From 4b02b4045b619b207235b34882a000ef088f0df1 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Tue, 2 Jun 2015 20:24:04 +0200 Subject: [PATCH] ipsec: Allow selection of ESP group type If a connection is edited, the IKE group types will be used instead. Fixes #10860 Signed-off-by: Michael Tremer Tested-by: Wolfgang Apolinarski --- doc/language_issues.de | 1 + doc/language_issues.es | 1 + doc/language_issues.fr | 1 + doc/language_issues.it | 1 + doc/language_issues.nl | 1 + doc/language_issues.pl | 1 + doc/language_issues.ru | 1 + doc/language_issues.tr | 1 + html/cgi-bin/vpnmain.cgi | 73 +++++++++++++++++++++++++++++++++++----- langs/en/cgi-bin/en.pl | 1 + 10 files changed, 74 insertions(+), 8 deletions(-) diff --git a/doc/language_issues.de b/doc/language_issues.de index 90accb3c0..0d8698756 100644 --- a/doc/language_issues.de +++ b/doc/language_issues.de @@ -644,6 +644,7 @@ WARNING: untranslated string: fwhost cust geoipgrp WARNING: untranslated string: fwhost err hostip WARNING: untranslated string: ike lifetime should be between 1 and 8 hours WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: qos add subclass WARNING: untranslated string: route config changed WARNING: untranslated string: routing config added diff --git a/doc/language_issues.es b/doc/language_issues.es index 9910db6a0..2a502006b 100644 --- a/doc/language_issues.es +++ b/doc/language_issues.es @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: openvpn default diff --git a/doc/language_issues.fr b/doc/language_issues.fr index ef01a1e10..aa4951d80 100644 --- a/doc/language_issues.fr +++ b/doc/language_issues.fr @@ -932,6 +932,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: ntp common settings diff --git a/doc/language_issues.it b/doc/language_issues.it index 522fee3ba..1669e79f6 100644 --- a/doc/language_issues.it +++ b/doc/language_issues.it @@ -705,6 +705,7 @@ WARNING: untranslated string: masquerading disabled WARNING: untranslated string: masquerading enabled WARNING: untranslated string: messages WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: outgoing compression in bytes per second WARNING: untranslated string: outgoing overhead in bytes per second WARNING: untranslated string: ovpn add conf diff --git a/doc/language_issues.nl b/doc/language_issues.nl index e7d8e08ea..11d76577b 100644 --- a/doc/language_issues.nl +++ b/doc/language_issues.nl @@ -737,6 +737,7 @@ WARNING: untranslated string: modem status WARNING: untranslated string: monitor interface WARNING: untranslated string: nameserver WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: outgoing compression in bytes per second WARNING: untranslated string: outgoing overhead in bytes per second diff --git a/doc/language_issues.pl b/doc/language_issues.pl index 9910db6a0..2a502006b 100644 --- a/doc/language_issues.pl +++ b/doc/language_issues.pl @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: openvpn default diff --git a/doc/language_issues.ru b/doc/language_issues.ru index 95caaa53f..d2215b6df 100644 --- a/doc/language_issues.ru +++ b/doc/language_issues.ru @@ -917,6 +917,7 @@ WARNING: untranslated string: most preferred WARNING: untranslated string: nameserver WARNING: untranslated string: no data WARNING: untranslated string: no hardware random number generator +WARNING: untranslated string: none WARNING: untranslated string: not a valid dh key WARNING: untranslated string: notice WARNING: untranslated string: openvpn default diff --git a/doc/language_issues.tr b/doc/language_issues.tr index d57c721a1..a9d633273 100644 --- a/doc/language_issues.tr +++ b/doc/language_issues.tr @@ -684,6 +684,7 @@ WARNING: untranslated string: incoming compression in bytes per second WARNING: untranslated string: incoming overhead in bytes per second WARNING: untranslated string: invalid input for valid till days WARNING: untranslated string: no data +WARNING: untranslated string: none WARNING: untranslated string: outgoing compression in bytes per second WARNING: untranslated string: outgoing overhead in bytes per second WARNING: untranslated string: ovpn add conf diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi index 218dafa26..8c44b7e93 100644 --- a/html/cgi-bin/vpnmain.cgi +++ b/html/cgi-bin/vpnmain.cgi @@ -329,7 +329,13 @@ sub writeipsecfiles { if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) { my @encs = split('\|', $lconfighash{$key}[21]); my @ints = split('\|', $lconfighash{$key}[22]); - my @groups = split('\|', $lconfighash{$key}[20]); + my @groups = split('\|', $lconfighash{$key}[23]); + + # Use IKE grouptype if no ESP group type has been selected + # (for backwards compatibility) + if ($lconfighash{$key}[23] eq "") { + @groups = split('\|', $lconfighash{$key}[20]); + } my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on")); print CONF "\tesp=" . join(",", @algos); @@ -1270,6 +1276,9 @@ END $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21]; $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22]; $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23]; + if ($cgiparams{'ESP_GROUPTYPE'} eq "") { + $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'}; + } $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17]; $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13]; $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24]; @@ -1865,7 +1874,7 @@ END $cgiparams{'IKE_LIFETIME'} = '3'; #[16]; $cgiparams{'ESP_ENCRYPTION'} = 'aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21]; $cgiparams{'ESP_INTEGRITY'} = 'sha2_512|sha2_256|sha1'; #[22]; - $cgiparams{'ESP_GROUPTYPE'} = ''; #[23]; + $cgiparams{'ESP_GROUPTYPE'} = '4096|3072|2048|1536|1024'; #[23]; $cgiparams{'ESP_KEYLIFE'} = '1'; #[17]; $cgiparams{'COMPRESSION'} = 'on'; #[13]; $cgiparams{'ONLY_PROPOSED'} = 'off'; #[24]; @@ -2175,13 +2184,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || goto ADVANCED_ERROR; } } - if ($cgiparams{'ESP_GROUPTYPE'} ne '' && - $cgiparams{'ESP_GROUPTYPE'} !~ /^ecp(192|224|256|384|512)(bp)?$/ && - $cgiparams{'ESP_GROUPTYPE'} !~ /^modp(1024|1536|2048|2048s(256|224|160)|3072|4096|6144|8192)$/) { + @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'}); + if ($#temp < 0) { $errormessage = $Lang::tr{'invalid input'}; goto ADVANCED_ERROR; } - + foreach my $val (@temp) { + if ($val !~ /^(e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|1024|1536|2048|2048s256|2048s224|2048s160|3072|4096|6144|8192|none)$/) { + $errormessage = $Lang::tr{'invalid input'}; + goto ADVANCED_ERROR; + } + } if ($cgiparams{'ESP_KEYLIFE'} !~ /^\d+$/) { $errormessage = $Lang::tr{'invalid input for esp keylife'}; goto ADVANCED_ERROR; @@ -2244,6 +2257,9 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || $cgiparams{'ESP_ENCRYPTION'} = $confighash{$cgiparams{'KEY'}}[21]; $cgiparams{'ESP_INTEGRITY'} = $confighash{$cgiparams{'KEY'}}[22]; $cgiparams{'ESP_GROUPTYPE'} = $confighash{$cgiparams{'KEY'}}[23]; + if ($cgiparams{'ESP_GROUPTYPE'} eq "") { + $cgiparams{'ESP_GROUPTYPE'} = $cgiparams{'IKE_GROUPTYPE'}; + } $cgiparams{'ESP_KEYLIFE'} = $confighash{$cgiparams{'KEY'}}[17]; $cgiparams{'COMPRESSION'} = $confighash{$cgiparams{'KEY'}}[13]; $cgiparams{'ONLY_PROPOSED'} = $confighash{$cgiparams{'KEY'}}[24]; @@ -2333,7 +2349,17 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || $checked{'ESP_INTEGRITY'}{'aesxcbc'} = ''; @temp = split('\|', $cgiparams{'ESP_INTEGRITY'}); foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; } - $checked{'ESP_GROUPTYPE'}{$cgiparams{'ESP_GROUPTYPE'}} = "selected='selected'"; + $checked{'ESP_GROUPTYPE'}{'768'} = ''; + $checked{'ESP_GROUPTYPE'}{'1024'} = ''; + $checked{'ESP_GROUPTYPE'}{'1536'} = ''; + $checked{'ESP_GROUPTYPE'}{'2048'} = ''; + $checked{'ESP_GROUPTYPE'}{'3072'} = ''; + $checked{'ESP_GROUPTYPE'}{'4096'} = ''; + $checked{'ESP_GROUPTYPE'}{'6144'} = ''; + $checked{'ESP_GROUPTYPE'}{'8192'} = ''; + $checked{'ESP_GROUPTYPE'}{'none'} = ''; + @temp = split('\|', $cgiparams{'ESP_GROUPTYPE'}); + foreach my $key (@temp) {$checked{'ESP_GROUPTYPE'}{$key} = "selected='selected'"; } $checked{'COMPRESSION'} = $cgiparams{'COMPRESSION'} eq 'on' ? "checked='checked'" : '' ; $checked{'ONLY_PROPOSED'} = $cgiparams{'ONLY_PROPOSED'} eq 'on' ? "checked='checked'" : '' ; @@ -2494,7 +2520,30 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) || - + + + @@ -3039,6 +3088,14 @@ sub make_algos($$$$$) { if (!$is_aead) { push(@algo, $int); } + + if ($grp eq "none") { + # noop + } elsif ($grp =~ m/^e(.*)$/) { + push(@algo, "ecp$1"); + } else { + push(@algo, "modp$grp"); + } } push(@algos, join("-", @algo)); diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index 7964644b7..af7fda947 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1645,6 +1645,7 @@ 'no modem selected' => 'No modem selected', 'no set selected' => 'No set was selected', 'no time limit' => 'unlimited time', +'none' => 'none', 'none found' => 'none found', 'nonetworkname' => 'No Network Name entered', 'noservicename' => 'No Service Name entered', -- 2.39.2