1)
$input_errors[] = "Maximum number of simultaneous clients should not be greater than \"1\".";
/* checked also by javascript */
if ($_POST['method'] != "static")
$input_errors[] = "Only static address assignment is supported.";
} else {
/* rsa */
$reqdfields = array_merge($reqdfields, explode(" ", "ca_cert srv_cert srv_key dh_param"));
$reqdfieldsn = array_merge($reqdfieldsn, explode(",", "CA certificate,Server certificate,Server key,DH parameters"));
if ($_POST['type'] == "tap") {
/* tap*/
if (!$_POST['bridge']) {
if ($_POST['method'] == "ovpn") {
$reqdfields = array_merge($reqdfields, "ipblock");
$reqdfieldsn = array_merge($reqdfieldsn, "IP address block");
$check_ipblock = 1;
} else {
$input_errors[] = "Only supported address assignment is \"Managed by OpenVPN\".";
}
} else {
if ($_POST['method'] == "ovpn") {
$reqdfields = array_merge($reqdfields, explode(" ", "range_from range_to gateway"));
$reqdfieldsn = array_merge($reqdfieldsn, explode(",", "Range begin,Range end,Gateway"));
if (intval($_POST['maxcli']) > (ip2long($_POST['range_to']) - ip2long($_POST['range_from']) + 1))
$input_errors[] = "IP range to small for maximum number of simultaneous clients.";
} else if ($_POST['method'] != "dhcp") {
$input_errors[] = "Wrong or emtpy OpenVPN address assignment.";
}
}
} else {
/* tun*/
$reqdfields = array_merge($reqdfields, "ipblock");
$reqdfieldsn = array_merge($reqdfieldsn, "IP address block");
/* checked also by javascript */
if ($_POST['method'] != "ovpn")
$input_errors[] = "Only supported address assignment is \"Managed by OpenVPN\".";
$check_ipblock = 1;
}
/* valid IP */
if ($_POST['ipblock'] && $check_ipblock) {
if (!is_ipaddr($_POST['ipblock'])) {
$input_errors[] = "A valid IP netblock must be specified.";
} else if ($_POST['type'] == "tun" && intval($_POST['prefix']) > 29) {
$input_errors[] = "Network mask too high for tun-style tunnels.";
} else {
$network = ip2long(gen_subnet($_POST['ipblock'], $_POST['prefix']));
$broadcast = ip2long(gen_subnet_max($_POST['ipblock'], $_POST['prefix']));
if ($_POST['maxcli']) {
if ($_POST['type'] == "tap") {
if (intval($_POST['maxcli']) > ($broadcast - $network - 3))
$input_errors[] = "Maximum number of simultaneous clients too high";
} else {
if (intval($_POST['maxcli']) > floor(($broadcast - $network) / 4))
$input_errors[] = "Maximum number of simultaneous clients too high";
}
}
}
}
/* Sort out the cert+key files */
if (!empty($_POST['ca_cert']) &&
(!strstr($_POST['ca_cert'], "BEGIN CERTIFICATE") ||
!strstr($_POST['ca_cert'], "END CERTIFICATE")))
$input_errors[] = "The CA certificate does not appear to be valid.";
if (!empty($_POST['srv_cert']) &&
(!strstr($_POST['srv_cert'], "BEGIN CERTIFICATE") ||
!strstr($_POST['srv_cert'], "END CERTIFICATE")))
$input_errors[] = "The server certificate does not appear to be valid.";
if (!empty($_POST['srv_key']) &&
(!strstr($_POST['srv_key'], "BEGIN RSA PRIVATE KEY") ||
!strstr($_POST['srv_key'], "END RSA PRIVATE KEY")))
$input_errors[] = "The server key does not appear to be valid.";
if (!empty($_POST['dh_param']) &&
(!strstr($_POST['dh_param'], "BEGIN DH PARAMETERS") ||
!strstr($_POST['dh_param'], "END DH PARAMETERS")))
$input_errors[] = "The DH parameters do not appear to be valid.";
if (isset($_POST['tlsauth']) && empty($_POST['pre-shared-key']))
$input_errors[] = "The field 'Pre-shared secret' is required.";
}
do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
if (($_POST['range_from'] && !is_ipaddr($_POST['range_from'])))
$input_errors[] = "A valid range must be specified.";
if (($_POST['range_to'] && !is_ipaddr($_POST['range_to'])))
$input_errors[] = "A valid range must be specified.";
if ($_POST['gateway'] && !is_ipaddr($_POST['gateway']))
$input_errors[] = "A valid gateway IP address must be specified.";
/* make sure the range lies within the bridged subnet */
if ($_POST['bridge']) {
if ($_POST['method'] == "ovpn") {
$ipaddr = $config['interfaces'][$_POST['bridge']]['ipaddr'];
$subnet = $config['interfaces'][$_POST['bridge']]['subnet'];
$subnet_start = (ip2long($ipaddr) & gen_subnet_mask_long($subnet));
$subnet_end = (ip2long($ipaddr) | (~gen_subnet_mask_long($subnet)));
if (!ip_in_subnet($_POST['gateway'], gen_subnet($ipaddr, $subnet) . "/" . $subnet))
$input_errors[] = "The specified gateway lies outside of the bridged subnet.";
if ((ip2long($_POST['range_from']) < $subnet_start) || (ip2long($_POST['range_from']) > $subnet_end) ||
(ip2long($_POST['range_to']) < $subnet_start) || (ip2long($_POST['range_to']) > $subnet_end)) {
$input_errors[] = "The specified range lies outside of the bridged subnet.";
}
if (ip2long($_POST['range_from']) > ip2long($_POST['range_to']))
$input_errors[] = "The range is invalid (first element higher than second element).";
}
}
/* valid Port */
if (empty($_POST['port']))
$input_errors[] = "You must provide a server in between 1 and 65535.";
else if (!is_port($_POST['port']))
$input_errors[] = "The server port must be an integer between 1 and 65535.";
/* check if dynip is set correctly */
if ($_POST['dynip'] && $_POST['bind_iface'] != 'all')
$input_errors[] = "Dynamic IP address can only be set with interface binding set to ALL.";
if (!empty($_POST['pre-shared-key']))
if (!strstr($_POST['pre-shared-key'], "BEGIN OpenVPN Static key") ||
!strstr($_POST['pre-shared-key'], "END OpenVPN Static key"))
$input_errors[] = "Pre-shared secret does not appear to be valid.";
if ($_POST['psh_pingrst'] && $_POST['psh_pingexit'])
$input_errors[] = "Ping-restart and Ping-exit are mutually exclusive and cannot be used together";
if ($_POST['psh_rtedelay'] && !is_numeric($_POST['psh_rtedelay_int']))
$input_errors[] = "Route-delay needs a numerical interval setting.";
if ($_POST['psh_inact'] && !is_numeric($_POST['psh_inact_int']))
$input_errors[] = "Inactive needs a numerical interval setting.";
if ($_POST['psh_ping'] && !is_numeric($_POST['psh_ping_int']))
$input_errors[] = "Ping needs a numerical interval setting.";
if ($_POST['psh_pingexit'] && !is_numeric($_POST['psh_pingexit_int']))
$input_errors[] = "Ping-exit needs a numerical interval setting.";
if ($_POST['psh_pingrst'] && !is_numeric($_POST['psh_pingrst_int']))
$input_errors[] = "Ping-restart needs a numerical interval setting.";
/* Editing an existing entry? */
if (isset($id) && $ovpnsrv[$id]) {
$ovpnent = $ovpnsrv[$id];
/* bridging changed */
if ($ovpnent['bridge'] != $_POST['bridge']) {
/* double bridging? */
if ($_POST['bridge'] &&
$_POST['type'] == "tap" &&
$_POST['authentication_method'] == "rsasig")
$retval = check_bridging($_POST['bridge']);
if (!empty($retval))
$input_errors[] = $retval;
}
/* port number syntactically valid, so lets check, if it is free */
if (isset($ovpnent['enable']) &&
!isset($_POST['disabled']) &&
$ovpnent['port'] != $_POST['port']) {
/* port number has changed */
if (in_array($_POST['port'], used_port_list())) {
/* port in use, check binding */
/* return interfaces bind to this port */
$bind_list = used_bind_list($_POST['port']);
/* check if binding is in use */
if (($_POST['bind_iface'] == "all") ||
in_array("all", $bind_list) ||
in_array($_POST['bind_iface'], $bind_list) ) {
$input_errors[] = "OpenVPN binding already in use by another OpenVPN daemon.";
}
}
}
/* binding free? */
if (isset($ovpnent['enable']) &&
!isset($_POST['disabled']) &&
$ovpnent['bind_iface'] != $_POST['bind_iface']) {
/* binding has changed, remove existing old entry from list */
$entry = array();
array_push($entry, $ovpnent['bind_iface']);
$bind_list = array_diff(used_bind_list($_POST['port']), $entry);
if (count($bind_list)) {
if ($_POST['bind_iface'] == "all")
$input_errors[] = "Interface binding is already in use.";
else if (in_array("all", $bind_list) ||
in_array($_POST['bind_iface'], $bind_list))
$input_errors[] = "Interface binding is already in use.";
}
}
/* Test Server type hasn't changed */
if ($ovpnent['type'] != $_POST['type']) {
$input_errors[] = "Delete this interface first before changing the type of the tunnel to " . strtoupper($_POST['type']) .".";
}
/* status changed to enable */
if (!isset($ovpnent['enable']) && !isset($_POST['disabled'])) {
/* check if port number is free */
if (in_array($_POST['port'], used_port_list())) {
/* port in use, check binding */
/* return interfaces bind to this port */
$bind_list = used_bind_list($_POST['port']);
if (($_POST['bind_iface'] == "all") ||
in_array("all", $bind_list ) ||
in_array($_POST['bind_iface'], $bind_list) ) {
/* binding in use */
$input_errors[] = "OpenVPN binding already in use by another OpenVPN daemon.";
}
}
}
} else {
/* Creating a new entry */
$ovpnent = array();
/* port number syntactically valid, so lets check, if it is free */
if ($_POST['port']) {
/* new port number */
$bind_list = used_bind_list($_POST['port']);
if (in_array($_POST['port'], used_port_list())) {
/* port in use, check binding */
if (($_POST['bind_iface'] == "all") ||
in_array("all", $bind_list ) ||
in_array($_POST['bind_iface'], $bind_list) ) {
/* binding in use */
$input_errors[] = "Port {$_POST['port']} is already used for another interface.";
}
}
}
if (!($ovpnent['tun_iface'] = getnxt_if($_POST['type'])))
$input_errors[] = "Run out of devices for a tunnel of type {$_POST['type']}";
/* double bridging? */
if ($ovpnent['bridge'] != $_POST['bridge']) {
/* double bridging? */
if ($_POST['bridge'] &&
$_POST['type'] == "tap" &&
$_POST['authentication_method'] == "rsasig")
$retval = check_bridging($_POST['bridge']);
if (!empty($retval))
$input_errors[] = $retval;
}
}
if (!$input_errors) {
$ovpnent['enable'] = isset($_POST['disabled']) ? false : true;
$ovpnent['bind_iface'] = $_POST['bind_iface'];
$ovpnent['port'] = $_POST['port'];
$ovpnent['proto'] = $_POST['proto'];
$ovpnent['type'] = $_POST['type'];
$ovpnent['method'] = $_POST['method'];
$ovpnent['authentication_method'] = $_POST['authentication_method'];
/* convert IP address block to a correct network IP address */
$ovpnent['ipblock'] = gen_subnet($_POST['ipblock'], $_POST['prefix']);
$ovpnent['prefix'] = $_POST['prefix'];
$ovpnent['lipaddr'] = $_POST['lipaddr'];
$ovpnent['ripaddr'] = $_POST['ripaddr'];
$ovpnent['netmask'] = $_POST['netmask'];
$ovpnent['range_from'] = $_POST['range_from'];
$ovpnent['range_to'] = $_POST['range_to'];
$ovpnent['gateway'] = $_POST['gateway'];
$ovpnent['bridge'] = $_POST['bridge'];
$ovpnent['descr'] = $_POST['descr'];
$ovpnent['verb'] = $_POST['verb'];
$ovpnent['maxcli'] = $_POST['maxcli'];
$ovpnent['crypto'] = $_POST['crypto'];
$ovpnent['comp_method'] = $_POST['comp_method'];
$ovpnent['cli2cli'] = $_POST['cli2cli'] ? true : false;
$ovpnent['dupcn'] = $_POST['dupcn'] ? true : false;
$ovpnent['dynip'] = $_POST['dynip'] ? true : false;
$ovpnent['tlsauth'] = $_POST['tlsauth'] ? true : false;
$ovpnent['crlname'] = $_POST['crlname'];
unset($ovpnent['pre-shared-key']);
if ($_POST['pre-shared-key'])
$ovpnent['pre-shared-key'] = base64_encode($_POST['pre-shared-key']);
$ovpnent['psh_options']['redir'] = $_POST['psh_redir'] ? true : false;
$ovpnent['psh_options']['redir_loc'] = $_POST['psh_redir_loc'] ? true : false;
$ovpnent['psh_options']['rtedelay'] = $_POST['psh_rtedelay'] ? true : false;
$ovpnent['psh_options']['inact'] = $_POST['psh_inact'] ? true : false;
$ovpnent['psh_options']['ping'] = $_POST['psh_ping'] ? true : false;
$ovpnent['psh_options']['pingrst'] = $_POST['psh_pingrst'] ? true : false;
$ovpnent['psh_options']['pingexit'] = $_POST['psh_pingexit'] ? true : false;
unset($ovpnent['psh_options']['rtedelay_int']);
unset($ovpnent['psh_options']['inact_int']);
unset($ovpnent['psh_options']['ping_int']);
unset($ovpnent['psh_options']['pingrst_int']);
unset($ovpnent['psh_options']['pingexit_int']);
if ($_POST['psh_rtedelay_int'])
$ovpnent['psh_options']['rtedelay_int'] = $_POST['psh_rtedelay_int'];
if ($_POST['psh_inact_int'])
$ovpnent['psh_options']['inact_int'] = $_POST['psh_inact_int'];
if ($_POST['psh_ping_int'])
$ovpnent['psh_options']['ping_int'] = $_POST['psh_ping_int'];
if ($_POST['psh_pingrst_int'])
$ovpnent['psh_options']['pingrst_int'] = $_POST['psh_pingrst_int'];
if ($_POST['psh_pingexit_int'])
$ovpnent['psh_options']['pingexit_int'] = $_POST['psh_pingexit_int'];
$ovpnent['ca_cert'] = base64_encode($_POST['ca_cert']);
$ovpnent['srv_cert'] = base64_encode($_POST['srv_cert']);
$ovpnent['srv_key'] = base64_encode($_POST['srv_key']);
$ovpnent['dh_param'] = base64_encode($_POST['dh_param']);
/* expertmode params */
$ovpnent['expertmode_enabled'] = $_POST['expertmode_enabled'] ? true : false;
if (!is_array($options))
$options = array();
if (!is_array($ovpnent['expertmode']))
$ovpnent['expertmode'] = array();
$options['option'] = array_map('trim', explode("\n", trim($_POST['expertmode_options'])));
$ovpnent['expertmode'] = $options;
if (isset($id) && $ovpnsrv[$id])
$ovpnsrv[$id] = $ovpnent;
else
$ovpnsrv[] = $ovpnent;
write_config();
ovpn_srv_dirty($ovpnent['tun_iface']);
header("Location: vpn_openvpn_srv.php");
exit;
} else {
$pconfig = $_POST;
$pconfig['enable'] = "true";
if (isset($_POST['disabled']))
unset($pconfig['enable']);
$pconfig['pre-shared-key'] = base64_encode($_POST['pre-shared-key']);
$pconfig['ca_cert'] = base64_encode($_POST['ca_cert']);
$pconfig['srv_cert'] = base64_encode($_POST['srv_cert']);
$pconfig['srv_key'] = base64_encode($_POST['srv_key']);
$pconfig['dh_param'] = base64_encode($_POST['dh_param']);
$pconfig['psh_options']['redir'] = $_POST['psh_redir'];
$pconfig['psh_options']['redir_loc'] = $_POST['psh_redir_loc'];
$pconfig['psh_options']['rtedelay'] = $_POST['psh_rtedelay'];
$pconfig['psh_options']['inact'] = $_POST['psh_inact'];
$pconfig['psh_options']['ping'] = $_POST['psh_ping'];
$pconfig['psh_options']['pingrst'] = $_POST['psh_pingrst'];
$pconfig['psh_options']['pingexit'] = $_POST['psh_pingexit'];
$pconfig['psh_options']['rtedelay_int'] = $_POST['psh_rtedelay_int'];
$pconfig['psh_options']['inact_int'] = $_POST['psh_inact_int'];
$pconfig['psh_options']['ping_int'] = $_POST['psh_ping_int'];
$pconfig['psh_options']['pingrst_int'] = $_POST['psh_pingrst_int'];
$pconfig['psh_options']['pingexit_int'] = $_POST['psh_pingexit_int'];
}
}
$pgtitle = array("VPN","OpenVPN","Edit server");
include("head.inc");
?>