ovpnmain.cgi: Load the OpenSSL legacy provider if required

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index c3fd6a0943a4636652c77a570379d51d53029a5f..b93b05cdb80ca59e38b471cd16e06a1dbba17020 100755 (executable)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -56,6 +56,14 @@ my @SUPPORTED_CIPHERS = (
        "CHACHA20-POLY1305",
 );
 
+my @LEGACY_CIPHERS = (
+       "BF-CBC",
+       "CAST5-CBC",
+       "DES-CBC",
+       "DESX-CBC",
+       "SEED-CBC",
+);
+
 my $DEFAULT_CIPHERS = "AES-256-GCM|AES-128-GCM|CHACHA20-POLY1305";
 
 # Translations for the cipher selection
@@ -127,6 +135,16 @@ sub iscertlegacy
        return 0;
 }
 
+sub is_legacy_cipher($) {
+       my $cipher = shift;
+
+       foreach my $c (@LEGACY_CIPHERS) {
+               return 1 if ($cipher eq $c);
+       }
+
+       return 0;
+}
+
 sub cleanssldatabase() {
        if (open(FILE, ">${General::swroot}/ovpn/certs/serial")) {
                print FILE "01";
@@ -162,6 +180,9 @@ sub deletebackupcert
 sub writeserverconf {
     my %sovpnsettings = ();
 
+       # Do we require the OpenSSL Legacy Provider?
+       my $requires_legacy_provider = 0;
+
     &General::readhash("${General::swroot}/ovpn/settings", \%sovpnsettings);
     &read_routepushfile(\%sovpnsettings);
 
@@ -247,6 +268,10 @@ sub writeserverconf {
 
        # Enable fallback cipher?
        if ($sovpnsettings{'DCIPHER'} ne '') {
+               if (&is_legacy_cipher($sovpnsettings{'DCIPHER'})) {
+                       $requires_legacy_provider++;
+               }
+
            print CONF "data-ciphers-fallback $sovpnsettings{'DCIPHER'}\n";
        }
 
@@ -303,6 +328,11 @@ sub writeserverconf {
     print CONF "management /var/run/openvpn.sock unix\n";
     print CONF "management-client-auth\n";
 
+       # Enable the legacy provider
+       if ($requires_legacy_provider > 0) {
+               print CONF "providers legacy default\n";
+       }
+
     close(CONF);
 
        # Rewrite all CCD configurations