From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4bhF3f11K2z2ywd for ; Tue, 15 Jul 2025 09:57:34 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R11" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4bhF3f0dCTz2xXs for ; Tue, 15 Jul 2025 09:57:34 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E6" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4bhF3c6Sn9zwN for ; Tue, 15 Jul 2025 09:57:32 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1752573453; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=Tj87yE9TVfOsJ6wxCMfloz+6lzde/CQNl+o6VcmsTvw=; b=kTigtXHz7hvmyrgEEHr8f/eVWqyFrEFAaVwa5kjHciq4Nwglg+66u5kwzMx1W3pOtDOxZt jEAS+ahCnInccCBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1752573453; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=Tj87yE9TVfOsJ6wxCMfloz+6lzde/CQNl+o6VcmsTvw=; b=t35wzUf+xIz9EWxw7pdLb59Srh0lS9lsIxW3OjPYolDpNQgtFAyRTAZNi5IWC/1A3d2Mkc iNwMaEk1GKptmSOEUlHArl3xB9E/faQHe+J0q4itUvq+vGHn1Z8UTUGP4FycljtPYCR8n7 x+2yhzJJE/R7fg7ysADc02Xi2yN19+1z6pklNltdEY9ezXavCb8M9Wjc8scpa5U5Z2uvjn P6AtRrt6J0A/reyBrBS5qhR60ajFm8Ekf+C/oyLQGwM6xC9IiIMkpwKGZMkLV4JWhcgl9Q FmTZgTpjesA+uvcA8IhJAI+2XhNgQzEd3J1OV2Yip1wojNw6c+871oKklTFzQg== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4bhF3c51DCz2xfL; Tue, 15 Jul 2025 09:57:32 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. c5ecfbe3f1cb1adc4d8ad04c97a5d749dd5a3f1a X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: c374391a112fd4ac6508d246442eac88ae111da3 X-Git-Newrev: c5ecfbe3f1cb1adc4d8ad04c97a5d749dd5a3f1a Message-Id: <4bhF3c51DCz2xfL@people01.haj.ipfire.org> Date: Tue, 15 Jul 2025 09:57:31 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via c5ecfbe3f1cb1adc4d8ad04c97a5d749dd5a3f1a (commit) via 231f939586d8ec1d72f654175b549859e59f105b (commit) via fa429bcca8f156125181667fba75b2dfd13c7281 (commit) via 3bbf7b6e2919bf054af1d6c924522f889142ba91 (commit) via eed199788837a54f739d567afe225abe02b0012f (commit) via 56400c89b82ecde90befe4fdda1027cfca707f03 (commit) via 5aebc354310a6cc3b9e9ade5cba02e151c1e6756 (commit) via 8ff821076e5bd610e747fef4b5c32eae3e744021 (commit) via 8e58e852163e636f4edf99a6c6419a8e3330113a (commit) via 07c05baff8f4c76d00dcbe9d6a120330131bb4ea (commit) via 3a9b321e3afc6cdbc0eb355d626f2a8fe8db3ce3 (commit) via 829d3f4f617c6bfcb2de7a178a171dec7a28a49f (commit) via ed66fe66298734b0ecde91ff478eb814f8b0a099 (commit) via 26034a80ffbaafcb78e6514868159a561594cf1f (commit) via ffe75e4767846f72bac49db6a2ba7274905d8d9d (commit) via 5f00c4dd53f403a8fd9c1f044ab1edd21a11a75d (commit) via 805eb6c1d6244887301fdc5414fafac420404a44 (commit) via 657998956d6ac7943d3ff3f6a9c65111bb3dcba6 (commit) via 693a13928d95fa3e6d73c841f70b4f3eec9d78e8 (commit) via 6d1abf3856ce9908089662cd35552f74ebafb941 (commit) via 956a69fdbeefbb681b3f6a76d3aedaae4f6d1539 (commit) via c5c19b5e0cee738a9adae9805133725b5f181892 (commit) via 77e2d1bfc81072d6958d709e083aad480ded1814 (commit) via 3c508e008fc3b1395123d4e4a57b6a4a18c27041 (commit) via 5acb54c2679e8140372f56de2078463c2467ecff (commit) via eb1b0ed1bf60f211d1f7da446542680f7f07e1c1 (commit) via 1b59f600e04aebd812026a4870fab2b7dd91043e (commit) via e85939b2e0a9d6dd8522384459549452e4ee45fb (commit) via 0ad27c8f9a59c171319d14b958fca6ecd6b43023 (commit) via d447db574723bcf98b2655e1b24af58e1be45ab1 (commit) via 3b100d3ad98ed5c51b2cccb8c050f5c798cf1a83 (commit) via 599e85983e63ff933f7d7a621a101f0af5729b60 (commit) via ea1a3a5afa75a402d13705627ddd16bce096a802 (commit) via 0fc1af8a4adfa93685808e4ddf1a2be4c03ecb76 (commit) via 8f3b80cc4cb650b0ac49dca10ee441aeaef7338f (commit) via 3aec750ad797be05abee92044d90c2cbfb0e0a8e (commit) via b13fb3dfc4ee6bdafe1ea3b38418f01fb6d90ddb (commit) via c98529a671cb519e8dfb09d922cd20fdac398de5 (commit) via c5d891d672ede1eda988f931977bbf408a1ddccc (commit) via 57f95cc2ea0f06336f2c0cbad5d65cb57ae3dab1 (commit) via 2649f62b5336d32725e4d5e2e0ad8972daefdca2 (commit) via 0bc717f598bbe9a3fa66a05ec8af76baf36c703d (commit) via 5b41f47b8ee302b86295aa5a3917037c6ab05fd3 (commit) via 6aff5b8104cc55d36b2446c328cb74f821b76ecb (commit) via 2271d043c4d62eb30876b60aec8f1150e8897ffa (commit) via 460942d7ed28ebf8c7727faa6321b63ee1c56964 (commit) via b4b89379ab94eff031b0b02253fe027897861122 (commit) via 29097cef3ffc786a7b1ef3d99ae6f9e0f43f2f55 (commit) via e3834fd8376e7a00be156549bf6c7b7ea710ffa4 (commit) via c71aa190c8b571f98bfede8e0c96a67e5fcb8a03 (commit) via decc7e0c4a7f813687fed5dc75995a6f0f4ff59a (commit) via 285be5bb34742be60a01f9eb17e56c0a5584c75a (commit) via 7d5d319b5075595c35d99b06b008b4994e7ce7c4 (commit) via a188dd85fe083e9b6fd8f0ddf7687350ee5ed40c (commit) via 057f781b87d87eda6abf9df12d41e0abbcb3dcb8 (commit) via dcbafa72e6fde4eecb4b18411aaf1008fbc7acf6 (commit) via cba980f4b369dbd1e745f944c9c2eaa7791c2702 (commit) via c33a0374a53968bc9cfab5f21b18ecf8619111e7 (commit) via 9b2035a8265e58fd15a329c52301ba28860985c8 (commit) via f560e558d839b4d007d8a8d03f484ca36304c7d1 (commit) via 2862417617ab134600c18ebdfccef0288f68d506 (commit) via fe5e31568be0758ec27b12a87f75640bc1bef813 (commit) via c620343fe4a890e5e497c6a7696d1382485e9467 (commit) via 9edd392855a89de1ab9420a56192db7259eb50b5 (commit) via 7a28cc59aee870bcee3ec59928f694a8531e5e11 (commit) via 364a2b619ce08f85b7dd332e9d15e7177e3b5ce2 (commit) via f5a05cdb55bde74b9f98036b12d808e630fa6961 (commit) via c0ef1cf560af98f17fcfdee13b7ff3b533c029fe (commit) via 4c85492195a84146a0c1908f709cf0b566b35a22 (commit) via a78cc8d035ef777fa04d9259ef6809841b04394f (commit) via 0a3766e0c68e6b7a43781d0643c2f726ec147b34 (commit) via 1e495925985bb4250352c041a131764b8bdc73a3 (commit) via 2241dbeff064dc5ece2d7c5988dbed69d2b87603 (commit) via befe483f8301b6ef2b59da742ca18946b21f13b4 (commit) via 86365ab34da492a0b7de928376dab86d5879b0b7 (commit) via 37af5ae84d361ee9eb346e53ea7c185dff2ca406 (commit) via bb192daff6d8fb856c8eab66cadace15cf3a97aa (commit) via 23fd2f1efbaa843c4253506de416200145ea5fe7 (commit) via fbbb8e4508fb0aa077eb7a68e24274b49057c3a7 (commit) via d3af28a489ff1bd4601b031069681431efc73818 (commit) via 3ad7c624e960227361847927e9d5bc9d968af1a7 (commit) via cee76ccca3b8420363f61c17baa05bdea6136e49 (commit) via 3cdb4766fb6cbbc4c7245ff7edf571f4da300814 (commit) via ec4de6703d6715e12b6113bd07fb0e2fc9b77ae6 (commit) via 1b81e5e2d306c5004bd29df752a8c02aa3cc21bf (commit) via 1eea39ff44cc981a29cc2a6d940a7cf1c74b3b4e (commit) via a6cb61553527bb700cc7960ab30d6644af17fffd (commit) via d8fa0cea30ed2b83d6353a4f432ee8f6b0c8c258 (commit) via fdcd1daa197f22d90c35eae6c86dd2a99a8ad4f3 (commit) via 04b453725355aec3f440249b4a0c7e0595b9069a (commit) via 41c81273c8681cd2410f1171fd91d696a6fe743d (commit) via a25d5d3ab1fbd486d91f967dfab3d3fa9e8c2a98 (commit) via fb171334fd2482471c5b8cc334c0369ee2fd7bc9 (commit) via 2bb7a36a8f7623bbd5aeb2ee2e4dbba2485d1725 (commit) via 1e28ce55ff6b87f6aa207b01403801ab0d480090 (commit) via e2120486c7bb14cd579560c1687f8cad5b449774 (commit) via 60caf9635d0515d4aa73913d6945bf956de0256b (commit) via fb10f9949011fae5d0f2101602e443b3d380f8ff (commit) via bfa6d0740ec7b12468ba03547b2c5be3a9a2bd42 (commit) via 07481d357af0118e1aaf88d46c00b758419606c3 (commit) via b769ba05e7f8fa2ece154e8eb9b37f1603276f01 (commit) via e017336a1f61cf6818afbba143fd5221973747e4 (commit) via cd1f918e4dce1694bb0449afbe42c02c585b0b21 (commit) via fe09cf897a725783e2be31360a785a878dd5629c (commit) via d7923ad1556c5d75c0a488b48bcb5c786e618055 (commit) via ab5af7d868b30eb062e456a9482b1a6d3dddc571 (commit) via 08837a72823efbb01f00b92b901e01fe87393a71 (commit) via 74eac5db4937392ba13ff05d60edd8b222417839 (commit) via f990fe0142d8ddaf05f2aae3a408ac001721c273 (commit) via 7f5f1321128d4bd206fca4c0c6024bfd42260b6c (commit) via 7b4a35c98a4b098872a6a44b0817540b3164f1f1 (commit) via a049b157b848bfb0dbbccc582f1307e366d52bee (commit) via 8a0868594526403a802c51151882dc887c446576 (commit) via 2208a0f85f966981acb11a17f739e9a11c53a427 (commit) via 963b71bfb5efc53f1eda90010e0651baef5b29e4 (commit) via 50e83cf2b1c441364bbc2718a8bdebed7219232e (commit) via 5fb0b119e5bfbbb1d2daabe45a2e5225b6de7212 (commit) via ef027014d9c03b2c108ac02f16f7175b3c6da8e6 (commit) via 7f876fd24a854f1dfd90580b5586dcdae41e6ce2 (commit) via a19e8621a3e70ddd9c72477f88ed71c3b24456e6 (commit) via a04af768608c933a80ec45c819815e3eb0e5888b (commit) via 1e716201e2cc6572b52b4e274f169be681a2d625 (commit) via 954bd9dfdee4e1cff5056b433d12fb21d6531372 (commit) via a10f3d5ac156f9c1b81b977ae508be525b52f421 (commit) via d7cb4fa910e3cb581b00043219edc449b4c9ad75 (commit) via cac18c9ca30881f90074d6efcc4039a1348215e6 (commit) via 2024b2a09f462794afa39d89af82c49e42a66889 (commit) via 92460a7c047778a6e152e019f047990fe399b711 (commit) via 42413182596203b9a2bbcf8f5cec73426560bc7f (commit) via 0187917c729bf75909b777d7254dbce9314fc3a7 (commit) via 2666a8072da5a10bd01c39e265234036f95fc18c (commit) via 19310ac789b5c115da5e38de698802bcf0d39af1 (commit) via 994e22d87a5e3ce3e61872b26dfd02f13fd2ed5c (commit) via 747386d4fbc8b2ed58707ff24a909b5dc2c72bef (commit) from c374391a112fd4ac6508d246442eac88ae111da3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c5ecfbe3f1cb1adc4d8ad04c97a5d749dd5a3f1a Author: Michael Tremer Date: Tue Jul 15 09:57:16 2025 +0000 core197: Ship OpenVPN changes Signed-off-by: Michael Tremer commit 231f939586d8ec1d72f654175b549859e59f105b Author: Michael Tremer Date: Tue Jul 8 10:49:47 2025 +0200 openvpn: Ignore existing PID files when starting processes This is all not very organised and tidy. The init process seems to be too cautious if there is a PID file left but there should not be any harm in trying to start the same process twice when in doubt because after all only one can bind to the same port at a time. Signed-off-by: Michael Tremer commit fa429bcca8f156125181667fba75b2dfd13c7281 Author: Michael Tremer Date: Tue Jul 8 10:44:30 2025 +0200 ovpnmain.cgi: Accept an empty value for ENABLED Signed-off-by: Michael Tremer commit 3bbf7b6e2919bf054af1d6c924522f889142ba91 Author: Michael Tremer Date: Tue Jul 8 10:42:36 2025 +0200 ovpnmain.cgi: Fix broken headline in N2N crypto section Signed-off-by: Michael Tremer commit eed199788837a54f739d567afe225abe02b0012f Author: Michael Tremer Date: Tue Jul 8 10:38:44 2025 +0200 Revert "ovpnmain.cgi: Remove yet another "if (1)" statement" This reverts commit 0dcafefb694d4e1ebef317f4d45f68216685ff25. Removing this breaks creating N2N connections and I don't think there is a way to fix this all properly without a major rewrite. Signed-off-by: Michael Tremer commit 56400c89b82ecde90befe4fdda1027cfca707f03 Author: Adolf Belka Date: Mon Jun 30 11:00:30 2025 +0200 services.cgi: Openvpn-2.6 rebase fix pid name for services page Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit 5aebc354310a6cc3b9e9ade5cba02e151c1e6756 Author: Michael Tremer Date: Mon Jun 30 10:41:35 2025 +0200 openvpn: Fix typo in initscript This prevented the authenticator from being shut down gracefully. https://lists.ipfire.org/development/1396727E-BF73-4015-B853-B3F854806B28@ipfire.org/T/#m41dd73643dc6fa0dd6d187f59f72277f9c5d072f Reported-by: Adolf Belka Signed-off-by: Michael Tremer commit 8ff821076e5bd610e747fef4b5c32eae3e744021 Author: Michael Tremer Date: Thu Jun 19 16:49:22 2025 +0200 ovpnmain.cgi: Accept empty input for ENABLED Signed-off-by: Michael Tremer commit 8e58e852163e636f4edf99a6c6419a8e3330113a Author: Stefan Schantl Date: Thu Jun 19 16:47:50 2025 +0200 ovpnmain.cgi: Make checkboxes unselectable Signed-off-by: Michael Tremer commit 07c05baff8f4c76d00dcbe9d6a120330131bb4ea Author: Michael Tremer Date: Tue Jun 3 17:04:50 2025 +0200 ovpnmain.cgi: Only load status when the server is running Otherwise we would show the status if the service is no longer running and show clients as connected which have only been connected when the server was stopped. Signed-off-by: Michael Tremer commit 3a9b321e3afc6cdbc0eb355d626f2a8fe8db3ce3 Author: Michael Tremer Date: Tue Jun 3 16:21:12 2025 +0200 ovpnmain.cgi: Fix reading the current status file again Signed-off-by: Michael Tremer commit 829d3f4f617c6bfcb2de7a178a171dec7a28a49f Author: Michael Tremer Date: Tue Jun 3 16:10:53 2025 +0200 ovpnmain.cgi: Remove more dead code Signed-off-by: Michael Tremer commit ed66fe66298734b0ecde91ff478eb814f8b0a099 Author: Michael Tremer Date: Tue Jun 3 16:08:45 2025 +0200 ovpnmain.cgi: Fix path to the RW PID file Signed-off-by: Michael Tremer commit 26034a80ffbaafcb78e6514868159a561594cf1f Author: Michael Tremer Date: Tue Jun 3 16:06:03 2025 +0200 ovpnmain.cgi: Use the helper binary to read the status log Signed-off-by: Michael Tremer commit ffe75e4767846f72bac49db6a2ba7274905d8d9d Author: Michael Tremer Date: Tue Jun 3 12:44:33 2025 +0200 ovpnmain.cgi: Log a better message if the RW log file could not be opened Signed-off-by: Michael Tremer commit 5f00c4dd53f403a8fd9c1f044ab1edd21a11a75d Author: Michael Tremer Date: Tue Jun 3 12:40:38 2025 +0200 ovpnmain.cgi: Tell the server the subnet in the old-fashioned way Signed-off-by: Michael Tremer commit 805eb6c1d6244887301fdc5414fafac420404a44 Author: Michael Tremer Date: Tue Jun 3 12:33:44 2025 +0200 ovpnmain.cgi: Remove some dead code This prevented creating new connections and was never being used at all. Signed-off-by: Michael Tremer commit 657998956d6ac7943d3ff3f6a9c65111bb3dcba6 Author: Michael Tremer Date: Tue Jun 3 12:27:28 2025 +0200 Revert "CSS: Make text/number inputs 100% wide, too" This reverts commit f9beaa17f22a191919b2982511d4a4598ffcf81e. This seems to break major parts of the layout on several pages. Signed-off-by: Michael Tremer commit 693a13928d95fa3e6d73c841f70b4f3eec9d78e8 Author: Michael Tremer Date: Tue Jun 3 12:25:38 2025 +0200 CSS: Fix merge error Signed-off-by: Michael Tremer commit 6d1abf3856ce9908089662cd35552f74ebafb941 Author: Michael Tremer Date: Tue Jun 3 09:27:03 2025 +0000 openvpn: Update to 2.6.14 Signed-off-by: Michael Tremer commit 956a69fdbeefbb681b3f6a76d3aedaae4f6d1539 Author: Adolf Belka Date: Sun Dec 8 12:23:30 2024 +0100 openvpn: Update to version 2.6.12 Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer commit c5c19b5e0cee738a9adae9805133725b5f181892 Author: Michael Tremer Date: Tue Apr 16 15:03:13 2024 +0200 ovpnmain.cgi: Implement a better way to set defaults Signed-off-by: Michael Tremer commit 77e2d1bfc81072d6958d709e083aad480ded1814 Author: Michael Tremer Date: Tue Apr 16 14:18:39 2024 +0200 ovpnmain.cgi: Load the main settings just once Signed-off-by: Michael Tremer commit 3c508e008fc3b1395123d4e4a57b6a4a18c27041 Author: Michael Tremer Date: Tue Apr 16 14:13:32 2024 +0200 ovpnmain.cgi: Use the same hash for the configuration like everywhere else Signed-off-by: Michael Tremer commit 5acb54c2679e8140372f56de2078463c2467ecff Author: Michael Tremer Date: Tue Apr 16 14:01:31 2024 +0200 ovpnmain.cgi: Restart instead of reload The option to reload the server does not seem to work well. The running is process is performing a number of checks that make very little sense and PID files get written by the user that launches the process (i.e. root) instead of the user that the process is running as later on (i.e. nobody). Since there is no chance to keep any existing connections alive this way, we may just as well restart the service for now. Signed-off-by: Michael Tremer commit eb1b0ed1bf60f211d1f7da446542680f7f07e1c1 Author: Michael Tremer Date: Tue Apr 16 14:00:35 2024 +0200 openvpn-rw: Use a sensible name for the PID file Signed-off-by: Michael Tremer commit 1b59f600e04aebd812026a4870fab2b7dd91043e Author: Michael Tremer Date: Tue Apr 16 13:58:47 2024 +0200 ovpnmain.cgi: Give the status log a more sensible name Signed-off-by: Michael Tremer commit e85939b2e0a9d6dd8522384459549452e4ee45fb Author: Michael Tremer Date: Tue Apr 16 13:25:30 2024 +0200 ovpnmain.cgi: Explicitly notify clients that the server is going down Signed-off-by: Michael Tremer commit 0ad27c8f9a59c171319d14b958fca6ecd6b43023 Author: Michael Tremer Date: Tue Apr 16 13:20:02 2024 +0200 i18n: Update note on the file format of the OpenVPN client configuration Signed-off-by: Michael Tremer commit d447db574723bcf98b2655e1b24af58e1be45ab1 Author: Michael Tremer Date: Thu Apr 11 22:29:09 2024 +0200 ovpnmain.cgi: Refactor top table of adding/creating connections Signed-off-by: Michael Tremer commit 3b100d3ad98ed5c51b2cccb8c050f5c798cf1a83 Author: Michael Tremer Date: Thu Apr 11 22:15:51 2024 +0200 ovpnmain.cgi: Remove yet another "if (1)" statement Signed-off-by: Michael Tremer commit 599e85983e63ff933f7d7a621a101f0af5729b60 Author: Michael Tremer Date: Thu Apr 11 22:10:23 2024 +0200 ovpnmain.cgi: Refactor connection statistics page No functional changes Signed-off-by: Michael Tremer commit ea1a3a5afa75a402d13705627ddd16bce096a802 Author: Michael Tremer Date: Thu Apr 11 21:42:16 2024 +0200 ovpnmain.cgi: Remove ns-cert-type server This option has been removed in OpenVPN 2.5. We do not support anything prior to that. Signed-off-by: Michael Tremer commit 0fc1af8a4adfa93685808e4ddf1a2be4c03ecb76 Author: Michael Tremer Date: Thu Apr 11 21:40:55 2024 +0200 ovpnmain.cgi: Remove unnecessary client configuration options We should send the most minimal configuration so that we do not overwrite any sensible defaults. Signed-off-by: Michael Tremer commit 8f3b80cc4cb650b0ac49dca10ee441aeaef7338f Author: Michael Tremer Date: Thu Apr 11 21:24:22 2024 +0200 ovpnmain.cgi: Fix spacing in client configuration file Signed-off-by: Michael Tremer commit 3aec750ad797be05abee92044d90c2cbfb0e0a8e Author: Michael Tremer Date: Thu Apr 11 21:22:15 2024 +0200 ovpnmain.cgi: Use LF only without CR for config files Fixes: #13355 Signed-off-by: Michael Tremer commit b13fb3dfc4ee6bdafe1ea3b38418f01fb6d90ddb Author: Michael Tremer Date: Thu Apr 11 21:20:01 2024 +0200 ovpnmain.cgi: Remove the ZIP container around configuration files Since we can now include everything in one file, there is no need to put it in a ZIP container. Signed-off-by: Michael Tremer commit c98529a671cb519e8dfb09d922cd20fdac398de5 Author: Michael Tremer Date: Thu Apr 11 21:12:54 2024 +0200 ovpnmain.cgi: Remove the "insecure" client package Signed-off-by: Michael Tremer commit c5d891d672ede1eda988f931977bbf408a1ddccc Author: Michael Tremer Date: Thu Apr 11 21:02:33 2024 +0200 ovpnmain.cgi: Include the PKCS12 certificate on config export Before, OpenVPN did not support PKCS12 files in an embedded format. We extracted the key and the certificate in PEM format instead. This is no longer necessary and therefore we can simply include the file. Signed-off-by: Michael Tremer commit 57f95cc2ea0f06336f2c0cbad5d65cb57ae3dab1 Author: Michael Tremer Date: Wed Apr 10 17:49:01 2024 +0200 ovpnmain.cgi: Reindent generating the client configuration There are no functional changes. Signed-off-by: Michael Tremer commit 2649f62b5336d32725e4d5e2e0ad8972daefdca2 Author: Michael Tremer Date: Wed Apr 10 17:14:07 2024 +0200 ovpnmain.cgi: Refactor CCD pool configuration Signed-off-by: Michael Tremer commit 0bc717f598bbe9a3fa66a05ec8af76baf36c703d Author: Michael Tremer Date: Wed Apr 10 15:52:06 2024 +0200 ovpnmain.cgi: Remove code to restart a connection This could not be triggered. Signed-off-by: Michael Tremer commit 5b41f47b8ee302b86295aa5a3917037c6ab05fd3 Author: Michael Tremer Date: Wed Apr 10 15:43:32 2024 +0200 ovpnmain.cgi: Refactor the connection listing Signed-off-by: Michael Tremer commit 6aff5b8104cc55d36b2446c328cb74f821b76ecb Author: Michael Tremer Date: Wed Apr 10 14:11:27 2024 +0200 ovpnmain.cgi: Enable legacy provider for auths, too Signed-off-by: Michael Tremer commit 2271d043c4d62eb30876b60aec8f1150e8897ffa Author: Michael Tremer Date: Wed Apr 10 14:03:30 2024 +0200 ovpnmain.cgi: Load the OpenSSL legacy provider if required Signed-off-by: Michael Tremer commit 460942d7ed28ebf8c7727faa6321b63ee1c56964 Author: Michael Tremer Date: Wed Apr 10 12:55:47 2024 +0200 ovpnmain.cgi: Move "ROUTE_PUSH" settings into the main settings file Signed-off-by: Michael Tremer commit b4b89379ab94eff031b0b02253fe027897861122 Author: Michael Tremer Date: Wed Apr 10 12:34:45 2024 +0200 ovpnmain.cgi: Fix checking custom routes Signed-off-by: Michael Tremer commit 29097cef3ffc786a7b1ef3d99ae6f9e0f43f2f55 Author: Michael Tremer Date: Tue Apr 9 19:49:30 2024 +0200 ovpnmain.cgi: Reload the server after changing advanced settings Signed-off-by: Michael Tremer commit e3834fd8376e7a00be156549bf6c7b7ea710ffa4 Author: Michael Tremer Date: Tue Apr 9 19:45:45 2024 +0200 ovpnmain.cgi: Remove more unused variables Signed-off-by: Michael Tremer commit c71aa190c8b571f98bfede8e0c96a67e5fcb8a03 Author: Michael Tremer Date: Tue Apr 9 19:41:59 2024 +0200 ovpnmain.cgi: Refactor the entire advanced settings page There are no functional changes. Signed-off-by: Michael Tremer commit decc7e0c4a7f813687fed5dc75995a6f0f4ff59a Author: Michael Tremer Date: Tue Apr 9 19:23:18 2024 +0200 CSS: Don't make headings so skinny Signed-off-by: Michael Tremer commit 285be5bb34742be60a01f9eb17e56c0a5584c75a Author: Michael Tremer Date: Tue Apr 9 19:08:25 2024 +0200 ovpnmain.cgi: Remove "additional configs" Signed-off-by: Michael Tremer commit 7d5d319b5075595c35d99b06b008b4994e7ce7c4 Author: Michael Tremer Date: Tue Apr 9 19:04:58 2024 +0200 ovpnmain.cgi: Remove client-to-client This is a potential security issue. See #13636. Signed-off-by: Michael Tremer commit a188dd85fe083e9b6fd8f0ddf7687350ee5ed40c Author: Michael Tremer Date: Tue Apr 9 19:02:22 2024 +0200 ovpnmain.cgi: Hard-code keepalive packets Signed-off-by: Michael Tremer commit 057f781b87d87eda6abf9df12d41e0abbcb3dcb8 Author: Michael Tremer Date: Tue Apr 9 18:58:51 2024 +0200 ovpnmain.cgi: Hard-code "verb 3" There is no reason why users will need to change this. Signed-off-by: Michael Tremer commit dcbafa72e6fde4eecb4b18411aaf1008fbc7acf6 Author: Michael Tremer Date: Tue Apr 9 18:54:30 2024 +0200 ovpnmain.cgi: Improve wording for RW settings Signed-off-by: Michael Tremer commit cba980f4b369dbd1e745f944c9c2eaa7791c2702 Author: Michael Tremer Date: Tue Apr 9 18:38:26 2024 +0200 initscripts: Manually load the tun module for OpenVPN The server cannot load the module itself. Signed-off-by: Michael Tremer commit c33a0374a53968bc9cfab5f21b18ecf8619111e7 Author: Michael Tremer Date: Tue Apr 9 18:36:56 2024 +0200 ovpnmain.cgi: Remove manual start/stop actions Signed-off-by: Michael Tremer commit 9b2035a8265e58fd15a329c52301ba28860985c8 Author: Michael Tremer Date: Tue Apr 9 18:25:47 2024 +0200 ovpnmain.cgi: Redesign the roadwarrior section Signed-off-by: Michael Tremer commit f560e558d839b4d007d8a8d03f484ca36304c7d1 Author: Michael Tremer Date: Tue Apr 9 18:25:11 2024 +0200 CSS: Make text/number inputs 100% wide, too Signed-off-by: Michael Tremer commit 2862417617ab134600c18ebdfccef0288f68d506 Author: Michael Tremer Date: Tue Apr 9 18:09:37 2024 +0200 ovpnmain.cgi: Only allow removing X.509 when the server is not enabled Signed-off-by: Michael Tremer commit fe5e31568be0758ec27b12a87f75640bc1bef813 Author: Michael Tremer Date: Tue Apr 9 18:08:33 2024 +0200 ovpnmain.cgi: Remove left-over code Signed-off-by: Michael Tremer commit c620343fe4a890e5e497c6a7696d1382485e9467 Author: Michael Tremer Date: Tue Apr 9 18:08:06 2024 +0200 ovpnmain.cgi: Move destination port to advanced settings Signed-off-by: Michael Tremer commit 9edd392855a89de1ab9420a56192db7259eb50b5 Author: Michael Tremer Date: Tue Apr 9 18:00:48 2024 +0200 ovpnmain.cgi: Move MTU setting to advanced settings Signed-off-by: Michael Tremer commit 7a28cc59aee870bcee3ec59928f694a8531e5e11 Author: Michael Tremer Date: Tue Apr 9 17:52:37 2024 +0200 ovpnmain.cgi: Move protocol setting to advanced settings Signed-off-by: Michael Tremer commit 364a2b619ce08f85b7dd332e9d15e7177e3b5ce2 Author: Michael Tremer Date: Tue Apr 9 17:45:46 2024 +0200 ovpnmain.cgi: Remove the old status indicator Signed-off-by: Michael Tremer commit f5a05cdb55bde74b9f98036b12d808e630fa6961 Author: Michael Tremer Date: Sat Mar 23 20:09:34 2024 +0100 vulnerabilities.cgi: Use section Signed-off-by: Michael Tremer commit c0ef1cf560af98f17fcfdee13b7ff3b533c029fe Author: Michael Tremer Date: Sat Mar 23 19:57:49 2024 +0100 vulnerabilities.cgi: Use CSS to colour the table Signed-off-by: Michael Tremer commit 4c85492195a84146a0c1908f709cf0b566b35a22 Author: Michael Tremer Date: Sat Mar 23 19:12:26 2024 +0100 web: Explain memory consumption Signed-off-by: Michael Tremer commit a78cc8d035ef777fa04d9259ef6809841b04394f Author: Michael Tremer Date: Sat Mar 23 19:06:31 2024 +0100 tor.cgi: Use new service function Signed-off-by: Michael Tremer commit 0a3766e0c68e6b7a43781d0643c2f726ec147b34 Author: Michael Tremer Date: Sat Mar 23 19:00:49 2024 +0100 CSS: Automatically stripe all tables Signed-off-by: Michael Tremer commit 1e495925985bb4250352c041a131764b8bdc73a3 Author: Michael Tremer Date: Sat Mar 23 18:42:13 2024 +0100 web: Create a function to show the service status Signed-off-by: Michael Tremer commit 2241dbeff064dc5ece2d7c5988dbed69d2b87603 Author: Michael Tremer Date: Sat Mar 23 17:01:14 2024 +0100 ovpnmain.cgi: Use global ethernet settings Signed-off-by: Michael Tremer commit befe483f8301b6ef2b59da742ca18946b21f13b4 Author: Michael Tremer Date: Sat Mar 23 15:33:55 2024 +0100 OpenVPN: Rename "Global Settings" to "Roadwarrior Settings" Signed-off-by: Michael Tremer commit 86365ab34da492a0b7de928376dab86d5879b0b7 Author: Michael Tremer Date: Sat Mar 23 15:32:36 2024 +0100 make.sh: Update language files Signed-off-by: Michael Tremer commit 37af5ae84d361ee9eb346e53ea7c185dff2ca406 Author: Michael Tremer Date: Sat Mar 23 15:29:27 2024 +0100 initscripts: Silence error messages when testing if a process is running Signed-off-by: Michael Tremer commit bb192daff6d8fb856c8eab66cadace15cf3a97aa Author: Michael Tremer Date: Sat Mar 23 15:03:36 2024 +0100 openvpnctrl: Rewrite the entire thing This binary because a major headache as it has been changed so many times by so many people neglegting the code quality. Therefore, the logic has now been moved into initscripts and the binary changed so that it only serves as a SUID wrapper to call the initscripts. Signed-off-by: Michael Tremer commit 23fd2f1efbaa843c4253506de416200145ea5fe7 Author: Michael Tremer Date: Sat Mar 23 15:00:18 2024 +0100 initscripts: Call the initscript to create firewall rules Signed-off-by: Michael Tremer commit fbbb8e4508fb0aa077eb7a68e24274b49057c3a7 Author: Michael Tremer Date: Sat Mar 23 14:57:19 2024 +0100 initscripts: No longer restart OpenVPN when RED comes up/goes down This is probably a relic from when dial-up connections where on trend and systems were offline for long times of the day. Now, we should always be on and there is no need to restart all those services on a reconnect. Signed-off-by: Michael Tremer commit d3af28a489ff1bd4601b031069681431efc73818 Author: Michael Tremer Date: Sat Mar 23 14:43:46 2024 +0100 openvpn-n2n: Implement deleting RRD databases Signed-off-by: Michael Tremer commit 3ad7c624e960227361847927e9d5bc9d968af1a7 Author: Michael Tremer Date: Sat Mar 23 14:39:30 2024 +0100 openvpn: Add an initscript for N2N connections Signed-off-by: Michael Tremer commit cee76ccca3b8420363f61c17baa05bdea6136e49 Author: Michael Tremer Date: Thu Mar 21 18:08:31 2024 +0100 openvpnctrl: Remove the stuff we no longer need Signed-off-by: Michael Tremer commit 3cdb4766fb6cbbc4c7245ff7edf571f4da300814 Author: Michael Tremer Date: Thu Mar 21 18:05:51 2024 +0100 initscripts: Start the OpenVPN Authenticator, too Signed-off-by: Michael Tremer commit ec4de6703d6715e12b6113bd07fb0e2fc9b77ae6 Author: Michael Tremer Date: Thu Mar 21 17:58:46 2024 +0100 initscripts: Add an initscript for OpenVPN RW Signed-off-by: Michael Tremer commit 1b81e5e2d306c5004bd29df752a8c02aa3cc21bf Author: Michael Tremer Date: Thu Mar 21 16:51:39 2024 +0100 firewall: Split OpenVPN INPUT chains for RW & N2N Signed-off-by: Michael Tremer commit 1eea39ff44cc981a29cc2a6d940a7cf1c74b3b4e Author: Michael Tremer Date: Thu Mar 21 16:47:21 2024 +0100 ovpnmain.cgi: Remove option to enable on ORANGE/BLUE There is no point in not making this service available to any local networks when it always has to be reachable from the Internet. This still has to be reflected in the initscripts Signed-off-by: Michael Tremer commit a6cb61553527bb700cc7960ab30d6644af17fffd Author: Michael Tremer Date: Wed Mar 20 20:38:52 2024 +0100 ovpnmain.cgi: Migrate to subnet topology For dynamic pools, this change is easy and does not require any extra steps. For CCD clients however, we need to update the configuration to replace the server IP address with the subnet mask. Signed-off-by: Michael Tremer commit d8fa0cea30ed2b83d6353a4f432ee8f6b0c8c258 Author: Michael Tremer Date: Wed Mar 20 17:34:00 2024 +0100 ovpnmain.cgi: Create functions to read CCD client/server routes Signed-off-by: Michael Tremer commit fdcd1daa197f22d90c35eae6c86dd2a99a8ad4f3 Author: Michael Tremer Date: Wed Mar 20 17:33:14 2024 +0100 ovpnmain.cgi: Remove comment that a restart is required This is incorrect as we can change CCD data without restarting the server. Signed-off-by: Michael Tremer commit 04b453725355aec3f440249b4a0c7e0595b9069a Author: Michael Tremer Date: Wed Mar 20 17:20:16 2024 +0100 ovpnmain.cgi: Refactor writing CCD files Signed-off-by: Michael Tremer commit 41c81273c8681cd2410f1171fd91d696a6fe743d Author: Michael Tremer Date: Wed Mar 20 14:56:20 2024 +0100 ovpnmain.cgi: Drop validdotmask() This is a totally braindead function that prevented some basic usability by using the more modern prefix notation. It simply checks if there is a freaking dot. Great! Signed-off-by: Michael Tremer commit a25d5d3ab1fbd486d91f967dfab3d3fa9e8c2a98 Author: Michael Tremer Date: Wed Mar 20 14:45:14 2024 +0100 ovpnmain.cgi: Drop hostsinnet This is no longer needed as we can use the function that lists all addresses that are in use and count them. Signed-off-by: Michael Tremer commit fb171334fd2482471c5b8cc334c0369ee2fd7bc9 Author: Michael Tremer Date: Wed Mar 20 14:42:27 2024 +0100 ovpnmain.cgi: Refactor listing CCD addresses Signed-off-by: Michael Tremer commit 2bb7a36a8f7623bbd5aeb2ee2e4dbba2485d1725 Author: Michael Tremer Date: Wed Mar 20 12:32:22 2024 +0100 ovpnmain.cgi: Refactor ccdmaxclients() Signed-off-by: Michael Tremer commit 1e28ce55ff6b87f6aa207b01403801ab0d480090 Author: Michael Tremer Date: Wed Mar 20 12:25:58 2024 +0100 ovpnmain.cgi: Refactor modccnet() Signed-off-by: Michael Tremer commit e2120486c7bb14cd579560c1687f8cad5b449774 Author: Michael Tremer Date: Wed Mar 20 12:12:00 2024 +0100 ovpnmain.cgi: Refactor addccdnet() Signed-off-by: Michael Tremer commit 60caf9635d0515d4aa73913d6945bf956de0256b Author: Michael Tremer Date: Wed Mar 20 11:36:23 2024 +0100 ovpnmain.cgi: Move function to check CCD names here This was in general-functions.pl for some reason. Signed-off-by: Michael Tremer commit fb10f9949011fae5d0f2101602e443b3d380f8ff Author: Michael Tremer Date: Wed Mar 20 11:33:16 2024 +0100 ovpnmain.cgi: Refactor function to remove a static pool Signed-off-by: Michael Tremer commit bfa6d0740ec7b12468ba03547b2c5be3a9a2bd42 Author: Michael Tremer Date: Wed Mar 20 11:21:58 2024 +0100 ovpnmain.cgi: Remove enabled marker files Nothing is using these any more. Signed-off-by: Michael Tremer commit 07481d357af0118e1aaf88d46c00b758419606c3 Author: Michael Tremer Date: Wed Mar 20 11:15:18 2024 +0100 ovpnmain.cgi: Remove any left-over traces of DH replacement Since there is no way for the user to manipulate this any more, there is no point in checking and showing the DH parameters. Signed-off-by: Michael Tremer commit b769ba05e7f8fa2ece154e8eb9b37f1603276f01 Author: Michael Tremer Date: Wed Mar 20 11:12:37 2024 +0100 ovpnmain.cgi: Remove excess whitespace Signed-off-by: Michael Tremer commit e017336a1f61cf6818afbba143fd5221973747e4 Author: Michael Tremer Date: Wed Mar 20 11:09:39 2024 +0100 ovpnmain.cgi: Remove more dead code Signed-off-by: Michael Tremer commit cd1f918e4dce1694bb0449afbe42c02c585b0b21 Author: Michael Tremer Date: Tue Mar 19 20:44:18 2024 +0100 ovpnmain.cgi: Force NCP on clients This change requires that all clients support NCP if they are set up with a new connection. Existing clients remain supported using the fallback cipher option. This will result that connections with OpenVPN <= 2.3 cannot be set up any more which is totally fine since that version is EOL. Signed-off-by: Michael Tremer commit fe09cf897a725783e2be31360a785a878dd5629c Author: Michael Tremer Date: Tue Mar 19 19:14:26 2024 +0000 openvpn: Update to 2.6.9 Signed-off-by: Michael Tremer commit d7923ad1556c5d75c0a488b48bcb5c786e618055 Author: Michael Tremer Date: Tue Mar 19 20:11:31 2024 +0100 ovpnmain.cgi: Completely remove compression for RW clients We will use the "compress migrate" option which disables compression by default. If a client has been found that wants to use compression, the server will push "stub-v2" to disable it. If that does not work, the server might fall back to compression. Signed-off-by: Michael Tremer commit ab5af7d868b30eb062e456a9482b1a6d3dddc571 Author: Michael Tremer Date: Tue Mar 19 19:32:50 2024 +0100 ovpnmain.cgi: Implement cipher negotiation for RW clients Signed-off-by: Michael Tremer commit 08837a72823efbb01f00b92b901e01fe87393a71 Author: Michael Tremer Date: Tue Mar 19 18:38:34 2024 +0100 ovpnmain.cgi: Remove presetting removed options Signed-off-by: Michael Tremer commit 74eac5db4937392ba13ff05d60edd8b222417839 Author: Michael Tremer Date: Tue Mar 19 18:37:45 2024 +0100 ovpnmain.cgi: Remove dead code Signed-off-by: Michael Tremer commit f990fe0142d8ddaf05f2aae3a408ac001721c273 Author: Michael Tremer Date: Tue Mar 19 18:37:24 2024 +0100 ovpnmain.cgi: Use SHA512 for hashing by default Signed-off-by: Michael Tremer commit 7f5f1321128d4bd206fca4c0c6024bfd42260b6c Author: Michael Tremer Date: Tue Mar 19 18:36:42 2024 +0100 ovpnmain.cgi: Keep the fallback cipher disabled by default Signed-off-by: Michael Tremer commit 7b4a35c98a4b098872a6a44b0817540b3164f1f1 Author: Michael Tremer Date: Tue Mar 19 18:32:25 2024 +0100 ovpnmain.cgi: Allow to disable the fallback cipher Signed-off-by: Michael Tremer commit a049b157b848bfb0dbbccc582f1307e366d52bee Author: Michael Tremer Date: Tue Mar 19 18:26:27 2024 +0100 ovpnmain.cgi: Rename cipher selection to fallback cipher This is to keep ancient clients and clients that have NCP disabled happy. Signed-off-by: Michael Tremer commit 8a0868594526403a802c51151882dc887c446576 Author: Michael Tremer Date: Tue Mar 19 18:04:20 2024 +0100 lang: Update because of OpenVPN changes Signed-off-by: Michael Tremer commit 2208a0f85f966981acb11a17f739e9a11c53a427 Author: Michael Tremer Date: Tue Mar 19 18:02:17 2024 +0100 CSS: Make all - - - -
- - - - + print < + $name + +END + } - - - + print < + + + + + + + + + + + + + + + + + + + + + + + + + +
$Lang::tr{'misc-options'}
+ $Lang::tr{'ovpn ha'} + + +
+ $Lang::tr{'ovpn tls auth'} + + +
+ $Lang::tr{'ovpn fallback cipher'} + + +
+ $Lang::tr{'ovpn fallback cipher help'} +
+ +
$Lang::tr{'ovpn dhcp settings'}
+ + + + + + + + + + + + + + +
Domain + +
DNS + +
WINS + +
+ +
$Lang::tr{'ovpn routing settings'}
+ + + + + + + + + + + +
$Lang::tr{'ovpn push default route'} + +
$Lang::tr{'ovpn routes push'} + +
+ +
$Lang::tr{'ovpn misc settings'}
+ + + + + + + + + + +
Max-Clients + +
+ + +
+END - - Client-To-Client - - + &Header::closesection(); + &Header::closebigbox(); - - Redirect-Gateway def1 - - + &Header::closepage(); + exit(0); - $Lang::tr{'comp-lzo'} - - $Lang::tr{'openvpn default'}: off ($Lang::tr{'attention'} exploitable via Voracle) - - - $Lang::tr{'ovpn add conf'} - - $Lang::tr{'openvpn default'}: off - +# Add, delete or edit CCD net - - mssfix - - $Lang::tr{'openvpn default'}: off - +} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} || + $cgiparams{'ACTION'} eq "ccd-add" || + $cgiparams{'ACTION'} eq "ccd-delete" || + $cgiparams{'ACTION'} eq "ccd-edit" || + $cgiparams{'ACTION'} eq 'ccd-edit-save'){ + &Header::showhttpheaders(); - - fragment
- - + &Header::openpage($Lang::tr{'ccd net'}, 1, ''); + &Header::openbigbox('100%', 'LEFT', '', ''); - - Max-Clients - - - - Keepalive
- (ping/ping-restart) - - - - + # Delete? + if ($cgiparams{'ACTION'} eq "ccd-delete") { + $errormessage = &delccdnet($cgiparams{'name'}); -
- - - - - - - + # Save after edit? + } elsif ($cgiparams{'ACTION'} eq 'ccd-edit-save') { + $errormessage = &modccdnet($cgiparams{'subnet'}, $cgiparams{'name'}); - - -
$Lang::tr{'log-options'}
VERB
+ # Clear inputs + if ($errormessage eq "") { + $cgiparams{"name"} = ""; + $cgiparams{"subnet"} = ""; + } -
-END + # Add? + } elsif ($cgiparams{'ACTION'} eq "ccd-add") { + $errormessage = &addccdnet($cgiparams{'name'}, $cgiparams{'subnet'}); -if ( -e "/var/run/openvpn.pid"){ -print"
$Lang::tr{'attention'}:
- $Lang::tr{'server restart'}

-
"; - print< - -   - - -   - - - -END -; + # Clear inputs + if ($errormessage eq "") { + $cgiparams{"name"} = ""; + $cgiparams{"subnet"} = ""; + } + } + &Header::errorbox($errormessage); -}else{ + my %ccdconfhash = (); + &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); - print< - -   - - -   - - - -END -; -} - &Header::closebox(); -# print ""; - &Header::closebigbox(); - &Header::closepage(); - exit(0); + &Header::opensection(); + print < + + + $Lang::tr{'ccd name'} + + + $Lang::tr{'network'} + -# A.Marx CCD Add,delete or edit CCD net + + $Lang::tr{'ccd used'} + -} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'ccd net'} || - $cgiparams{'ACTION'} eq $Lang::tr{'ccd add'} || - $cgiparams{'ACTION'} eq "kill" || - $cgiparams{'ACTION'} eq "edit" || - $cgiparams{'ACTION'} eq 'editsave'){ - &Header::showhttpheaders(); - &Header::openpage($Lang::tr{'ccd net'}, 1, ''); - &Header::openbigbox('100%', 'LEFT', '', ''); + + +END - if ($cgiparams{'ACTION'} eq "kill"){ - &delccdnet($cgiparams{'net'}); - } + foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) { + my $name = $ccdconfhash{$key}[0]; + my $subnet = $ccdconfhash{$key}[1]; - if ($cgiparams{'ACTION'} eq 'editsave'){ - my ($a,$b) =split (/\|/,$cgiparams{'ccdname'}); - if ( $a ne $b){ &modccdnet($a,$b);} - $cgiparams{'ccdname'}=''; - $cgiparams{'ccdsubnet'}=''; - } + my $ccdhosts = scalar &get_addresses_in_use($subnet); + my $maxhosts = &ccdmaxclients($subnet); - if ($cgiparams{'ACTION'} eq $Lang::tr{'ccd add'}) { - &addccdnet($cgiparams{'ccdname'},$cgiparams{'ccdsubnet'}); - } - if ($errormessage) { - &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'}); - print "$errormessage"; - print " "; - &Header::closebox(); + print < + + $name + + + + $subnet + + + + ${ccdhosts}/${maxhosts} + + + +
+ + + + +
+ + + +
+ + + +
+ + +END } -if ($cgiparams{'ACTION'} eq "edit"){ + print ""; + &Header::closesection(); + + &Header::openbox('100%', 'LEFT', + ($cgiparams{'ACTION'} eq "ccd-edit") ? $Lang::tr{'ccd modify'} : $Lang::tr{'ccd add'}); - &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd modify'}); + # The subnet cannot be edited + my $readonly = ($cgiparams{'ACTION'} eq "ccd-edit") ? "readonly" : ""; + my $action = ($cgiparams{'ACTION'} eq "ccd-edit") ? "ccd-edit-save" : "ccd-add"; print < -
- $Lang::tr{'ccd name'}: - $Lang::tr{'ccd subnet'}: -
- - -
+
+ + + + + + + + + + + + + + +
$Lang::tr{'ccd name'} + +
$Lang::tr{'ccd subnet'} + +
+ + +
+
END -; &Header::closebox(); - &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} ); - print < - - $Lang::tr{'ccd name'}$Lang::tr{'network'}$Lang::tr{'ccd used'} -END -; -} -else{ - if (! -e "/var/run/openvpn.pid"){ - &Header::openbox('100%', 'LEFT', $Lang::tr{'ccd add'}); print < -
- $Lang::tr{'ccd hint'}

- - $Lang::tr{'ccd name'}: - $Lang::tr{'ccd subnet'}: -
- -
+
+ $Lang::tr{'back'} +
END - &Header::closebox(); -} - &Header::openbox('100%', 'LEFT',$Lang::tr{'ccd net'} ); - if ( -e "/var/run/openvpn.pid"){ - print "$Lang::tr{'attention'}:
"; - print "$Lang::tr{'ccd noaddnet'}
"; - } - - print < - - $Lang::tr{'ccd name'}$Lang::tr{'network'}$Lang::tr{'ccd used'} -END -; -} - my %ccdconfhash=(); - &General::readhasharray("${General::swroot}/ovpn/ccd.conf", \%ccdconfhash); - my @ccdconf=(); - my $count=0; - foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) { - @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]); - $count++; - my $ccdhosts = &hostsinnet($ccdconf[0]); - if ($count % 2){ print" ";} - else{ print" ";} - print"$ccdconf[0]$ccdconf[1]$ccdhosts/".(&ccdmaxclients($ccdconf[1])+1).""; - print < - - - - - -
- - - -
-END -; - } - print ""; - &Header::closebox(); - print ""; &Header::closebigbox(); &Header::closepage(); - exit(0); -#END CCD + exit(0); ### ### Openvpn Connections Statistics @@ -2997,111 +3071,136 @@ END &Header::showhttpheaders(); &Header::openpage($Lang::tr{'ovpn con stat'}, 1, ''); &Header::openbigbox('100%', 'LEFT', '', ''); - &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn con stat'}); -# -# $Lang::tr{'protocol'} -# protocol temp removed - print < - - $Lang::tr{'common name'} - $Lang::tr{'real address'} - $Lang::tr{'country'} - $Lang::tr{'virtual address'} - $Lang::tr{'loged in at'} - $Lang::tr{'bytes sent'} - $Lang::tr{'bytes received'} - $Lang::tr{'last activity'} - + &Header::opensection(); + + print < + + $Lang::tr{'common name'} + $Lang::tr{'real address'} + $Lang::tr{'country'} + $Lang::tr{'virtual address'} + $Lang::tr{'loged in at'} + $Lang::tr{'bytes sent'} + $Lang::tr{'bytes received'} + $Lang::tr{'last activity'} + END -; - my $filename = "/var/run/ovpnserver.log"; - open(FILE, $filename) or die 'Unable to open config file.'; + + open(FILE, "/usr/local/bin/openvpnctrl rw log |") or die "Unable to open $RW_STATUS: $!"; my @current = ; close(FILE); - my @users =(); + + my @users = (); my $status; my $uid = 0; - my $cn; my @match = (); - my $proto = "udp"; - my $address; my %userlookup = (); - foreach my $line (@current) - { + + foreach my $line (@current) { chomp($line); - if ( $line =~ /^Updated,(.+)/){ - @match = split( /^Updated,(.+)/, $line); - $status = $match[1]; - } -#gian - if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) { - @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line); - if ($match[1] ne "Common Name") { - $cn = $match[1]; - $userlookup{$match[2]} = $uid; - $users[$uid]{'CommonName'} = $match[1]; - $users[$uid]{'RealAddress'} = $match[2]; - $users[$uid]{'BytesReceived'} = &sizeformat($match[3]); - $users[$uid]{'BytesSent'} = &sizeformat($match[4]); - $users[$uid]{'Since'} = $match[5]; - $users[$uid]{'Proto'} = $proto; - - # get country code for "RealAddress"... - my $ccode = &Location::Functions::lookup_country_code((split ':', $users[$uid]{'RealAddress'})[0]); - my $flag_icon = &Location::Functions::get_flag_icon($ccode); - $users[$uid]{'Country'} = "$ccode"; - $uid++; - } - } - if ( $line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) { - @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line); - if ($match[1] ne "Virtual Address") { - $address = $match[3]; - #find the uid in the lookup table - $uid = $userlookup{$address}; - $users[$uid]{'VirtualAddress'} = $match[1]; - $users[$uid]{'LastRef'} = $match[4]; + + if ($line =~ /^Updated,(.+)/) { + @match = split(/^Updated,(.+)/, $line); + $status = $match[1]; + + } elsif ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) { + @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line); + + # Skip the header + next if ($match[1] eq "Common Name"); + + $userlookup{$match[2]} = $uid; + $users[$uid]{'CommonName'} = $match[1]; + $users[$uid]{'RealAddress'} = $match[2]; + $users[$uid]{'BytesReceived'} = &General::formatBytes($match[3]); + $users[$uid]{'BytesSent'} = &General::formatBytes($match[4]); + $users[$uid]{'Since'} = $match[5]; + + my $address = (split ':', $users[$uid]{'RealAddress'})[0]; + $users[$uid]{'Country'} = &Location::Functions::lookup_country_code($address); + $uid++; + + } elsif ($line =~ /^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/) { + @match = split(m/^(\d+\.\d+\.\d+\.\d+),(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(.+)/, $line); + + # Skip the header + next if ($match[1] eq "Virtual Address"); + + my $address = $match[3]; + #find the uid in the lookup table + $uid = $userlookup{$address}; + $users[$uid]{'VirtualAddress'} = $match[1]; + $users[$uid]{'LastRef'} = $match[4]; } - } } - my $user2 = @users; - if ($user2 >= 1){ - for (my $idx = 1; $idx <= $user2; $idx++){ - if ($idx % 2) { - print ""; - $col="bgcolor='$color{'color22'}'"; - } else { - print ""; - $col="bgcolor='$color{'color20'}'"; - } - print "$users[$idx-1]{'CommonName'}"; - print "$users[$idx-1]{'RealAddress'}"; - print "$users[$idx-1]{'Country'}"; - print "$users[$idx-1]{'VirtualAddress'}"; - print "$users[$idx-1]{'Since'}"; - print "$users[$idx-1]{'BytesSent'}"; - print "$users[$idx-1]{'BytesReceived'}"; - print "$users[$idx-1]{'LastRef'}"; - } + + foreach my $id (keys @users) { + my $user = $users[$id]; + + my $flag_icon = &Location::Functions::get_flag_icon($user->{"Country"}); + + print < + + $user->{"CommonName"} + + + + $user->{"RealAddress"} + + + + + $user->{"Country"} + + + + + $user->{"VirtualAddress"} + + + + $user->{"Since"} + + + + $user->{"BytesSent"} + + + + $user->{"BytesReceived"} + + + + $user->{"LastRef"} + + +END } - print ""; - print < - - - - - $Lang::tr{'the statistics were last updated at'} $status +print < + +

+ $Lang::tr{'the statistics were last updated at'} $status +

END ; - &Header::closebox(); - print ""; + + &Header::closesection(); + + print < + $Lang::tr{'back'} +

+END + &Header::closebigbox(); &Header::closepage(); + exit(0); ### @@ -3127,8 +3226,6 @@ END ### } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'toggle enable disable'}) { - - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); if ($confighash{$cgiparams{'KEY'}}) { @@ -3153,28 +3250,7 @@ END $errormessage = $Lang::tr{'invalid key'}; } -### -### Restart connection -### -} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'restart'}) { - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); - &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - - if ($confighash{$cgiparams{'KEY'}}) { -# if ($vpnsettings{'ENABLED'} eq 'on' || -# $vpnsettings{'ENABLED_BLUE'} eq 'on') { -# system('/usr/local/bin/ipsecctrl', 'S', $cgiparams{'KEY'}); -# } - } else { - $errormessage = $Lang::tr{'invalid key'}; - } - -### -# m.a.d net2net -### - } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'add'} && $cgiparams{'TYPE'} eq '') { - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); &Header::showhttpheaders(); &Header::openpage($Lang::tr{'ovpn'}, 1, ''); &Header::openbigbox('100%', 'LEFT', '', ''); @@ -3219,10 +3295,6 @@ END &Header::closepage(); exit (0); -### -# m.a.d net2net -### - } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) && ($cgiparams{'TYPE'} eq 'net2net')){ my @firen2nconf; @@ -3294,10 +3366,6 @@ END goto N2N_ERROR; } -### -# m.a.d net2net -### - if ($cgiparams{'n2nname'} ne ''){ $uplconffilename2 = "$cgiparams{'n2nname'}.conf"; @@ -3397,10 +3465,6 @@ $n2nauth[1] =~ s/\n|\r//g; chomp ($complzoactive); chomp ($mssfixactive); -### -# m.a.d net2net -### - ### # Check if there is no other entry with this name ### @@ -3558,20 +3622,12 @@ if ($confighash{$cgiparams{'KEY'}}) { $errormessage = $Lang::tr{'invalid key'}; } - -### -# m.a.d net2net -### - - ### ### Adding a new connection ### } elsif (($cgiparams{'ACTION'} eq $Lang::tr{'add'}) || ($cgiparams{'ACTION'} eq $Lang::tr{'edit'}) || ($cgiparams{'ACTION'} eq $Lang::tr{'save'} && $cgiparams{'ADVANCED'} eq '')) { - - &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings); &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash); &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); @@ -3613,7 +3669,7 @@ if ($confighash{$cgiparams{'KEY'}}) { } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) { $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'}); -#A.Marx CCD check iroute field and convert it to decimal +# CCD check iroute field and convert it to decimal if ($cgiparams{'TYPE'} eq 'host') { my @temp=(); my %ccdroutehash=(); @@ -3667,19 +3723,19 @@ if ($cgiparams{'TYPE'} eq 'host') { } #check for existing network IP's - if (&General::IpInSubnet ($ip,$netsettings{GREEN_NETADDRESS},$netsettings{GREEN_NETMASK}) && $netsettings{GREEN_NETADDRESS} ne '0.0.0.0') + if (&General::IpInSubnet ($ip,$Network::ethernet{GREEN_NETADDRESS},$Network::ethernet{GREEN_NETMASK}) && $Network::ethernet{GREEN_NETADDRESS} ne '0.0.0.0') { $errormessage=$Lang::tr{'ccd err green'}; goto VPNCONF_ERROR; - }elsif(&General::IpInSubnet ($ip,$netsettings{RED_NETADDRESS},$netsettings{RED_NETMASK}) && $netsettings{RED_NETADDRESS} ne '0.0.0.0') + }elsif(&General::IpInSubnet ($ip,$Network::ethernet{RED_NETADDRESS},$Network::ethernet{RED_NETMASK}) && $Network::ethernet{RED_NETADDRESS} ne '0.0.0.0') { $errormessage=$Lang::tr{'ccd err red'}; goto VPNCONF_ERROR; - }elsif(&General::IpInSubnet ($ip,$netsettings{BLUE_NETADDRESS},$netsettings{BLUE_NETMASK}) && $netsettings{BLUE_NETADDRESS} ne '0.0.0.0' && $netsettings{BLUE_NETADDRESS} gt '') + }elsif(&General::IpInSubnet ($ip,$Network::ethernet{BLUE_NETADDRESS},$Network::ethernet{BLUE_NETMASK}) && $Network::ethernet{BLUE_NETADDRESS} ne '0.0.0.0' && $Network::ethernet{BLUE_NETADDRESS} gt '') { $errormessage=$Lang::tr{'ccd err blue'}; goto VPNCONF_ERROR; - }elsif(&General::IpInSubnet ($ip,$netsettings{ORANGE_NETADDRESS},$netsettings{ORANGE_NETMASK}) && $netsettings{ORANGE_NETADDRESS} ne '0.0.0.0' && $netsettings{ORANGE_NETADDRESS} gt '' ) + }elsif(&General::IpInSubnet ($ip,$Network::ethernet{ORANGE_NETADDRESS},$Network::ethernet{ORANGE_NETMASK}) && $Network::ethernet{ORANGE_NETADDRESS} ne '0.0.0.0' && $Network::ethernet{ORANGE_NETADDRESS} gt '' ) { $errormessage=$Lang::tr{'ccd err orange'}; goto VPNCONF_ERROR; @@ -3724,22 +3780,20 @@ if ($cgiparams{'TYPE'} eq 'host') { $ccdroute2hash{$keypoint}[0]=$cgiparams{'NAME'}; if ($cgiparams{'IFROUTE'} eq ''){$cgiparams{'IFROUTE'} = $Lang::tr{'ccd none'};} @temp = split(/\|/,$cgiparams{'IFROUTE'}); - my %ownnet=(); - &General::readhash("${General::swroot}/ethernet/settings", \%ownnet); foreach $val (@temp){ chomp($val); $val=~s/\s*$//g; if ($val eq $Lang::tr{'green'}) { - $val=$ownnet{GREEN_NETADDRESS}."/".$ownnet{GREEN_NETMASK}; + $val=$Network::ethernet{GREEN_NETADDRESS}."/".$Network::ethernet{GREEN_NETMASK}; } if ($val eq $Lang::tr{'blue'}) { - $val=$ownnet{BLUE_NETADDRESS}."/".$ownnet{BLUE_NETMASK}; + $val=$Network::ethernet{BLUE_NETADDRESS}."/".$Network::ethernet{BLUE_NETMASK}; } if ($val eq $Lang::tr{'orange'}) { - $val=$ownnet{ORANGE_NETADDRESS}."/".$ownnet{ORANGE_NETMASK}; + $val=$Network::ethernet{ORANGE_NETADDRESS}."/".$Network::ethernet{ORANGE_NETMASK}; } my ($ip,$cidr) = split (/\//, $val); @@ -3779,9 +3833,6 @@ if ($cgiparams{'TYPE'} eq 'host') { } } -#CCD End - - if ($cgiparams{'TYPE'} !~ /^(host|net)$/) { $errormessage = $Lang::tr{'connection type is invalid'}; if ($cgiparams{'TYPE'} eq 'net') { @@ -3820,10 +3871,6 @@ if ($cgiparams{'TYPE'} eq 'host') { goto VPNCONF_ERROR; } -### -# m.a.d net2net -### - if ($cgiparams{'TYPE'} eq 'net') { if ($cgiparams{'DEST_PORT'} eq $vpnsettings{'DDEST_PORT'}) { $errormessage = $Lang::tr{'openvpn destination port used'}; @@ -3876,21 +3923,21 @@ if ($cgiparams{'TYPE'} eq 'net') { goto VPNCONF_ERROR; } - if ( &validdotmask ($cgiparams{'LOCAL_SUBNET'})) { + if (!&Network::check_subnet($cgiparams{'LOCAL_SUBNET'})) { $errormessage = $Lang::tr{'openvpn prefix local subnet'}; unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; goto VPNCONF_ERROR; } - if ( &validdotmask ($cgiparams{'OVPN_SUBNET'})) { + if (!&Network::check_subnet($cgiparams{'OVPN_SUBNET'})) { $errormessage = $Lang::tr{'openvpn prefix openvpn subnet'}; unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; goto VPNCONF_ERROR; } - if ( &validdotmask ($cgiparams{'REMOTE_SUBNET'})) { + if (!&Network::check_subnet($cgiparams{'REMOTE_SUBNET'})) { $errormessage = $Lang::tr{'openvpn prefix remote subnet'}; unlink ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}/$cgiparams{'NAME'}.conf") or die "Removing Configfile fail: $!"; rmdir ("${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}") || die "Removing Directory fail: $!"; @@ -3922,11 +3969,6 @@ if ($cgiparams{'TYPE'} eq 'net') { } } -# if (($cgiparams{'TYPE'} eq 'net') && ($cgiparams{'SIDE'} !~ /^(left|right)$/)) { -# $errormessage = $Lang::tr{'ipfire side is invalid'}; -# goto VPNCONF_ERROR; -# } - # Check if there is no other entry with this name if (! $cgiparams{'KEY'}) { foreach my $key (keys %confighash) { @@ -4008,26 +4050,12 @@ if ($cgiparams{'TYPE'} eq 'net') { } } - if ($cgiparams{'ENABLED'} !~ /^(on|off)$/) { - $errormessage = $Lang::tr{'invalid input'}; - goto VPNCONF_ERROR; - } - if ($cgiparams{'EDIT_ADVANCED'} !~ /^(on|off)$/) { + if ($cgiparams{'ENABLED'} !~ /^(on|off|)$/) { $errormessage = $Lang::tr{'invalid input'}; goto VPNCONF_ERROR; } -#fixplausi - if ($cgiparams{'AUTH'} eq 'psk') { -# if (! length($cgiparams{'PSK'}) ) { -# $errormessage = $Lang::tr{'pre-shared key is too short'}; -# goto VPNCONF_ERROR; -# } -# if ($cgiparams{'PSK'} =~ /['",&]/) { -# $errormessage = $Lang::tr{'invalid characters found in pre-shared key'}; -# goto VPNCONF_ERROR; -# } - } elsif ($cgiparams{'AUTH'} eq 'certreq') { + if ($cgiparams{'AUTH'} eq 'certreq') { if ($cgiparams{'KEY'}) { $errormessage = $Lang::tr{'cant change certificates'}; goto VPNCONF_ERROR; @@ -4056,7 +4084,7 @@ if ($cgiparams{'TYPE'} eq 'net') { $errormessage = "$Lang::tr{'openssl produced an error'}: $?"; unlink ($filename); unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem"); - &newcleanssldatabase(); + &cleanssldatabase(); goto VPNCONF_ERROR; } else { unlink ($filename); @@ -4284,7 +4312,7 @@ if ($cgiparams{'TYPE'} eq 'net') { unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}key.pem"); unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem"); unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}cert.pem"); - &newcleanssldatabase(); + &cleanssldatabase(); goto VPNCONF_ERROR; } else { unlink ("${General::swroot}/ovpn/certs/$cgiparams{'NAME'}req.pem"); @@ -4390,82 +4418,13 @@ if ($cgiparams{'TYPE'} eq 'net') { &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - if ($cgiparams{'CHECK1'} ){ - - my ($ccdip,$ccdsub)=split "/",$cgiparams{$name}; - my ($a,$b,$c,$d) = split (/\./,$ccdip); - if ( -e "${General::swroot}/ovpn/ccd/$confighash{$key}[2]"){ - unlink "${General::swroot}/ovpn/ccd/$cgiparams{'CERT_NAME'}"; - } - open ( CCDRWCONF,'>',"${General::swroot}/ovpn/ccd/$confighash{$key}[2]") or die "Unable to create clientconfigfile $!"; - print CCDRWCONF "# OpenVPN clientconfig from ccd extension by Copymaster#\n\n"; - if($cgiparams{'CHECK1'} eq 'dynamic'){ - print CCDRWCONF "#This client uses the dynamic pool\n"; - }else{ - print CCDRWCONF "#Ip address client and server\n"; - print CCDRWCONF "ifconfig-push $ccdip ". &Network::bin2ip(&Network::ip2bin($ccdip) - 1) ."\n"; - } - if ($confighash{$key}[34] eq 'on'){ - print CCDRWCONF "\n#Redirect Gateway: \n#All IP traffic is redirected through the vpn \n"; - print CCDRWCONF "push redirect-gateway\n"; - } - &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash); - if ($cgiparams{'IR'} ne ''){ - print CCDRWCONF "\n#Client routes these networks (behind Client)\n"; - foreach my $key (keys %ccdroutehash){ - if ($ccdroutehash{$key}[0] eq $cgiparams{'NAME'}){ - foreach my $i ( 1 .. $#{$ccdroutehash{$key}}){ - my ($a,$b)=split (/\//,$ccdroutehash{$key}[$i]); - print CCDRWCONF "iroute $a $b\n"; - } - } - } - } - if ($cgiparams{'IFROUTE'} eq $Lang::tr{'ccd none'} ){$cgiparams{'IFROUTE'}='';} - if ($cgiparams{'IFROUTE'} ne ''){ - print CCDRWCONF "\n#Client gets routes to these networks (behind IPFire)\n"; - foreach my $key (keys %ccdroute2hash){ - if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){ - foreach my $i ( 1 .. $#{$ccdroute2hash{$key}}){ - if($ccdroute2hash{$key}[$i] eq $Lang::tr{'blue'}){ - my %blue=(); - &General::readhash("${General::swroot}/ethernet/settings", \%blue); - print CCDRWCONF "push \"route $blue{BLUE_ADDRESS} $blue{BLUE_NETMASK}\n"; - }elsif($ccdroute2hash{$key}[$i] eq $Lang::tr{'orange'}){ - my %orange=(); - &General::readhash("${General::swroot}/ethernet/settings", \%orange); - print CCDRWCONF "push \"route $orange{ORANGE_ADDRESS} $orange{ORANGE_NETMASK}\n"; - }else{ - my ($a,$b)=split (/\//,$ccdroute2hash{$key}[$i]); - print CCDRWCONF "push \"route $a $b\"\n"; - } - } - } - } - } - if(($cgiparams{'CCD_DNS1'} eq '') && ($cgiparams{'CCD_DNS1'} ne '')){ $cgiparams{'CCD_DNS1'} = $cgiparams{'CCD_DNS2'};$cgiparams{'CCD_DNS2'}='';} - if($cgiparams{'CCD_DNS1'} ne ''){ - print CCDRWCONF "\n#Client gets these nameservers\n"; - print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS1'}\" \n"; - } - if($cgiparams{'CCD_DNS2'} ne ''){ - print CCDRWCONF "push \"dhcp-option DNS $cgiparams{'CCD_DNS2'}\" \n"; - } - if($cgiparams{'CCD_WINS'} ne ''){ - print CCDRWCONF "\n#Client gets this WINS server\n"; - print CCDRWCONF "push \"dhcp-option WINS $cgiparams{'CCD_WINS'}\" \n"; - } - close CCDRWCONF; - } - -### -# m.a.d n2n begin -### + # Rewrite the server configuration + &writeserverconf(); if ($cgiparams{'TYPE'} eq 'net') { if (-e "/var/run/$confighash{$key}[1]n2n.pid") { - &General::system("/usr/local/bin/openvpnctrl", "-kn2n", "$confighash{$cgiparams{'KEY'}}[1]"); + &General::system("/usr/local/bin/openvpnctrl", "n2n", "stop", "$confighash{$cgiparams{'KEY'}}[1]"); &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); my $key = $cgiparams{'KEY'}; @@ -4479,30 +4438,16 @@ if ($cgiparams{'TYPE'} eq 'net') { $confighash{$key}[0] = 'on'; &General::writehasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - &General::system("/usr/local/bin/openvpnctrl", "-sn2n", "$confighash{$cgiparams{'KEY'}}[1]"); + &General::system("/usr/local/bin/openvpnctrl", "n2n", "start", "$confighash{$cgiparams{'KEY'}}[1]"); } } -### -# m.a.d n2n end -### - - if ($cgiparams{'EDIT_ADVANCED'} eq 'on') { - $cgiparams{'KEY'} = $key; - $cgiparams{'ACTION'} = $Lang::tr{'advanced'}; - } goto VPNCONF_END; } else { $cgiparams{'ENABLED'} = 'on'; -### -# m.a.d n2n begin -### $cgiparams{'MSSFIX'} = 'on'; $cgiparams{'FRAGMENT'} = '1300'; - $cgiparams{'DAUTH'} = 'SHA512'; -### -# m.a.d n2n end -### + $cgiparams{'DAUTH'} = 'SHA512'; $cgiparams{'SIDE'} = 'left'; if ( ! -f "${General::swroot}/ovpn/ca/cakey.pem" ) { $cgiparams{'AUTH'} = 'psk'; @@ -4511,7 +4456,7 @@ if ($cgiparams{'TYPE'} eq 'net') { } else { $cgiparams{'AUTH'} = 'certgen'; } - $cgiparams{'LOCAL_SUBNET'} ="$netsettings{'GREEN_NETADDRESS'}/$netsettings{'GREEN_NETMASK'}"; + $cgiparams{'LOCAL_SUBNET'} ="$Network::ethernet{'GREEN_NETADDRESS'}/$Network::ethernet{'GREEN_NETMASK'}"; $cgiparams{'CERT_ORGANIZATION'} = $vpnsettings{'ROOTCERT_ORGANIZATION'}; $cgiparams{'CERT_CITY'} = $vpnsettings{'ROOTCERT_CITY'}; $cgiparams{'CERT_STATE'} = $vpnsettings{'ROOTCERT_STATE'}; @@ -4523,17 +4468,8 @@ if ($cgiparams{'TYPE'} eq 'net') { $checked{'ENABLED'}{'off'} = ''; $checked{'ENABLED'}{'on'} = ''; $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED'; - $checked{'ENABLED_BLUE'}{'off'} = ''; - $checked{'ENABLED_BLUE'}{'on'} = ''; - $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED'; - $checked{'ENABLED_ORANGE'}{'off'} = ''; - $checked{'ENABLED_ORANGE'}{'on'} = ''; - $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED'; - - $checked{'EDIT_ADVANCED'}{'off'} = ''; - $checked{'EDIT_ADVANCED'}{'on'} = ''; - $checked{'EDIT_ADVANCED'}{$cgiparams{'EDIT_ADVANCED'}} = 'CHECKED'; + $checked{'OTP_STATE'}{$cgiparams{'OTP_STATE'}} = 'CHECKED'; $selected{'SIDE'}{'server'} = ''; $selected{'SIDE'}{'client'} = ''; @@ -4576,11 +4512,6 @@ if ($cgiparams{'TYPE'} eq 'net') { $selected{'DCIPHER'}{'CAST5-CBC'} = ''; $selected{'DCIPHER'}{'BF-CBC'} = ''; $selected{'DCIPHER'}{'DES-CBC'} = ''; - # If no cipher has been chossen yet, select - # the old default (AES-256-CBC) for compatiblity reasons. - if ($cgiparams{'DCIPHER'} eq '') { - $cgiparams{'DCIPHER'} = 'AES-256-CBC'; - } $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED'; $selected{'DAUTH'}{'whirlpool'} = ''; $selected{'DAUTH'}{'SHA512'} = ''; @@ -4594,14 +4525,11 @@ if ($cgiparams{'TYPE'} eq 'net') { if (1) { &Header::showhttpheaders(); - &Header::openpage($Lang::tr{'ovpn'}, 1, ''); - &Header::openbigbox('100%', 'LEFT', '', $errormessage); - if ($errormessage) { - &Header::openbox('100%', 'LEFT', $Lang::tr{'error messages'}); - print "$errormessage"; - print " "; - &Header::closebox(); - } + &Header::openpage($Lang::tr{'ovpn'}, 1, ''); + &Header::openbigbox('100%', 'LEFT', '', $errormessage); + + # Show any errors + &Header::errorbox($errormessage); if ($warnmessage) { &Header::openbox('100%', 'LEFT', "$Lang::tr{'warning messages'}:"); @@ -4619,34 +4547,22 @@ if ($cgiparams{'TYPE'} eq 'net') { } &Header::openbox('100%', 'LEFT', "$Lang::tr{'connection'}:"); - print "\n"; - print ""; + my $readonly = ($cgiparams{'KEY'}) ? "readonly" : ""; - if ($cgiparams{'TYPE'} eq 'host') { - if ($cgiparams{'KEY'}) { - print ""; - } else { - print ""; - } -# print ""; -# print ""; -# print <"; - if ($cgiparams{'KEY'}) { - print ""; - } else { - print ""; - } + print < + + + + +END + if ($cgiparams{'TYPE'} eq 'net') { # If GCM ciphers are in usage, HMAC menu is disabled my $hmacdisabled; if (($confighash{$cgiparams{'KEY'}}[40] eq 'AES-256-GCM') || @@ -4720,7 +4636,7 @@ if ($cgiparams{'TYPE'} eq 'net') { - + @@ -4757,7 +4673,6 @@ if ($cgiparams{'TYPE'} eq 'net') { END ; - } #### JAVA SCRIPT #### # Validate N2N cipher. If GCM will be used, HMAC menu will be disabled onchange @@ -4773,17 +4688,50 @@ print< END + } -#jumper - print ""; - print "
$Lang::tr{'name'}: *$cgiparams{'NAME'}
$Lang::tr{'interface'}
$cgiparams{'NAME'}
+ $Lang::tr{'name'} + + +
$Lang::tr{'ovpn crypt options'}:$Lang::tr{'ovpn crypto settings'}:
$Lang::tr{'cipher'}
$Lang::tr{'remark title'}
"; + # Remark + print < + + $Lang::tr{'remark title'} + + + + + +END + # Enabled? if ($cgiparams{'TYPE'} eq 'host') { - print "$Lang::tr{'enabled'} "; + print < + + $Lang::tr{'enabled'} + + + + + +END } - print"

"; -#A.Marx CCD new client + # OTP? + if ($cgiparams{'TYPE'} eq 'host') { + print < + + $Lang::tr{'enable otp'} + + + + + +END + } + + print ""; + if ($cgiparams{'TYPE'} eq 'host') { print ""; my %vpnnet=(); @@ -4801,22 +4749,21 @@ if ($cgiparams{'TYPE'} eq 'host') { print"

$Lang::tr{'ccd choose net'}


"; my $name=$cgiparams{'CHECK1'}; $checked{'RG'}{$cgiparams{'RG'}} = 'CHECKED'; - $checked{'OTP_STATE'}{$cgiparams{'OTP_STATE'}} = 'CHECKED'; if (! -z "${General::swroot}/ovpn/ccd.conf"){ print""; foreach my $key (sort { uc($ccdconfhash{$a}[0]) cmp uc($ccdconfhash{$b}[0]) } keys %ccdconfhash) { $count++; @ccdconf=($ccdconfhash{$key}[0],$ccdconfhash{$key}[1]); - if ($count % 2){print"";}else{print"";} + if ($count % 2){print"";}else{print"";} print""; } print "
$Lang::tr{'ccd name'}$Lang::tr{'network'}$Lang::tr{'ccd clientip'}
$ccdconf[0]$ccdconf[1]"; - &fillselectbox($ccdconf[1],$ccdconf[0],$cgiparams{$name}); + &fillselectbox($ccdconf[0], $ccdconf[1], &convert_top30_ccd_allocation($cgiparams{$name})); print"




"; } } -# ccd end + &Header::closebox(); if ($cgiparams{'KEY'} && $cgiparams{'AUTH'} eq 'psk') { @@ -4853,10 +4800,6 @@ if ($cgiparams{'TYPE'} eq 'host') { END ; -### -# m.a.d net2net -### - } else { print <$country"; } -### -# m.a.d net2net -### if ($cgiparams{'TYPE'} eq 'host') { print <
"; &Header::openbox('100%', 'LEFT', "$Lang::tr{'ccd client options'}:"); @@ -4937,7 +4868,6 @@ if ($cgiparams{'TYPE'} eq 'host') { print < - $Lang::tr{'enable otp'}: Redirect Gateway:
$Lang::tr{'ccd routes'}   @@ -4961,7 +4891,7 @@ END } print <$Lang::tr{'ccd iroutehint'} +
$Lang::tr{'ccd iroute2'}"; - if ($cgiparams{'KEY'}) { -# print ""; - } print ""; &Header::closebigbox(); &Header::closepage(); @@ -5089,116 +5016,24 @@ END VPNCONF_END: } -# SETTINGS_ERROR: -### -### Default status page -### - %cgiparams = (); %cahash = (); %confighash = (); - &General::readhash("${General::swroot}/ovpn/settings", \%cgiparams); &General::readhasharray("${General::swroot}/ovpn/caconfig", \%cahash); &General::readhasharray("${General::swroot}/ovpn/ovpnconfig", \%confighash); - open(FILE, "/var/run/ovpnserver.log"); - my @status = ; - close(FILE); + my @status = (); - if ($cgiparams{'VPN_IP'} eq '' && -e "${General::swroot}/red/active") { - if (open(IPADDR, "${General::swroot}/red/local-ipaddress")) { - my $ipaddr = ; - close IPADDR; - chomp ($ipaddr); - $cgiparams{'VPN_IP'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0]; - if ($cgiparams{'VPN_IP'} eq '') { - $cgiparams{'VPN_IP'} = $ipaddr; - } - } + # Only load status when the RW server is enabled + if ($vpnsettings{'ENABLED'} eq 'on') { + open(FILE, "/usr/local/bin/openvpnctrl rw log |"); + @status = ; + close(FILE); } -#default setzen - if ($cgiparams{'DCIPHER'} eq '') { - $cgiparams{'DCIPHER'} = 'AES-256-CBC'; - } - if ($cgiparams{'DDEST_PORT'} eq '') { - $cgiparams{'DDEST_PORT'} = '1194'; - } - if ($cgiparams{'DMTU'} eq '') { - $cgiparams{'DMTU'} = '1400'; - } - if ($cgiparams{'MSSFIX'} eq '') { - $cgiparams{'MSSFIX'} = 'off'; - } - if ($cgiparams{'DAUTH'} eq '') { - if (-z "${General::swroot}/ovpn/ovpnconfig") { - $cgiparams{'DAUTH'} = 'SHA512'; - } - foreach my $key (keys %confighash) { - if ($confighash{$key}[3] ne 'host') { - $cgiparams{'DAUTH'} = 'SHA512'; - } else { - $cgiparams{'DAUTH'} = 'SHA1'; - } - } - } - if ($cgiparams{'TLSAUTH'} eq '') { - $cgiparams{'TLSAUTH'} = 'off'; - } - if ($cgiparams{'DOVPN_SUBNET'} eq '') { - $cgiparams{'DOVPN_SUBNET'} = '10.' . int(rand(256)) . '.' . int(rand(256)) . '.0/255.255.255.0'; - } $checked{'ENABLED'}{'off'} = ''; $checked{'ENABLED'}{'on'} = ''; - $checked{'ENABLED'}{$cgiparams{'ENABLED'}} = 'CHECKED'; - $checked{'ENABLED_BLUE'}{'off'} = ''; - $checked{'ENABLED_BLUE'}{'on'} = ''; - $checked{'ENABLED_BLUE'}{$cgiparams{'ENABLED_BLUE'}} = 'CHECKED'; - $checked{'ENABLED_ORANGE'}{'off'} = ''; - $checked{'ENABLED_ORANGE'}{'on'} = ''; - $checked{'ENABLED_ORANGE'}{$cgiparams{'ENABLED_ORANGE'}} = 'CHECKED'; - - $selected{'DPROTOCOL'}{'udp'} = ''; - $selected{'DPROTOCOL'}{'tcp'} = ''; - $selected{'DPROTOCOL'}{$cgiparams{'DPROTOCOL'}} = 'SELECTED'; - - $selected{'DCIPHER'}{'AES-256-GCM'} = ''; - $selected{'DCIPHER'}{'AES-192-GCM'} = ''; - $selected{'DCIPHER'}{'AES-128-GCM'} = ''; - $selected{'DCIPHER'}{'CAMELLIA-256-CBC'} = ''; - $selected{'DCIPHER'}{'CAMELLIA-192-CBC'} = ''; - $selected{'DCIPHER'}{'CAMELLIA-128-CBC'} = ''; - $selected{'DCIPHER'}{'AES-256-CBC'} = ''; - $selected{'DCIPHER'}{'AES-192-CBC'} = ''; - $selected{'DCIPHER'}{'AES-128-CBC'} = ''; - $selected{'DCIPHER'}{'DES-EDE3-CBC'} = ''; - $selected{'DCIPHER'}{'DESX-CBC'} = ''; - $selected{'DCIPHER'}{'SEED-CBC'} = ''; - $selected{'DCIPHER'}{'DES-EDE-CBC'} = ''; - $selected{'DCIPHER'}{'CAST5-CBC'} = ''; - $selected{'DCIPHER'}{'BF-CBC'} = ''; - $selected{'DCIPHER'}{'DES-CBC'} = ''; - $selected{'DCIPHER'}{$cgiparams{'DCIPHER'}} = 'SELECTED'; - - $selected{'DAUTH'}{'whirlpool'} = ''; - $selected{'DAUTH'}{'SHA512'} = ''; - $selected{'DAUTH'}{'SHA384'} = ''; - $selected{'DAUTH'}{'SHA256'} = ''; - $selected{'DAUTH'}{'SHA1'} = ''; - $selected{'DAUTH'}{$cgiparams{'DAUTH'}} = 'SELECTED'; - - $checked{'TLSAUTH'}{'off'} = ''; - $checked{'TLSAUTH'}{'on'} = ''; - $checked{'TLSAUTH'}{$cgiparams{'TLSAUTH'}} = 'CHECKED'; + $checked{'ENABLED'}{$vpnsettings{'ENABLED'}} = 'CHECKED'; - $checked{'DCOMPLZO'}{'off'} = ''; - $checked{'DCOMPLZO'}{'on'} = ''; - $checked{'DCOMPLZO'}{$cgiparams{'DCOMPLZO'}} = 'CHECKED'; - -# m.a.d - $checked{'MSSFIX'}{'off'} = ''; - $checked{'MSSFIX'}{'on'} = ''; - $checked{'MSSFIX'}{$cgiparams{'MSSFIX'}} = 'CHECKED'; -#new settings &Header::showhttpheaders(); &Header::openpage($Lang::tr{'status ovpn'}, 1, ''); &Header::openbigbox('100%', 'LEFT', '', $errormessage); @@ -5206,20 +5041,6 @@ END # Show any errors and warnings &Header::errorbox($errormessage); - if ($cryptoerror) { - &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto error'}); - print "$cryptoerror"; - print " "; - &Header::closebox(); - } - - if ($cryptowarning) { - &Header::openbox('100%', 'LEFT', $Lang::tr{'crypto warning'}); - print "$cryptowarning"; - print " "; - &Header::closebox(); - } - if ($warnmessage) { &Header::openbox('100%', 'LEFT', $Lang::tr{'warning messages'}); print "$warnmessage
"; @@ -5230,442 +5051,318 @@ END exit 0; } - my $sactive = "
$Lang::tr{'stopped'}
"; - my $srunning = "no"; - my $activeonrun = ""; - if ( -e "/var/run/openvpn.pid"){ - $sactive = "
$Lang::tr{'running'}
"; - $srunning ="yes"; - $activeonrun = ""; - } else { - $activeonrun = "disabled='disabled'"; - } - &Header::openbox('100%', 'LEFT', $Lang::tr{'global settings'}); + &Header::openbox('100%', 'LEFT', $Lang::tr{'ovpn roadwarrior settings'}); # Show the service status &Header::ServiceStatus({ $Lang::tr{'ovpn roadwarrior server'} => { "process" => "openvpn", - "pidfile" => "/var/run/openvpn.pid", + "pidfile" => "/var/run/openvpn-rw.pid", } }); print < -
-   -   -   - $Lang::tr{'ovpn server status'} - $sactive - $Lang::tr{'ovpn on red'} - + + + + + + + + + + + + + + + + + + + + + + + + +
+ $Lang::tr{'enabled'} + + +
+ $Lang::tr{'ovpn fqdn'} + + +
+ $Lang::tr{'ovpn dynamic client subnet'} + + +
+ + + +
+
END -; - if (&haveBlueNet()) { - print "$Lang::tr{'ovpn on blue'}"; - print ""; - } - if (&haveOrangeNet()) { - print "$Lang::tr{'ovpn on orange'}"; - print ""; - } + &Header::closebox(); + + &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' }); print < + + + $Lang::tr{'name'} + + + $Lang::tr{'type'} + + + $Lang::tr{'remark'} + + + $Lang::tr{'status'} + + + $Lang::tr{'action'} + + +END -
- - $Lang::tr{'net config'}: - -
- - $Lang::tr{'local vpn hostname/ip'}:
- $Lang::tr{'ovpn subnet'}
- $Lang::tr{'protocol'} - - $Lang::tr{'destination port'}: - - $Lang::tr{'MTU'}  - - + my $gif; -
- - $Lang::tr{'ovpn crypt options'}: - -
+ foreach my $key (sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) { + my $status = $confighash{$key}[0]; + my $name = $confighash{$key}[1]; + my $type = $confighash{$key}[3]; - - $Lang::tr{'ovpn ha'} - - + # Create some simple booleans to check the status + my $hasExpired = 0; + my $expiresSoon = 0; - $Lang::tr{'cipher'} - - - + # Fetch information about the certificate for non-N2N connections only + if ($confighash{$key}[3] ne 'net') { + my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", + "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem"); -
- - $Lang::tr{'ovpn tls auth'} - - + my $expiryDate = 0; -

-END -; + # Parse the certificate information + foreach my $line (@cavalid) { + if ($line =~ /Not After : (.*)[\n]/) { + $expiryDate = &Date::Parse::str2time($1); + last; + } + } - if ( $srunning eq "yes" ) { - print ""; - print ""; - print ""; - print ""; - } else{ - print ""; - print ""; - print ""; - if (( -e "${General::swroot}/ovpn/ca/cacert.pem" && - -e "$dhparameter" && - -e "${General::swroot}/ovpn/certs/servercert.pem" && - -e "${General::swroot}/ovpn/certs/serverkey.pem") && - (( $cgiparams{'ENABLED'} eq 'on') || - ( $cgiparams{'ENABLED_BLUE'} eq 'on') || - ( $cgiparams{'ENABLED_ORANGE'} eq 'on'))){ - print ""; - } else { - print ""; - } - } - print ""; - &Header::closebox(); + # Calculate the remaining time + my $remainingTime = $expiryDate - time(); - if ( -f "${General::swroot}/ovpn/ca/cacert.pem" ) { -### -# m.a.d net2net -#$Lang::tr{'remark'}
L2089 -### + # Determine whether the certificate has already expired, or will so soon + $hasExpired = ($remainingTime <= 0); + $expiresSoon = ($remainingTime <= 30 * 24 * 3600); + } - &Header::openbox('100%', 'LEFT', $Lang::tr{'connection status and controlc' }); - ; - my $id = 0; - my $gif; - my $col1=""; - my $lastnet; - foreach my $key (sort { ncmp ($confighash{$a}[32],$confighash{$b}[32]) } sort { ncmp ($confighash{$a}[1],$confighash{$b}[1]) } keys %confighash) { - if ($confighash{$key}[32] eq "" && $confighash{$key}[3] eq 'net' ){$confighash{$key}[32]=$Lang::tr{'fwhost OpenVPN N-2-N'};} - if ($confighash{$key}[32] eq "dynamic"){$confighash{$key}[32]=$Lang::tr{'ccd dynrange'};} - if($id == 0){ - print"$confighash{$key}[32]"; - print < - - $Lang::tr{'name'} - $Lang::tr{'type'} - $Lang::tr{'remark'} - $Lang::tr{'status'} - $Lang::tr{'action'} - -END + my @classes = (); + + # Highlight the row if the certificate has expired/will expire soon + if ($hasExpired || $expiresSoon) { + push(@classes, "is-warning"); } - if ($id > 0 && $lastnet ne $confighash{$key}[32]){ - print "
"; - print"$confighash{$key}[32]"; - print < - - $Lang::tr{'name'} - $Lang::tr{'type'} - $Lang::tr{'remark'} - $Lang::tr{'status'} - $Lang::tr{'action'} - -END + + # Start a new row + print ""; + + # Show the name of the connection + print " $name"; + if ($hasExpired) { + print " ($Lang::tr{'openvpn cert has expired'})"; + } elsif ($expiresSoon) { + print " ($Lang::tr{'openvpn cert expires soon'})"; } - if ($confighash{$key}[0] eq 'on') { $gif = 'on.gif'; } else { $gif = 'off.gif'; } + print ""; - # Create some simple booleans to check the status - my $hasExpired; - my $expiresSoon; + # Show type + print "$Lang::tr{$type}"; - # Fetch information about the certificate for non-N2N connections only - if ($confighash{$key}[3] ne 'net') { - my @cavalid = &General::system_output("/usr/bin/openssl", "x509", "-text", - "-in", "${General::swroot}/ovpn/certs/$confighash{$key}[1]cert.pem"); + # Show remarks + print "$confighash{$key}[25]"; - my $expiryDate = 0; + my $connstatus = "DISCONNECTED"; - # Parse the certificate information - foreach my $line (@cavalid) { - if ($line =~ /Not After : (.*)[\n]/) { - $expiryDate = &Date::Parse::str2time($1); - last; - } - } + # Disabled Connections + if ($status eq "off") { + $connstatus = "DISABLED"; - # Calculate the remaining time - my $remainingTime = $expiryDate - time(); + # N2N Connections + } elsif ($type eq "net") { + if (-e "/var/run/${name}n2n.pid") { + my $port = $confighash{$key}[22]; - # Determine whether the certificate has already expired, or will so soon - $hasExpired = ($remainingTime <= 0); - $expiresSoon = ($remainingTime <= 30 * 24 * 3600); + if ($port ne "") { + $connstatus = &openvpn_status($confighash{$key}[22]); + } + } - } else { - # Populate booleans with dummy values for N2N connections (#13066) - $hasExpired = 0; - $expiresSoon = 0; - } + # RW Connections + } elsif ($type eq "host") { + my $cn; - print ""; + foreach my $line (@status) { + chomp($line); - if ($hasExpired || $expiresSoon) { - $col="bgcolor='$color{'color14'}'"; - } elsif ($id % 2) { - $col="bgcolor='$color{'color20'}'"; - } else { - $col="bgcolor='$color{'color22'}'"; - } - print "$confighash{$key}[1]"; - if ($hasExpired) { - print " ($Lang::tr{'openvpn cert has expired'})"; - } elsif ($expiresSoon) { - print " ($Lang::tr{'openvpn cert expires soon'})"; - } - print ""; - print "" . $Lang::tr{"$confighash{$key}[3]"} . " (" . $Lang::tr{"$confighash{$key}[4]"} . ")"; - print "$confighash{$key}[25]"; - $col1="class='status is-disconnected'"; - my $active = "$Lang::tr{'capsclosed'}"; - - if ($confighash{$key}[0] eq 'off') { - $col1="class='status is-disabled'"; - $active = "$Lang::tr{'capsclosed'}"; - } else { + if ($line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) { + my @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line); -### -# m.a.d net2net -### + if ($match[1] ne "Common Name") { + $cn = $match[1]; + } - if ($confighash{$key}[3] eq 'net') { - - if (-e "/var/run/$confighash{$key}[1]n2n.pid") { - my @output = ""; - my @tustate = ""; - my $tport = $confighash{$key}[22]; - my $tnet = new Net::Telnet ( Timeout=>5, Errmode=>'return', Port=>$tport); - if ($tport ne '') { - $tnet->open('127.0.0.1'); - @output = $tnet->cmd(String => 'state', Prompt => '/(END.*\n|ERROR:.*\n)/'); - @tustate = split(/\,/, $output[1]); -### -#CONNECTING -- OpenVPN's initial state. -#WAIT -- (Client only) Waiting for initial response from server. -#AUTH -- (Client only) Authenticating with server. -#GET_CONFIG -- (Client only) Downloading configuration options from server. -#ASSIGN_IP -- Assigning IP address to virtual network interface. -#ADD_ROUTES -- Adding routes to system. -#CONNECTED -- Initialization Sequence Completed. -#RECONNECTING -- A restart has occurred. -#EXITING -- A graceful exit is in progress. -#### - - if (($tustate[1] eq 'CONNECTED') || ($tustate[1] eq 'WAIT')) { - $col1="class='status is-connected'"; - $active = "$Lang::tr{'capsopen'}"; - }else { - $col1="class='status is-disconnected'"; - $active = "$tustate[1]"; - } - } - } - }else { - - my $cn; - my @match = (); - foreach my $line (@status) { - chomp($line); - if ( $line =~ /^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/) { - @match = split(m/^(.+),(\d+\.\d+\.\d+\.\d+\:\d+),(\d+),(\d+),(.+)/, $line); - if ($match[1] ne "Common Name") { - $cn = $match[1]; - } - if ($cn eq "$confighash{$key}[2]") { - $col1="class='status is-connected'"; - $active = "$Lang::tr{'capsopen'}"; + if ($cn eq "$confighash{$key}[2]") { + $connstatus = "CONNECTED"; + } } } - } - } -} + } + if ($connstatus eq "DISABLED") { + print "$Lang::tr{'capsclosed'}"; + } elsif ($connstatus eq "CONNECTED") { + print "$Lang::tr{'capsopen'}"; + } elsif ($connstatus eq "DISCONNECTED") { + print "$Lang::tr{'capsclosed'}"; + } else { + print "$connstatus"; + } - if ($confighash{$key}[41] eq "pass") { - print <$active + # Download Configuration + print < +
+ + + +
+ +END -
- - - - -
+ # Show Certificate + if ($confighash{$key}[4] eq 'cert') { + print < +
+ + + +
+ END - ; } elsif ($confighash{$key}[41] eq "no-pass") { - print <$active + } else { + print ""; + } -
- - - - -
+ # Show OTP QR code + if ($confighash{$key}[43] eq 'on') { + print < +
+ + + +
+ END - ; } else { - print " "; - } + } else { + print ""; + } - if ($confighash{$key}[4] eq 'cert') { - print < - - - - + # Download Certificate + if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") { + print < +
+ + + +
+ END - ; } else { - print " "; - } - if ($confighash{$key}[43] eq 'on') { - print < - - - - + } elsif ($confighash{$key}[4] eq 'cert') { + print < +
+ + + +
+ END -; } else { - print " "; - } + } else { + print ""; + } - if ($confighash{$key}[4] eq 'cert' && -f "${General::swroot}/ovpn/certs/$confighash{$key}[1].p12") { - print < - - - - -END - ; } elsif ($confighash{$key}[4] eq 'cert') { - print < - - - - + if ($status eq 'on') { + $gif = 'on.gif'; + } else { + $gif = 'off.gif'; + } + + print < +
+ + + +
+ + + +
+ + + +
+ + + +
+ + + +
+ + END - ; } else { - print " "; + } - print < - - - - - -
- - - -
-
- - - -
- -END - ; - $id++; - $lastnet = $confighash{$key}[32]; - } - print""; - ; + print""; - # If the config file contains entries, print Key to action icons - if ( $id ) { + # Show controls print < - -   $Lang::tr{'legend'}: -     ?RELOAD - $Lang::tr{'dl client arch insecure'} -     ?RELOAD - $Lang::tr{'dl client arch'} -     $Lang::tr{ - $Lang::tr{'show certificate'} -     $Lang::tr{ - $Lang::tr{'show otp qrcode'} - - -   -     ?FLOPPY - $Lang::tr{'download certificate'} -   ?OFF - $Lang::tr{'click to enable'} -   $Lang::tr{ - $Lang::tr{'click to disable'} - -     $Lang::tr{ - $Lang::tr{'edit'} -     $Lang::tr{ - $Lang::tr{'remove'} - -
+ + + + +
+
+ + +
+
END - ; - } - print < -
- - - - -
- -END - ; &Header::closebox(); - } # CA/key listing &Header::openbox('100%', 'LEFT', "$Lang::tr{'certificate authorities'}"); @@ -5678,12 +5375,12 @@ END END ; - my $col1="bgcolor='$color{'color22'}'"; - my $col2="bgcolor='$color{'color20'}'"; + my $col1="bgcolor='$Header::color{'color22'}'"; + my $col2="bgcolor='$Header::color{'color20'}'"; # DH parameter line - my $col3="bgcolor='$color{'color22'}'"; + my $col3="bgcolor='$Header::color{'color22'}'"; # ta.key line - my $col4="bgcolor='$color{'color20'}'"; + my $col4="bgcolor='$Header::color{'color20'}'"; if (-f "${General::swroot}/ovpn/ca/cacert.pem") { my @casubject = &General::system_output("/usr/bin/openssl", "x509", "-text", "-in", "${General::swroot}/ovpn/ca/cacert.pem"); @@ -5769,45 +5466,6 @@ END ; } - # Adding DH parameter to chart - if (-f "$dhparameter") { - my @dhsubject = &General::system_output("/usr/bin/openssl", "dhparam", "-text", "-in", "$dhparameter"); - my $dhsubject; - - foreach my $line (@dhsubject) { - if ($line =~ / (.*)[\n]/) { - $dhsubject = $1; - - last; - } - } - - print < - $Lang::tr{'dh'} - $dhsubject -
- - -
-
-
-   - -END - ; - } else { - # Nothing - print < - $Lang::tr{'dh'}: - $Lang::tr{'not present'} -   - -END - ; - } - # Adding ta.key to chart if (-f "${General::swroot}/ovpn/certs/ta.key") { open(FILE, "${General::swroot}/ovpn/certs/ta.key"); @@ -5861,9 +5519,9 @@ END if (keys %cahash > 0) { foreach my $key (keys %cahash) { if (($key + 1) % 2) { - print "\n"; + print "\n"; } else { - print "\n"; + print "\n"; } print "$cahash{$key}[0]\n"; print "$cahash{$key}[1]\n"; @@ -5934,7 +5592,7 @@ END END ; - if ( $srunning eq "yes" ) { + if ($vpnsettings{'ENABLED'} eq "yes") { print "
\n"; } else { print "
\n"; diff --git a/html/cgi-bin/services.cgi b/html/cgi-bin/services.cgi index 462b6bfa1a..8b92f7e082 100644 --- a/html/cgi-bin/services.cgi +++ b/html/cgi-bin/services.cgi @@ -2,7 +2,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2005-2021 IPFire Team # +# Copyright (C) 2005-2025 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -114,7 +114,7 @@ $querry[1] = 'hour' unless defined $querry[1]; # OpenVPN Roadwarrior $Lang::tr{'ovpn roadwarrior server'} => { "process" => "openvpn", - "pidfile" => "/var/run/openvpn.pid", + "pidfile" => "/var/run/openvpn-rw.pid", } }); diff --git a/html/cgi-bin/tor.cgi b/html/cgi-bin/tor.cgi index 9aa2bc95a1..cfad229e12 100644 --- a/html/cgi-bin/tor.cgi +++ b/html/cgi-bin/tor.cgi @@ -241,26 +241,11 @@ sub showMainBox() { &Header::openbox('100%', 'center', $Lang::tr{'tor'}); - -if ( ($memory != 0) && (@pid[0] ne "///") ){ - print ""; - print ""; - print ""; - print ""; - print ""; - print ""; - print ""; - print ""; - print ""; - print ""; - print "
$Lang::tr{'tor service'}
$Lang::tr{'tor daemon'}$Lang::tr{'running'}
PID$Lang::tr{'memory'}
@pid[0]$memory KB
"; - } else { - print ""; - print ""; - print ""; - print ""; - print "
$Lang::tr{'tor service'}
$Lang::tr{'tor daemon'}$Lang::tr{'stopped'}
"; - } + &Header::ServiceStatus({ + $Lang::tr{'tor service'} => { + "process" => "tor", + } + }); &Header::closebox(); diff --git a/html/cgi-bin/vulnerabilities.cgi b/html/cgi-bin/vulnerabilities.cgi index a98eb7b004..cab38d8de4 100644 --- a/html/cgi-bin/vulnerabilities.cgi +++ b/html/cgi-bin/vulnerabilities.cgi @@ -96,7 +96,7 @@ if ($notice) { &Header::closebox(); } -&Header::openbox('100%', 'center', $Lang::tr{'processor vulnerability mitigations'}); +&Header::opensection(); print < @@ -159,7 +159,7 @@ print < END -&Header::closebox(); +&Header::closesection(); print "
\n"; diff --git a/html/html/themes/ipfire/include/css/style.css b/html/html/themes/ipfire/include/css/style.css index c598893261..df6ee6b47f 100644 --- a/html/html/themes/ipfire/include/css/style.css +++ b/html/html/themes/ipfire/include/css/style.css @@ -106,6 +106,10 @@ h6 { font-size: 1em; } +select, textarea { + width: 100%; +} + br.clear { clear: both; } @@ -386,6 +390,12 @@ table.form tr.header td { margin-top: 1rem; } +table.form tr.header td { + font-weight: bold; + + margin-top: 1rem; +} + table.form tr.action td { padding-top: 1rem; @@ -400,6 +410,11 @@ table.form tr.action td form { width: 100%; } +.tbl tr.is-warning td { + color: var(--color-yellow-invert) !important; + background-color: var(--color-yellow) !important; +} + .tbl th { color: #ffffff; border-top: 1px solid #363636; @@ -407,6 +422,9 @@ table.form tr.action td form { background: #363636; padding-left: 0.5em; padding-right: 0.5em; + + text-align: center; + font-weight: bold; } .tbl th[scope=row] { @@ -513,7 +531,7 @@ table.form tr.action td form { color: var(--color-red-invert); } -.tbl .status.is-disabled, .tbl .status.is-mitigation { +.tbl .status.is-mitigation, .tbl .status.is-disabled { background-color: var(--color-blue); color: var(--color-blue-invert); } diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index a05b6056db..22ab0bad10 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -2,12 +2,17 @@ %tr, '24 hours' => '24 Hours', +'AES-128-CBC' => 'AES - CBC Mode - 128 Bit', +'AES-128-GCM' => 'AES - GCM Mode - 128 Bit', +'AES-256-CBC' => 'AES - CBC Mode - 256 Bit', +'AES-256-GCM' => 'AES - GCM Mode - 256 Bit', 'Act as' => 'Act as:', 'Add Level7 rule' => 'Add Level7 rule', 'Add Port Rule' => 'Add port rule', 'Add Rule' => 'Add rule', 'Add a route' => 'Add a route', 'Async logging enabled' => 'Enable asynchronous writing of the syslog file', +'CHACHA20-POLY1305' => 'ChaCha20-Poly1305', 'Captive' => 'Captive Portal', 'Captive 1day' => '1 day', 'Captive 1month' => '1 month', @@ -166,7 +171,7 @@ 'administrator username' => 'Administrator username', 'adsl settings' => 'ADSL settings', 'advanced' => 'Advanced', -'advanced server' => 'Advanced server options', +'advanced server' => 'Advanced Settings', 'advproxy AUTH always required' => 'Require authentication for unrestricted source addresses', 'advproxy AUTH auth cache TTL' => 'Authentication cache TTL (in minutes)', 'advproxy AUTH global settings' => 'Global authentication settings', @@ -792,7 +797,7 @@ 'destination ip bad' => 'Invalid destination IP', 'destination ip or net' => 'Destination IP or net', 'destination net' => 'Destination Net', -'destination port' => 'Destination port', +'destination port' => 'Destination Port', 'destination port numbers' => 'Destination port must be a valid port number or port range.', 'destination port overlaps' => 'Destination port range overlaps an existing port range.', 'detail level' => 'Detail level', @@ -839,7 +844,6 @@ 'dhcp server enabled' => 'DHCP server enabled. Restarting.', 'dhcp server enabled on blue interface' => 'DHCP server enabled on BLUE interface', 'dhcp valid range required when deny known clients checked' => 'Valid range required when "Deny known clients:" is checked', -'dhcp-options' => 'DHCP push options', 'dial' => 'Connect', 'dial profile' => 'Connect with profile', 'dial user password' => 'Dial user password:', @@ -861,8 +865,7 @@ 'display hostname in window title' => 'Display hostname in window title', 'display traffic at home' => 'Display calculated traffic on startpage', 'display webinterface effects' => 'Activate effects', -'dl client arch' => 'Download Encrypted Client Package (zip)', -'dl client arch insecure' => 'Download insecure Client Package (zip)', +'dl client arch' => 'Download Client Configuration', 'dmz' => 'DMZ', 'dmz pinhole configuration' => 'DMZ pinhole configuration', 'dmz pinhole rule added' => 'DMZ pinhole rule added; restarting DMZ pinhole', @@ -1825,7 +1828,6 @@ 'minimum' => 'Minimum', 'minute' => 'Minute', 'minutes' => 'Minutes', -'misc-options' => 'Miscellaneous options', 'missing dat' => 'Encrypted archive not found', 'missing gz' => 'Unencrypted archive not found', 'mitigated' => 'Mitigated', @@ -2034,20 +2036,28 @@ 'override mtu' => 'Override default MTU', 'ovpn' => 'OpenVPN', 'ovpn add conf' => 'Additional configuration', +'ovpn ciphers' => 'Ciphers', 'ovpn con stat' => 'OpenVPN Connection Statistics', 'ovpn config' => 'OVPN-Config', 'ovpn connection name' => 'Connection Name', -'ovpn crypt options' => 'Cryptographic options', +'ovpn crypto settings' => 'Cryptographic Settings', 'ovpn device' => 'OpenVPN device:', +'ovpn dhcp settings' => 'DHCP Settings', 'ovpn dl' => 'OVPN-Config Download', +'ovpn dynamic client subnet' => 'Dynamic Client Subnet', 'ovpn engines' => 'Crypto engine', 'ovpn errmsg green already pushed' => 'Route for green network is always set', 'ovpn errmsg invalid ip or mask' => 'Invalid network-address or subnetmask', +'ovpn errmsg invalid route' => 'Invalid route', 'ovpn error md5' => 'You host certificate uses MD5 for the signature which is not accepted anymore.
Please update to the latest IPFire version and generate a new root and host certificate.

All OpenVPN clients needs then to be renewed!
', +'ovpn fallback cipher' => 'Fallback Cipher', +'ovpn fallback cipher help' => 'This cipher is being used by clients that do not support cipher negotiation.', +'ovpn fqdn' => 'FQDN', 'ovpn generating the root and host certificates' => 'Generating the root and host certificate can take a long time.', 'ovpn ha' => 'Hash algorithm', 'ovpn log' => 'OVPN-Log', 'ovpn mgmt in root range' => 'A port number of 1024 or higher is required.', +'ovpn misc settings' => 'Miscellaneous Settings', 'ovpn mtu-disc' => 'Path MTU Discovery', 'ovpn mtu-disc and mtu not 1500' => 'Path MTU Discovery requires a MTU of 1500.', 'ovpn mtu-disc maybe' => 'Optionally', @@ -2055,21 +2065,27 @@ 'ovpn mtu-disc off' => 'Disabled', 'ovpn mtu-disc with mssfix or fragment' => 'Path MTU Discovery cannot be used with mssfix or fragment.', 'ovpn mtu-disc yes' => 'Forced', +'ovpn no cipher selected' => 'No cipher selected', 'ovpn no connections' => 'No active OpenVPN connections', 'ovpn on blue' => 'OpenVPN on BLUE:', 'ovpn on orange' => 'OpenVPN on ORANGE:', 'ovpn on red' => 'OpenVPN on RED:', 'ovpn port in root range' => 'A port number of 1024 or higher is required.', +'ovpn protocol settings' => 'Protocol Settings', +'ovpn push default route' => 'Push Default Route', 'ovpn reneg sec' => 'Session key lifetime:', 'ovpn roadwarrior server' => 'OpenVPN Roadwarrior Server', -'ovpn routes push' => 'Routes (one per line) e.g. 192.168.10.0/255.255.255.0 192.168.20.0/24', -'ovpn routes push options' => 'Route push options', +'ovpn roadwarrior settings' => 'Roadwarrior Settings', +'ovpn routes push' => 'Custom Routes', +'ovpn routing settings' => 'Routing Settings', 'ovpn rw connection log' => 'OpenVPN Roadwarrior Connections Log', 'ovpn server status' => 'Current OpenVPN server status:', 'ovpn subnet' => 'OpenVPN subnet:', 'ovpn subnet is invalid' => 'OpenVPN subnet is invalid.', 'ovpn subnet overlap' => 'OpenVPN Subnet overlaps with : ', 'ovpn tls auth' => 'TLS Channel Protection:', +'ovpn transport protocol' => 'Transport Protocol', +'ovpn unsupported cipher selected' => 'Unknown cipher selected', 'ovpn warning rfc3280' => 'Your host certificate is not RFC3280 compliant.
Please update to the latest IPFire version and generate as soon as possible a new root and host certificate.

All OpenVPN clients needs then to be renewed!
', 'ovpn_fastio' => 'Fast-IO', 'ovpn_mssfix' => 'MSSFIX Size', @@ -2300,6 +2316,8 @@ 'router ip' => 'Router IP address:', 'routing' => 'Routing', 'routing table entries' => 'Routing Table Entries', +'rss' => 'RSS', +'rss long' => 'Resident Set Size', 'rsvd dst port overlap' => 'Destination Port Range overlaps a port reserved for IPFire:', 'rsvd src port overlap' => 'Source Port Range overlaps a port reserved for IPFire:', 'rules already up to date' => 'Rules already up to date', @@ -2317,7 +2335,7 @@ 'save config' => 'save settings', 'save error' => 'Unable to save configuration archive file', 'save settings' => 'Save settings', -'save-adv-options' => 'Save advanced options', +'save-adv-options' => 'Save Advanced Settings', 'scanned' => 'Scanned', 'script name' => 'Script name:', 'search' => 'Search', diff --git a/lfs/initscripts b/lfs/initscripts index 700e912445..99fe2f1be4 100644 --- a/lfs/initscripts +++ b/lfs/initscripts @@ -95,6 +95,8 @@ $(TARGET) : ln -sf ../init.d/vdradmin /etc/rc.d/rc0.d/K01vdradmin ln -sf ../init.d/fcron /etc/rc.d/rc0.d/K08fcron ln -sf ../init.d/apache /etc/rc.d/rc0.d/K28apache + ln -sf ../init.d/openvpn-rw /etc/rc.d/rc0.d/K10openvpn-rw + ln -sf ../init.d/openvpn-n2n /etc/rc.d/rc0.d/K11openvpn-n2n ln -sf ../init.d/sshd /etc/rc.d/rc0.d/K30sshd ln -sf ../init.d/setclock /etc/rc.d/rc0.d/K47setclock ln -sf ../init.d/cyrus-sasl /etc/rc.d/rc0.d/K49cyrus-sasl @@ -129,6 +131,8 @@ $(TARGET) : ln -sf ../init.d/sshd /etc/rc.d/rc3.d/S30sshd ln -sf ../init.d/apache /etc/rc.d/rc3.d/S32apache ln -sf ../init.d/fcron /etc/rc.d/rc3.d/S40fcron + ln -sf ../init.d/openvpn-n2n /etc/rc.d/rc3.d/S51openvpn-n2n + ln -sf ../init.d/openvpn-rw /etc/rc.d/rc3.d/S50openvpn-rw ln -sf ../init.d/wireguard /etc/rc.d/rc3.d/S50wireguard ln -sf ../../sysconfig/rc.local /etc/rc.d/rc3.d/S98rc.local ln -sf ../init.d/grub-btrfsd /etc/rc.d/rc3.d/S99grub-btrfsd @@ -137,6 +141,8 @@ $(TARGET) : ln -sf ../init.d/grub-btrfsd /etc/rc.d/rc6.d/K01grub-btrfsd ln -sf ../init.d/vdradmin /etc/rc.d/rc6.d/K01vdradmin ln -sf ../init.d/fcron /etc/rc.d/rc6.d/K08fcron + ln -sf ../init.d/openvpn-rw /etc/rc.d/rc6.d/K10openvpn-rw + ln -sf ../init.d/openvpn-n2n /etc/rc.d/rc6.d/K11openvpn-n2n ln -sf ../init.d/apache /etc/rc.d/rc6.d/K28apache ln -sf ../init.d/sshd /etc/rc.d/rc6.d/K30sshd ln -sf ../init.d/setclock /etc/rc.d/rc6.d/K47setclock diff --git a/lfs/openvpn b/lfs/openvpn index 807019f0a1..e66b50c2e5 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.5.10 +VER = 2.6.14 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 7f4ae82162e2e48e66df2da8008f45a2db53a22483730808b873948f1dc13a2e5582c79e4469f9d794f8b0f87f08d627e8d1bd070b088ea33444af31779f5479 +$(DL_FILE)_BLAKE2 = 15376d0a1600abfbf8541614282c622bbc09bf4402730a20eb6606bf1debdda0836e069fd45068bda1d71deb72df052c68425771693592d3c72d680a16c87d6d install : $(TARGET) diff --git a/lfs/tor b/lfs/tor index 980c1a8f5a..0d57f5fed9 100644 --- a/lfs/tor +++ b/lfs/tor @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 88 +PAK_VER = 89 DEPS = libseccomp diff --git a/src/initscripts/networking/red.down/10-ovpn b/src/initscripts/networking/red.down/10-ovpn deleted file mode 100644 index 948d7b276a..0000000000 --- a/src/initscripts/networking/red.down/10-ovpn +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -/usr/local/bin/openvpnctrl -k & -/usr/local/bin/openvpnctrl -kn2n & - -exit 0 diff --git a/src/initscripts/networking/red.up/50-ovpn b/src/initscripts/networking/red.up/50-ovpn deleted file mode 100644 index f3db648bc1..0000000000 --- a/src/initscripts/networking/red.up/50-ovpn +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -/usr/local/bin/openvpnctrl -s > /dev/null 2>&1 -/usr/local/bin/openvpnctrl -sn2n > /dev/null 2>&1 - -exit 0 diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall index 0d5bb00615..304c7c3cc9 100644 --- a/src/initscripts/system/firewall +++ b/src/initscripts/system/firewall @@ -332,9 +332,13 @@ iptables_init() { iptables -N WGINPUT iptables -A INPUT -j WGINPUT - # OpenVPN - iptables -N OVPNINPUT - iptables -A INPUT -j OVPNINPUT + # OpenVPN Roadwarrior + iptables -N OVPNINPUTRW + iptables -A INPUT -j OVPNINPUTRW + + # OpenVPN N2N + iptables -N OVPNINPUTN2N + iptables -A INPUT -j OVPNINPUTN2N # Tor (outbound) iptables -N TOR_OUTPUT @@ -419,8 +423,8 @@ iptables_init() { # Populate IPsec chains /usr/lib/firewall/ipsec-policy - # Apply OpenVPN firewall rules - /usr/local/bin/openvpnctrl --firewall-rules + # Apply OpenVPN N2N firewall rules + /etc/rc.d/init.d/openvpn-n2n firewall-rules # run wirelessctrl /usr/local/bin/wirelessctrl diff --git a/src/initscripts/system/functions b/src/initscripts/system/functions index 94c9236d3f..85eb3e975b 100644 --- a/src/initscripts/system/functions +++ b/src/initscripts/system/functions @@ -369,7 +369,7 @@ pidofproc() for pid in ${lpids} do if [ "${pid}" -ne "$$" -a "${pid}" -ne "${PPID}" ]; then - kill -0 "${pid}" > /dev/null && + kill -0 "${pid}" 2> /dev/null && pidlist="${pidlist} ${pid}" fi diff --git a/src/initscripts/system/openvpn-n2n b/src/initscripts/system/openvpn-n2n new file mode 100644 index 0000000000..4d55f4cbd5 --- /dev/null +++ b/src/initscripts/system/openvpn-n2n @@ -0,0 +1,372 @@ +#!/bin/sh +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +. /etc/sysconfig/rc +. ${rc_functions} + +# Include network functions +. /etc/init.d/networking/functions.network + +update_firewall_rules() { + local id + local enabled + local name + local x3 + local type + local x5 + local x6 + local role + local x8 + local local_subnet + local x10 + local x11 + local x12 + local x13 + local x14 + local x15 + local x16 + local x17 + local x18 + local x19 + local x20 + local x21 + local x22 + local x23 + local x24 + local x25 + local x26 + local x27 + local transfer_subnet + local proto + local port + local rest + + local transfer_address + local local_address + + # Flush the block chain + iptables -F OVPNBLOCK + + # Flush the NAT chain + iptables -t nat -F OVPNNAT + + local IFS=',' + + # Read all connections + while read -r id enabled name x3 type x5 x6 role x8 local_subnet x10 \ + x11 x12 x13 x14 x15 x16 x17 x18 x19 x20 x21 x22 x23 x24 x25 \ + x26 x27 transfer_subnet proto port rest; do + # Skip all disabled connections + if [ "${enabled}" != "on" ]; then + continue + fi + + # Skip all connections that are not of type 'net' + if [ "${type}" != "net" ]; then + continue + fi + + # Open port + iptables -A OVPNINPUTN2N -p "${proto}" --dport "${port}" -j ACCEPT + + # Block all communication from transfer networks + iptables -A OVPNBLOCK -s "${transfer_subnet}" -j DROP + + # Calculate NAT addresses + transfer_address="$(calculate_transfer_address "${transfer_subnet}" "${role}")" + local_address="$(calculate_local_address "${local_subnet}")" + + # NAT all outgoing connections away from the transfer net + if [ -n "${transfer_address}" -a -n "${local_address}" ]; then + iptables -t nat -A OVPNNAT -s "${transfer_address}" \ + -j SNAT --to-source "${local_address}" + fi + done < /var/ipfire/ovpn/ovpnconfig +} + +calculate_transfer_address() { + local network="${1}" + local role="${2}" + + local address="$(network_get_address "${network}")" + local netmask="$(network_get_netmask "${network}")" + + # Convert everything to binary + address="$(ip2bin "${address}")" + netmask="$(ip2bin "${netmask}")" + + # Make sure the address is the first address of the network + (( address &= netmask )) + + case "${role}" in + server) + (( address += 1 )) + ;; + + client) + (( address += 2 )) + ;; + + # Exit on any invalid role + *) + return 1 + ;; + esac + + # Return the address + bin2ip "${address}" +} + +calculate_local_address() { + local network="${1}" + + local addresses=( + # GREEN + "${GREEN_ADDRESS}" + + # BLUE + "${BLUE_ADDRESS}" + + # ORANGE + "${ORANGE_ADDRESS}" + ) + + local address + for address in "${addresses[@]}"; do + if network_address_in_network "${address}" "${network}"; then + echo "${address}" + return 0 + fi + done + + return 1 +} + +all_connections() { + local command="${1}" + shift + + local id + local enabled + local name + local x3 + local type + local rest + + local IFS=, + + # Read all connections + while read -r id enabled name x3 type rest; do + # Filter for all connections that of type 'net' + case "${type}" in + net) + # Check if the connection is in the filter list + if [ $# -gt 0 ]; then + local found=0 + + local n + for n in $@; do + if [ "${name}" = "${n}" ]; then + found=1 + break + fi + done + + # Skip this connection if not found + if [ "${found}" -eq 0 ]; then + continue + fi + fi + + # Run the command + "${command}" "${name}" + ;; + esac + done < /var/ipfire/ovpn/ovpnconfig +} + +start_connections() { + local connection + local failed=0 + + for connection in $@; do + start "${connection}" || failed=1 + done + + return "${failed}" +} + +start() { + local name="${1}" + + local id + local enabled + local _name + local rest + + local IFS=, + + # Read the connection + while read -r id enabled _name rest; do + if [ "${name}" = "${_name}" ]; then + if [ "${enabled}" = "on" ]; then + break + + # Log an error if the connection is not enabled + else + boot_mesg "OpenVPN N2N connection '${name}' is not enabled" "${WARNING}" + echo_warning + + return 0 + fi + fi + done < /var/ipfire/ovpn/ovpnconfig + + # Create path to the configuration file + local config="/var/ipfire/ovpn/n2nconf/${name}/${name}.conf" + + # Check if the connection exists + if [ ! -r "${config}" ]; then + boot_mesg "OpenVPN N2N connection '${name}' does not exist" "${FAILURE}" + echo_failure + + return 1 + fi + + # Load the tun module + modprobe tun + + boot_mesg "Starting OpenVPN N2N connection '${name}'..." + + PIDFILE="/var/run/${name}n2n.pid" \ + loadproc -f /usr/sbin/openvpn --config "${config}" +} + +stop() { + local name="${1}" + + boot_mesg "Stopping OpenVPN N2N connection '${name}'..." + + PIDFILE="/var/run/${name}n2n.pid" \ + killproc /usr/sbin/openvpn +} + +reload() { + local name="${1}" + + boot_mesg "Reloading OpenVPN N2N connection '${name}'..." + + PIDFILE="/var/run/${name}n2n.pid" \ + reloadproc /usr/sbin/openvpn +} + +status() { + local name="${1}" + + local pidlist + + PIDFILE="/var/run/${name}n2n.pid" getpids "/usr/bin/openvpn" + + if [ -n "${pidlist}" ]; then + echo -e "${INFO}Connection '${name}' is running with Process ID(s) ${pidlist}.${NORMAL}" + else + echo -e "${INFO}Connection '${name}' is not running.${NORMAL}" + return 1 + fi +} + +delete() { + local name="${1}" + + local id + local enabled + local _name + local x3 + local type + local rest + + local IFS=, + + # Read the connection + while read -r id enabled _name x3 type rest; do + if [ "${name}" = "${_name}" ]; then + case "${type}" in + host) + rm -rf "/var/log/rrd/collectd/localhost/openvpn-${name}/" + ;; + + net) + rm -rf "/var/log/rrd/collectd/localhost/openvpn-${name}-n2n/" + ;; + esac + fi + done < /var/ipfire/ovpn/ovpnconfig +} + +case "${1}" in + start) + # Update all firewall rules + update_firewall_rules + + # Start all connections + all_connections start "${@:2}" + ;; + + stop) + # Update all firewall rules + update_firewall_rules + + # Stop all connections + all_connections stop "${@:2}" + ;; + + reload) + # Update all firewall rules + update_firewall_rules + + # Reload all connections + all_connections reload "${@:2}" + ;; + + restart) + ${0} stop + sleep 1 + ${0} start + ;; + + status) + # Show the status of all connections + all_connections status "${@:2}" + ;; + + firewall-rules) + update_firewall_rules + ;; + + delete) + delete "${2}" + ;; + + *) + echo "Usage: ${0} {start|stop|reload|restart|status}" + exit 1 + ;; +esac diff --git a/src/initscripts/system/openvpn-rw b/src/initscripts/system/openvpn-rw new file mode 100644 index 0000000000..56a62d71cc --- /dev/null +++ b/src/initscripts/system/openvpn-rw @@ -0,0 +1,86 @@ +#!/bin/sh +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2022 IPFire Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see . # +# # +############################################################################### + +. /etc/sysconfig/rc +. ${rc_functions} + +PIDFILE="/var/run/openvpn-rw.pid" + +# Load configuration +eval $(/usr/local/bin/readhash /var/ipfire/ovpn/settings) + +case "${1}" in + start) + # Exit if OpenVPN is not enabled + if [ "${ENABLED}" != "on" ]; then + exit 0 + fi + + # Load the tun module + modprobe tun + + # Flush all firewall rules + iptables -F OVPNINPUTRW + + # Open the port + iptables -A OVPNINPUTRW \ + -p "${DPROTOCOL}" --dport "${DDEST_PORT}" -j ACCEPT + + boot_mesg "Starting OpenVPN Roadwarrior Server..." + loadproc -f /usr/sbin/openvpn \ + --config /var/ipfire/ovpn/server.conf + + boot_mesg "Starting OpenVPN Authenticator..." + PIDFILE= loadproc /usr/sbin/openvpn-authenticator --daemon + ;; + + stop) + boot_mesg "Stopping OpenVPN Authenticator..." + PIDFILE= killproc /usr/sbin/openvpn-authenticator + + boot_mesg "Stopping OpenVPN Roadwarrior Server..." + killproc /usr/sbin/openvpn + + # Flush all firewall rules + iptables -F OVPNINPUTRW + ;; + + restart) + ${0} stop + sleep 1 + ${0} start + ;; + + status) + statusproc /usr/sbin/openvpn + ;; + + log) + if [ -r "/var/run/openvpn-rw.log" ]; then + cat "/var/run/openvpn-rw.log" + fi + ;; + + *) + echo "Usage: ${0} {start|stop|reload|restart|status}" + exit 1 + ;; +esac diff --git a/src/misc-progs/openvpnctrl.c b/src/misc-progs/openvpnctrl.c index fb32146e43..cd2a9ca4d6 100644 --- a/src/misc-progs/openvpnctrl.c +++ b/src/misc-progs/openvpnctrl.c @@ -1,779 +1,41 @@ -#define _DEFAULT_SOURCE -#define _XOPEN_SOURCE 500 -#include +/* This file is part of the IPFire Firewall. + * + * This program is distributed under the terms of the GNU General Public + * Licence. See the file COPYING for details. + * + */ + #include #include -#include -#include -#include -#include -#include -#include -#include -#include "setuid.h" -#include "netutil.h" -#include "libsmooth.h" - -#define noovpndebug - -// global vars - struct keyvalue *kv = NULL; - FILE *ifacefile = NULL; - -char redif[STRING_SIZE]; -char blueif[STRING_SIZE]; -char orangeif[STRING_SIZE]; -char enablered[STRING_SIZE] = "off"; -char enableblue[STRING_SIZE] = "off"; -char enableorange[STRING_SIZE] = "off"; - -// consts -char OVPNINPUT[STRING_SIZE] = "OVPNINPUT"; -char OVPNBLOCK[STRING_SIZE] = "OVPNBLOCK"; -char OVPNNAT[STRING_SIZE] = "OVPNNAT"; -char WRAPPERVERSION[STRING_SIZE] = "ipfire-2.2.4"; - -struct connection_struct { - char name[STRING_SIZE]; - char type[STRING_SIZE]; - char proto[STRING_SIZE]; - char status[STRING_SIZE]; - char local_subnet[STRING_SIZE]; - char transfer_subnet[STRING_SIZE]; - char role[STRING_SIZE]; - char port[STRING_SIZE]; - struct connection_struct *next; -}; - -typedef struct connection_struct connection; - -static int recursive_remove_callback(const char* fpath, const struct stat* sb, int typeflag, struct FTW* ftwbuf) { - int rv = remove(fpath); - if (rv) - perror(fpath); - - return rv; -} - -static int recursive_remove(const char* path) { - return nftw(path, recursive_remove_callback, 64, FTW_DEPTH | FTW_PHYS); -} - -void exithandler(void) -{ - if(kv) - freekeyvalues(kv); - if (ifacefile) - fclose(ifacefile); -} - -void usage(void) -{ -#ifdef ovpndebug - printf("Wrapper for OpenVPN %s-debug\n", WRAPPERVERSION); -#else - printf("Wrapper for OpenVPN %s\n", WRAPPERVERSION); -#endif - printf("openvpnctrl