Fix accidentially reverted IKE lifetime limit to 24 hours

[people/ms/ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index c84884239acee44fb1e62d3a8860a15aae5dbb52..bfa60d27d17723567cb9b6c9bd258092dfbbf0ab 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2013  IPFire Team  info@ipfire.org                       #
+# Copyright (C) 2007-2020  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -604,7 +604,7 @@ END
                }
        }
 
-       if (ref ($cgiparams{'FH'}) ne 'Fh') {
+       unless (ref ($cgiparams{'FH'})) {
                $errormessage = $Lang::tr{'there was no file upload'};
                goto UPLOADCA_ERROR;
        }
@@ -822,15 +822,17 @@ END
                        close IPADDR;
                        chomp ($ipaddr);
                        $cgiparams{'ROOTCERT_HOSTNAME'} = (gethostbyaddr(pack("C4", split(/\./, $ipaddr)), 2))[0];
+                       $cgiparams{'SUBJECTALTNAME'} = "DNS:" . $cgiparams{'ROOTCERT_HOSTNAME'};
                        if ($cgiparams{'ROOTCERT_HOSTNAME'} eq '') {
                                $cgiparams{'ROOTCERT_HOSTNAME'} = $ipaddr;
+                               $cgiparams{'SUBJECTALTNAME'} = "IP:" . $cgiparams{'ROOTCERT_HOSTNAME'};
                        }
                }
                $cgiparams{'ROOTCERT_COUNTRY'} = $vpnsettings{'ROOTCERT_COUNTRY'} if (!$cgiparams{'ROOTCERT_COUNTRY'});
        } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'upload p12 file'}) {
                &General::log("ipsec", "Importing from p12...");
 
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto ROOTCERT_ERROR;
                }
@@ -975,6 +977,11 @@ END
                #       IP: an IP address
                # example: email:franck@foo.com,IP:10.0.0.10,DNS:franck.foo.com
 
+               if ($cgiparams{'SUBJECTALTNAME'} eq '') {
+                       $errormessage = $Lang::tr{'vpn subjectaltname missing'};
+                       goto ROOTCERT_ERROR;
+               }
+
                if ($cgiparams{'SUBJECTALTNAME'} ne '' && $cgiparams{'SUBJECTALTNAME'} !~ /^(email|URI|DNS|RID|IP):[a-zA-Z0-9 :\/,\.\-_@]*$/) {
                        $errormessage = $Lang::tr{'vpn altname syntax'};
                        goto VPNCONF_ERROR;
@@ -1129,7 +1136,7 @@ END
        }
        print <<END
                </select></td></tr>
-       <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)</td>
+       <tr><td class='base'>$Lang::tr{'vpn subjectaltname'} (subjectAltName=email:*,URI:*,DNS:*,RID:*)&nbsp;<img src='/blob.gif' alt='*' /></td>
        <td class='base' nowrap='nowrap'><input type='text' name='SUBJECTALTNAME' value='$cgiparams{'SUBJECTALTNAME'}' size='32' /></td></tr>
        <tr><td>&nbsp;</td>
                <td><br /><input type='submit' name='ACTION' value='$Lang::tr{'generate root/host certificates'}' /><br /><br /></td></tr>
@@ -1340,6 +1347,7 @@ END
                $cgiparams{'DPD_TIMEOUT'}               = $confighash{$cgiparams{'KEY'}}[30];
                $cgiparams{'DPD_DELAY'}                 = $confighash{$cgiparams{'KEY'}}[31];
                $cgiparams{'FORCE_MOBIKE'}              = $confighash{$cgiparams{'KEY'}}[32];
+               $cgiparams{'START_ACTION'}              = $confighash{$cgiparams{'KEY'}}[33];
                $cgiparams{'INACTIVITY_TIMEOUT'}        = $confighash{$cgiparams{'KEY'}}[34];
                $cgiparams{'MODE'}                      = $confighash{$cgiparams{'KEY'}}[35];
                $cgiparams{'INTERFACE_MODE'}            = $confighash{$cgiparams{'KEY'}}[36];
@@ -1362,6 +1370,10 @@ END
                        $cgiparams{'MODE'} = "tunnel";
                }
 
+               if ($cgiparams{'INTERFACE_MTU'} eq "") {
+                       $cgiparams{'INTERFACE_MTU'} = 1500;
+               }
+
        } elsif ($cgiparams{'ACTION'} eq $Lang::tr{'save'}) {
                $cgiparams{'REMARK'} = &Header::cleanhtml($cgiparams{'REMARK'});
                if ($cgiparams{'TYPE'} !~ /^(host|net)$/) {
@@ -1526,7 +1538,7 @@ END
                        $errormessage = $Lang::tr{'cant change certificates'};
                        goto VPNCONF_ERROR;
                }
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto VPNCONF_ERROR;
                }
@@ -1563,7 +1575,7 @@ END
        } elsif ($cgiparams{'AUTH'} eq 'pkcs12') {
                &General::log("ipsec", "Importing from p12...");
 
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto ROOTCERT_ERROR;
                }
@@ -1653,7 +1665,7 @@ END
                        $errormessage = $Lang::tr{'cant change certificates'};
                        goto VPNCONF_ERROR;
                }
-               if (ref ($cgiparams{'FH'}) ne 'Fh') {
+               unless (ref ($cgiparams{'FH'})) {
                        $errormessage = $Lang::tr{'there was no file upload'};
                        goto VPNCONF_ERROR;
                }
@@ -1921,6 +1933,7 @@ END
        $confighash{$key}[30] = $cgiparams{'DPD_TIMEOUT'};
        $confighash{$key}[31] = $cgiparams{'DPD_DELAY'};
        $confighash{$key}[32] = $cgiparams{'FORCE_MOBIKE'};
+       $confighash{$key}[33] = $cgiparams{'START_ACTION'};
        $confighash{$key}[34] = $cgiparams{'INACTIVITY_TIMEOUT'};
        $confighash{$key}[35] = $cgiparams{'MODE'};
        $confighash{$key}[36] = $cgiparams{'INTERFACE_MODE'};
@@ -1994,11 +2007,11 @@ END
        #use default advanced value
        $cgiparams{'IKE_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[18];
        $cgiparams{'IKE_INTEGRITY'}             = 'sha2_512|sha2_256'; #[19];
-       $cgiparams{'IKE_GROUPTYPE'}             = 'curve25519|4096|3072|2048'; #[20];
+       $cgiparams{'IKE_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[20];
        $cgiparams{'IKE_LIFETIME'}              = '3'; #[16];
        $cgiparams{'ESP_ENCRYPTION'}    = 'chacha20poly1305|aes256gcm128|aes256gcm96|aes256gcm64|aes256|aes192gcm128|aes192gcm96|aes192gcm64|aes192|aes128gcm128|aes128gcm96|aes128gcm64|aes128'; #[21];
        $cgiparams{'ESP_INTEGRITY'}             = 'sha2_512|sha2_256'; #[22];
-       $cgiparams{'ESP_GROUPTYPE'}             = 'curve25519|4096|3072|2048'; #[23];
+       $cgiparams{'ESP_GROUPTYPE'}             = 'curve25519|curve448|4096|3072|2048'; #[23];
        $cgiparams{'ESP_KEYLIFE'}               = '1'; #[17];
        $cgiparams{'COMPRESSION'}               = 'off'; #[13];
        $cgiparams{'ONLY_PROPOSED'}             = 'on'; #[24];
@@ -2080,6 +2093,7 @@ VPNCONF_ERROR:
        <input type='hidden' name='DPD_DELAY' value='$cgiparams{'DPD_DELAY'}' />
        <input type='hidden' name='DPD_TIMEOUT' value='$cgiparams{'DPD_TIMEOUT'}' />
        <input type='hidden' name='FORCE_MOBIKE' value='$cgiparams{'FORCE_MOBIKE'}' />
+       <input type='hidden' name='START_ACTION' value='$cgiparams{'START_ACTION'}' />
        <input type='hidden' name='INACTIVITY_TIMEOUT' value='$cgiparams{'INACTIVITY_TIMEOUT'}' />
 END
 ;
@@ -2361,7 +2375,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
-                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
+                       if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@ -2370,7 +2384,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        $errormessage = $Lang::tr{'invalid input for ike lifetime'};
                        goto ADVANCED_ERROR;
                }
-               if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 8) {
+               if ($cgiparams{'IKE_LIFETIME'} < 1 || $cgiparams{'IKE_LIFETIME'} > 24) {
                        $errormessage = $Lang::tr{'ike lifetime should be between 1 and 8 hours'};
                        goto ADVANCED_ERROR;
                }
@@ -2402,7 +2416,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        goto ADVANCED_ERROR;
                }
                foreach my $val (@temp) {
-                       if ($val !~ /^(curve25519|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
+                       if ($val !~ /^(curve25519|curve448|e521|e384|e256|e224|e192|e512bp|e384bp|e256bp|e224bp|768|1024|1536|2048|3072|4096|6144|8192|none)$/) {
                                $errormessage = $Lang::tr{'invalid input'};
                                goto ADVANCED_ERROR;
                        }
@@ -2542,6 +2556,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        @temp = split('\|', $cgiparams{'IKE_INTEGRITY'});
        foreach my $key (@temp) {$checked{'IKE_INTEGRITY'}{$key} = "selected='selected'"; }
        $checked{'IKE_GROUPTYPE'}{'curve25519'} = '';
+       $checked{'IKE_GROUPTYPE'}{'curve448'} = '';
        $checked{'IKE_GROUPTYPE'}{'768'} = '';
        $checked{'IKE_GROUPTYPE'}{'1024'} = '';
        $checked{'IKE_GROUPTYPE'}{'1536'} = '';
@@ -2581,6 +2596,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
        @temp = split('\|', $cgiparams{'ESP_INTEGRITY'});
        foreach my $key (@temp) {$checked{'ESP_INTEGRITY'}{$key} = "selected='selected'"; }
        $checked{'ESP_GROUPTYPE'}{'curve25519'} = '';
+       $checked{'ESP_GROUPTYPE'}{'curve448'} = '';
        $checked{'ESP_GROUPTYPE'}{'768'} = '';
        $checked{'ESP_GROUPTYPE'}{'1024'} = '';
        $checked{'ESP_GROUPTYPE'}{'1536'} = '';
@@ -2745,6 +2761,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        <td class='boldbase'>
                                <select name='IKE_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
                                        <option value='curve25519' $checked{'IKE_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
+                                       <option value='curve448' $checked{'IKE_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
                                        <option value='e521' $checked{'IKE_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'IKE_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'IKE_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@ -2767,6 +2784,7 @@ if(($cgiparams{'ACTION'} eq $Lang::tr{'advanced'}) ||
                        <td class='boldbase'>
                                <select name='ESP_GROUPTYPE' multiple='multiple' size='6' style='width: 100%'>
                                        <option value='curve25519' $checked{'ESP_GROUPTYPE'}{'curve25519'}>Curve 25519 (256 bit)</option>
+                                       <option value='curve448' $checked{'ESP_GROUPTYPE'}{'curve448'}>Curve 448 (224 bit)</option>
                                        <option value='e521' $checked{'ESP_GROUPTYPE'}{'e521'}>ECP-521 (NIST)</option>
                                        <option value='e512bp' $checked{'ESP_GROUPTYPE'}{'e512bp'}>ECP-512 (Brainpool)</option>
                                        <option value='e384' $checked{'ESP_GROUPTYPE'}{'e384'}>ECP-384 (NIST)</option>
@@ -3318,24 +3336,24 @@ sub make_algos($$$$$) {
 
                                        if ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
-                                       } elsif ($grp =~ m/curve25519/) {
+                                       } elsif ($grp =~ m/curve(25519|448)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");
                                        }
 
-                               } elsif ($mode eq "esp" && $pfs) {
+                               } elsif ($mode eq "esp") {
                                        my $is_aead = ($enc =~ m/[cg]cm/);
 
                                        if (!$is_aead) {
                                                push(@algo, $int);
                                        }
 
-                                       if ($grp eq "none") {
+                                       if (!$pfs || $grp eq "none") {
                                                # noop
                                        } elsif ($grp =~ m/^e(.*)$/) {
                                                push(@algo, "ecp$1");
-                                       } elsif ($grp =~ m/curve25519/) {
+                                       } elsif ($grp =~ m/curve(25519|448)/) {
                                                push(@algo, "$grp");
                                        } else {
                                                push(@algo, "modp$grp");