'.$line if ( $line =~ /error|unknown/ ); + } + if ($ret) { + $ret= &Header::cleanhtml($ret); + } + return $ret ? "$Lang::tr{'openssl produced an error'}: $ret" : '' ; +} +### +### Obtain a CN from given cert +### +sub getCNfromcert ($) { + #&General::log("ipsec", "Extracting name from $_[0]..."); + my $temp = `/usr/bin/openssl x509 -text -in $_[0]`; + $temp =~ /Subject:.*CN=(.*)[\n]/; + $temp = $1; + $temp =~ s+/Email+, E+; + $temp =~ s/ ST=/ S=/; + $temp =~ s/,//g; + $temp =~ s/\'//g; + return $temp; +} +### +### Obtain Subject from given cert +### +sub getsubjectfromcert ($) { + #&General::log("ipsec", "Extracting subject from $_[0]..."); + my $temp = `/usr/bin/openssl x509 -text -in $_[0]`; + $temp =~ /Subject: (.*)[\n]/; + $temp = $1; + $temp =~ s+/Email+, E+; + $temp =~ s/ ST=/ S=/; + return $temp; +} +### +### Combine local subnet and connection name to make a unique name for each connection section +### (this sub is not used now) +### +sub makeconnname ($) { + my $conn = shift; + my $subnet = shift; + + $subnet =~ /^(.*?)\/(.*?)$/; # $1=IP $2=mask + my $ip = unpack('N', &Socket::inet_aton($1)); + if (length ($2) > 2) { + my $mm = unpack('N', &Socket::inet_aton($2)); + while ( ($mm & 1)==0 ) { + $ip >>= 1; + $mm >>= 1; + }; + } else { + $ip >>= (32 - $2); + } + return sprintf ("%s-%X", $conn, $ip); +} +### +### Write a config file. +### +###Type=Host : GUI can choose the interface used (RED,GREEN,BLUE) and +### the side is always defined as 'left'. +### configihash[14]: 'VHOST' is allowed +### +###Type=Net : GUI can choose to be left or right. This serve nothing in the conf! +### interface is fixed to RED only. No special reason for this also. +### + sub writeipsecfiles { my %lconfighash = (); my %lvpnsettings = (); @@ -136,28 +248,26 @@ sub writeipsecfiles { flock SECRETS, 2; print CONF "version 2\n\n"; print CONF "config setup\n"; - if ($lvpnsettings{'ENABLED_BLUE'} eq 'on') - { - if ($lvpnsettings{'ENABLED'} eq 'on') - { - print CONF "\tinterfaces=\"%defaultroute ipsec1=$netsettings{'BLUE_DEV'}\"\n"; - } else { - print CONF "\tinterfaces=ipsec0=$netsettings{'BLUE_DEV'}\n"; - } - } else { - print CONF "\tinterfaces=%defaultroute\n"; - } - + #create an ipsec Interface for each 'enabled' ones + my $interfaces = "\tinterfaces=\""; + $interfaces .= "%defaultroute " if ($lvpnsettings{'ENABLED'} eq 'on'); + $interfaces .= "ipsec1=$netsettings{'GREEN_DEV'} " if ($lvpnsettings{'ENABLED_GREEN'} eq 'on'); + $interfaces .= "ipsec2=$netsettings{'BLUE_DEV'} " if ($lvpnsettings{'ENABLED_BLUE'} eq 'on'); + $interfaces .= "ipsec3=$netsettings{'ORANGE_DEV'} " if ($lvpnsettings{'ENABLED_ORANGE'} eq 'on'); + print CONF $interfaces . "\"\n"; + my $plutodebug = ''; # build debug list map ($plutodebug .= $lvpnsettings{$_} eq 'on' ? lc (substr($_,4)).' ' : '', ('DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL', 'DBG_KLIPS','DBG_DNS','DBG_NAT_T')); $plutodebug = 'none' if $plutodebug eq ''; # if nothing selected, use 'none'. - print CONF "\tklipsdebug=none\n"; + print CONF "\tklipsdebug=\"none\"\n"; print CONF "\tplutodebug=\"$plutodebug\"\n"; # deprecated in ipsec.conf version 2 #print CONF "\tplutoload=%search\n"; #print CONF "\tplutostart=%search\n"; + print CONF "\tplutoload=%search\n"; + print CONF "\tplutostart=%search\n"; print CONF "\tuniqueids=yes\n"; print CONF "\tnat_traversal=yes\n"; print CONF "\toverridemtu=$lvpnsettings{'VPN_OVERRIDE_MTU'}\n" if ($lvpnsettings{'VPN_OVERRIDE_MTU'} ne ''); @@ -183,163 +293,154 @@ sub writeipsecfiles { if (-f "${General::swroot}/certs/hostkey.pem") { print SECRETS ": RSA ${General::swroot}/certs/hostkey.pem\n" } - + my $last_secrets = ''; # old the less specifics connections + foreach my $key (keys %lconfighash) { - if ($lconfighash{$key}[0] eq 'on') { - if ($lconfighash{$key}[10] eq '') { $lconfighash{$key}[10] = '%any'; } + next if ($lconfighash{$key}[0] ne 'on'); - print CONF "conn $lconfighash{$key}[1]\n"; - #always choose LEFT localside for roadwarrior - if ($lconfighash{$key}[3] eq 'host' || $lconfighash{$key}[6] eq 'left') { - if ($lconfighash{$key}[26] eq 'BLUE') - { - print CONF "\tleft=$netsettings{'BLUE_ADDRESS'}\n"; -# print CONF "\tleftnexthop=$netsettings{'BLUE_NETADDRESS'}\n"; - } - elsif ($lconfighash{$key}[26] eq 'ORANGE') - { - print CONF "\tleft=$netsettings{'ORANGE_ADDRESS'}\n"; - } - elsif ($lconfighash{$key}[26] eq 'GREEN') - { - print CONF "\tleft=$netsettings{'GREEN_ADDRESS'}\n"; - } - elsif ($lconfighash{$key}[26] eq 'RED') - { - print CONF "\tleft=$lvpnsettings{'VPN_IP'}\n"; - print CONF "\tleftnexthop=%defaultroute\n" if ($lvpnsettings{'VPN_IP'} ne '%defaultroute'); - } - print CONF "\tleftsubnet=$lconfighash{$key}[8]\n"; - print CONF "\tright=$lconfighash{$key}[10]\n"; - if ($lconfighash{$key}[3] eq 'net') { - print CONF "\trightsubnet=$lconfighash{$key}[11]\n"; - print CONF "\trightnexthop=%defaultroute\n"; - } elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { - print CONF "\trightsubnet=vhost:%no,%priv\n"; - } - if ($lconfighash{$key}[4] eq 'cert') { - print CONF "\tleftcert=${General::swroot}/certs/hostcert.pem\n"; - print CONF "\trightcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n"; + #remote peer is not set? => use '%any' + $lconfighash{$key}[10] = '%any' if ($lconfighash{$key}[10] eq ''); + + my ($L,$R); #Local & Remote sides + + print CONF "conn $lconfighash{$key}[1]\n"; + #always choose LEFT localside for roadwarrior + if ($lconfighash{$key}[3] eq 'host' || $lconfighash{$key}[6] eq 'left') { + $L = 'left'; + $R = 'right'; + } else { + $R = 'left'; + $L = 'right'; + } + print CONF "\t${L}="; + if ($lconfighash{$key}[26] eq 'BLUE') { + print CONF "$netsettings{'BLUE_ADDRESS'}\n"; + } elsif ($lconfighash{$key}[26] eq 'ORANGE') { + print CONF "$netsettings{'ORANGE_ADDRESS'}\n"; + } elsif ($lconfighash{$key}[26] eq 'GREEN') { + print CONF "$netsettings{'GREEN_ADDRESS'}\n"; + } elsif ($lconfighash{$key}[26] eq 'RED') { + print CONF "$lvpnsettings{'VPN_IP'}\n"; + print CONF "\t${L}nexthop=%defaultroute\n" if ($lvpnsettings{'VPN_IP'} ne '%defaultroute'); + } + print CONF "\t${L}subnet=$lconfighash{$key}[8]\n"; + print CONF "\t${R}=$lconfighash{$key}[10]\n"; + + if ($lconfighash{$key}[3] eq 'net') { + print CONF "\t${R}subnet=$lconfighash{$key}[11]\n"; + print CONF "\t${R}nexthop=%defaultroute\n"; + } elsif ($lconfighash{$key}[10] eq '%any' && $lconfighash{$key}[14] eq 'on') { #vhost allowed? + print CONF "\trightsubnet=vhost:%no,%priv\n"; + } + + # Local Cert and Remote Cert (unless auth is DN dn-auth) + if ($lconfighash{$key}[4] eq 'cert') { + print CONF "\t${L}cert=${General::swroot}/certs/hostcert.pem\n"; + print CONF "\t${R}cert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n" if ($lconfighash{$key}[2] ne '%auth-dn'); + } + + # Local and Remote IDs + print CONF "\t${L}id=\"$lconfighash{$key}[7]\"\n" if ($lconfighash{$key}[7]); + print CONF "\t${R}id=\"$lconfighash{$key}[9]\"\n" if ($lconfighash{$key}[9]); + + # Algorithms + if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) { + print CONF "\tike="; + my @encs = split('\|', $lconfighash{$key}[18]); + my @ints = split('\|', $lconfighash{$key}[19]); + my @groups = split('\|', $lconfighash{$key}[20]); + my $comma = 0; + foreach my $i (@encs) { + foreach my $j (@ints) { + foreach my $k (@groups) { + if ($comma != 0) { print CONF ","; } else { $comma = 1; } + print CONF "$i-$j-modp$k"; } + } + } + if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms? + print CONF "!\n"; } else { - print CONF "\tright=$lvpnsettings{'VPN_IP'}\n"; - print CONF "\trightsubnet=$lconfighash{$key}[8]\n"; - print CONF "\trightnexthop=%defaultroute\n" if ($lvpnsettings{'VPN_IP'} ne '%defaultroute'); - print CONF "\tleft=$lconfighash{$key}[10]\n"; - if ($lconfighash{$key}[3] eq 'net') { - print CONF "\tleftsubnet=$lconfighash{$key}[11]\n"; - print CONF "\tleftnexthop=%defaultroute\n"; - } - if ($lconfighash{$key}[4] eq 'cert') { - print CONF "\trightcert=${General::swroot}/certs/hostcert.pem\n"; - print CONF "\tleftcert=${General::swroot}/certs/$lconfighash{$key}[1]cert.pem\n"; + print CONF "\n"; + } + } + if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) { + print CONF "\tesp="; + my @encs = split('\|', $lconfighash{$key}[21]); + my @ints = split('\|', $lconfighash{$key}[22]); + my $comma = 0; + foreach my $i (@encs) { + foreach my $j (@ints) { + if ($comma != 0) { print CONF ","; } else { $comma = 1; } + print CONF "$i-$j"; } } - print CONF "\tleftid=$lconfighash{$key}[7]\n" if ($lconfighash{$key}[7]); - print CONF "\trightid=$lconfighash{$key}[9]\n" if ($lconfighash{$key}[9]); - - # Algorithms - if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) { - print CONF "\tike="; - my @encs = split('\|', $lconfighash{$key}[18]); - my @ints = split('\|', $lconfighash{$key}[19]); - my @groups = split('\|', $lconfighash{$key}[20]); - my $comma = 0; - foreach my $i (@encs) { - foreach my $j (@ints) { - foreach my $k (@groups) { - if ($comma != 0) { print CONF ","; } else { $comma = 1; } - print CONF "$i-$j-modp$k"; - } - } - } - if ($lconfighash{$key}[24] eq 'on') { - print CONF "!\n"; - } else { - print CONF "\n"; - } - } - if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) { - print CONF "\tesp="; - my @encs = split('\|', $lconfighash{$key}[21]); - my @ints = split('\|', $lconfighash{$key}[22]); - my $comma = 0; - foreach my $i (@encs) { - foreach my $j (@ints) { - if ($comma != 0) { print CONF ","; } else { $comma = 1; } - print CONF "$i-$j"; - } - } - if ($lconfighash{$key}[24] eq 'on') { - print CONF "!\n"; - } else { - print CONF "\n"; - } - } - if ($lconfighash{$key}[23]) { - print CONF "\tpfsgroup=$lconfighash{$key}[23]\n"; - } - - # Lifetimes - if ($lconfighash{$key}[16]) { - print CONF "\tikelifetime=$lconfighash{$key}[16]h\n"; - } - if ($lconfighash{$key}[17]) { - print CONF "\tkeylife=$lconfighash{$key}[17]h\n"; - } - - # Compression - if ($lconfighash{$key}[13] eq 'on') { - print CONF "\tcompress=yes\n"; - } - - # Dead Peer Detection - print CONF "\tdpddelay=30\n"; - print CONF "\tdpdtimeout=120\n"; - print CONF "\tdpdaction=$lconfighash{$key}[27]\n"; - - # Disable pfs ? - print CONF "\tpfs=$lconfighash{$key}[28]\n"; - - # Print Authentication details - if ($lconfighash{$key}[4] eq 'psk') { - if ($lconfighash{$key}[6] eq 'left'){ - if ($lconfighash{$key}[26] eq 'BLUE') { - print SECRETS ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $netsettings{'BLUE_ADDRESS'}) . " "; - print SECRETS $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; - print SECRETS " : PSK \"$lconfighash{$key}[5]\"\n"; - } else { - print SECRETS ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $lvpnsettings{'VPN_IP'}) . " "; - print SECRETS $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; - print SECRETS " : PSK \"$lconfighash{$key}[5]\"\n"; - } - } else { - if ($lconfighash{$key}[26] eq 'BLUE') { - print SECRETS ($lconfighash{$key}[9] ? $lconfighash{$key}[9] : $netsettings{'BLUE_ADDRESS'}) . " "; - print SECRETS $lconfighash{$key}[7] ? $lconfighash{$key}[7] : $lconfighash{$key}[10]; - print SECRETS " : PSK \"$lconfighash{$key}[5]\"\n"; - } else { - print SECRETS ($lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lvpnsettings{'VPN_IP'}) . " "; - print SECRETS $lconfighash{$key}[7] ? $lconfighash{$key}[7] : $lconfighash{$key}[10]; - print SECRETS " : PSK \"$lconfighash{$key}[5]\"\n"; - } - } - - print CONF "\tauthby=secret\n"; + if ($lconfighash{$key}[24] eq 'on') { #only proposed algorythms? + print CONF "!\n"; } else { - print CONF "\tauthby=rsasig\n"; + print CONF "\n"; } + } + if ($lconfighash{$key}[23]) { + print CONF "\tpfsgroup=$lconfighash{$key}[23]\n"; + } - # Automatically start only if a net-to-net connection - if ($lconfighash{$key}[3] eq 'host') { - print CONF "\tauto=add\n"; - } else { - print CONF "\tauto=start\n"; + # Lifetimes + print CONF "\tikelifetime=$lconfighash{$key}[16]h\n" if ($lconfighash{$key}[16]); + print CONF "\tkeylife=$lconfighash{$key}[17]h\n" if ($lconfighash{$key}[17]); + + # Aggresive mode + print CONF "\taggrmode=yes\n" if ($lconfighash{$key}[12] eq 'on'); + + # Compression + print CONF "\tcompress=yes\n" if ($lconfighash{$key}[13] eq 'on'); + + # Dead Peer Detection + print CONF "\tdpddelay=30\n"; + print CONF "\tdpdtimeout=120\n"; + print CONF "\tdpdaction=$lconfighash{$key}[27]\n"; + + # Disable pfs ? + print CONF "\tpfs=". ($lconfighash{$key}[28] eq 'on' ? "yes\n" : "no\n"); + + # Build Authentication details: LEFTid RIGHTid : PSK psk + my $psk_line; + if ($lconfighash{$key}[4] eq 'psk') { + my $localside; + if ($lconfighash{$key}[26] eq 'BLUE') { + $localside = $netsettings{'BLUE_ADDRESS'}; + } elsif ($lconfighash{$key}[26] eq 'GREEN') { + $localside = $netsettings{'GREEN_ADDRESS'}; + } elsif ($lconfighash{$key}[26] eq 'ORANGE') { + $localside = $netsettings{'ORANGE_ADDRESS'}; + } else { # it is RED + $localside = $lvpnsettings{'VPN_IP'}; } - print CONF "\n"; - }#on + $psk_line = ($lconfighash{$key}[7] ? $lconfighash{$key}[7] : $localside) . " " ; + $psk_line .= $lconfighash{$key}[9] ? $lconfighash{$key}[9] : $lconfighash{$key}[10]; #remoteid or remote address? + $psk_line .= " : PSK '$lconfighash{$key}[5]'\n"; + # if the line contains %any, it is less specific than two IP or ID, so move it at end of file. + if ($psk_line =~ /%any/) { + $last_secrets .= $psk_line; + } else { + print SECRETS $psk_line; + } + print CONF "\tauthby=secret\n"; + } else { + print CONF "\tauthby=rsasig\n"; + print CONF "\tleftrsasigkey=%cert\n"; + print CONF "\trightrsasigkey=%cert\n"; + } + + # Automatically start only if a net-to-net connection + if ($lconfighash{$key}[3] eq 'host') { + print CONF "\tauto=add\n"; + } else { + print CONF "\tauto=start\n"; + } + print CONF "\n"; }#foreach key - + print SECRETS $last_secrets if ($last_secrets); close(CONF); close(SECRETS); } @@ -365,17 +466,22 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg goto SAVE_ERROR; } + unless ($cgiparams{'VPN_WATCH'} =~ /^(|off|on)$/ ) { + $errormessage = $Lang::tr{'invalid input'}; + goto SAVE_ERROR; + } + map ($vpnsettings{$_} = $cgiparams{$_}, - ('ENABLED','ENABLED_BLUE','DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL', + ('ENABLED','ENABLED_GREEN','ENABLED_ORANGE','ENABLED_BLUE','DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL', 'DBG_KLIPS','DBG_DNS','DBG_NAT_T')); $vpnsettings{'VPN_IP'} = $cgiparams{'VPN_IP'}; $vpnsettings{'VPN_DELAYED_START'} = $cgiparams{'VPN_DELAYED_START'}; $vpnsettings{'VPN_OVERRIDE_MTU'} = $cgiparams{'VPN_OVERRIDE_MTU'}; + $vpnsettings{'VPN_WATCH'} = $cgiparams{'VPN_WATCH'}; &General::writehash("${General::swroot}/vpn/settings", \%vpnsettings); &writeipsecfiles(); - if ($vpnsettings{'ENABLED'} eq 'on' || - $vpnsettings{'ENABLED_BLUE'} eq 'on') { + if (&vpnenabled) { system('/usr/local/bin/ipsecctrl', 'S'); } else { system('/usr/local/bin/ipsecctrl', 'D'); @@ -385,8 +491,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg ### ### Reset all step 2 ### -} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'} && $cgiparams{'AREUSURE'} eq 'yes') { - my $file = ''; +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'} && $cgiparams{'AREUSURE'} eq 'yes') { &General::readhasharray("${General::swroot}/vpn/config", \%confighash); foreach my $key (keys %confighash) { @@ -394,7 +499,7 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg delete $confighash{$key}; } } - while ($file = glob("${General::swroot}/{ca,certs,crls,private}/*")) { + while (my $file = glob("${General::swroot}/{ca,certs,crls,private}/*")) { unlink $file } &cleanssldatabase(); @@ -410,19 +515,26 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'TYPE'} eq '' && $cg ### ### Reset all step 1 ### -} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'reset'}) { +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'remove x509'}) { &Header::showhttpheaders(); &Header::openpage($Lang::tr{'vpn configuration main'}, 1, ''); - &Header::openbigbox('100%', 'LEFT', '', ''); - &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'}); + &Header::openbigbox('100%', 'left', '', ''); + &Header::openbox('100%', 'left', $Lang::tr{'are you sure'}); print <
$output\n"; @@ -523,14 +628,15 @@ END } ### -### Download ca certificate +### Export ca certificate to browser ### } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download ca certificate'}) { &General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash); if ( -f "${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem" ) { + print "Content-Type: application/force-download\n"; print "Content-Type: application/octet-stream\r\n"; - print "Content-Disposition: filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n"; + print "Content-Disposition: attachment; filename=$cahash{$cgiparams{'KEY'}}[0]cert.pem\r\n\r\n"; print `/usr/bin/openssl x509 -in ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem`; exit(0); } else { @@ -549,10 +655,7 @@ END my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$cgiparams{'KEY'}}[0]cert.pem ${General::swroot}/certs/$confighash{$key}[1]cert.pem`; if ($test =~ /: OK/) { # Delete connection - if ($vpnsettings{'ENABLED'} eq 'on' || - $vpnsettings{'ENABLED_BLUE'} eq 'on') { - system('/usr/local/bin/ipsecctrl', 'D', $key); - } + system('/usr/local/bin/ipsecctrl', 'D', $key) if (&vpnenabled); unlink ("${General::swroot}/certs/$confighash{$key}[1]cert.pem"); unlink ("${General::swroot}/certs/$confighash{$key}[1].p12"); delete $confighash{$key}; @@ -586,17 +689,26 @@ END if ($assignedcerts) { &Header::showhttpheaders(); &Header::openpage($Lang::tr{'vpn configuration main'}, 1, ''); - &Header::openbigbox('100%', 'LEFT', '', ''); - &Header::openbox('100%', 'LEFT', $Lang::tr{'are you sure'}); + &Header::openbigbox('100%', 'left', '', ''); + &Header::openbox('100%', 'left', $Lang::tr{'are you sure'}); print <
| $Lang::tr{'organization name'}: | -- | ||
| $Lang::tr{'ipfires hostname'}: | -- | ||
$Lang::tr{'your e-mail'}:  |
- - | ||
| $Lang::tr{'your department'}: |
- - | ||
| $Lang::tr{'city'}: |
- - | ||
| $Lang::tr{'state or province'}: |
- - | ||
| $Lang::tr{'country'}: | -- | ||
| - | |||
|
- $Lang::tr{'this field may be blank'} |
- - $Lang::tr{'capswarning'}: - $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'} - | ||
| $Lang::tr{'upload p12 file'}: | -- | ||
| $Lang::tr{'pkcs12 file password'}: |
- - | ||
| - | - | ||
|
- $Lang::tr{'this field may be blank'} | |||
| $Lang::tr{'organization name'}: | +|
| $Lang::tr{'ipcops hostname'}: | +|
| $Lang::tr{'your e-mail'}: |
+ |
| $Lang::tr{'your department'}: |
+ |
| $Lang::tr{'city'}: |
+ |
| $Lang::tr{'state or province'}: |
+ |
| $Lang::tr{'country'}: | +|
| $Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*) |
+ |
| + | |
| + $Lang::tr{'capswarning'}: + $Lang::tr{'generating the root and host certificates may take a long time. it can take up to several minutes on older hardware. please be patient'} + | |
| $Lang::tr{'upload p12 file'}: | +|
| $Lang::tr{'pkcs12 file password'}: |
+ |
| + | |
|
+ $Lang::tr{'this field may be blank'} | |
$output\n"; @@ -1092,14 +1159,14 @@ END } ### -### Download Certificate +### Export Certificate to browser ### } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'download certificate'}) { &General::readhasharray("${General::swroot}/vpn/config", \%confighash); if ( -f "${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem") { - print "Content-Disposition: filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\r\n"; - print "Content-Type: application/octet-stream\r\n\r\n"; + print "Content-Type: application/force-download\n"; + print "Content-Disposition: attachment; filename=" . $confighash{$cgiparams{'KEY'}}[1] . "cert.pem\n\n"; print `/bin/cat ${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem`; exit (0); } @@ -1117,20 +1184,14 @@ END $confighash{$cgiparams{'KEY'}}[0] = 'on'; &General::writehasharray("${General::swroot}/vpn/config", \%confighash); &writeipsecfiles(); - if ($vpnsettings{'ENABLED'} eq 'on' || - $vpnsettings{'ENABLED_BLUE'} eq 'on') { - system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}); - sleep $sleepDelay; - } + system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}) if (&vpnenabled); } else { $confighash{$cgiparams{'KEY'}}[0] = 'off'; - if ($vpnsettings{'ENABLED'} eq 'on' || - $vpnsettings{'ENABLED_BLUE'} eq 'on') { - system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}); - } &General::writehasharray("${General::swroot}/vpn/config", \%confighash); &writeipsecfiles(); + system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled); } + sleep $sleepDelay; } else { $errormessage = $Lang::tr{'invalid key'}; } @@ -1143,8 +1204,7 @@ END &General::readhasharray("${General::swroot}/vpn/config", \%confighash); if ($confighash{$cgiparams{'KEY'}}) { - if ($vpnsettings{'ENABLED'} eq 'on' || - $vpnsettings{'ENABLED_BLUE'} eq 'on') { + if (&vpnenabled) { system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}); sleep $sleepDelay; } @@ -1160,10 +1220,7 @@ END &General::readhasharray("${General::swroot}/vpn/config", \%confighash); if ($confighash{$cgiparams{'KEY'}}) { - if ($vpnsettings{'ENABLED'} eq 'on' || - $vpnsettings{'ENABLED_BLUE'} eq 'on') { - system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}); - } + system('/usr/local/bin/ipsecctrl', 'D', $cgiparams{'KEY'}) if (&vpnenabled); unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem"); unlink ("${General::swroot}/certs/$confighash{$cgiparams{'KEY'}}[1].p12"); delete $confighash{$cgiparams{'KEY'}}; @@ -1177,20 +1234,23 @@ END ### Choose between adding a host-net or net-net connection ### } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') { - &General::readhash("${General::swroot}/vpn/settings", \%vpnsettings); &Header::showhttpheaders(); &Header::openpage($Lang::tr{'vpn configuration main'}, 1, ''); - &Header::openbigbox('100%', 'LEFT', '', ''); - &Header::openbox('100%', 'LEFT', $Lang::tr{'connection type'}); + &Header::openbigbox('100%', 'left', '', ''); + &Header::openbox('100%', 'left', $Lang::tr{'connection type'}); print <
-
| + | $Lang::tr{'host to net vpn'} | +
| + | $Lang::tr{'net to net vpn'} | +
| + | |
' . + 'DER_ASN1_DN: @c=FR/ou=Paris/ou=Home/cn=*
' . + 'FQDN: @ipcop.org
' . + 'USER_FQDN: franck@ipcop.org
' . + 'IPV4_ADDR: @123.123.123.123'; goto VPNCONF_ERROR; } - - if ($cgiparams{'AUTH'} eq 'psk') { + # If Auth is DN, verify existance of Remote ID. + if ( $cgiparams{'REMOTE_ID'} eq '' && ( + $cgiparams{'AUTH'} eq 'auth-dn'|| # while creation + $confighash{$cgiparams{'KEY'}}[2] eq '%auth-dn')){ # while editing + $errormessage = $Lang::tr{'vpn missing remote id'}; + goto VPNCONF_ERROR; + } + + if ($cgiparams{'AUTH'} eq 'psk') { if (! length($cgiparams{'PSK'}) ) { $errormessage = $Lang::tr{'pre-shared key is too short'}; goto VPNCONF_ERROR; } - if ($cgiparams{'PSK'} =~ /['",&]/) { # " ' correct coloring syntax editor ! + if ($cgiparams{'PSK'} =~ /'/) { + $cgiparams{'PSK'} =~ tr/'/ /; $errormessage = $Lang::tr{'invalid characters found in pre-shared key'}; goto VPNCONF_ERROR; } @@ -1348,35 +1434,116 @@ END goto VPNCONF_ERROR; } - # Sign the certificate request and move it - # Sign the host certificate request - system('/usr/bin/openssl', 'ca', '-days', '999999', - '-batch', '-notext', - '-in', $filename, - '-out', "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); - if ($?) { - $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; + # Sign the certificate request + &General::log("ipsec", "Signing your cert $cgiparams{'NAME'}..."); + my $opt = " ca -days 999999"; + $opt .= " -batch -notext"; + $opt .= " -in $filename"; + $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"; + + if ( $errormessage = &callssl ($opt) ) { unlink ($filename); unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); &cleanssldatabase(); goto VPNCONF_ERROR; } else { - unlink ($filename); - &cleanssldatabase(); + unlink ($filename); + &cleanssldatabase(); } - my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem`; - $temp =~ /Subject:.*CN=(.*)[\n]/; - $temp = $1; - $temp =~ s+/Email+, E+; - $temp =~ s/ ST=/ S=/; - $cgiparams{'CERT_NAME'} = $temp; - $cgiparams{'CERT_NAME'} =~ s/,//g; - $cgiparams{'CERT_NAME'} =~ s/\'//g; + $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); if ($cgiparams{'CERT_NAME'} eq '') { $errormessage = $Lang::tr{'could not retrieve common name from certificate'}; goto VPNCONF_ERROR; } + } elsif ($cgiparams{'AUTH'} eq 'pkcs12') { + &General::log("ipsec", "Importing from p12..."); + + if (ref ($cgiparams{'FH'}) ne 'Fh') { + $errormessage = $Lang::tr{'there was no file upload'}; + goto ROOTCERT_ERROR; + } + + # Move uploaded certificate request to a temporary file + (my $fh, my $filename) = tempfile( ); + if (copy ($cgiparams{'FH'}, $fh) != 1) { + $errormessage = $!; + goto ROOTCERT_ERROR; + } + + # Extract the CA certificate from the file + &General::log("ipsec", "Extracting caroot from p12..."); + if (open(STDIN, "-|")) { + my $opt = " pkcs12 -cacerts -nokeys"; + $opt .= " -in $filename"; + $opt .= " -out /tmp/newcacert"; + $errormessage = &callssl ($opt); + } else { #child + print "$cgiparams{'P12_PASS'}\n"; + exit (0); + } + + # Extract the Host certificate from the file + if (!$errormessage) { + &General::log("ipsec", "Extracting host cert from p12..."); + if (open(STDIN, "-|")) { + my $opt = " pkcs12 -clcerts -nokeys"; + $opt .= " -in $filename"; + $opt .= " -out /tmp/newhostcert"; + $errormessage = &callssl ($opt); + } else { #child + print "$cgiparams{'P12_PASS'}\n"; + exit (0); + } + } + + if (!$errormessage) { + &General::log("ipsec", "Moving cacert..."); + #If CA have new subject, add it to our list of CA + my $casubject = &Header::cleanhtml(getsubjectfromcert ('/tmp/newcacert')); + my @names; + foreach my $x (keys %cahash) { + $casubject='' if ($cahash{$x}[1] eq $casubject); + unshift (@names,$cahash{$x}[0]); + } + if ($casubject) { # a new one! + my $temp = `/usr/bin/openssl x509 -text -in /tmp/newcacert`; + if ($temp !~ /CA:TRUE/i) { + $errormessage = $Lang::tr{'not a valid ca certificate'}; + } else { + #compute a name for it + my $idx=0; + while (grep(/Imported-$idx/, @names) ) {$idx++}; + $cgiparams{'CA_NAME'}="Imported-$idx"; + $cgiparams{'CERT_NAME'}=&Header::cleanhtml(getCNfromcert ('/tmp/newhostcert')); + move("/tmp/newcacert", "${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"); + $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); + if (!$errormessage) { + my $key = &General::findhasharraykey (\%cahash); + $cahash{$key}[0] = $cgiparams{'CA_NAME'}; + $cahash{$key}[1] = $casubject; + &General::writehasharray("${General::swroot}/vpn/caconfig", \%cahash); + system('/usr/local/bin/ipsecctrl', 'R'); + } + } + } + } + if (!$errormessage) { + &General::log("ipsec", "Moving host cert..."); + move("/tmp/newhostcert", "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); + $errormessage = "$Lang::tr{'certificate file move failed'}: $!" if ($? ne 0); + } + + #cleanup temp files + unlink ($filename); + unlink ('/tmp/newcacert'); + unlink ('/tmp/newhostcert'); + if ($errormessage) { + unlink ("${General::swroot}/ca/$cgiparams{'CA_NAME'}cert.pem"); + unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); + goto VPNCONF_ERROR; + } + &General::log("ipsec", "p12 import completed!"); } elsif ($cgiparams{'AUTH'} eq 'certfile') { if ($cgiparams{'KEY'}) { $errormessage = $Lang::tr{'cant change certificates'}; @@ -1394,15 +1561,16 @@ END } # Verify the certificate has a valid CA and move it - my $validca = 0; + &General::log("ipsec", "Validating imported cert against our known CA..."); + my $validca = 1; #assume ok my $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/cacert.pem $filename`; - if ($test =~ /: OK/) { - $validca = 1; - } else { + if ($test !~ /: OK/) { + my $validca = 0; foreach my $key (keys %cahash) { $test = `/usr/bin/openssl verify -CAfile ${General::swroot}/ca/$cahash{$key}[0]cert.pem $filename`; if ($test =~ /: OK/) { $validca = 1; + last; } } } @@ -1419,14 +1587,7 @@ END } } - my $temp = `/usr/bin/openssl x509 -text -in ${General::swroot}/certs/$cgiparams{'NAME'}cert.pem`; - $temp =~ /Subject:.*CN=(.*)[\n]/; - $temp = $1; - $temp =~ s+/Email+, E+; - $temp =~ s/ ST=/ S=/; - $cgiparams{'CERT_NAME'} = $temp; - $cgiparams{'CERT_NAME'} =~ s/,//g; - $cgiparams{'CERT_NAME'} =~ s/\'//g; + $cgiparams{'CERT_NAME'} = getCNfromcert ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); if ($cgiparams{'CERT_NAME'} eq '') { unlink ("${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); $errormessage = $Lang::tr{'could not retrieve common name from certificate'}; @@ -1478,6 +1639,19 @@ END $errormessage = $Lang::tr{'invalid input for country'}; goto VPNCONF_ERROR; } + #the exact syntax is a list comma separated of + # email:any-validemail + # URI: a uniform resource indicator + # DNS: a DNS domain name + # RID: a registered OBJECT IDENTIFIER + # IP: an IP address + # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com + + if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) { + $errormessage = $Lang::tr{'vpn altname syntax'}; + goto VPNCONF_ERROR; + } + if (length($cgiparams{'CERT_PASS1'}) < 5) { $errormessage = $Lang::tr{'password too short'}; goto VPNCONF_ERROR; @@ -1493,65 +1667,77 @@ END (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./; # Create the Host certificate request - my $pid = open(OPENSSL, "|-"); - $SIG{ALRM} = sub { $errormessage = $Lang::tr{'broken pipe'}; goto VPNCONF_ERROR;}; - if ($pid) { # parent - print OPENSSL "$cgiparams{'CERT_COUNTRY'}\n"; - print OPENSSL "$state\n"; - print OPENSSL "$city\n"; - print OPENSSL "$cgiparams{'CERT_ORGANIZATION'}\n"; - print OPENSSL "$ou\n"; - print OPENSSL "$cgiparams{'CERT_NAME'}\n"; - print OPENSSL "$cgiparams{'CERT_EMAIL'}\n"; - print OPENSSL ".\n"; - print OPENSSL ".\n"; - close (OPENSSL); - if ($?) { - $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; + &General::log("ipsec", "Creating a cert..."); + + if (open(STDIN, "-|")) { + my $opt = " req -nodes -rand /proc/interrupts:/proc/net/rt_cache"; + $opt .= " -newkey rsa:1024"; + $opt .= " -keyout ${General::swroot}/certs/$cgiparams{'NAME'}key.pem"; + $opt .= " -out ${General::swroot}/certs/$cgiparams{'NAME'}req.pem"; + + if ( $errormessage = &callssl ($opt) ) { unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem"); unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem"); goto VPNCONF_ERROR; - } - } else { # child - unless (exec ('/usr/bin/openssl', 'req', '-nodes', '-rand', '/proc/interrupts:/proc/net/rt_cache', - '-newkey', 'rsa:1024', - '-keyout', "${General::swroot}/certs/$cgiparams{'NAME'}key.pem", - '-out', "${General::swroot}/certs/$cgiparams{'NAME'}req.pem")) { - $errormessage = "$Lang::tr{'cant start openssl'}: $!"; - unlink ("${General::swroot}/certs/$cgiparams{'NAME'}key.pem"); - unlink ("${General::swroot}/certs/$cgiparams{'NAME'}req.pem"); - goto VPNCONF_ERROR; - } + } + } else { #child + print "$cgiparams{'CERT_COUNTRY'}\n"; + print "$state\n"; + print "$city\n"; + print "$cgiparams{'CERT_ORGANIZATION'}\n"; + print "$ou\n"; + print "$cgiparams{'CERT_NAME'}\n"; + print "$cgiparams{'CERT_EMAIL'}\n"; + print ".\n"; + print ".\n"; + exit (0); } - + # Sign the host certificate request - system('/usr/bin/openssl', 'ca', '-days', '999999', - '-batch', '-notext', - '-in', "${General::swroot}/certs/$cgiparams{'NAME'}req.pem", - '-out', "${General::swroot}/certs/$cgiparams{'NAME'}cert.pem"); - if ($?) { - $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; + &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}..."); + + #No easy way for specifying the contain of subjectAltName without writing a config file... + my ($fh, $v3extname) = tempfile ('/tmp/XXXXXXXX'); + print $fh <
+ ($Lang::tr{'eg'} @xy.example.com)
$Lang::tr{'upload a certificate request'}
$Lang::tr{'vpn auth-dn'}
$Lang::tr{'generate a certificate'}
";
+ if ($cgiparams{'KEY'}) {
+ print "";
+ }
+ print "
";
+ &Header::closebigbox();
+ &Header::closepage();
+ exit (0);
+
VPNCONF_END:
}
@@ -1893,18 +2143,11 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
}
if ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
- if ($cgiparams{'NAT'} !~ /^(on|off)$/) {
- $errormessage = $Lang::tr{'invalid input'};
- goto ADVANCED_ERROR;
- }
- if ($cgiparams{'COMPRESSION'} !~ /^(on|off)$/) {
- $errormessage = $Lang::tr{'invalid input'};
- goto ADVANCED_ERROR;
- }
- if ($cgiparams{'NAT'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
- $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
- goto ADVANCED_ERROR;
- }
+ # I didn't read any incompatibilities here....
+ #if ($cgiparams{'VHOST'} eq 'on' && $cgiparams{'COMPRESSION'} eq 'on') {
+ # $errormessage = $Lang::tr{'cannot enable both nat traversal and compression'};
+ # goto ADVANCED_ERROR;
+ #}
my @temp = split('\|', $cgiparams{'IKE_ENCRYPTION'});
if ($#temp < 0) {
$errormessage = $Lang::tr{'invalid input'};
@@ -1982,12 +2225,18 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
$errormessage = $Lang::tr{'esp keylife should be between 1 and 24 hours'};
goto ADVANCED_ERROR;
}
- if ($cgiparams{'ONLY_PROPOSED'} !~ /^(on|off)$/) {
+
+ if (
+ ($cgiparams{'AGGRMODE'} !~ /^(|on|off)$/) ||
+ ($cgiparams{'COMPRESSION'} !~ /^(|on|off)$/) ||
+ ($cgiparams{'ONLY_PROPOSED'} !~ /^(|on|off)$/) ||
+ ($cgiparams{'PFS'} !~ /^(|on|off)$/) ||
+ ($cgiparams{'VHOST'} !~ /^(|on|off)$/)
+ ){
$errormessage = $Lang::tr{'invalid input'};
goto ADVANCED_ERROR;
}
- $confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'NAT'};
- $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
+
$confighash{$cgiparams{'KEY'}}[18] = $cgiparams{'IKE_ENCRYPTION'};
$confighash{$cgiparams{'KEY'}}[19] = $cgiparams{'IKE_INTEGRITY'};
$confighash{$cgiparams{'KEY'}}[20] = $cgiparams{'IKE_GROUPTYPE'};
@@ -1996,19 +2245,19 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
$confighash{$cgiparams{'KEY'}}[22] = $cgiparams{'ESP_INTEGRITY'};
$confighash{$cgiparams{'KEY'}}[23] = $cgiparams{'ESP_GROUPTYPE'};
$confighash{$cgiparams{'KEY'}}[17] = $cgiparams{'ESP_KEYLIFE'};
+ $confighash{$cgiparams{'KEY'}}[12] = $cgiparams{'AGGRMODE'};
+ $confighash{$cgiparams{'KEY'}}[13] = $cgiparams{'COMPRESSION'};
$confighash{$cgiparams{'KEY'}}[24] = $cgiparams{'ONLY_PROPOSED'};
+ $confighash{$cgiparams{'KEY'}}[28] = $cgiparams{'PFS'};
+ $confighash{$cgiparams{'KEY'}}[14] = $cgiparams{'VHOST'};
&General::writehasharray("${General::swroot}/vpn/config", \%confighash);
&writeipsecfiles();
- if ($vpnsettings{'ENABLED'} eq 'on' ||
- $vpnsettings{'ENABLED_BLUE'} eq 'on') {
+ if (&vpnenabled) {
system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'});
sleep $sleepDelay;
}
goto ADVANCED_END;
} else {
-
- $cgiparams{'NAT'} = $confighash{$cgiparams{'KEY'}}[14];
- $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
$cgiparams{'IKE_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[18];
$cgiparams{'IKE_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[19];
$cgiparams{'IKE_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[20];
@@ -2017,20 +2266,18 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
$cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22];
$cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23];
$cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17];
+ $cgiparams{'AGGRMODE'} = $confighash{$cgiparams{'KEY'}}[12];
+ $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13];
$cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24];
-
+ $cgiparams{'PFS'} = $confighash{$cgiparams{'KEY'}}[28];
+ $cgiparams{'VHOST'} = $confighash{$cgiparams{'KEY'}}[14];
+
if ($confighash{$cgiparams{'KEY'}}[3] eq 'net' || $confighash{$cgiparams{'KEY'}}[10]) {
- $cgiparams{'NAT'} = 'off';
+ $cgiparams{'VHOST'} = 'off';
}
}
ADVANCED_ERROR:
- $checked{'NAT'}{'off'} = '';
- $checked{'NAT'}{'on'} = '';
- $checked{'NAT'}{$cgiparams{'NAT'}} = "checked='checked'";
- $checked{'COMPRESSION'}{'off'} = '';
- $checked{'COMPRESSION'}{'on'} = '';
- $checked{'COMPRESSION'}{$cgiparams{'COMPRESSION'}} = "checked='checked'";
$checked{'IKE_ENCRYPTION'}{'aes256'} = '';
$checked{'IKE_ENCRYPTION'}{'aes128'} = '';
$checked{'IKE_ENCRYPTION'}{'3des'} = '';
@@ -2083,112 +2330,140 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
$checked{'ESP_GROUPTYPE'}{'modp3072'} = '';
$checked{'ESP_GROUPTYPE'}{'modp4096'} = '';
$checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'";
- $checked{'ONLY_PROPOSED'}{'off'} = '';
- $checked{'ONLY_PROPOSED'}{'on'} = '';
- $checked{'ONLY_PROPOSED'}{$cgiparams{'ONLY_PROPOSED'}} = "checked='checked'";
+
+ $checked{'AGGRMODE'} = $cgiparams{'AGGRMODE'} eq 'on' ? "checked='checked'" : '' ;
+ $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ;
+ $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ;
+ $checked{'PFS'} = $cgiparams{'PFS'} eq 'on' ? "checked='checked'" : '' ;
+ $checked{'VHOST'} = $cgiparams{'VHOST'} eq 'on' ? "checked='checked'" : '' ;
&Header::showhttpheaders();
&Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
- &Header::openbigbox('100%', 'LEFT', '', $errormessage);
+ &Header::openbigbox('100%', 'left', '', $errormessage);
if ($errormessage) {
- &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
+ &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
print "";
- print "
";
&Header::closebigbox();
&Header::closepage();
exit(0);
@@ -2205,6 +2480,7 @@ EOF
&General::readhash("${General::swroot}/vpn/settings", \%cgiparams);
&General::readhasharray("${General::swroot}/vpn/caconfig", \%cahash);
&General::readhasharray("${General::swroot}/vpn/config", \%confighash);
+ $cgiparams{'CA_NAME'} = '';
my @status = `/usr/sbin/ipsec auto --status`;
@@ -2224,64 +2500,86 @@ EOF
$cgiparams{'VPN_IP'} ='%defaultroute' if ($cgiparams{'VPN_IP'} eq '');
$cgiparams{'VPN_DELAYED_START'} = 0 if (! defined ($cgiparams{'VPN_DELAYED_START'}));
+ $checked{'VPN_WATCH'} = $cgiparams{'VPN_WATCH'} eq 'on' ? "checked='checked'" : '' ;
map ($checked{$_} = $cgiparams{$_} eq 'on' ? "checked='checked'" : '',
- ('ENABLED','ENABLED_BLUE','DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL',
+ ('ENABLED','ENABLED_GREEN','ENABLED_ORANGE','ENABLED_BLUE','DBG_CRYPT','DBG_PARSING','DBG_EMITTING','DBG_CONTROL',
'DBG_KLIPS','DBG_DNS','DBG_NAT_T'));
&Header::showhttpheaders();
&Header::openpage($Lang::tr{'vpn configuration main'}, 1, '');
- &Header::openbigbox('100%', 'LEFT', '', $errormessage);
+ &Header::openbigbox('100%', 'left', '', $errormessage);
if ($errormessage) {
- &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'});
+ &Header::openbox('100%', 'left', $Lang::tr{'error messages'});
print "
