function BuildTunServer(){
LoadArgvs();
$unix=new unix();
if(isset($GLOBALS["CLASS_SOCKETS"])){$sock=$GLOBALS["CLASS_SOCKETS"];}else{$GLOBALS["CLASS_SOCKETS"]=new sockets();$sock=$GLOBALS["CLASS_SOCKETS"];}
$servername=$unix->hostname_g();
$routess=array();
$duplicate_cn=null;
if(preg_match("#^(.+?)\.#",$servername,$re)){$servername=$re[1];}
$servername=strtoupper($servername);
echo "Starting......: OpenVPN building settings for $servername...\n";
$ini=new Bs_IniHandler();
$ini->loadString($sock->GET_INFO("ArticaOpenVPNSettings"));
if(!isset($ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"])){$ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"]=0;}
if(!isset($ini->_params["GLOBAL"]["IP_START"])){$ini->_params["GLOBAL"]["IP_START"]="10.8.0.0";}
if(!isset($ini->_params["GLOBAL"]["NETMASK"])){$ini->_params["GLOBAL"]["NETMASK"]="255.255.255.0";}
if($ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"]==1){
echo "Starting......: OpenVPN building settings mode bridge enabled...\n";
BuildBridgeServer();
return;
}
$IPTABLES_ETH=$GLOBALS["IPTABLES_ETH"];
$DEV_TYPE=$ini->_params["GLOBAL"]["DEV_TYPE"];
$port=$ini->_params["GLOBAL"]["LISTEN_PORT"];
$IP_START=$ini->_params["GLOBAL"]["IP_START"];
$NETMASK=$ini->_params["GLOBAL"]["NETMASK"];
$bind_addr=$ini->_params["GLOBAL"]["LOCAL_BIND"];
$LISTEN_PROTO=$ini->_params["GLOBAL"]["LISTEN_PROTO"];
if($LISTEN_PROTO==null){$LISTEN_PROTO="udp";}
if($LISTEN_PROTO=="udp"){$proto="--proto udp";}else{$proto="--proto tcp-server";}
if(trim($port)==null){$port=1194;}
if(trim($IP_START)==null){$IP_START="10.8.0.0";}
if(trim($NETMASK)==null){$NETMASK="255.255.255.0";}
$nic=new networking();
while (list ($num, $ligne) = each ($nic->array_TCP) ){
if($ligne==null){continue;}
$eths[][$num]=$num;
$ethi[$num]=$ligne;
}
if($IPTABLES_ETH<>null){
echo "Starting......: OpenVPN linked to $IPTABLES_ETH ({$ethi[$IPTABLES_ETH]})...\n";
$IPTABLES_ETH_ROUTE=IpCalcRoute($ethi[$IPTABLES_ETH]);
}else{
echo "Starting......: OpenVPN no local NIC linked...\n";
}
$ca='/etc/artica-postfix/openvpn/keys/allca.crt';
$dh='/etc/artica-postfix/openvpn/keys/dh1024.pem';
$key="/etc/artica-postfix/openvpn/keys/vpn-server.key";
$crt="/etc/artica-postfix/openvpn/keys/vpn-server.crt";
$route='';
//$IPTABLES_ETH_IP=
if (is_file('/etc/artica-postfix/settings/Daemons/OpenVPNRoutes')){
$routes=(explode("\n",@file_get_contents("/etc/artica-postfix/settings/Daemons/OpenVPNRoutes")));
while (list ($num, $ligne) = each ($routes) ){
if(!preg_match("#(.+?)\s+(.+)#",$ligne,$re)){continue;}
$routess[]="--push \"route {$re[1]} {$re[2]}\"";
}
}
$GetRoutes=GetRoutes();
$routess=$routess+$GetRoutes;
if(count($routess)==0){
if($IPTABLES_ETH_ROUTE<>null){
echo "Starting......: OpenVPN IP adding default route \"$IPTABLES_ETH_ROUTE\"\n";
$routess[]="--push \"route $IPTABLES_ETH_ROUTE\"";
}
}else{
echo "Starting......: OpenVPN IP adding ".count($routess)." routes\n";
}
if(trim($bind_addr)<>null){
$local=" --local $bind_addr";
echo "Starting......: OpenVPN IP bind $bind_addr\n";
}
$IP_START=FIX_IP_START($IP_START,$local);
$ini->set("GLOBAL","IP_START",$IP_START);
if(preg_match("#(.+?)\.([0-9]+)$#",$IP_START,$re)){
$calc_ip=" {$re[1]}.0";
$calc_ip_end="{$re[1]}.254";
echo "Starting......: OpenVPN IP pool from {$re[1]}.2 to {$re[1]}.254 mask:$NETMASK\n";
$server_ip="{$re[1]}.1";
$IP_START_PREFIX=$re[1];
}
if($NETMASK==null){
$ip=new IP();
$cdir=$ip->ip2cidr($calc_ip,$calc_ip_end);
$arr=$ip->parseCIDR($cdir);
$rang=$arr[0];
$netbit=$arr[1];
$ipv=new ipv4($calc_ip,$netbit);
$NETMASK=$ipv->netmask();
if($NETMASK=="255.255.255.255"){$NETMASK="255.255.255.0";}
echo "Starting......: OpenVPN Netmask is null for the range $calc_ip, assume $NETMASK\n";
$ini->set("GLOBAL","NETMASK",$NETMASK);
}
$OpenVpnPasswordCert=$sock->GET_INFO("OpenVpnPasswordCert");
if($OpenVpnPasswordCert==null){$OpenVpnPasswordCert="MyKey";}
$askpass=null;
if(is_file("/etc/artica-postfix/openvpn/keys/password")){
$askpass="******";
}
$ifconfig_pool_persist=" --ifconfig-pool-persist /etc/artica-postfix/openvpn/ipp.txt ";
if(isset($GLOBALS["OPENVPNPARAMS"]["duplicate-cn"])){
echo "Starting......: OpenVPN duplicate-cn is enabled\n";
$duplicate_cn=" --duplicate-cn ";
$ifconfig_pool_persist=null;
}
if(isset($GLOBALS["OPENVPNPARAMS"]["script-security"])){
echo "Starting......: OpenVPN script-security is enabled\n";
$script_security=" --script-security 2";
}
if(!is_dir("/etc/openvpn/cdd")){@mkdir("/etc/openvpn/cdd");}
$already=array();
echo "Starting......: OpenVPN get remote sites routes...\n";
$sql="SELECT sitename,IP_START,netmask,remote_site_routes,FixedIPAddr FROM vpnclient WHERE connexion_type=1";
$q=new mysql();
$results=$q->QUERY_SQL($sql,"artica_backup");
if(!$q->ok){echo2("Starting......: OpenVPN : $q->mysql_error");}
while($ligne=mysql_fetch_array($results,MYSQL_ASSOC)){
$iroute=array();
$sitename=$ligne["sitename"];
$FixedIPAddr=$ligne["FixedIPAddr"];
if(!is_numeric($FixedIPAddr)){$FixedIPAddr=0;}
if($IP_START_PREFIX<>null){
if($FixedIPAddr>2){
if($FixedIPAddr<255){
echo "Starting......: OpenVPN $sitename $IP_START_PREFIX.$FixedIPAddr fixed IP address\n";
$iroute[]="ifconfig-push $IP_START_PREFIX.$FixedIPAddr $IP_START_PREFIX.2";
}
}
}
if(!isset($already[$ligne["IP_START"]])){
echo "Starting......: OpenVPN $sitename ({$ligne["IP_START"]} {$ligne["netmask"]})\n";
$rou[]=" --route {$ligne["IP_START"]} {$ligne["netmask"]}";
$iroute[]="iroute {$ligne["IP_START"]} {$ligne["netmask"]}";
$already[$ligne["IP_START"]]=true;
}
$remote_site_routes=unserialize(base64_decode($ligne["remote_site_routes"]));
while (list ($num, $site_mask) = each ($remote_site_routes) ){
if(!isset($already[$num])){
echo "Starting......: OpenVPN $sitename ($num $site_mask)\n";
$rou[]=" --route $num $site_mask";
$iroute[]="iroute $num $site_mask";
$already[$num]=true;
}
}
echo "Starting......: OpenVPN cdd $sitename\n";
@file_put_contents("/etc/openvpn/cdd/$sitename",@implode("\n", $iroute) );
}
if(count($rou)>0){
$localroutes=@implode(" ", $rou);
$client_config_dir=" --client-config-dir /etc/openvpn/cdd";
}
$LDAP_AUTH=$ini->_params["GLOBAL"]["LDAP_AUTH"];
if($LDAP_AUTH==1){
if(is_file("/usr/lib/openvpn/openvpn-auth-pam.so")){
$plugin=" --plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth";
echo "Starting......: OpenVPN auth is enabled\n";
shell_exec("/usr/share/artica-postfix/bin/artica-install --nsswitch");
}
}
@mkdir("/etc/openvpn/ccd",0666,true);
$php5=$unix->LOCATE_PHP5_BIN();
$me=__FILE__;
$cmd=" --port $port --dev tun $proto --server $IP_START $NETMASK$localroutes$client_config_dir --comp-lzo $local --ca $ca --dh $dh --key $key --cert $crt";
$cmd=$cmd. "$ifconfig_pool_persist " . implode(" ",$routess);
$cmd=$cmd. " $askpass$duplicate_cn--client-to-client$script_security$plugin --learn-address \"$php5 $me --client-connect\" --keepalive 10 60 --persist-tun --verb 5 --daemon --writepid /var/run/openvpn/openvpn-server.pid --log \"/var/log/openvpn/openvpn.log\"";
$cmd=$cmd. " --status /var/log/openvpn/openvpn-status.log 10";
echo "Starting......: OpenVPN building /etc/openvpn/cmdline.conf done\n";
@file_put_contents("/etc/openvpn/cmdline.conf",$cmd);
$sock->SaveConfigFile($ini->toString(),"ArticaOpenVPNSettings");
send_email_events("OpenVPN was successfully reconfigured",$cmd,"VPN");
echo "Starting......: OpenVPN building settings done.\n";
if($GLOBALS["VERBOSE"]){writelogs("$cmd",__FUNCTION__,__FILE__,__LINE__);}
}
function BuildTunServer()
{
$unix = new unix();
$sock = new sockets();
$servername = $unix->hostname_g();
if (preg_match("#^(.+?)\\.#", $servername, $re)) {
$servername = $re[1];
}
$servername = strtoupper($servername);
echo "Starting......: OpenVPN building settings for {$servername}...\n";
$ini = new Bs_IniHandler();
$sock = new sockets();
$ini->loadString($sock->GET_INFO("ArticaOpenVPNSettings"));
if ($ini->_params["GLOBAL"]["ENABLE_BRIDGE_MODE"] == 1) {
echo "Starting......: OpenVPN building settings mode bridge enabled...\n";
BuildBridgeServer();
return;
}
$IPTABLES_ETH = $GLOBALS["IPTABLES_ETH"];
$DEV_TYPE = $ini->_params["GLOBAL"]["DEV_TYPE"];
$port = $ini->_params["GLOBAL"]["LISTEN_PORT"];
$IP_START = $ini->_params["GLOBAL"]["IP_START"];
$NETMASK = $ini->_params["GLOBAL"]["NETMASK"];
$bind_addr = $ini->_params["GLOBAL"]["LOCAL_BIND"];
if (trim($port) == null) {
$port = 1194;
}
if (trim($IP_START) == null) {
$IP_START = "10.8.0.0";
}
if (trim($NETMASK) == null) {
$IP_START = "255.255.255.0";
}
$nic = new networking();
while (list($num, $ligne) = each($nic->array_TCP)) {
if ($ligne == null) {
continue;
}
$eths[][$num] = $num;
$ethi[$num] = $ligne;
}
if ($IPTABLES_ETH != null) {
echo "Starting......: OpenVPN linked to {$IPTABLES_ETH} ({$ethi[$IPTABLES_ETH]})...\n";
$IPTABLES_ETH_ROUTE = IpCalcRoute($ethi[$IPTABLES_ETH]);
} else {
echo "Starting......: OpenVPN no local NIC linked...\n";
}
$ca = '/etc/artica-postfix/openvpn/keys/allca.crt';
$dh = '/etc/artica-postfix/openvpn/keys/dh1024.pem';
$key = "/etc/artica-postfix/openvpn/keys/vpn-server.key";
$crt = "/etc/artica-postfix/openvpn/keys/vpn-server.crt";
$route = '';
//$IPTABLES_ETH_IP=
if (is_file('/etc/artica-postfix/settings/Daemons/OpenVPNRoutes')) {
$routes = explode("\n", @file_get_contents("/etc/artica-postfix/settings/Daemons/OpenVPNRoutes"));
while (list($num, $ligne) = each($routes)) {
if (!preg_match("#(.+?)\\s+(.+)#", $ligne, $re)) {
continue;
}
$routess[] = "--push \"route {$re[1]} {$re[2]}\"";
}
}
$routess[] = GetRoutes();
if (count($routess) == 0) {
if ($IPTABLES_ETH_ROUTE != null) {
echo "Starting......: OpenVPN IP adding default route \"{$IPTABLES_ETH_ROUTE}\"\n";
$routess[] = "--push \"route {$IPTABLES_ETH_ROUTE}\"";
}
} else {
echo "Starting......: OpenVPN IP adding " . count($routess) . " routes\n";
}
if (trim($bind_addr) != null) {
$local = " --local {$bind_addr}";
echo "Starting......: OpenVPN IP bind {$bind_addr}\n";
}
$IP_START = FIX_IP_START($IP_START, $local);
$ini->set("GLOBAL", "IP_START", $IP_START);
if (preg_match("#(.+?)\\.([0-9]+)\$#", $IP_START, $re)) {
$calc_ip = " {$re[1]}.0";
$calc_ip_end = "{$re[1]}.254";
echo "Starting......: OpenVPN IP pool from {$re[1]}.2 to {$re[1]}.254 mask:{$NETMASK}\n";
$server_ip = "{$re[1]}.1";
}
if ($NETMASK == null) {
$ip = new IP();
$cdir = $ip->ip2cidr($calc_ip, $calc_ip_end);
$arr = $ip->parseCIDR($cdir);
$rang = $arr[0];
$netbit = $arr[1];
$ipv = new ipv4($calc_ip, $netbit);
$NETMASK = $ipv->netmask();
if ($NETMASK == "255.255.255.255") {
$NETMASK = "255.255.255.0";
}
echo "Starting......: OpenVPN Netmask is null for the range {$calc_ip}, assume {$NETMASK}\n";
$ini->set("GLOBAL", "NETMASK", $NETMASK);
}
$OpenVpnPasswordCert = $sock->GET_INFO("OpenVpnPasswordCert");
if ($OpenVpnPasswordCert == null) {
$OpenVpnPasswordCert = "MyKey";
}
if (is_file("/etc/artica-postfix/openvpn/keys/password")) {
$askpass = "******";
}
$cmd = " --port {$port} --dev tun --server {$IP_START} {$NETMASK} --comp-lzo {$local} --ca {$ca} --dh {$dh} --key {$key} --cert {$crt}";
$cmd = $cmd . " --ifconfig-pool-persist /etc/artica-postfix/openvpn/ipp.txt " . implode(" ", $routess);
$cmd = $cmd . " {$askpass}--client-to-client --persist-tun --verb 5 --daemon --writepid /var/run/openvpn/openvpn-server.pid --log \"/var/log/openvpn/openvpn.log\"";
$cmd = $cmd . " --status /var/log/openvpn/openvpn-status.log 10";
@file_put_contents("/etc/openvpn/cmdline.conf", $cmd);
$sock->SaveConfigFile($ini->toString(), "ArticaOpenVPNSettings");
echo "Starting......: OpenVPN building settings done.\n";
if ($GLOBALS["VERBOSE"]) {
writelogs("{$cmd}", __FUNCTION__, __FILE__, __LINE__);
}
}