('disabled', true); } else { document.getElementById('n2nhmac').removeAttribute('disabled'); @@ -4940,7 +5212,7 @@ if ($cgiparams{'TYPE'} eq 'host') { print < $Lang::tr{'enable otp'}: - Redirect Gateway: + Redirect Gateway:
$Lang::tr{'ccd routes'}   $Lang::tr{'ccd iroute'}