#!/bin/sh

export DATE="24.4.2010";SCRIPT=${0#/rom}
export TITLE="Admin:
OpenVPN RSA"
. ${SCRIPT%/*}/cgi-bin-pre.sh

cat<<EOF
<H1>Admin:
OpenVPN RSA</H1>
EOF

key_encode() {
local l=
local o=
for l in $(echo "$1"|sed 's/%/%25/g;s/ /%20/g;s/\//%2f/g;s/:/%3a/g;s/=/%3d/g;s/[[:cntrl:]]//g;a%0a');do
o=$o$l
done
echo -n $o
}
client=
ff_ovpn_tmp_crt_key=
ff_ovpn_cli=
if test -f /etc/init.d/S91openvpn;then
ff_ovpn_cli=$(nvram get ff_ovpn_cli)
fi
case $REQUEST_METHOD in POST)
read QUERY_STRING
;;esac
case $QUERY_STRING in "")
wan_hostname="$(nvram get wan_hostname)"
ff_ovpn_clientremote="$(nvram get ff_ovpn_clientremote)"
ff_ovpn_ca_crt="$(nvram get ff_ovpn_ca_crt)"
ff_ovpn_ca_key="$(nvram get ff_ovpn_ca_key)"
ff_ovpn_crt_key="$(nvram get ff_ovpn_crt_key)"
ff_ovpn_dh="$(nvram get ff_ovpn_dh)"
;;*)
IFS=\&;set $QUERY_STRING;unset IFS;eval $*
client="$(unescape $client)"
wan_hostname="$(unescape $wan_hostname)"
ff_ovpn_clientremote="$(unescape $ff_ovpn_clientremote)"
ff_ovpn_ca_crt="$(unescape $ff_ovpn_ca_crt)"
ff_ovpn_ca_key="$(unescape $ff_ovpn_ca_key)"
ff_ovpn_crt_key="$(unescape $ff_ovpn_crt_key)"
ff_ovpn_dh="$(unescape $ff_ovpn_dh)"
export KEY_CITY=
export KEY_CN=
export KEY_COUNTRY=
export KEY_DIR=/tmp/keys
export KEY_EMAIL=
export KEY_EXPIRE=3650
export KEY_NAME=
export KEY_ORG=Freifunk
export KEY_OU=
export KEY_PROVINCE=
export KEY_SIZE=1024
test -d $KEY_DIR || mkdir $KEY_DIR
test -f $KEY_DIR/serial || echo 01 > $KEY_DIR/serial
test -f $KEY_DIR/index.txt || : > $KEY_DIR/index.txt
case $post_build_ca in "");;*)
unset QUERY_STRING
echo '<PRE ID="work">'
export KEY_CN="${wan_hostname}_CA"
/usr/bin/openssl req \
-batch \
-days $KEY_EXPIRE \
-nodes \
-new \
-newkey rsa:$KEY_SIZE \
-sha1 \
-x509 \
-config /etc/openssl.cnf \
-keyout $KEY_DIR/ca.key \
-out $KEY_DIR/ca.crt
ff_ovpn_ca_crt=$(cat<<EOF
$KEY_CN.crt:
$(cat $KEY_DIR/ca.crt|sed -n '/^-----/,/^-----/p')
EOF
)
ff_ovpn_ca_key=$(cat<<EOF
$KEY_CN.key:
$(cat $KEY_DIR/ca.key|sed -n '/^-----/,/^-----/p')
EOF
)
echo '</PRE>'
;;esac
case $post_build_key_server in "");;*)
unset QUERY_STRING
echo '<PRE ID="work">'
echo "$ff_ovpn_ca_crt" > $KEY_DIR/ca.crt
echo "$ff_ovpn_ca_key" > $KEY_DIR/ca.key
export KEY_CN="${wan_hostname}_SERVER"
/usr/bin/openssl req \
-batch \
-days $KEY_EXPIRE \
-nodes \
-new \
-newkey rsa:$KEY_SIZE \
-extensions server \
-config /etc/openssl.cnf \
-keyout $KEY_DIR/server.key \
-out $KEY_DIR/server.csr
/usr/bin/openssl ca \
-batch \
-days $KEY_EXPIRE \
-md sha1 \
-extensions server \
-config /etc/openssl.cnf \
-out $KEY_DIR/server.crt \
-in $KEY_DIR/server.csr
unset LF
ff_ovpn_crt_key=$(cat<<EOF
$KEY_CN.crt:
$(cat $KEY_DIR/server.crt|sed -n '/^-----/,/^-----/p')
$LF
$KEY_CN.key:
$(cat $KEY_DIR/server.key|sed -n '/^-----/,/^-----/p')
EOF
)
echo '</PRE>'
;;esac
case $post_build_key_client in "");;*)
unset QUERY_STRING
echo '<PRE ID="work">'
case $client in "")echo "Error: no client name set";;*)
echo "$ff_ovpn_ca_crt" > $KEY_DIR/ca.crt
echo "$ff_ovpn_ca_key" > $KEY_DIR/ca.key
export KEY_CN="${wan_hostname}_${client}"
/usr/bin/openssl req \
-batch \
-days 3650 \
-nodes \
-new \
-newkey rsa:1024 \
-config /etc/openssl.cnf \
-keyout $KEY_DIR/client.key \
-out $KEY_DIR/client.csr
/usr/bin/openssl ca \
-batch \
-days 3650 \
-md sha1 \
-config /etc/openssl.cnf \
-out $KEY_DIR/client.crt \
-in $KEY_DIR/client.csr
unset LF
ff_ovpn_tmp_crt_key=$(cat<<EOF
$KEY_CN.crt:
$(cat $KEY_DIR/client.crt|sed -n '/^-----/,/^-----/p')
$LF
$KEY_CN.key:
$(cat $KEY_DIR/client.key|sed -n '/^-----/,/^-----/p')
EOF
)
;;esac
echo '</PRE>'
;;esac
case $post_build_dh in "");;*)
unset QUERY_STRING
echo '<PRE ID="work">'
/usr/bin/openssl dhparam \
-out $KEY_DIR/dh${KEY_SIZE}.pem \
$KEY_SIZE
ff_ovpn_dh="$(cat $KEY_DIR/dh${KEY_SIZE}.pem)"
echo '</PRE>'
;;esac
# Make sure we got all from nvram config
rm -r $KEY_DIR
;;esac
case $QUERY_STRING in "")

cat<<EOF
<SCRIPT LANGUAGE="JavaScript" TYPE="text/javascript">
function hideWork() {
var obj=document.getElementById('work');
if (null!=obj)obj.style.display='none';
}
window.onload=function(){setTimeout("hideWork()",1500);}
</SCRIPT>
<FORM ACTION="openvpn-easyrsa.html" METHOD="POST"><TABLE CLASS="shadow0" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE CLASS="shadow1" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE CLASS="shadow2" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE BORDER="0"
CLASS="form" STYLE="padding-top:8pt"><TR><TD>Client Name:</TD>
<TD COLSPAN="2"><INPUT MAXLENGTH="48" NAME="client" SIZE="24" TYPE="TEXT" VALUE="$client">&nbsp;(Mandatory to Generate)
EOF

case $ff_ovpn_cli in 0)

cat<<EOF
</TD>
</TR>
<TR><TD>Download:</TD>
<TD COLSPAN="2">
EOF

case $ff_ovpn_tmp_crt_key in "")

cat<<EOF
Key
missing for
EOF

;;*)key=$(key_encode "$ff_ovpn_crt_key");echo -n "<a href=\"openvpn-easyrsa.sh/$key/$ff_ovpn_clientremote/ovpn-${wan_hostname}_${client}.tar\">";;esac

cat<<EOF
Client
Configuration (Tar)
EOF

case $ff_ovpn_tmp_crt_key in "");;*)echo -n "</a>";;esac;;esac

cat<<EOF
</TD>
</TR>
<TR><TD VALIGN="TOP">Client
Certificate (*.crt) &amp;<BR>
Client Key (*.key):</TD><TD ROWSPAN="2" VALIGN="TOP"><TEXTAREA NAME="ff_ovpn_tmp_crt_key" ROWS="4" COLS="66" READONLY="READONLY">$ff_ovpn_tmp_crt_key</TEXTAREA></TD>
<TD ROWSPAN="2" VALIGN="TOP"><IMG SRC="../images/copy.gif" WIDTH="16" HEIGHT="16" TITLE="Secret / Transport to Client"></TD>
</TR><TR><TD VALIGN="BOTTOM"><INPUT NAME="post_build_key_client" VALUE="Generate Client Pair" TYPE="submit" ONCLICK="if(''==this.form.client.value)return false"$(case $ff_ovpn_ca_key in "")echo ' disabled="disabled"';;esac)></TD>
</TR>
</TABLE></TD></TR></TABLE></TD></TR></TABLE></TD></TR></TABLE>
<P>&nbsp;</P>
<TABLE CLASS="shadow0" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE CLASS="shadow1" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE CLASS="shadow2" CELLPADDING="0" CELLSPACING="0"><TR><TD><TABLE BORDER="0" CLASS="form"><TR><TD>
EOF

case $ff_ovpn_cli in 0)

cat<<EOF
External
Address:</TD><TD COLSPAN="2"><INPUT NAME="ff_ovpn_clientremote" SIZE="24" TYPE="TEXT" VALUE="$ff_ovpn_clientremote" MAXLENGTH="48">&nbsp;(For client
config tar, see above)</TD>
</TR><TR><TD>
EOF

;;esac

cat<<EOF
Host Name:</TD>
<TD COLSPAN="2"><INPUT NAME="wan_hostname" SIZE="24" TYPE="TEXT" VALUE="$wan_hostname" MAXLENGTH="48">&nbsp;(Prefix for all CN)</TD>
</TR><TR><TD VALIGN="TOP">CA
Certificate (ca.crt):</TD><TD VALIGN="TOP"><TEXTAREA NAME="ff_ovpn_ca_crt" ROWS="4" COLS="66">$ff_ovpn_ca_crt</TEXTAREA></TD>
<TD VALIGN="TOP"><IMG SRC="../images/public.gif" TITLE="Publish / For Clients" WIDTH="16" HEIGHT="16"></TD>
</TR><TR><TD VALIGN="TOP">CA
Key (ca.key):</TD><TD ROWSPAN="2" VALIGN="TOP"><TEXTAREA NAME="ff_ovpn_ca_key" ROWS="4" COLS="66">$ff_ovpn_ca_key</TEXTAREA></TD>
<TD ROWSPAN="2" VALIGN="TOP"><IMG SRC="../images/secret.gif" TITLE="Secret / For Server Only" WIDTH="16" HEIGHT="21"></TD>
</TR><TR><TD VALIGN="BOTTOM"><INPUT NAME="post_build_ca" VALUE="Generate CA" TYPE="submit"></TD>
</TR><TR><TD COLSPAN="3">&nbsp;</TD>
</TR><TR><TD VALIGN="TOP">Server
Certificate (server.crt) &amp; Server Key (server.key):</TD><TD
ROWSPAN="2" VALIGN="TOP"><TEXTAREA NAME="ff_ovpn_crt_key" ROWS="4" COLS="66">$ff_ovpn_crt_key</TEXTAREA>
</TD><TD ROWSPAN="2" VALIGN="TOP"><IMG SRC="../images/secret.gif" TITLE="Secret / For Server Only" WIDTH="16" HEIGHT="21"></TD>
</TR><TR><TD VALIGN="BOTTOM"><INPUT NAME="post_build_key_server" VALUE="Generate Server Pair" TYPE="submit"$(case $ff_ovpn_ca_key in "")echo ' disabled="disabled"';;esac)></TD>
</TR>
<TR><TD COLSPAN="3">&nbsp;</TD>
</TR><TR><TD>Diffie
Hellman Parameters:</TD><TD ROWSPAN="2"><TEXTAREA NAME="ff_ovpn_dh" ROWS="4" COLS="66">$ff_ovpn_dh</TEXTAREA>
</TD><TD ROWSPAN="2"><IMG SRC="../images/secret.gif" TITLE="Secret / For Server Only" WIDTH="16" HEIGHT="21"></TD>
</TR><TR><TD VALIGN="BOTTOM"><INPUT NAME="post_build_dh" VALUE="Generate DH" TYPE="submit"></TD>
</TR><TR><TD COLSPAN="3">&nbsp;</TD>
</TR><TR><TD COLSPAN="3">&nbsp;<INPUT NAME="post_ovpn" TITLE="Apply these settings. The settings are applied with the next restart." VALUE="Apply" TYPE="submit">&nbsp;&nbsp;&nbsp;
<INPUT NAME="post_abort" TITLE="Cancel dialog page." VALUE="Cancel" TYPE="submit">&nbsp;</TD>
</TR>
</TABLE></TD></TR></TABLE></TD></TR></TABLE></TD></TR></TABLE></FORM>
<P><B>Tip</B>:
This page manages only the first configuration, if multiple OpenVPN
configurations are present. For a secondary OpenVPN server (e.g. with TCP
on another port) you therefore need to copy the respective input fields
from the first to the second configuration page manually.</P>
<H2>Hints
on Managing Keys</H2>
<UL>
<LI>A
key can be used to encrypt or decrypt a data stream. A certificate
proves the authenticity of a key. All keys and certificates generated
here are valid for 10 years.</LI>
<LI> The CA (&quot;Certificate
Authoritiy&quot;) is required to prove the authenticity of all generated
keys and certificates. On this server, you will generate a CA key in a
first step. This key is secret, so do not distribute.</LI>
<LI> By using the CA key, a CA certificate is
also created. Disribute the CA certificate to all clients. <B>Note</B>:
Everybody can generate self-signed certificates. You can spend more
money by inviting third parties to validate authenticity (e.g.
goverments or companies). Their competence and honesty is trusted e.g.
by a lot of web browsers. For that reason, web browsers include
pre-installed CA certificates which they trust blindly. If you carry a
CA certificate from Computer to Computer, make sure to avoid the bad
guys which may exchange the storage medium underway.</LI>
<LI> In a second step, you generate a
pair of a key and a certificate for the server. This pair stays on the
server.</LI>
<LI> In additional steps, you generate
pairs of keys and certificates for every client. Transport these pairs
to the clients on a secure channel. Now repeat these steps for every
client:
<OL>
<LI>Fill
in the <B>Client Name</B> input field.</LI>
<LI>Click the <B>Generate Client
Pair</B> button.</LI>
<LI>Copy the
contents of the <B>Client Certificate &amp; Client Key</B> field to
a text file via clipboard.</LI>
<LI>Transport the text file to the
client and enter it's contents there in the <B>Certificate &amp;
Key</B> input field.</LI>
</OL>
<P><B>Tip</B>:
First configure the OpenVPN server as desired. Use the first OpenVPN
configuration, if more than one configuration is present. Then, after
you created a client key, click the <B>Client Configuration (Tar)</B>
link. The downloaded archive file can be used e.g. with the Windows
OpenVPN GUI: unpack the archive contents to C:\Program
Files\OpenVPN\config.</P>
<P><B>Note</B>: Storage space on
this router is limited. For this reason, generated keys and
certificates for clients are not saved. To revoke single keys later
on, you may store published keys elsewere. A CRL (Certificate
Revocation List) is not managed by this user interface.</P></LI>
<LI>The server
requires the &quot;Diffie Hellman&quot; parameters to optimize the data
connection by using a faster symmetric encryption. Copy these parameters
from one of your others servers or generate new parameters. The
paramters are secret, so do not distribute. <B>Attention</B>: this
process requires up to 15 minutes on a router.</LI>
<LI>If
you are ready, do not forget to save all settings by clicking on the
<B>Apply</B> button.</LI>
</UL>
EOF

;;*)
DIRTY=
case $post_ovpn in "");;*)
keys="wan_hostname ff_ovpn_ca_crt ff_ovpn_ca_key ff_ovpn_crt_key ff_ovpn_dh"
case $ff_ovpn_cli in 0)keys="$keys ff_ovpn_clientremote";;esac
for V in $keys; do
eval C=\"\$$V\"
case "$(nvram get $V)" in "$C");;*)
DIRTY=1
nvram set $V="$C"
;;esac
done
;;esac
case $DIRTY in "")

cat<<EOF
<TABLE BORDER="0" CLASS="note"><TR><TD>No settings are
changed.</TD>
</TR>
</TABLE>
EOF

;;1)
nvram commit>&- 2>&-

cat<<EOF
<TABLE BORDER="0" CLASS="note"><TR><TD> The
changed settings are committed. The settings are active after the next
<A HREF="reset.html">Restart</A>.   </TD>
</TR>
</TABLE>
EOF

;;esac
;;esac

. ${SCRIPT%/*}/cgi-bin-post.sh