ovpnmain.cgi: Force NCP on clients

This change requires that all clients support NCP if they are set up
with a new connection. Existing clients remain supported using the
fallback cipher option.

This will result that connections with OpenVPN <= 2.3 cannot be set up
any more which is totally fine since that version is EOL.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/doc/language_issues.de b/doc/language_issues.de
index 10bc2e5018db24a7027ec58886bed7c967adcd6a..ff7decff5214942ac52f509220105feecf460911 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -951,7 +951,7 @@ WARNING: untranslated string: optional = Optional
 WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn unsupported cipher selected = Unknown cipher selected
 WARNING: untranslated string: pakfire invalid tree = Invalid repository selected
 WARNING: untranslated string: regenerate host certificate = Renew Host Certificate

diff --git a/doc/language_issues.en b/doc/language_issues.en
index c0b81d112bdd10be267564350b05df7f30d739da..e7c487f8292cc3ecef7e859786ef8ad801335b04 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -1467,8 +1467,8 @@ WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-a
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn ha = Hash algorithm
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
 WARNING: untranslated string: ovpn mgmt in root range = A port number of 1024 or higher is required.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn no connections = No active OpenVPN connections
 WARNING: untranslated string: ovpn on blue = OpenVPN on BLUE:
 WARNING: untranslated string: ovpn on orange = OpenVPN on ORANGE:

diff --git a/doc/language_issues.es b/doc/language_issues.es
index 3054b8cdeb70ce19efd097c0ff514c620773bf26..0723b605c2e0f2bb40a75dbada9d46712ef8ab25 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -1013,7 +1013,7 @@ WARNING: untranslated string: openvpn cert has expired = Expired
 WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn unsupported cipher selected = Unknown cipher selected
 WARNING: untranslated string: pakfire ago = ago.
 WARNING: untranslated string: regenerate host certificate = Renew Host Certificate

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index a973e161fe8c5a0974ed79c8d93a03cd6159cd24..87760bb1786a4a3a8e1ba34ee3259db2e21157b6 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -957,7 +957,7 @@ WARNING: untranslated string: hostile networks total = Total Hostile Networks
 WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn unsupported cipher selected = Unknown cipher selected
 WARNING: untranslated string: pakfire ago = ago.
 WARNING: untranslated string: routing config added = unknown string

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 39522efec6d83deb951a1431132d6d4473717319..0be772a61955cc6f84ffb7277bcddd94dab0610a 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -1204,7 +1204,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn rw connection log = OpenVPN Roadwarrior Connections Log
 WARNING: untranslated string: ovpn tls auth = TLS Channel Protection:
 WARNING: untranslated string: ovpn unsupported cipher selected = Unknown cipher selected

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 573f68cb813ba2b2cd63d9a080e5c0d4a71a6ec4..595e12fcdb26db25728c52893870adb56554af7a 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -1228,7 +1228,7 @@ WARNING: untranslated string: ovpn crypt options = Cryptographic options
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn ha = Hash algorithm
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn rw connection log = OpenVPN Roadwarrior Connections Log
 WARNING: untranslated string: ovpn tls auth = TLS Channel Protection:
 WARNING: untranslated string: ovpn unsupported cipher selected = Unknown cipher selected

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 4821848ecfe2a05674c8546e91fc0f60b81497bc..2d5541fd26a8a9b519f2581f849fd69ebfdc3c36 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1395,8 +1395,8 @@ WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-a
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn ha = Hash algorithm
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
 WARNING: untranslated string: ovpn mgmt in root range = A port number of 1024 or higher is required.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn no connections = No active OpenVPN connections
 WARNING: untranslated string: ovpn port in root range = A port number of 1024 or higher is required.
 WARNING: untranslated string: ovpn routes push = Routes (one per line) e.g. 192.168.10.0/255.255.255.0 192.168.20.0/24

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index e5dc832be1f489646687319341945085876ecf2f..9bc038059aae39b8a290f4e4bc59e59f2c9f64c1 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -1392,8 +1392,8 @@ WARNING: untranslated string: ovpn crypt options = Cryptographic options
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn ha = Hash algorithm
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
 WARNING: untranslated string: ovpn mgmt in root range = A port number of 1024 or higher is required.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn no connections = No active OpenVPN connections
 WARNING: untranslated string: ovpn port in root range = A port number of 1024 or higher is required.
 WARNING: untranslated string: ovpn rw connection log = OpenVPN Roadwarrior Connections Log

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 51895180b630bee3eea5ab0b2eab11bbdfa4935b..3d4655dfac8c9930c0ac8446e4e640020e38e03a 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -1118,7 +1118,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
-WARNING: untranslated string: ovpn if ncp is disabled we must have cipher = If you want to disable cipher negotiation, you will have to select a fallback cipher.
+WARNING: untranslated string: ovpn no cipher selected = No cipher selected
 WARNING: untranslated string: ovpn rw connection log = OpenVPN Roadwarrior Connections Log
 WARNING: untranslated string: ovpn tls auth = TLS Channel Protection:
 WARNING: untranslated string: ovpn unsupported cipher selected = Unknown cipher selected

diff --git a/doc/language_missings b/doc/language_missings
index cbab174f8db57e6c9b0b9bbd3c1777fb1fcc6205..0d64e895b18da7e7c927ea1150803c2c6c75b574 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -84,7 +84,7 @@
 < ovpn ciphers
 < ovpn fallback cipher
 < ovpn fallback cipher help
-< ovpn if ncp is disabled we must have cipher
+< ovpn no cipher selected
 < ovpn unsupported cipher selected
 < quick control
 < random number generator daemon
@@ -146,7 +146,7 @@
 < ovpn ciphers
 < ovpn fallback cipher
 < ovpn fallback cipher help
-< ovpn if ncp is disabled we must have cipher
+< ovpn no cipher selected
 < ovpn unsupported cipher selected
 < regenerate host certificate
 < reiserfs warning1
@@ -176,7 +176,7 @@
 < ovpn ciphers
 < ovpn fallback cipher
 < ovpn fallback cipher help
-< ovpn if ncp is disabled we must have cipher
+< ovpn no cipher selected
 < ovpn unsupported cipher selected
 < system time
 < timeformat
@@ -550,7 +550,7 @@
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
-< ovpn if ncp is disabled we must have cipher
+< ovpn no cipher selected
 < ovpn rw connection log
 < ovpn tls auth
 < ovpn unsupported cipher selected
@@ -1108,7 +1108,7 @@
 < ovpn fallback cipher help
 < ovpn generating the root and host certificates
 < ovpn ha
-< ovpn if ncp is disabled we must have cipher
+< ovpn no cipher selected
 < ovpn reneg sec
 < ovpn rw connection log
 < ovpn tls auth
@@ -1984,7 +1984,6 @@
 < ovpn fallback cipher help
 < ovpn generating the root and host certificates
 < ovpn ha
-< ovpn if ncp is disabled we must have cipher
 < ovpn mgmt in root range
 < ovpn mtu-disc
 < ovpn mtu-disc and mtu not 1500
@@ -1993,6 +1992,7 @@
 < ovpn mtu-disc off
 < ovpn mtu-disc with mssfix or fragment
 < ovpn mtu-disc yes
+< ovpn no cipher selected
 < ovpn no connections
 < ovpn port in root range
 < ovpn reneg sec
@@ -2994,7 +2994,6 @@
 < ovpn fallback cipher help
 < ovpn generating the root and host certificates
 < ovpn ha
-< ovpn if ncp is disabled we must have cipher
 < ovpn mgmt in root range
 < ovpn mtu-disc
 < ovpn mtu-disc and mtu not 1500
@@ -3003,6 +3002,7 @@
 < ovpn mtu-disc off
 < ovpn mtu-disc with mssfix or fragment
 < ovpn mtu-disc yes
+< ovpn no cipher selected
 < ovpn no connections
 < ovpn port in root range
 < ovpn reneg sec
@@ -3504,7 +3504,7 @@
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
-< ovpn if ncp is disabled we must have cipher
+< ovpn no cipher selected
 < ovpn rw connection log
 < ovpn tls auth
 < ovpn unsupported cipher selected

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index cee2750263db28988c58bd56d5f5cc1eaab60d26..8f21fba4fdcffb1425ec60c5b16d71163e1f726e 100755 (executable)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -715,9 +715,9 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
     my @temp=();
 
-       # If NCP is disabled, we need the fallback cipher
-       if ($cgiparams{'DATACIPHERS'} eq '' && $cgiparams{'DCIPHER'} eq '') {
-               $errormessage = $Lang::tr{'ovpn if ncp is disabled we must have cipher'};
+       # We must have at least one cipher selected
+       if ($cgiparams{'DATACIPHERS'} eq '') {
+               $errormessage = $Lang::tr{'ovpn no cipher selected'};
                goto ADV_ERROR;
        }
 
@@ -2180,18 +2180,9 @@ else
        $zip->addFile( "${General::swroot}/ovpn/certs/$confighash{$cgiparams{'KEY'}}[1]cert.pem", "$confighash{$cgiparams{'KEY'}}[1]cert.pem") or die "Can't add file $confighash{$cgiparams{'KEY'}}[1]cert.pem\n";
     }
 
-       # Cryptography
-
-       # If no data ciphers have been selected, we try to use the fallback cipher
-       if ($vpnsettings{'DATACIPHERS'} eq '') {
-               print CLIENTCONF "ncp-disable\r\n";
-
-               if ($vpnsettings{'DCIPHER'} ne '') {
-                   print CLIENTCONF "cipher $vpnsettings{'DCIPHER'}\r\n";
-               }
-       } else {
-               # Otherwise we don't write anything because the server and client will negotiate
-       }
+       # We no longer send any cryptographic configuration since 2.6.
+       # That way, we will be able to push this from the server.
+       # Therefore we always mandate NCP for new clients.
 
        print CLIENTCONF "auth $vpnsettings{'DAUTH'}\r\n";
 
@@ -2652,7 +2643,7 @@ ADV_ERROR:
                                        </td>
 
                                        <td>
-                                               <select name='DATACIPHERS' multiple>
+                                               <select name='DATACIPHERS' multiple required>
 END
 
        foreach my $cipher (@SUPPORTED_CIPHERS) {

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 2b415b9d31f591ff92220d422710ed67529c0041..a3739c922625bf0a1d89b65d2f39a87e8ab9f2bb 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2033,7 +2033,6 @@
 'ovpn fallback cipher help' => 'This cipher is being used by clients that do not support cipher negotiation.',
 'ovpn generating the root and host certificates' => 'Generating the root and host certificate can take a long time.',
 'ovpn ha' => 'Hash algorithm',
-'ovpn if ncp is disabled we must have cipher' => 'If you want to disable cipher negotiation, you will have to select a fallback cipher.',
 'ovpn log' => 'OVPN-Log',
 'ovpn mgmt in root range' => 'A port number of 1024 or higher is required.',
 'ovpn mtu-disc' => 'Path MTU Discovery',
@@ -2043,6 +2042,7 @@
 'ovpn mtu-disc off' => 'Disabled',
 'ovpn mtu-disc with mssfix or fragment' => 'Path MTU Discovery cannot be used with mssfix or fragment.',
 'ovpn mtu-disc yes' => 'Forced',
+'ovpn no cipher selected' => 'No cipher selected',
 'ovpn no connections' => 'No active OpenVPN connections',
 'ovpn on blue' => 'OpenVPN on BLUE:',
 'ovpn on orange' => 'OpenVPN on ORANGE:',