vpnmain.cgi: Add option to regenerate the host certificate

This is necessary since we now have a much shorter lifetime for the host
certificate. However, it is complicated to do this is which is why we
are copying the previous certificate and generate a new CSR. This is
then signed.

A caveat of this patch is that we do not rollover the key.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/ssl/openssl.cnf b/config/ssl/openssl.cnf
index 3b980fcd40f3bae0815bdcf37003d4d1483af09c..00c206ed8e12143dd3600238a0d3deadd0f628fb 100644 (file)
--- a/config/ssl/openssl.cnf
+++ b/config/ssl/openssl.cnf
@@ -23,6 +23,7 @@ default_md    = sha256
 preserve       = no
 policy         = policy_match
 email_in_dn    = no
+copy_extensions = copyall
 
 [ policy_match ]
 countryName            = optional

diff --git a/doc/language_issues.de b/doc/language_issues.de
index 56bd09414f3f55e7bdedcaeb71394cf14711e792..46fb9ee5a0675bf338ffba528d0b22cd331b7b32 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -939,6 +939,7 @@ WARNING: untranslated string: netbios nameserver daemon = NetBIOS Nameserver Dae
 WARNING: untranslated string: no entries = No entries at the moment.
 WARNING: untranslated string: optional = Optional
 WARNING: untranslated string: pakfire invalid tree = Invalid repository selected
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: required = Required

diff --git a/doc/language_issues.en b/doc/language_issues.en
index c55a6fb2cfce4267cc18808aef9e8ee14d473d74..86d5890f23e77a034e5af0cfc8c95cfbd258398d 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -1582,6 +1582,7 @@ WARNING: untranslated string: red1 = RED
 WARNING: untranslated string: references = References
 WARNING: untranslated string: refresh = Refresh
 WARNING: untranslated string: refresh index page while connected = Refresh index.cgi page while connected
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: release = Release

diff --git a/doc/language_issues.es b/doc/language_issues.es
index eef18d6e0adfed70444662792fd0258ea135fc6e..30e20ae87df4e94ed1a424e7227d9351bd24f2a0 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -1001,6 +1001,7 @@ WARNING: untranslated string: no data = unknown string
 WARNING: untranslated string: openvpn cert expires soon = Expires Soon
 WARNING: untranslated string: openvpn cert has expired = Expired
 WARNING: untranslated string: pakfire ago = ago.
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: route config changed = unknown string

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index 36cd4944bc7f890bc2e43347fe8f36a419affd90..a53358147c9e93e968685fb07fff4d8bf1a426fe 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -954,6 +954,7 @@ WARNING: untranslated string: hostile networks total = Total Hostile Networks
 WARNING: untranslated string: log drop hostile in = Log dropped packets FROM hostile networks
 WARNING: untranslated string: log drop hostile out = Log dropped packets TO hostile networks
 WARNING: untranslated string: pakfire ago = ago.
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: route config changed = unknown string

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 43bbd4a1f0970f99da402588880dbabc363639eb..24efece2b42269e7847e8ee388444944f91ae743 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -1219,6 +1219,7 @@ WARNING: untranslated string: rdns = rDNS
 WARNING: untranslated string: reboot fsck = Reboot & run ‘fsck’
 WARNING: untranslated string: rebooting ipfire fsck = Rebooting IPFire, forcing filesystem check
 WARNING: untranslated string: received = Received
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: release = Release

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 761cda4a2840f6a270e798c30a20624217c384c2..b6a65fad29ac77b32a1401052c919ad220598a0c 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -1241,6 +1241,7 @@ WARNING: untranslated string: ptr = PTR
 WARNING: untranslated string: rdns = rDNS
 WARNING: untranslated string: rebooting ipfire fsck = Rebooting IPFire, forcing filesystem check
 WARNING: untranslated string: received = Received
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: required = Required

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 8b6e3efd0e9d453fa4e193e82a75120c0ad45798..1a4f62870fdbb4f8540d1ce047445ade960f6f1f 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1422,6 +1422,7 @@ WARNING: untranslated string: reboot fsck = Reboot & run ‘fsck’
 WARNING: untranslated string: rebooting ipfire fsck = Rebooting IPFire, forcing filesystem check
 WARNING: untranslated string: received = Received
 WARNING: untranslated string: red1 = RED
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: release = Release

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 93ff3c636d05561d1f8a19b95a4de9a2883bb5a8..8da6fe4b6d25934856af07be868a42ad6206bf51 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -1417,6 +1417,7 @@ WARNING: untranslated string: reboot fsck = Reboot & run ‘fsck’
 WARNING: untranslated string: rebooting ipfire fsck = Rebooting IPFire, forcing filesystem check
 WARNING: untranslated string: received = Received
 WARNING: untranslated string: red1 = RED
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: release = Release

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 05c16e1c29925a9ae45ae06f1a89643c3ff0049f..96fe71f7b5027a76bf2f86bbe03136bae35a49e8 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -1129,6 +1129,7 @@ WARNING: untranslated string: ptr = PTR
 WARNING: untranslated string: reboot fsck = Reboot & run ‘fsck’
 WARNING: untranslated string: rebooting ipfire fsck = Rebooting IPFire, forcing filesystem check
 WARNING: untranslated string: received = Received
+WARNING: untranslated string: regenerate host certificate = Renew Host Certificate
 WARNING: untranslated string: reiserfs warning1 = Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.
 WARNING: untranslated string: reiserfs warning2 = Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.
 WARNING: untranslated string: release = Release

diff --git a/doc/language_missings b/doc/language_missings
index eb58bd3859ccfe5981878bfdc26de0336a6af1b3..c92e1e6a367764f1fa78f65434ea87237dc2b2cb 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -78,6 +78,7 @@
 < optional
 < quick control
 < random number generator daemon
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < required
@@ -127,6 +128,7 @@
 < log drop hostile out
 < openvpn cert expires soon
 < openvpn cert has expired
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < service boot setting unavailable
@@ -153,6 +155,7 @@
 < hostile networks total
 < log drop hostile in
 < log drop hostile out
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < spec rstack overflow
@@ -542,6 +545,7 @@
 < reboot fsck
 < rebooting ipfire fsck
 < received
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < release
@@ -1086,6 +1090,7 @@
 < rdns
 < rebooting ipfire fsck
 < received
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < required
@@ -1970,6 +1975,7 @@
 < rebooting ipfire fsck
 < received
 < red1
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < release
@@ -2965,6 +2971,7 @@
 < rebooting ipfire fsck
 < received
 < red1
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < release
@@ -3440,6 +3447,7 @@
 < reboot fsck
 < rebooting ipfire fsck
 < received
+< regenerate host certificate
 < reiserfs warning1
 < reiserfs warning2
 < release

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index d82e6b5c9426082829276c761a27bfa3e7a57a0c..9173a85d847f5e17e1b0389144a00fd95c3e7e6c 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -866,6 +866,12 @@ END
                exit(0);
        }
 ###
+### Regenerate the host certificate
+###
+} elsif ($cgiparams{'ACTION'} eq $Lang::tr{'regenerate host certificate'}) {
+       $errormessage = &regenerate_host_certificate();
+
+###
 ### Form for generating/importing the caroot+host certificate
 ###
 } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'generate root/host certificates'} ||
@@ -3612,7 +3618,12 @@ END
                        <input type='hidden' name='ACTION' value="$Lang::tr{'download host certificate'}" />
                        </form>
                </td>
-               <td width='4%' $col2>&nbsp;</td></tr>
+               <td width='4%' align='center' $col2>
+                       <form method='post' action='$ENV{'SCRIPT_NAME'}'>
+                               <input type='image' name='$Lang::tr{'regenerate host certificate'}' src='/images/reload.gif' alt='$Lang::tr{'regenerate host certificate'}' title='$Lang::tr{'regenerate host certificate'}' />
+                               <input type='hidden' name='ACTION' value='$Lang::tr{'regenerate host certificate'}' />
+                       </form>
+               </td></tr>
 END
 ;
        } else {
@@ -3782,3 +3793,44 @@ sub make_subnets($$) {
 
        return join(",", @cidr_nets);
 }
+
+sub regenerate_host_certificate() {
+       my $errormessage = "";
+
+       &General::log("ipsec", "Regenerating host certificate...");
+
+       # Create a CSR based on the existing certificate
+       my $opt = " x509 -x509toreq -copy_extensions copyall";
+       $opt .= " -signkey ${General::swroot}/certs/hostkey.pem";
+       $opt .= " -in ${General::swroot}/certs/hostcert.pem";
+       $opt .= " -out ${General::swroot}/certs/hostreq.pem";
+       $errormessage = &callssl($opt);
+
+       # Revoke the old certificate
+       if (!$errormessage) {
+               &General::log("ipsec", "Revoking the old host cert...");
+
+               my $opt = " ca -revoke ${General::swroot}/certs/hostcert.pem";
+               $errormessage = &callssl($opt);
+       }
+
+       # Sign the host certificate request
+       if (!$errormessage) {
+               &General::log("ipsec", "Self signing host cert...");
+
+               my $opt = " ca -md sha256 -days 825";
+               $opt .= " -batch -notext";
+               $opt .= " -in ${General::swroot}/certs/hostreq.pem";
+               $opt .= " -out ${General::swroot}/certs/hostcert.pem";
+               $errormessage = &callssl ($opt);
+
+               unlink ("${General::swroot}/certs/hostreq.pem"); #no more needed
+       }
+
+       # Reload the new certificate
+       if (!$errormessage) {
+               &General::system('/usr/local/bin/ipsecctrl', 'R');
+       }
+
+       return $errormessage;
+}

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 27831a4927c35edf4a323c558467067336214fc0..3246102ba58d0aa06a2cc6d9ecf888078515f24f 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2212,6 +2212,7 @@
 'refresh' => 'Refresh',
 'refresh index page while connected' => 'Refresh index.cgi page while connected',
 'refresh update list' => 'Refresh update list',
+'regenerate host certificate' => 'Renew Host Certificate',
 'registered user rules' => 'Talos VRT rules for registered users',
 'reiserfs warning1' => 'Reiserfs is deprecated and scheduled to be removed from the kernel in 2025.',
 'reiserfs warning2' => 'Ensure a fresh installation is made using either ext4 or xfs filesystems before that date.',