vpnmain.cgi: Rewrite algorithm generation code

[ipfire-2.x.git] / html / cgi-bin / vpnmain.cgi

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index b0041ef42255eb90cd5e3cb005762067050b8790..55566d7cfb8ffa9df59c85dd4ab615ce8a162bc3 100644 (file)
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -310,67 +310,33 @@ sub writeipsecfiles {
 
        # Algorithms
        if ($lconfighash{$key}[18] && $lconfighash{$key}[19] && $lconfighash{$key}[20]) {
-           print CONF "\tike=";
-           my @encs   = split('\|', $lconfighash{$key}[18]);
-           my @ints   = split('\|', $lconfighash{$key}[19]);
-           my @groups = split('\|', $lconfighash{$key}[20]);
-           my $comma = 0;
-           foreach my $i (@encs) {
-               foreach my $j (@ints) {
-                   foreach my $k (@groups) {
-                       if ($comma != 0) { print CONF ","; } else { $comma = 1; }
-
-                       my @l = split("", $k);
-                       if ($l[0] eq "e") {
-                           shift @l;
-                           print CONF "$i-$j-ecp".join("", @l);
-                       } else {
-                           print CONF "$i-$j-modp$k";
-                       }
-                   }
-               }
-           }
-           if ($lconfighash{$key}[24] eq 'on') {       #only proposed algorythms?
-               print CONF "!\n";
-           } else {
-               print CONF "\n";
-           }
+               my @encs   = split('\|', $lconfighash{$key}[18]);
+               my @ints   = split('\|', $lconfighash{$key}[19]);
+               my @groups = split('\|', $lconfighash{$key}[20]);
+
+               my @algos = &make_algos("ike", \@encs, \@ints, \@groups, 1);
+               print CONF "\tike=" . join(",", @algos);
+
+               if ($lconfighash{$key}[24] eq 'on') {   #only proposed algorythms?
+                       print CONF "!\n";
+               } else {
+                       print CONF "\n";
+               }
        }
+
        if ($lconfighash{$key}[21] && $lconfighash{$key}[22]) {
-           print CONF "\tesp=";
-           my @encs   = split('\|', $lconfighash{$key}[21]);
-           my @ints   = split('\|', $lconfighash{$key}[22]);
-           my @groups = split('\|', $lconfighash{$key}[20]);
-           my $comma = 0;
-           foreach my $i (@encs) {
-               foreach my $j (@ints) {
-                       my $modp = "";
-                       if ($pfs eq "on") {
-                               foreach my $k (@groups) {
-                                   if ($comma != 0) { print CONF ","; } else { $comma = 1; }
-                                   if ($pfs eq "on") {
-                                       my @l = split("", $k);
-                                       if ($l[0] eq "e") {
-                                               $modp = "";
-                                       } else {
-                                               $modp = "-modp$k";
-                                       }
-                                   } else {
-                                       $modp = "";
-                                   }
-                                   print CONF "$i-$j$modp";
-                               }
-                       } else {
-                               if ($comma != 0) { print CONF ","; } else { $comma = 1; }
-                               print CONF "$i-$j";
-                       }
+               my @encs   = split('\|', $lconfighash{$key}[21]);
+               my @ints   = split('\|', $lconfighash{$key}[22]);
+               my @groups = split('\|', $lconfighash{$key}[20]);
+
+               my @algos = &make_algos("esp", \@encs, \@ints, \@groups, ($pfs eq "on"));
+               print CONF "\tesp=" . join(",", @algos);
+
+               if ($lconfighash{$key}[24] eq 'on') {   #only proposed algorythms?
+                       print CONF "!\n";
+               } else {
+                       print CONF "\n";
                }
-           }
-           if ($lconfighash{$key}[24] eq 'on') {       #only proposed algorythms?
-               print CONF "!\n";
-           } else {
-               print CONF "\n";
-           }
        }
 
        # IKE V1 or V2
@@ -435,6 +401,10 @@ sub writeipsecfiles {
        } else {
            print CONF "\tauto=start\n";
        }
+
+       # Fragmentation
+       print CONF "\tfragmentation=yes\n";
+
        print CONF "\n";
     }#foreach key
     print SECRETS $last_secrets if ($last_secrets);
@@ -1673,7 +1643,7 @@ END
            (my $city = $cgiparams{'CERT_CITY'}) =~ s/^\s*$/\./;
            (my $state = $cgiparams{'CERT_STATE'}) =~ s/^\s*$/\./;
 
-           # Create the Host certificate request
+           # Create the Client certificate request
            &General::log("ipsec", "Creating a cert...");
 
            if (open(STDIN, "-|")) {
@@ -1700,7 +1670,7 @@ END
                exit (0);
            }
            
-           # Sign the host certificate request
+           # Sign the client certificate request
            &General::log("ipsec", "Signing the cert $cgiparams{'NAME'}...");
 
            #No easy way for specifying the contain of subjectAltName without writing a config file...
@@ -1709,6 +1679,7 @@ END
            basicConstraints=CA:FALSE
            nsComment="OpenSSL Generated Certificate"
            subjectKeyIdentifier=hash
+           extendedKeyUsage=clientAuth
            authorityKeyIdentifier=keyid,issuer:always
 END
 ;
@@ -3020,3 +2991,54 @@ END
     &Header::closebox();
     &Header::closebigbox();
     &Header::closepage();
+
+sub array_unique($) {
+       my $array = shift;
+       my @unique = ();
+
+       my %seen = ();
+       foreach my $e (@$array) {
+               next if $seen{$e}++;
+               push(@unique, $e);
+       }
+
+       return @unique;
+}
+
+sub make_algos($$$$$) {
+       my ($mode, $encs, $ints, $grps, $pfs) = @_;
+       my @algos = ();
+
+       foreach my $enc (@$encs) {
+               foreach my $int (@$ints) {
+                       foreach my $grp (@$grps) {
+                               my @algo = ($enc);
+
+                               my $is_aead = ($enc =~ m/[cg]cm/);
+                               if (!$is_aead) {
+                                       push(@algo, $int);
+                               }
+
+                               if ($mode eq "ike") {
+                                       if ($grp =~ m/^e(\d+)/) {
+                                               push(@algo, "ecp$1");
+                                       } else {
+                                               push(@algo, "modp$grp");
+                                       }
+                               }
+
+                               if ($mode eq "esp" && $pfs) {
+                                       if ($grp =~ m/^e\d+/) {
+                                               push(@algo, $grp);
+                                       } else {
+                                               push(@algo, "modp$grp");
+                                       }
+                               }
+
+                               push(@algos, join("-", @algo));
+                       }
+               }
+       }
+
+       return &array_unique(\@algos);
+}