mark 3DES and 1024 bit DH params as weak

[people/pmueller/ipfire-2.x.git] / html / cgi-bin / ovpnmain.cgi

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index d46a14e7916454192306afa91eb82d54b15b384a..9f5e682bdcfb3ac9c46560a5a817d8bef48a0556 100644 (file)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -1061,8 +1061,15 @@ unless(-d "${General::swroot}/ovpn/n2nconf/$cgiparams{'NAME'}"){mkdir "${General
                }
         }
   }
- 
-  print CLIENTCONF "ns-cert-type server\n";   
+  # Check host certificate if X509 is RFC3280 compliant.
+  # If not, old --ns-cert-type directive will be used.
+  # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
+  my $hostcert = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
+  if ($hostcert !~ /TLS Web Server Authentication/) {
+       print CLIENTCONF "ns-cert-type server\n";
+  } else {
+       print CLIENTCONF "remote-cert-tls server\n";
+  }
   print CLIENTCONF "# Auth. Client\n"; 
   print CLIENTCONF "tls-client\n"; 
   print CLIENTCONF "# Cipher\n"; 
@@ -1313,7 +1320,7 @@ END
                <form method='post'><input type='hidden' name='AREUSURE' value='yes' />
                <input type='hidden' name='KEY' value='$cgiparams{'KEY'}' />
                        <select name='DHLENGHT'>
-                               <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'}</option>
+                               <option value='1024' $selected{'DHLENGHT'}{'1024'}>1024 $Lang::tr{'bit'} ($Lang::tr{'vpn weak'})</option>
                                <option value='2048' $selected{'DHLENGHT'}{'2048'}>2048 $Lang::tr{'bit'}</option>
                                <option value='3072' $selected{'DHLENGHT'}{'3072'}>3072 $Lang::tr{'bit'}</option>
                                <option value='4096' $selected{'DHLENGHT'}{'4096'}>4096 $Lang::tr{'bit'}</option>
@@ -2173,7 +2180,15 @@ if ($confighash{$cgiparams{'KEY'}}[3] eq 'net'){
                }
        }
    }
-   print CLIENTCONF "ns-cert-type server\n";   
+   # Check host certificate if X509 is RFC3280 compliant.
+   # If not, old --ns-cert-type directive will be used.
+   # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
+   my $hostcert = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
+   if ($hostcert !~ /TLS Web Server Authentication/) {
+               print CLIENTCONF "ns-cert-type server\n";
+   } else {
+               print CLIENTCONF "remote-cert-tls server\n";
+   }
    print CLIENTCONF "# Auth. Client\n"; 
    print CLIENTCONF "tls-client\n"; 
    print CLIENTCONF "# Cipher\n";
@@ -2332,7 +2347,15 @@ else
         print CLIENTCONF "comp-lzo\r\n";
     }
     print CLIENTCONF "verb 3\r\n";
-    print CLIENTCONF "ns-cert-type server\r\n";
+       # Check host certificate if X509 is RFC3280 compliant.
+       # If not, old --ns-cert-type directive will be used.
+       # If appropriate key usage extension exists, new --remote-cert-tls directive will be used.
+       my $hostcert = `/usr/bin/openssl x509 -text -in ${General::swroot}/ovpn/certs/servercert.pem`;
+       if ($hostcert !~ /TLS Web Server Authentication/) {
+               print CLIENTCONF "ns-cert-type server\r\n";
+       } else {
+               print CLIENTCONF "remote-cert-tls server\r\n";
+       }
     print CLIENTCONF "verify-x509-name $vpnsettings{ROOTCERT_HOSTNAME} name\r\n";
     if ($vpnsettings{MSSFIX} eq 'on') {
        print CLIENTCONF "mssfix\r\n";
@@ -4952,6 +4975,35 @@ END
                }
                if ($set == '1' && $#temp != -1){ print"<option selected>$temp[1]</option>";$set=0;}elsif($set == '0' && $#temp != -1){print"<option>$temp[1]</option>";}
        }       
+
+       my %vpnconfig = ();
+       &General::readhasharray("${General::swroot}/vpn/config", \%vpnconfig);
+       foreach my $vpn (keys %vpnconfig) {
+               # Skip all disabled VPN connections
+               my $enabled = $vpnconfig{$vpn}[0];
+               next unless ($enabled eq "on");
+
+               my $name = $vpnconfig{$vpn}[1];
+
+               # Remote subnets
+               my @networks = split(/\|/, $vpnconfig{$vpn}[11]);
+               foreach my $network (@networks) {
+                       my $selected = "";
+
+                       foreach my $key (keys %ccdroute2hash) {
+                               if ($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}) {
+                                       foreach my $i (1 .. $#{$ccdroute2hash{$key}}) {
+                                               if ($ccdroute2hash{$key}[$i] eq $network) {
+                                                       $selected = "selected";
+                                               }
+                                       }
+                               }
+                       }
+
+                       print "<option value=\"$network\" $selected>$name ($network)</option>\n";
+               }
+       }
+
        #check if green,blue,orange are defined for client
        foreach my $key (keys %ccdroute2hash) {
                if($ccdroute2hash{$key}[0] eq $cgiparams{'NAME'}){